← all publishers

santosomar

@santosomar source repo

Report this profile Claim this profile

• 800 skills
• 0 followers
• 11 hours ago last updated

1. ▌
   Attack Ics T0860 Wireless Compromise · santosomar bundle

   Analyze MITRE ATT&CK T0860 Wireless Compromise in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0860, Wireless Compromise, or ics ATT&CK. Adversaries may perform wireless compromise as a method of gaining communications and unauthorized access to a wireless network.
   0 installs
2. ▌
   Attack Ics T1691 001 Command Message · santosomar bundle

   Analyze MITRE ATT&CK T1691.001 Command Message in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1691.001, Command Message, or ics ATT&CK. Adversaries may block a command message from reaching its intended target to prevent command execution.
   0 installs
3. ▌
   Attack Ics T1692 001 Command Message · santosomar bundle

   Analyze MITRE ATT&CK T1692.001 Command Message in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1692.001, Command Message, or ics ATT&CK. Adversaries may send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, or without the logical preconditions to trigger their expected function.
   0 installs
4. ▌
   Attack Ent T1110 Brute Force · santosomar bundle

   Analyze MITRE ATT&CK T1110 Brute Force in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1110, Brute Force, or enterprise ATT&CK. Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Without knowledge of the password for an a…
   0 installs
5. ▌
   Attack Ent T1127 001 Msbuild · santosomar bundle

   Analyze MITRE ATT&CK T1127.001 MSBuild in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1127.001, MSBuild, or enterprise ATT&CK. Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility.
   0 installs
6. ▌
   Attack Ent T1127 003 Jamplus · santosomar bundle

   Analyze MITRE ATT&CK T1127.003 JamPlus in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1127.003, JamPlus, or enterprise ATT&CK. Adversaries may use `JamPlus` to proxy the execution of a malicious script.
   0 installs
7. ▌
   Attack Ent T1137 006 Add Ins · santosomar bundle

   Analyze MITRE ATT&CK T1137.006 Add-ins in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1137.006, Add-ins, or enterprise ATT&CK. Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system.
   0 installs
8. ▌
   Attack Ent T1218 007 Msiexec · santosomar bundle

   Analyze MITRE ATT&CK T1218.007 Msiexec in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1218.007, Msiexec, or enterprise ATT&CK. Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.
   0 installs
9. ▌
   Attack Ics T0815 Denial Of View · santosomar bundle

   Analyze MITRE ATT&CK T0815 Denial of View in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0815, Denial of View, or ics ATT&CK. Adversaries may cause a denial of view in attempt to disrupt and prevent operator oversight on the status of an ICS environment.
   0 installs
10. ▌
    Attack Ics T0845 Program Upload · santosomar bundle

    Analyze MITRE ATT&CK T0845 Program Upload in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0845, Program Upload, or ics ATT&CK. Adversaries may attempt to upload a program from a PLC to gather information about an industrial process.
    0 installs
11. ▌
    Attack Ics T0852 Screen Capture · santosomar bundle

    Analyze MITRE ATT&CK T0852 Screen Capture in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0852, Screen Capture, or ics ATT&CK. Adversaries may attempt to perform screen capture of devices in the control system environment.
    0 installs
12. ▌
    Attack Ics T0859 Valid Accounts · santosomar bundle

    Analyze MITRE ATT&CK T0859 Valid Accounts in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0859, Valid Accounts, or ics ATT&CK. Adversaries may steal the credentials of a specific user or service account using credential access techniques.
    0 installs
13. ▌
    Attack Ics T0863 User Execution · santosomar bundle

    Analyze MITRE ATT&CK T0863 User Execution in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0863, User Execution, or ics ATT&CK. Adversaries may rely on a targeted organizations user interaction for the execution of malicious code.
    0 installs
14. ▌
    Attack Ics T0880 Loss Of Safety · santosomar bundle

    Analyze MITRE ATT&CK T0880 Loss of Safety in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0880, Loss of Safety, or ics ATT&CK. Adversaries may compromise safety system functions designed to maintain safe operation of a process when unacceptable or dangerous conditions occur.
    0 installs
15. ▌
    Attack Ics T0889 Modify Program · santosomar bundle

