MITRE ATT&CK Technique Guides for Defenders

MITRE ATT&CK catalogs how attackers behave. This index links a defender guide for each enterprise technique, covering how it works at a high level, how to detect it and how to reduce the risk.

Key takeaways

• 706 guides, each written for defenders and based on the source record.
• Each guide follows MITRE ATT&CK and links back to the MITRE page.
• Start with the free dependency scan at gold.safeguard.sh/scan if you want a quick look at your own packages.

All guides

• Detecting and Reducing Data Obfuscation in C2 Traffic (T1001)
• Junk Data in C2 Traffic and How to Spot It (T1001.001)
• Steganography in Command and Control Traffic (T1001.002)
• Detecting Protocol or Service Impersonation in C2 (T1001.003)
• OS Credential Dumping (T1003) Detection and Defense Guide
• Defending Against LSASS Memory Credential Dumping (T1003.001)
• Detecting SAM Database Credential Dumping (T1003.002)
• Protecting NTDS.dit From Credential Theft (T1003.003)
• LSA Secrets Dumping on Windows (T1003.004) Defense Guide
• Cached Domain Credentials Theft (T1003.005) Detection Guide
• Detecting DCSync Abuse of Domain Replication (T1003.006)
• Credential Dumping From the Linux /proc Filesystem (T1003.007)
• Protecting /etc/passwd and /etc/shadow From Dumping (T1003.008)
• Detecting Data Collection From the Local System (T1005)
• Direct Volume Access on Windows (T1006) Detection and Defense
• System Service Discovery (T1007) Detection Guide
• Fallback C2 Channels (T1008) Detection and Mitigation Guide
• Application Window Discovery (T1010) Detection Basics
• Exfiltration Over Other Network Medium (T1011) Guide
• Exfiltration Over Bluetooth (T1011.001) Defense Guide
• Query Registry (T1012) Detection and Defense Notes
• Rootkits (T1014) Detection and Defense Guide
• System Network Configuration Discovery (T1016) Guide
• Internet Connection Discovery (T1016.001) Basics
• Wi-Fi Discovery (T1016.002) Detection and Defense
• Detecting Remote System Discovery (T1018) Step by Step
• Automated Exfiltration (T1020) Detection and Mitigation
• Traffic Duplication (T1020.001) in Cloud and Network Devices
• Remote Services (T1021) Detection and Hardening Guide
• Detecting and Hardening Remote Desktop Protocol (T1021.001)
• Detecting and Mitigating SMB Admin Share Abuse (T1021.002)
• Detecting and Mitigating DCOM Lateral Movement (T1021.003)
• Detecting and Mitigating SSH Lateral Movement (T1021.004)
• Detecting and Mitigating VNC Abuse (T1021.005)
• Detecting and Mitigating WinRM Abuse (T1021.006)
• Detecting and Mitigating Cloud Service Logins (T1021.007)
• Detecting and Mitigating Direct Cloud VM Connections (T1021.008)
• Detecting and Mitigating Data Theft from Removable Media (T1025)
• Detecting and Mitigating Obfuscated Files or Information (T1027)
• Detecting and Mitigating Binary Padding (T1027.001)
• Detecting and Mitigating Software Packing (T1027.002)
• Detecting and Mitigating Steganography (T1027.003)
• Detecting and Mitigating Compile After Delivery (T1027.004)
• Detecting and Mitigating Indicator Removal from Tools (T1027.005)
• Detecting and Mitigating HTML Smuggling (T1027.006)
• Detecting and Mitigating Dynamic API Resolution (T1027.007)
• Detecting and Mitigating Stripped Payloads (T1027.008)
• Detecting and Mitigating Embedded Payloads (T1027.009)
• Detecting and Mitigating Command Obfuscation (T1027.010)
• Detecting and Mitigating Fileless Storage (T1027.011)
• Detecting and Mitigating LNK Icon Smuggling (T1027.012)
• Detecting and Mitigating Encrypted or Encoded Files (T1027.013)
• Detecting and Mitigating Polymorphic Code (T1027.014)
