ATT&CK Techniques
Curated techniques grounded in empirical offensive operations, reverse engineering, and digital forensics triage.
Obfuscated Files or Information
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, compressing, or packing file payloads.
Masquerading
Adversaries may attempt to manipulate the name, appearance, or location of an executable or file to deceive users or security mechanisms into thinking it is legitimate.
Masquerading: Match Legitimate Name or Location
Adversaries may match or approximate legitimate file or process names or paths to evade detection.
Exfiltration Over C2 Channel
Adversaries may steal data by transferring it over an existing command and control channel rather than initiating a separate connection.
Scheduled Task/Job
Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.
Scheduled Task/Job: Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code.
Input Capture: Keylogging
Adversaries may log user keystrokes to intercept credentials, sensitive emails, or messages as the user types.
Command and Scripting Interpreter: Windows Command Shell
Adversaries may abuse the Windows command shell (cmd.exe) for execution. Cmd.exe is the primary command prompt on Windows systems.
Command and Scripting Interpreter: Python
Adversaries may abuse Python commands and scripts for execution. Python is a cross-platform language capable of system administration and automated exploitation.
Application Layer Protocol: Web Protocols
Adversaries may communicate using application layer protocols (HTTP, HTTPS, WebSockets) to blend with normal network traffic and evade detection.
Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing computer or program using software, system, or service bugs to cause unintended code execution.
System Binary Proxy Execution
Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious code through signed or trusted binaries.
System Binary Proxy Execution: Rundll32
Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security mechanisms that monitor for program execution.
Virtualization/Sandbox Evasion
Adversaries may check for environmental artifacts or human activity indicators to determine if they are running inside a virtual machine or automated analysis sandbox.
Virtualization/Sandbox Evasion: System Checks
Adversaries may check for system environment characteristics such as screen resolution, hardware specifications, and system identifiers to determine if a system is a virtual machine or analysis environment.
Virtualization/Sandbox Evasion: Time Based Evasion
Adversaries may employ time-based evasion mechanisms, such as executing computational loops or extended sleep delays, to outlast automated sandbox analysis windows.
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Adversaries may achieve persistence or escalate privileges by configuring programs to execute on system boot or user logon via Registry Run keys or Startup folder entries.
Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Adversaries may abuse sudo and sudo caching to execute commands with elevated root privileges or bypass authentication restrictions.
Hijack Execution Flow: DLL Side-Loading
Adversaries may execute their own malicious payloads by side-loading a spoofed dynamic-link library (DLL) into a legitimate signed application binary.