    Analyze MITRE ATT&CK T0889 Modify Program in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0889, Modify Program, or ics ATT&CK. Adversaries may modify or add a program on a controller to affect how it interacts with the physical process, peripheral devices and other hosts on the network.
    0 installs
16. ▌
    Attack Ics T1695 001 Serial Com · santosomar bundle

    Analyze MITRE ATT&CK T1695.001 Serial COM in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1695.001, Serial COM, or ics ATT&CK. Adversaries may block access to serial COM to prevent instructions or configurations from reaching target devices.
    0 installs
17. ▌
    Attack Ics T0843 003 Program Append · santosomar bundle

    Analyze MITRE ATT&CK T0843.003 Program Append in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0843.003, Program Append, or ics ATT&CK. Adversaries may execute a program append to a PLC to update parts of an existing program.
    0 installs
18. ▌
    Attack Ics T0879 Damage To Property · santosomar bundle

    Analyze MITRE ATT&CK T0879 Damage to Property in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0879, Damage to Property, or ics ATT&CK. Adversaries may cause damage and destruction of property to infrastructure, equipment, and the surrounding environment when attacking control systems.
    0 installs
19. ▌
    Attack Ics T0885 Commonly Used Port · santosomar bundle

    Analyze MITRE ATT&CK T0885 Commonly Used Port in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0885, Commonly Used Port, or ics ATT&CK. Adversaries may communicate over a commonly used port to bypass firewalls or network detection systems and to blend in with normal network activity, to avoid more detailed inspection.
    0 installs
20. ▌
    Attack Mob T1516 Input Injection · santosomar bundle

    Analyze MITRE ATT&CK T1516 Input Injection in the mobile matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1516, Input Injection, or mobile ATT&CK. A malicious application can inject input to the user interface to mimic user interaction through the abuse of Android's accessibility APIs.
    0 installs
21. ▌
    Attack Mob T1521 003 Ssl Pinning · santosomar bundle

    Analyze MITRE ATT&CK T1521.003 SSL Pinning in the mobile matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1521.003, SSL Pinning, or mobile ATT&CK. Adversaries may use [SSL Pinning](https://attack.mitre.org/techniques/T1521/003) to protect the C2 traffic from being intercepted and analyzed.
    0 installs
22. ▌
    Attack Mob T1629 Impair Defenses · santosomar bundle

    Analyze MITRE ATT&CK T1629 Impair Defenses in the mobile matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1629, Impair Defenses, or mobile ATT&CK. Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.
    0 installs
23. ▌
    Attack Ent T1036 Masquerading · santosomar bundle

    Analyze MITRE ATT&CK T1036 Masquerading in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1036, Masquerading, or enterprise ATT&CK. Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
    0 installs
24. ▌
    Attack Ent T1584 005 Botnet · santosomar bundle

    Analyze MITRE ATT&CK T1584.005 Botnet in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1584.005, Botnet, or enterprise ATT&CK. Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting.
    0 installs
25. ▌
    Attack Ics T0813 Denial Of Control · santosomar bundle

    Analyze MITRE ATT&CK T0813 Denial of Control in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0813, Denial of Control, or ics ATT&CK. Adversaries may cause a denial of control to temporarily prevent operators and engineers from interacting with process controls.
    0 installs
26. ▌
    Attack Ics T0814 Denial Of Service · santosomar bundle

    Analyze MITRE ATT&CK T0814 Denial of Service in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0814, Denial of Service, or ics ATT&CK. Adversaries may perform Denial-of-Service (DoS) attacks to disrupt expected device functionality.
    0 installs
27. ▌
    Attack Ics T0878 Alarm Suppression · santosomar bundle

    Analyze MITRE ATT&CK T0878 Alarm Suppression in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0878, Alarm Suppression, or ics ATT&CK. Adversaries may target protection function alarms to prevent them from notifying operators of critical conditions.
    0 installs
28. ▌
    Attack Ics T0887 Wireless Sniffing · santosomar bundle