• Detecting and Mitigating Compression as Obfuscation (T1027.015)
• Detecting and Mitigating Junk Code Insertion (T1027.016)
• Detecting and Mitigating SVG Smuggling (T1027.017)
• Detecting and Mitigating Invisible Unicode in Code (T1027.018)
• Detecting and Mitigating Scheduled Transfer Exfiltration (T1029)
• Detecting and Mitigating Data Transfer Size Limits (T1030)
• Detecting and Mitigating System Owner and User Discovery (T1033)
• Detecting and Mitigating Masquerading (T1036)
• Invalid Code Signature (T1036.001): Detection Guide
• Right-to-Left Override Filenames (T1036.002) Explained
• Renamed System Utilities (T1036.003): Detect and Reduce
• Masquerading Tasks and Services (T1036.004) Guide
• Matching Legitimate Names and Locations (T1036.005)
• Space After Filename (T1036.006) on macOS and Linux
• Double File Extensions (T1036.007): Spot and Stop Them
• Masquerading File Types (T1036.008): Detection Guide
• Breaking Process Trees (T1036.009) on Linux and macOS
• Masquerading Account Names (T1036.010): Detect and Audit
• Overwriting Process Arguments (T1036.011) on Linux
• Spoofed Browser Fingerprints (T1036.012): Detection Notes
• Boot or Logon Initialization Scripts (T1037): Detection
• Windows Logon Scripts via the Registry (T1037.001)
• macOS Login Hooks (T1037.002): Detection and Cleanup
• Network Logon Scripts (T1037.003): Group Policy and NETLOGON
• RC Scripts Persistence (T1037.004): rc.local, init.d and ESXi
• macOS Startup Items (T1037.005): What to Check
• Data from Network Shared Drives (T1039): Detection Guide
• Network Sniffing (T1040): Detect and Mitigate Packet Capture
• Exfiltration Over a C2 Channel (T1041): Detection Basics
• Network Service Discovery (T1046): Detecting Port and Service Scans
• Detecting and Mitigating WMI Abuse (T1047)
• Exfiltration Over Alternative Protocols (T1048): Detection
• Exfiltration Over Symmetric Encrypted Non-C2 Protocol (T1048.001)
• Exfiltration Over Asymmetric Encrypted Non-C2 Protocol (T1048.002)
• Exfiltration Over Unencrypted Non-C2 Protocols (T1048.003)
• System Network Connections Discovery (T1049): Detection
• Exfiltration Over Physical Medium (T1052): USB and Removable Media
• Detecting and Mitigating Exfiltration over USB (T1052.001)
• Detecting and Mitigating Scheduled Task/Job Abuse (T1053)
• Detecting and Mitigating Abuse of the at Utility (T1053.002)
• Detecting and Mitigating Cron Job Abuse (T1053.003)
• Detecting and Mitigating Windows Scheduled Task Abuse (T1053.005)
• Detecting and Mitigating Systemd Timer Abuse (T1053.006)
• Detecting and Mitigating Malicious Kubernetes CronJobs (T1053.007)
• Detecting and Mitigating Process Injection (T1055)
• Detecting and Mitigating DLL Injection (T1055.001)
• Detecting and Mitigating PE Injection (T1055.002)
• Detecting and Mitigating Thread Execution Hijacking (T1055.003)
• Detecting and Mitigating APC Injection (T1055.004)
• Detecting and Mitigating TLS Callback Injection (T1055.005)
• Detecting and Mitigating Ptrace Process Injection on Linux (T1055.008)
• Detecting and Mitigating Proc Memory Injection on Linux (T1055.009)
• Detecting and Mitigating Extra Window Memory Injection (T1055.011)
• Detecting and Mitigating Process Hollowing (T1055.012)
• Detecting and Mitigating Process Doppelgänging (T1055.013)
• Detecting and Mitigating VDSO Hijacking on Linux (T1055.014)
• Detecting and Mitigating ListPlanting Injection (T1055.015)
• Detecting and Mitigating Input Capture (T1056)
• Detecting and Mitigating Keylogging (T1056.001)
• Detecting and Mitigating GUI Input Capture (T1056.002)
• Detecting and Mitigating Web Portal Capture (T1056.003)
