beta - attack-mitre-japan

MITRE ATT&CK 日本語化プロジェクト

ATT&CK Matrix for Enterprise

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

9 techniques

10 techniques

18 techniques

12 techniques

34 techniques

14 techniques

23 techniques

9 techniques

16 techniques

9 techniques

13 techniques

Drive-by Compromise

Exploit Public-Facing Application

External Remote Services

Hardware Additions

=	Phishing ₍₃₎
	Spearphishing Attachment Spearphishing Link Spearphishing via Service

Replication Through Removable Media

=	Supply Chain Compromise ₍₃₎
	Compromise Software Dependencies and Development Tools Compromise Software Supply Chain Compromise Hardware Supply Chain

Trusted Relationship

=	Valid Accounts ₍₄₎
	Default Accounts Domain Accounts Local Accounts Cloud Accounts

=	Command and Scripting Interpreter ₍₆₎
	PowerShell AppleScript Windows Command Shell Bash VBScript Python

Exploitation for Client Execution

=	Inter-Process Communication ₍₂₎
	Component Object Model Dynamic Data Exchange

Native API

=	Scheduled Task/Job ₍₅₎
	At (Windows) Scheduled Task At (Linux) Launchd Cron

Shared Modules

Software Deployment Tools

=	System Services ₍₂₎
	Launchctl Service Execution

=	User Execution ₍₂₎
	Malicious Link Malicious File

Windows Management Instrumentation

=	Account Manipulation ₍₃₎
	Additional Azure Service Principal Credentials Exchange Email Delegate Permissions Add Office 365 Global Administrator Role

BITS Jobs

=	Boot or Logon Autostart Execution ₍₁₁₎
	Registry Run Keys / Startup Folder Authentication Package Time Providers Winlogon Helper DLL Security Support Provider Kernel Modules and Extensions Re-opened Applications LSASS Driver Shortcut Modification Port Monitors Plist Modification

=	Boot or Logon Initialization Scripts ₍₅₎
	Logon Script (Windows) Logon Script (Mac) Network Logon Script Rc.common Startup Items

Browser Extensions

Compromise Client Software Binary

=	Create Account ₍₃₎
	Local Account Domain Account Cloud Account

=	Create or Modify System Process ₍₄₎
	Launch Agent Systemd Service Windows Service Launch Daemon

=	Event Triggered Execution ₍₁₅₎
	Change Default File Association Screensaver Windows Management Instrumentation Event Subscription .bash_profile and .bashrc Trap LC_LOAD_DYLIB Addition Netsh Helper DLL Accessibility Features AppCert DLLs AppInit DLLs Application Shimming Image File Execution Options Injection PowerShell Profile Emond Component Object Model Hijacking

External Remote Services

=	Hijack Execution Flow ₍₁₀₎
	Services File Permissions Weakness Executable Installer File Permissions Weakness Services Registry Permissions Weakness Path Interception by Unquoted Path Path Interception by PATH Environment Variable Path Interception by Search Order Hijacking DLL Search Order Hijacking DLL Side-Loading LD_PRELOAD Dylib Hijacking

Implant Container Image

=	Office Application Startup ₍₆₎
	Add-ins Office Template Macros Outlook Forms Outlook Rules Outlook Home Page Office Test

=	Pre-OS Boot ₍₃₎
	System Firmware Component Firmware Bootkit

=	Scheduled Task/Job ₍₅₎
	At (Windows) Scheduled Task At (Linux) Launchd Cron

=	Server Software Component ₍₃₎
	SQL Stored Procedures Transport Agent Web Shell

=	Traffic Signaling ₍₁₎
	Port Knocking

=	Valid Accounts ₍₄₎
	Default Accounts Domain Accounts Local Accounts Cloud Accounts

=	Abuse Elevation Control Mechanism ₍₄₎
	Setuid and Setgid Bypass User Access Control Sudo and Sudo Caching Elevated Execution with Prompt

=	Access Token Manipulation ₍₅₎
	Token Impersonation/theft Create Process with Token Make and Impersonate Token Parent PID Spoofing SID-History Injection

=	Boot or Logon Autostart Execution ₍₁₁₎
	Registry Run Keys / Startup Folder Authentication Package Time Providers Winlogon Helper DLL Security Support Provider Kernel Modules and Extensions Re-opened Applications LSASS Driver Shortcut Modification Port Monitors Plist Modification

=	Boot or Logon Initialization Scripts ₍₅₎
	Logon Script (Windows) Logon Script (Mac) Network Logon Script Rc.common Startup Items

=	Create or Modify System Process ₍₄₎
	Launch Agent Systemd Service Windows Service Launch Daemon

=	Event Triggered Execution ₍₁₅₎
	Change Default File Association Screensaver Windows Management Instrumentation Event Subscription .bash_profile and .bashrc Trap LC_LOAD_DYLIB Addition Netsh Helper DLL Accessibility Features AppCert DLLs AppInit DLLs Application Shimming Image File Execution Options Injection PowerShell Profile Emond Component Object Model Hijacking