    Analyze MITRE ATT&CK T0887 Wireless Sniffing in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0887, Wireless Sniffing, or ics ATT&CK. Adversaries may seek to capture radio frequency (RF) communication used for remote control and reporting in distributed environments.
    0 installs
29. ▌
    Attack Ics T0892 Change Credential · santosomar bundle

    Analyze MITRE ATT&CK T0892 Change Credential in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0892, Change Credential, or ics ATT&CK. Adversaries may modify software and device credentials to prevent operator and responder access.
    0 installs
30. ▌
    Attack Mob T1414 Clipboard Data · santosomar bundle

    Analyze MITRE ATT&CK T1414 Clipboard Data in the mobile matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1414, Clipboard Data, or mobile ATT&CK. Adversaries may abuse clipboard manager APIs to obtain sensitive information copied to the device clipboard.
    0 installs
31. ▌
    Attack Mob T1481 Web Service · santosomar bundle

    Analyze MITRE ATT&CK T1481 Web Service in the mobile matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1481, Web Service, or mobile ATT&CK. Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system.
    0 installs
32. ▌
    Attack Mob T1582 Sms Control · santosomar bundle

    Analyze MITRE ATT&CK T1582 SMS Control in the mobile matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1582, SMS Control, or mobile ATT&CK. Adversaries may delete, alter, or send SMS messages without user authorization.
    0 installs
33. ▌
    Attack Ent T1003 003 Ntds · santosomar bundle

    Analyze MITRE ATT&CK T1003.003 NTDS in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1003.003, NTDS, or enterprise ATT&CK. Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and a…
    0 installs
34. ▌
    Attack Ent T1053 003 Cron · santosomar bundle

    Analyze MITRE ATT&CK T1053.003 Cron in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1053.003, Cron, or enterprise ATT&CK. Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code.(Citation: 20 macOS Common Tools and Techniques) The <code>cron</code> utility is a tim…
    0 installs
35. ▌
    Attack Ent T1546 005 Trap · santosomar bundle

    Analyze MITRE ATT&CK T1546.005 Trap in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1546.005, Trap, or enterprise ATT&CK. Adversaries may establish persistence by executing malicious content triggered by an interrupt signal.
    0 installs
36. ▌
    Attack Ent T1566 Phishing · santosomar bundle

    Analyze MITRE ATT&CK T1566 Phishing in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1566, Phishing, or enterprise ATT&CK. Adversaries may send phishing messages to gain access to victim systems.
    0 installs
37. ▌
    Attack Ent T1588 002 Tool · santosomar bundle

    Analyze MITRE ATT&CK T1588.002 Tool in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1588.002, Tool, or enterprise ATT&CK. Adversaries may buy, steal, or download software tools that can be used during targeting.
    0 installs
38. ▌
    Attack Ics T0843 001 Download All · santosomar bundle

    Analyze MITRE ATT&CK T0843.001 Download All in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0843.001, Download All, or ics ATT&CK. Adversaries may execute a full program download to a PLC to overwrite the entire PLC program and configuration to deploy a new project or make major changes.
    0 installs
39. ▌
    Attack Ics T0843 Program Download · santosomar bundle

    Analyze MITRE ATT&CK T0843 Program Download in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0843, Program Download, or ics ATT&CK. Adversaries may perform a program download to transfer a user program to a controller.
    0 installs
40. ▌
    Attack Ics T0884 Connection Proxy · santosomar bundle

    Analyze MITRE ATT&CK T0884 Connection Proxy in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0884, Connection Proxy, or ics ATT&CK. Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications.
    0 installs
41. ▌
    Attack Mob T1417 Input Capture · santosomar bundle

    Analyze MITRE ATT&CK T1417 Input Capture in the mobile matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1417, Input Capture, or mobile ATT&CK. Adversaries may use methods of capturing user input to obtain credentials or collect information.
    0 installs
42. ▌
    Attack Mob T1429 Audio Capture · santosomar bundle