• Detecting and Mitigating Credential API Hooking (T1056.004)
• Detecting and Mitigating Process Discovery (T1057)
• Detecting and Mitigating Command and Scripting Interpreter Abuse (T1059)
• Detecting and Mitigating PowerShell Abuse (T1059.001)
• Detecting and Mitigating AppleScript Abuse (T1059.002)
• Detecting and Mitigating Windows Command Shell Abuse (T1059.003)
• Detecting and Mitigating Unix Shell Abuse (T1059.004)
• Detecting and Mitigating Visual Basic Abuse (T1059.005)
• Detecting and Mitigating Python Abuse (T1059.006)
• Detecting and Mitigating JavaScript Abuse (T1059.007)
• Detecting and Mitigating Network Device CLI Abuse (T1059.008)
• Detecting and Mitigating Cloud API Abuse (T1059.009)
• Detecting and Mitigating AutoHotKey and AutoIT Abuse (T1059.010)
• Detecting and Mitigating Lua Scripting Abuse (T1059.011)
• Detecting and Mitigating Hypervisor CLI Abuse (T1059.012)
• Detecting and Mitigating Container CLI and API Abuse (T1059.013)
• Detecting and Mitigating Exploitation for Privilege Escalation (T1068)
• Detecting and Mitigating Permission Groups Discovery (T1069)
• Detecting and Mitigating Local Groups Discovery (T1069.001)
• Detecting and Mitigating Domain Groups Discovery (T1069.002)
• Detecting and Mitigating Cloud Groups Discovery (T1069.003)
• Detecting and Mitigating Indicator Removal (T1070)
• Detecting and Mitigating Clear Command History (T1070.003)
• Detecting and Mitigating File Deletion by Intruders (T1070.004)
• Detecting and Mitigating Network Share Connection Removal (T1070.005)
• Detecting and Mitigating Timestomping (T1070.006)
• Detecting and Mitigating Cleared Network History (T1070.007)
• Detecting and Mitigating Clear Mailbox Data (T1070.008)
• Detecting and Mitigating Clear Persistence (T1070.009)
• Detecting and Mitigating Relocated Malware (T1070.010)
• Detecting and Mitigating Application Layer Protocol C2 (T1071)
• Detecting and Mitigating Web Protocol C2 (T1071.001)
• Detecting and Mitigating File Transfer Protocol C2 (T1071.002)
• Detecting and Mitigating Mail Protocol C2 (T1071.003)
• Detecting and Mitigating DNS Tunneling and C2 (T1071.004)
• Detecting and Mitigating Pub/Sub Protocol C2 (T1071.005)
• Detecting and Mitigating Software Deployment Tool Abuse (T1072)
• Detecting and Mitigating Data Staging (T1074)
• Detecting and Mitigating Local Data Staging (T1074.001)
• Detecting and Mitigating Remote Data Staging (T1074.002)
• Detecting and Mitigating Valid Accounts Abuse (T1078)
• Detecting and Mitigating Default Account Abuse (T1078.001)
• Detecting and Mitigating Domain Account Abuse (T1078.002)
• Detecting and Mitigating Local Account Abuse (T1078.003)
• Detecting and Mitigating Cloud Account Abuse (T1078.004)
• Detecting and Mitigating Tainted Shared Content (T1080)
• Detecting System Information Discovery (T1082)
• Detecting File and Directory Discovery (T1083)
• Detecting and Mitigating Account Discovery (T1087)
• Detecting Local Account Discovery (T1087.001)
• Detecting and Mitigating Domain Account Discovery (T1087.002)
• Detecting Email Account Discovery (T1087.003)
• Detecting and Mitigating Cloud Account Discovery (T1087.004)
• Detecting and Mitigating Proxy Use for C2 (T1090)
• Detecting and Mitigating Internal Proxy Use (T1090.001)
• Detecting and Mitigating External Proxy Use (T1090.002)
• Detecting and Mitigating Multi-hop Proxy Chains (T1090.003)
• Detecting and Mitigating Domain Fronting (T1090.004)
• Detecting and Mitigating Replication Through Removable Media (T1091)
• Detecting Communication Through Removable Media (T1092)
• Detecting Non-Application Layer Protocols for C2 (T1095)
• Detecting and Mitigating Account Manipulation (T1098)