Exploitation for Privilege Escalation

Group Policy Modification

=	Hijack Execution Flow ₍₁₀₎
	Services File Permissions Weakness Executable Installer File Permissions Weakness Services Registry Permissions Weakness Path Interception by Unquoted Path Path Interception by PATH Environment Variable Path Interception by Search Order Hijacking DLL Search Order Hijacking DLL Side-Loading LD_PRELOAD Dylib Hijacking

=	Process Injection ₍₁₁₎
	Dynamic-link Library Injection Portable Executable Injection Thread Execution Hijacking Asynchronous Procedure Call Thread Local Storage Ptrace System Calls Proc Memory Extra Window Memory Injection Process Doppelgänging Process Hollowing VDSO Hijacking

=	Scheduled Task/Job ₍₅₎
	At (Windows) Scheduled Task At (Linux) Launchd Cron

=	Valid Accounts ₍₄₎
	Default Accounts Domain Accounts Local Accounts Cloud Accounts

=	Abuse Elevation Control Mechanism ₍₄₎
	Setuid and Setgid Bypass User Access Control Sudo and Sudo Caching Elevated Execution with Prompt

=	Access Token Manipulation ₍₅₎
	Token Impersonation/theft Create Process with Token Make and Impersonate Token Parent PID Spoofing SID-History Injection

BITS Jobs

Deobfuscate/Decode Files or Information

Direct Volume Access

Execution Guardrails

Exploitation for Defense Evasion

=	File and Directory Permissions Modification ₍₂₎
	Windows File and Directory Permissions Modification Linux and Mac File and Directory Permissions Modification

Group Policy Modification

=	Hide Artifacts ₍₄₎
	Hidden Files and Directories Hidden Users Hidden Window NTFS File Attributes

=	Hijack Execution Flow ₍₁₀₎
	Services File Permissions Weakness Executable Installer File Permissions Weakness Services Registry Permissions Weakness Path Interception by Unquoted Path Path Interception by PATH Environment Variable Path Interception by Search Order Hijacking DLL Search Order Hijacking DLL Side-Loading LD_PRELOAD Dylib Hijacking

=	Impair Defenses ₍₅₎
	Disable or Modify Tools Disable Windows Event Logging HISTCONTROL Disable or Modify System Firewall Indicator Blocking

=	Indicator Removal on Host ₍₆₎
	Clear Windows Event Logs Clear Linux or Mac System Logs Clear Command History File Deletion Network Share Connection Removal Timestomp

Indirect Command Execution

=	Masquerading ₍₆₎
	Invalid Code Signature Right-to-Left Override Rename System Utilities Masquerade Task or Service Match Legitimate Name or Location Space after Filename

=	Modify Authentication Process ₍₂₎
	Domain Controller Authentication Password Filter DLL

Modify Registry

=	Obfuscated Files or Information ₍₅₎
	Binary Padding Software Packing Steganography Compile After Delivery Indicator Removal from Tools

=	Pre-OS Boot ₍₃₎
	System Firmware Component Firmware Bootkit

=	Process Injection ₍₁₁₎
	Dynamic-link Library Injection Portable Executable Injection Thread Execution Hijacking Asynchronous Procedure Call Thread Local Storage Ptrace System Calls Proc Memory Extra Window Memory Injection Process Doppelgänging Process Hollowing VDSO Hijacking

Revert Cloud Instance

Rogue Domain Controller

Rootkit

=	Signed Binary Proxy Execution ₍₁₀₎
	Rundll32 Compiled HTML File Control Panel CMSTP InstallUtil Mshta Regsvcs/Regasm Regsvr32 Msiexec Odbcconf

=	Signed Script Proxy Execution ₍₁₎
	PubPrn

=	Subvert Trust Controls ₍₄₎
	Gatekeeper Bypass Code Signing SIP and Trust Provider Hijacking Install Root Certificate

Template Injection

=	Traffic Signaling ₍₁₎
	Port Knocking

=	Trusted Developer Utilities Proxy Execution ₍₁₎
	MSBuild

Unused/Unsupported Cloud Regions

=	Use Alternate Authentication Material ₍₄₎
	Pass the Hash Pass the Ticket Application Access Token Web Session Cookie

=	Valid Accounts ₍₄₎
	Default Accounts Domain Accounts Local Accounts Cloud Accounts

=	Virtualization/sandbox Evasion ₍₃₎
	System Checks User Activity Based Checks Time Based Evasion

XSL Script Processing

=	Brute Force ₍₄₎
	Password Guessing Password Cracking Password Spraying Credential Stuffing

=	Credentials from Password Stores ₍₃₎
	Keychain Securityd Memory Credentials from Web Browsers

Exploitation for Credential Access

Forced Authentication

=	Input Capture ₍₄₎
	Keylogging GUI Input Capture Web Portal Capture Credential API Hooking

=	Man-in-the-Middle ₍₁₎
	LLMNR/NBT-NS Poisoning and SMB Relay

=	Modify Authentication Process ₍₂₎
	Domain Controller Authentication Password Filter DLL