    Analyze MITRE ATT&CK T1429 Audio Capture in the mobile matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1429, Audio Capture, or mobile ATT&CK. Adversaries may capture audio to collect information by leveraging standard operating system APIs of a mobile device.
    0 installs
43. ▌
    Attack Mob T1451 Sim Card Swap · santosomar bundle

    Analyze MITRE ATT&CK T1451 SIM Card Swap in the mobile matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1451, SIM Card Swap, or mobile ATT&CK. Adversaries may gain access to mobile devices through transfers or swaps from victims’ phone numbers to adversary-controlled SIM cards and mobile devices.(Citation: ATT SIM Swap Scams)(Citation: Verizon SIM Swapping) Th…
    0 installs
44. ▌
    Attack Mob T1512 Video Capture · santosomar bundle

    Analyze MITRE ATT&CK T1512 Video Capture in the mobile matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1512, Video Capture, or mobile ATT&CK. An adversary can leverage a device’s cameras to gather information by capturing video recordings.
    0 installs
45. ▌
    Attack Ent T1021 004 Ssh · santosomar bundle

    Analyze MITRE ATT&CK T1021.004 SSH in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1021.004, SSH, or enterprise ATT&CK. Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH).
    0 installs
46. ▌
    Attack Ent T1021 005 Vnc · santosomar bundle

    Analyze MITRE ATT&CK T1021.005 VNC in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1021.005, VNC, or enterprise ATT&CK. Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely control machines using Virtual Network Computing (VNC).
    0 installs
47. ▌
    Attack Ent T1059 011 Lua · santosomar bundle

    Analyze MITRE ATT&CK T1059.011 Lua in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1059.011, Lua, or enterprise ATT&CK. Adversaries may abuse Lua commands and scripts for execution.
    0 installs
48. ▌
    Attack Ent T1071 004 Dns · santosomar bundle

    Analyze MITRE ATT&CK T1071.004 DNS in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1071.004, DNS, or enterprise ATT&CK. Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic.
    0 installs
49. ▌
    Attack Ent T1218 014 Mmc · santosomar bundle

    Analyze MITRE ATT&CK T1218.014 MMC in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1218.014, MMC, or enterprise ATT&CK. Adversaries may abuse mmc.exe to proxy execution of malicious .msc files.
    0 installs
50. ▌
    Attack Ent T1574 001 Dll · santosomar bundle

    Analyze MITRE ATT&CK T1574.001 DLL in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1574.001, DLL, or enterprise ATT&CK. Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses.
    0 installs
51. ▌
    Attack Ent T1590 002 Dns · santosomar bundle

    Analyze MITRE ATT&CK T1590.002 DNS in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1590.002, DNS, or enterprise ATT&CK. Adversaries may gather information about the victim's DNS that can be used during targeting.
    0 installs
52. ▌
    Attack Ent T1542 003 Bootkit · santosomar bundle

    Analyze MITRE ATT&CK T1542.003 Bootkit in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1542.003, Bootkit, or enterprise ATT&CK. Adversaries may use bootkits to persist on systems.
    0 installs
53. ▌
    Attack Ent T1542 Pre Os Boot · santosomar bundle

    Analyze MITRE ATT&CK T1542 Pre-OS Boot in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1542, Pre-OS Boot, or enterprise ATT&CK. Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system.
    0 installs
54. ▌
    Attack Ent T1583 001 Domains · santosomar bundle

    Analyze MITRE ATT&CK T1583.001 Domains in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1583.001, Domains, or enterprise ATT&CK. Adversaries may acquire domains that can be used during targeting.
    0 installs
55. ▌
    Attack Ent T1584 001 Domains · santosomar bundle

    Analyze MITRE ATT&CK T1584.001 Domains in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1584.001, Domains, or enterprise ATT&CK. Adversaries may hijack domains and/or subdomains that can be used during targeting.
    0 installs
56. ▌
    Attack Ent T1587 001 Malware · santosomar bundle

    Analyze MITRE ATT&CK T1587.001 Malware in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1587.001, Malware, or enterprise ATT&CK. Adversaries may develop malware and malware components that can be used during targeting.
    0 installs
57. ▌
    Attack Ent T1588 001 Malware · santosomar bundle