• Detecting and Mitigating Additional Cloud Credentials (T1098.001)
• Detecting and Mitigating Email Delegate Permission Abuse (T1098.002)
• Detecting and Mitigating Additional Cloud Roles (T1098.003)
• Detecting and Mitigating SSH Authorized Keys Abuse (T1098.004)
• Detecting and Mitigating Device Registration Abuse (T1098.005)
• Detecting and Mitigating Added Cluster Roles in Kubernetes (T1098.006)
• Detecting and Mitigating Added Local or Domain Groups (T1098.007)
• Detecting and Mitigating Web Service Command and Control (T1102)
• Detecting and Mitigating Dead Drop Resolvers (T1102.001)
• Detecting and Mitigating Two-Way Web Service C2 (T1102.002)
• Detecting and Mitigating One-Way Web Service C2 (T1102.003)
• Detecting and Mitigating Multi-Stage C2 Channels (T1104)
• Detecting and Mitigating Ingress Tool Transfer (T1105)
• Detecting and Mitigating Native API Abuse (T1106)
• Detecting and Mitigating Brute Force Attacks (T1110)
• Detecting and Mitigating Password Guessing (T1110.001)
• Detecting and Mitigating Password Cracking (T1110.002)
• Detecting and Mitigating Password Spraying (T1110.003)
• Detecting and Mitigating Credential Stuffing (T1110.004)
• Detecting and Mitigating MFA Interception (T1111)
• Detecting and Mitigating Windows Registry Modification (T1112)
• Detecting and Mitigating Screen Capture (T1113)
• Detecting and Mitigating Email Collection (T1114)
• Detecting and Mitigating Local Email Collection (T1114.001)
• Detecting and Mitigating Remote Email Collection (T1114.002)
• Detecting and Mitigating Email Forwarding Rule Abuse (T1114.003)
• Detecting and Mitigating Clipboard Data Theft (T1115)
• Detecting and Mitigating Automated Collection (T1119)
• Detecting and Mitigating Peripheral Device Discovery (T1120)
• Detecting and Mitigating Audio Capture (T1123)
• Detecting and Mitigating System Time Discovery (T1124)
• Detecting and Mitigating Video Capture (T1125)
• Detecting and Mitigating Trusted Developer Utility Abuse (T1127)
• Detecting and Mitigating MSBuild Proxy Execution (T1127.001)
• Detecting and Mitigating ClickOnce Proxy Execution (T1127.002)
• Detecting and Mitigating JamPlus Proxy Execution (T1127.003)
• Detecting and Mitigating Shared Module Loading (T1129)
• Detecting Data Encoding in Command and Control Traffic (T1132)
• Detecting Standard Encoding in C2 Traffic (T1132.001)
• Detecting Non-Standard Encoding in C2 Traffic (T1132.002)
• Detecting and Mitigating External Remote Services Abuse (T1133)
• Detecting and Mitigating Access Token Manipulation (T1134)
• Detecting Token Impersonation and Theft on Windows (T1134.001)
• Detecting Create Process with Token on Windows (T1134.002)
• Detecting Make and Impersonate Token on Windows (T1134.003)
• Detecting Parent PID Spoofing on Windows (T1134.004)
• Detecting and Cleaning Up SID-History Injection (T1134.005)
• Detecting and Mitigating Network Share Discovery (T1135)
• Detecting and Mitigating Account Creation for Persistence (T1136)
• Detecting and Mitigating Local Account Creation (T1136.001)
• Detecting and Mitigating Domain Account Creation (T1136.002)
• Detecting and Mitigating Cloud Account Creation (T1136.003)
• Detecting and Mitigating Office Application Startup Persistence (T1137)
• Detecting and Mitigating Office Template Macros (T1137.001)
• Detecting and Mitigating the Office Test Registry Key (T1137.002)
• Detecting and Mitigating Malicious Outlook Forms (T1137.003)
• Detecting and Mitigating the Outlook Home Page Abuse (T1137.004)
• Detecting and Mitigating Malicious Outlook Rules (T1137.005)
• Detecting and Mitigating Malicious Office Add-ins (T1137.006)
