Initial Access Tactic (TA0001)
techniques and strategies to breach an organisation
focus on delivering payload to target system or network
Objective
to gain a foothold in the network
Examples
Social Engineering techniques such as phishing.
Exploiting vulnerabilities through public-facing servers.
Spraying credentials through exposed authentication endpoints.
Executing commands through malicious flash drives.
Installing cracked software with hidden malicious code.
Access gained
account access via valid credentials
What to hunt?
signs of method mentioned above
Execution Tactic (TA0002)
execute or run their malicious code in conjunction with the initial access techniques or ways of delivering the attack.
it enables the attackers to successfully run their commands remotely and continue with the series of attacks to establish further access.
Examples
Execution through command-line tools like PowerShell and Windows Command Processor (cmd.exe).
Execution through scripting/programming tools, such as Python or PHP.
What to hunt?
Defense Evasion Tactic (TA0005)
disguising malicious activities as usual legitimate operations or manipulating known benign files or processes
Objective
to avoid detection by network security systems during or following an infiltration.
Examples
Disabling security software.
Deleting attack footprints on logs.
Deceiving analysts through masquerading, obfuscation, and encryption.
Executing known bypasses to security controls.
What to hunt?
Persistence Tactic (TA0003)
Objective
to maintain access to a compromised network over an extended period
Examples
Modification of registry keys to hijack the typical system/program startup.
Installation of malicious scripts or software that automatically starts.
Creation of additional high-privileged backdoor accounts.
What to hunt?
the system's subtle changes and activities
unrecognized or unexpected scripts running at startup
spotting unusual scheduled tasks
noticing irregularities in system registry keys
Command and Control Tactic (TA0011)
an adversary communicates with the compromised systems within a target network
attacker usually directs or continuously issues remote commands to the compromised system to fulfil the attacker's objectives
provide a lifeline between the attacker and the infiltrated network, enabling two-way communication
attacker solidifies their control over the compromised systems
Examples
Standard network protocols, such as DNS, ICMP, HTTP/s.
Known cloud-based services.
Encrypted custom HTTP/s server.
What to hunt?
Discovery Tactic (TA0007)
actions an attacker may take to understand better the systems and networks they have infiltrated.
involves identifying system and network configurations, finding sensitive data, or identifying other potential targets within the network.
Examples
Obtaining current user information and privileges, such as groups and accessible assets.
Enumerating host information, such as its operating system, installed applications, and implemented security controls.
Understanding internal network topology through hosts and services scanning.
Listing internal domain information, such as domain users, groups, and access control lists.
What to hunt?
Privilege Escalation Tactic (TA0004)
allow an attacker to gain higher privileges or permissions on a system or network
it can provide the attacker with increased access and control
Examples
Exploiting of privilege escalation vulnerabilities.
Using valid accounts with higher privileges.
Abusing misconfigured access controls.
Leveraging host misconfiguration on services and applications.
What to hunt?
unusual events executed by privileged accounts
Abusing of excessive service permissions
Credential Access Tactic (TA0006)
to steal or discover valid account usernames and passwords (or hashes)
allowing them to escalate privileges or gain access to other systems or network resources
Examples
Dumping credentials in memory or the disk.
Enumerating files containing credentials (scripts or browser files).
Dumping domain credentials.
Credential spraying and brute-forcing.
Reusing discovered passwords or hashes on other accounts.
What to hunt?
indicators of adversaries attempting to acquire or misuse credentials
Lateral Movement Tactic (TA0008)
attacker’s techniques to navigate a network, leveraging the credentials and sessions harvested during previous attack phases
enable an attacker to explore a network, find valuable assets, and gain access to them
Examples
Exploiting internal remote services and applications.
Using legitimate administrative tools to access remote hosts.
Authenticating to other workstations or servers using valid credentials.
Accessing sensitive information stored in file servers or database servers.
What to hunt?
uncovering suspicious authentication events and remote machine access from a haystack of benign login attempts by regular users