    Analyze MITRE ATT&CK T1588.001 Malware in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1588.001, Malware, or enterprise ATT&CK. Adversaries may buy, steal, or download malware that can be used during targeting.
    0 installs
58. ▌
    Attack Ics T0837 Loss Of Protection · santosomar bundle

    Analyze MITRE ATT&CK T0837 Loss of Protection in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0837, Loss of Protection, or ics ATT&CK. Adversaries may compromise protective system functions designed to prevent the effects of faults and abnormal conditions.
    0 installs
59. ▌
    Attack Ent T1003 006 Dcsync · santosomar bundle

    Analyze MITRE ATT&CK T1003.006 DCSync in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1003.006, DCSync, or enterprise ATT&CK. Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetN…
    0 installs
60. ▌
    Attack Ent T1059 006 Python · santosomar bundle

    Analyze MITRE ATT&CK T1059.006 Python in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1059.006, Python, or enterprise ATT&CK. Adversaries may abuse Python commands and scripts for execution.
    0 installs
61. ▌
    Attack Ent T1106 Native API · santosomar bundle

    Analyze MITRE ATT&CK T1106 Native API in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1106, Native API, or enterprise ATT&CK. Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
    0 installs
62. ▌
    Attack Ent T1216 001 Pubprn · santosomar bundle

    Analyze MITRE ATT&CK T1216.001 PubPrn in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1216.001, PubPrn, or enterprise ATT&CK. Adversaries may use PubPrn to proxy execution of malicious remote files.
    0 installs
63. ▌
    Attack Ent T1491 Defacement · santosomar bundle

    Analyze MITRE ATT&CK T1491 Defacement in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1491, Defacement, or enterprise ATT&CK. Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content.
    0 installs
64. ▌
    Attack Ent T1583 004 Server · santosomar bundle

    Analyze MITRE ATT&CK T1583.004 Server in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1583.004, Server, or enterprise ATT&CK. Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting.
    0 installs
65. ▌
    Attack Ent T1583 005 Botnet · santosomar bundle

    Analyze MITRE ATT&CK T1583.005 Botnet in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1583.005, Botnet, or enterprise ATT&CK. Adversaries may buy, lease, or rent a network of compromised systems that can be used during targeting.
    0 installs
66. ▌
    Attack Ent T1584 004 Server · santosomar bundle

    Analyze MITRE ATT&CK T1584.004 Server in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1584.004, Server, or enterprise ATT&CK. Adversaries may compromise third-party servers that can be used during targeting.
    0 installs
67. ▌
    Attack Ent T1218 003 Cmstp · santosomar bundle

    Analyze MITRE ATT&CK T1218.003 CMSTP in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1218.003, CMSTP, or enterprise ATT&CK. Adversaries may abuse CMSTP to proxy execution of malicious code.
    0 installs
68. ▌
    Attack Ent T1218 005 Mshta · santosomar bundle

    Analyze MITRE ATT&CK T1218.005 Mshta in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1218.005, Mshta, or enterprise ATT&CK. Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility.
    0 installs
69. ▌
    Attack Ent T1546 014 Emond · santosomar bundle

    Analyze MITRE ATT&CK T1546.014 Emond in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1546.014, Emond, or enterprise ATT&CK. Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond).
    0 installs
70. ▌
    Attack Ent T1561 Disk Wipe · santosomar bundle

    Analyze MITRE ATT&CK T1561 Disk Wipe in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1561, Disk Wipe, or enterprise ATT&CK. Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources.
    0 installs
71. ▌
    Attack Ent T1596 002 Whois · santosomar bundle

    Analyze MITRE ATT&CK T1596.002 WHOIS in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1596.002, WHOIS, or enterprise ATT&CK. Adversaries may search public WHOIS data for information about victims that can be used during targeting.
    0 installs
72. ▌
    Attack Ics T0809 Data Destruction · santosomar bundle

    Analyze MITRE ATT&CK T0809 Data Destruction in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0809, Data Destruction, or ics ATT&CK. Adversaries may perform data destruction over the course of an operation.
    0 installs
73. ▌
    Attack Ics T0836 Modify Parameter · santosomar bundle