Network Sniffing

=	OS Credential Dumping ₍₈₎
	LSASS Memory Security Account Manager NTDS DCSync Proc Filesystem /etc/passwd and /etc/shadow Cached Domain Credentials LSA Secrets

Steal Application Access Token

=	Steal or Forge Kerberos Tickets ₍₃₎
	Golden Ticket Silver Ticket Kerberoasting

Steal Web Session Cookie

Two-Factor Authentication Interception

=	Unsecured Credentials ₍₆₎
	Credentials In Files Credentials in Registry Bash History Private Keys Cloud Instance Metadata API Group Policy Preferences

=	Account Discovery ₍₄₎
	Local Account Domain Account Email Account Cloud Account

Application Window Discovery

Browser Bookmark Discovery

Cloud Service Dashboard

Cloud Service Discovery

Domain Trust Discovery

File and Directory Discovery

Network Service Scanning

Network Share Discovery

Network Sniffing

Password Policy Discovery

Peripheral Device Discovery

=	Permission Groups Discovery ₍₃₎
	Domain Groups Cloud Groups Local Groups

Process Discovery

Query Registry

Remote System Discovery

=	Software Discovery ₍₁₎
	Security Software Discovery

System Information Discovery

System Network Configuration Discovery

System Network Connections Discovery

System Owner/User Discovery

System Service Discovery

System Time Discovery

Exploitation of Remote Services

Internal Spearphishing

Lateral Tool Transfer

=	Remote Service Session Hijacking ₍₂₎
	SSH Hijacking RDP Hijacking

=	Remote Services ₍₆₎
	Remote Desktop Protocol SMB/Windows Admin Shares Distributed Component Object Model SSH VNC Windows Remote Management

Replication Through Removable Media

Software Deployment Tools

Taint Shared Content

=	Use Alternate Authentication Material ₍₄₎
	Pass the Hash Pass the Ticket Application Access Token Web Session Cookie

=	Archive Collected Data ₍₃₎
	Archive via Utility Archive via Library Archive via Custom Method

Audio Capture

Automated Collection

Clipboard Data

Data from Cloud Storage Object

=	Data from Information Repositories ₍₂₎
	Confluence Sharepoint

Data from Local System

Data from Network Shared Drive

Data from Removable Media

=	Data Staged ₍₂₎
	Local Data Staging Remote Data Staging

=	Email Collection ₍₃₎
	Local Email Collection Remote Email Collection Email Forwarding Rule

=	Input Capture ₍₄₎
	Keylogging GUI Input Capture Web Portal Capture Credential API Hooking

Man in the Browser

=	Man-in-the-Middle ₍₁₎
	LLMNR/NBT-NS Poisoning and SMB Relay

Screen Capture

Video Capture

=	Application Layer Protocol ₍₄₎
	Web Protocols File Transfer Protocols Mail Protocols DNS

Communication Through Removable Media

=	Data Encoding ₍₂₎
	Standard Encoding Non-Standard Encoding

=	Data Obfuscation ₍₃₎
	Junk Data Steganography Protocol Impersonation

=	Dynamic Resolution ₍₃₎
	Domain Generation Algorithms Fast Flux DNS DNS Calculation

=	Encrypted Channel ₍₂₎
	Symmetric Cryptography Asymmetric Cryptography

Fallback Channels

Ingress Tool Transfer

Multi-Stage Channels

Non-Application Layer Protocol

Non-Standard Port

Protocol Tunneling

=	Proxy ₍₄₎
	Internal Proxy External Proxy Multi-hop Proxy Domain Fronting

Remote Access Software

=	Traffic Signaling ₍₁₎
	Port Knocking

=	Web Service ₍₃₎
	Dead Drop Resolver Bidirectional Communication One-Way Communication

Automated Exfiltration

Data Transfer Size Limits

=	Exfiltration Over Alternative Protocol ₍₃₎
	Exfiltration Over Symmetric Encrypted Non-C2 Protocol Exfiltration Over Asymmetric Encrypted Non-C2 Protocol Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol

Exfiltration Over C2 Channel

=	Exfiltration Over Other Network Medium ₍₁₎
	Exfiltration Over Bluetooth

=	Exfiltration Over Physical Medium ₍₁₎
	Exfiltration over USB

=	Exfiltration Over Web Service ₍₂₎
	Exfiltration to Code Repository Exfiltration to Cloud Storage

Scheduled Transfer

Transfer Data to Cloud Account

Account Access Removal

Data Destruction

Data Encrypted for Impact

=	Data Manipulation ₍₃₎
	Stored Data Manipulation Transmitted Data Manipulation Runtime Data Manipulation

=	Defacement ₍₂₎
	Internal Defacement External Defacement

=	Disk Wipe ₍₂₎
	Disk Content Wipe Disk Structure Wipe

=	Endpoint Denial of Service ₍₄₎
	OS Exhaustion Flood Service Exhaustion Flood Application Exhaustion Flood Application or System Exploitation

Firmware Corruption

Inhibit System Recovery

=	Network Denial of Service ₍₂₎
	Direct Network Flood Reflection Amplification

Resource Hijacking

Service Stop

System Shutdown/Reboot