• Detecting Deobfuscate and Decode Files or Information (T1140)
• Detecting and Mitigating Malicious Software Extensions (T1176)
• Detecting and Mitigating Malicious Browser Extensions (T1176.001)
• Detecting and Mitigating Malicious IDE Extensions (T1176.002)
• Detecting and Mitigating Browser Session Hijacking (T1185)
• Detecting and Mitigating Forced Authentication (T1187)
• Detecting and Mitigating Drive-by Compromise (T1189)
• Detecting and Mitigating Exploit of Public-Facing Apps (T1190)
• Detecting and Mitigating Supply Chain Compromise (T1195)
• Detecting and Mitigating Compromised Dependencies (T1195.001)
• Detecting and Mitigating Software Supply Chain Compromise (T1195.002)
• Detecting and Mitigating Hardware Supply Chain Compromise (T1195.003)
• Detecting and Mitigating BITS Jobs Abuse (T1197)
• Detecting and Mitigating Trusted Relationship Abuse (T1199)
• Detecting and Mitigating Hardware Additions (T1200)
• Detecting and Mitigating Password Policy Discovery (T1201)
• Detecting and Mitigating Indirect Command Execution (T1202)
• Detecting and Mitigating Exploitation for Client Execution (T1203)
• Detecting and Mitigating User Execution (T1204)
• Detecting and Mitigating Malicious Link Execution (T1204.001)
• Detecting and Mitigating Malicious File Execution (T1204.002)
• Detecting and Mitigating Malicious Images (T1204.003)
• Detecting and Mitigating ClickFix Copy and Paste (T1204.004)
• Detecting and Mitigating Malicious Libraries (T1204.005)
• Detecting and Mitigating Traffic Signaling (T1205)
• Detecting and Mitigating Port Knocking Backdoors (T1205.001)
• Detecting and Mitigating Socket Filters Backdoors (T1205.002)
• Detecting and Mitigating Rogue Domain Controller DCShadow (T1207)
• Detecting and Mitigating Exploitation of Remote Services (T1210)
• Detecting and Mitigating Exploitation for Stealth (T1211)
• Detecting and Mitigating Exploitation for Credential Access (T1212)
• Detecting and Mitigating Data from Information Repositories (T1213)
• Detecting and Mitigating Confluence Data Mining (T1213.001)
• Detecting and Mitigating SharePoint Data Mining (T1213.002)
• Detecting and Mitigating Code Repository Data Theft (T1213.003)
• Detecting and Mitigating CRM Data Mining (T1213.004)
• Detecting and Mitigating Chat App Data Mining (T1213.005)
• Detecting and Mitigating Database Data Mining (T1213.006)
• Detecting and Mitigating System Script Proxy Execution (T1216)
• Detecting and Mitigating PubPrn Proxy Execution (T1216.001)
• Detecting SyncAppvPublishingServer Script Abuse (T1216.002)
• Detecting Browser Information Discovery (T1217)
• Detecting and Mitigating System Binary Proxy Execution (T1218)
• Detecting and Mitigating Compiled HTML File Abuse (T1218.001)
• Detecting and Mitigating Control Panel Item Abuse (T1218.002)
• Detecting and Mitigating CMSTP Abuse (T1218.003)
• Detecting and Mitigating InstallUtil Abuse (T1218.004)
• Detecting and Mitigating Mshta Abuse (T1218.005)
• Detecting and Mitigating Msiexec Abuse (T1218.007)
• Detecting and Mitigating Odbcconf Abuse (T1218.008)
• Detecting and Mitigating Regsvcs and Regasm Abuse (T1218.009)
• Detecting and Mitigating Regsvr32 Abuse (T1218.010)
• Detecting and Mitigating Rundll32 Abuse (T1218.011)
• Detecting and Mitigating Verclsid Abuse (T1218.012)
• Detecting and Mitigating Mavinject Abuse (T1218.013)
• Detecting and Mitigating MMC Proxy Execution (T1218.014)
• Detecting and Mitigating Electron Application Abuse (T1218.015)
• Detecting and Mitigating Remote Access Tool Abuse (T1219)
• Detecting and Mitigating IDE Tunneling Abuse (T1219.001)
• Detecting and Mitigating Remote Desktop Software Abuse (T1219.002)