    Analyze MITRE ATT&CK T0836 Modify Parameter in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0836, Modify Parameter, or ics ATT&CK. Adversaries may modify parameters used to instruct industrial control system devices.
    0 installs
74. ▌
    Attack Ics T0842 Network Sniffing · santosomar bundle

    Analyze MITRE ATT&CK T0842 Network Sniffing in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0842, Network Sniffing, or ics ATT&CK. Network sniffing is the practice of using a network interface on a computer system to monitor or capture information (Citation: Enterprise ATT&CK January 2018) regardless of whether it is the specified destination for t…
    0 installs
75. ▌
    Attack Ics T0849 Masquerading · santosomar bundle

    Analyze MITRE ATT&CK T0849 Masquerading in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0849, Masquerading, or ics ATT&CK. Adversaries may use masquerading to disguise a malicious application or executable as another file, to avoid operator and engineer suspicion.
    0 installs
76. ▌
    Attack Ics T0881 Service Stop · santosomar bundle

    Analyze MITRE ATT&CK T0881 Service Stop in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0881, Service Stop, or ics ATT&CK. Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
    0 installs
77. ▌
    Attack Ics T1695 002 Ethernet · santosomar bundle

    Analyze MITRE ATT&CK T1695.002 Ethernet in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1695.002, Ethernet, or ics ATT&CK. Adversaries may block access to Ethernet communications to prevent instructions or configurations messages from reaching target systems and devices.
    0 installs
78. ▌
    Attack Ent T1053 002 At · santosomar bundle

    Analyze MITRE ATT&CK T1053.002 At in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1053.002, At, or enterprise ATT&CK. Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial or recurring execution of malicious code.
    0 installs
79. ▌
    Attack Ics T0846 001 Port Scan · santosomar bundle

    Analyze MITRE ATT&CK T0846.001 Port Scan in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0846.001, Port Scan, or ics ATT&CK. Adversaries may perform a port scan on a system, device, or network to identify live hosts, enumerate open ports and running services, identify operating systems, and map out the network.(Citation: NIST SP 800-82r3) The…
    0 installs
80. ▌
    Attack Ics T0895 Autorun Image · santosomar bundle

    Analyze MITRE ATT&CK T0895 Autorun Image in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0895, Autorun Image, or ics ATT&CK. Adversaries may leverage AutoRun functionality or scripts to execute malicious code.
    0 installs
81. ▌
    Attack Mob T1575 Native API · santosomar bundle

    Analyze MITRE ATT&CK T1575 Native API in the mobile matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1575, Native API, or mobile ATT&CK. Adversaries may use Android’s Native Development Kit (NDK) to write native functions that can achieve execution of binaries or functions.
    0 installs
82. ▌
    Attack Ent T1014 Rootkit · santosomar bundle

    Analyze MITRE ATT&CK T1014 Rootkit in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1014, Rootkit, or enterprise ATT&CK. Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.
    0 installs
83. ▌
    Attack Ics T1693 Modify Firmware · santosomar bundle

    Analyze MITRE ATT&CK T1693 Modify Firmware in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1693, Modify Firmware, or ics ATT&CK. Firmware is low-level software embedded in hardware that enables systems and devices to function properly and is commonly found in ICS environments.
    0 installs
84. ▌
    Attack Mob T1616 Call Control · santosomar bundle

    Analyze MITRE ATT&CK T1616 Call Control in the mobile matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1616, Call Control, or mobile ATT&CK. Adversaries may make, forward, or block phone calls without user authorization.
    0 installs
85. ▌
    Attack Mob T1634 001 Keychain · santosomar bundle

    Analyze MITRE ATT&CK T1634.001 Keychain in the mobile matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1634.001, Keychain, or mobile ATT&CK. Adversaries may collect keychain data from an iOS device to acquire credentials.
    0 installs
86. ▌
    Attack Mob T1636 002 Call Log · santosomar bundle

    Analyze MITRE ATT&CK T1636.002 Call Log in the mobile matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1636.002, Call Log, or mobile ATT&CK. Adversaries may utilize standard operating system APIs to gather call log data.
    0 installs
87. ▌
    Attack Mob T1636 005 Accounts · santosomar bundle

    Analyze MITRE ATT&CK T1636.005 Accounts in the mobile matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1636.005, Accounts, or mobile ATT&CK. Adversaries may utilize standard operating system APIs to gather account data.
    0 installs
88. ▌
    Attack Mob T1655 Masquerading · santosomar bundle

    Analyze MITRE ATT&CK T1655 Masquerading in the mobile matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1655, Masquerading, or mobile ATT&CK. Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
    0 installs
89. ▌
    Attack Ent T1197 Bits Jobs · santosomar bundle

    Analyze MITRE ATT&CK T1197 BITS Jobs in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1197, BITS Jobs, or enterprise ATT&CK. Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks.
    0 installs
90. ▌
    Attack Ics T1695 003 Wi Fi · santosomar bundle

    Analyze MITRE ATT&CK T1695.003 Wi-Fi in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1695.003, Wi-Fi, or ics ATT&CK. Adversaries may block access to Wi-Fi communications to prevent messages from reaching target systems and devices.
    0 installs
91. ▌
    Attack Ics T0834 Native API · santosomar bundle

    Analyze MITRE ATT&CK T0834 Native API in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0834, Native API, or ics ATT&CK. Adversaries may directly interact with the native OS application programming interface (API) to access system functions.
    0 installs
92. ▌
    Attack Mob T1617 Hooking · santosomar bundle

    Analyze MITRE ATT&CK T1617 Hooking in the mobile matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1617, Hooking, or mobile ATT&CK. Adversaries may utilize hooking to hide the presence of artifacts associated with their behaviors to evade detection.
    0 installs
93. ▌
    Attack Mob T1660 Phishing · santosomar bundle

    Analyze MITRE ATT&CK T1660 Phishing in the mobile matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1660, Phishing, or mobile ATT&CK. Adversaries may send malicious content to users in order to gain access to their mobile devices.
    0 installs
94. ▌
    Attack Ent T1090 Proxy · santosomar bundle

    Analyze MITRE ATT&CK T1090 Proxy in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1090, Proxy, or enterprise ATT&CK. Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.
    0 installs
95. ▌
    Attack Ics T0829 Loss Of View · santosomar bundle

    Analyze MITRE ATT&CK T0829 Loss of View in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0829, Loss of View, or ics ATT&CK. Adversaries may cause a sustained or permanent loss of view where the ICS equipment will require local, hands-on operator intervention; for instance, a restart or manual operation.
    0 installs
96. ▌
    Attack Ics T0848 Rogue Master · santosomar bundle

    Analyze MITRE ATT&CK T0848 Rogue Master in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0848, Rogue Master, or ics ATT&CK. Adversaries may setup a rogue master to leverage control server functions to communicate with outstations.
    0 installs
97. ▌
    Attack Ics T0851 Rootkit · santosomar bundle

    Analyze MITRE ATT&CK T0851 Rootkit in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0851, Rootkit, or ics ATT&CK. Adversaries may deploy rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.
    0 installs
98. ▌
    Attack Ics T0874 Hooking · santosomar bundle

    Analyze MITRE ATT&CK T0874 Hooking in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0874, Hooking, or ics ATT&CK. Adversaries may hook into application programming interface (API) functions used by processes to redirect calls for execution and privilege escalation means.
    0 installs
99. ▌
    Attack Ics T0853 Scripting · santosomar bundle

    Analyze MITRE ATT&CK T0853 Scripting in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0853, Scripting, or ics ATT&CK. Adversaries may use scripting languages to execute arbitrary code in the form of a pre-written script or in the form of user-supplied code to an interpreter.
    0 installs
100. ▌
     Attack Ics T0877 I O Image · santosomar bundle

     Analyze MITRE ATT&CK T0877 I/O Image in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0877, I/O Image, or ics ATT&CK. Adversaries may seek to capture process values related to the inputs and outputs of a PLC.
     0 installs