• Detecting and Mitigating Remote Access Hardware (T1219.003)
• Detecting and Mitigating XSL Script Processing (T1220)
• Detecting and Mitigating Template Injection (T1221)
• Detecting File and Directory Permissions Modification (T1222)
• Detecting Windows File Permission Changes (T1222.001)
• Detecting Linux and macOS Permission Abuse (T1222.002)
• Understanding Execution Guardrails in Malware (T1480)
• Environmental Keying: Payloads Locked to One Target (T1480.001)
• Mutual Exclusion in Malware: Mutex Checks (T1480.002)
• Detecting Domain Trust Discovery in Active Directory (T1482)
• Detecting Domain or Tenant Policy Modification (T1484)
• Detecting Malicious Group Policy Modification (T1484.001)
• Detecting Trust Modification in AD and Identity Tenants (T1484.002)
• Detecting and Mitigating Data Destruction (T1485)
• Detecting Lifecycle Triggered Deletion in Cloud Storage (T1485.001)
• Detecting and Mitigating Data Encrypted for Impact (T1486)
• Detecting and Mitigating Service Stop Attacks (T1489)
• Detecting and Mitigating Inhibit System Recovery (T1490)
• Detecting and Recovering from Defacement (T1491)
• Detecting Internal Defacement of Systems and Banners (T1491.001)
• Detecting External Website Defacement (T1491.002)
• Detecting and Mitigating Firmware Corruption (T1495)
• Detecting and Mitigating Resource Hijacking (T1496)
• Detecting Compute Hijacking and Cryptomining (T1496.001)
• Detecting Bandwidth Hijacking and Proxyjacking (T1496.002)
• Detecting and Preventing SMS Pumping Fraud (T1496.003)
• Detecting Cloud Service Hijacking and LLMjacking (T1496.004)
• Detecting Virtualization and Sandbox Evasion (T1497)
• Detecting System Checks Used for Sandbox Evasion (T1497.001)
• Detecting User Activity Checks in Malware (T1497.002)
• Detecting Time Based Sandbox Evasion (T1497.003)
• Detecting and Mitigating Network Denial of Service (T1498)
• Detecting Direct Network Flood Attacks (T1498.001)
• Detecting Reflection Amplification DDoS Attacks (T1498.002)
• Detecting and Mitigating Endpoint Denial of Service (T1499)
• Detecting OS Exhaustion Floods (T1499.001)
• Detecting Service Exhaustion Floods (T1499.002)
• Detecting Application Exhaustion Floods (T1499.003)
• Detecting Crash Based DoS Exploitation (T1499.004)
• Detecting Malicious Server Software Components (T1505)
• Detecting SQL Stored Procedure Abuse (T1505.001)
• Detecting Malicious Exchange Transport Agents (T1505.002)
• Detecting and Mitigating Web Shells (T1505.003)
• Detecting Malicious IIS Components (T1505.004)
• Detecting Terminal Services DLL Tampering (T1505.005)
• Detecting Malicious vSphere Installation Bundles (T1505.006)
• Detecting Software Discovery Activity (T1518)
• Detecting Security Software Discovery (T1518.001)
• Detecting Backup Software Discovery (T1518.002)
• Detecting Implanted Cloud and Container Images (T1525)
• Detecting Cloud Service Discovery (T1526)
• Detecting and Mitigating Stolen Access Tokens (T1528)
• Detecting Malicious System Shutdown or Reboot (T1529)
• Detecting and Preventing Data Theft from Cloud Storage (T1530)
• Detecting Account Access Removal (T1531)
• Detecting Internal Spearphishing (T1534)
• Detecting Use of Unused Cloud Regions (T1535)
• Detecting Data Transfer to an Attacker Cloud Account (T1537)
• Detecting Cloud Service Dashboard Use (T1538)
• Detecting and Mitigating Web Session Cookie Theft (T1539)
• Detecting Pre-OS Boot Persistence (T1542)
• Detecting System Firmware Tampering (T1542.001)
• Detecting Component Firmware Tampering (T1542.002)
• Detecting Bootkits (T1542.003)
• Detecting ROMMONkit Tampering on Cisco Devices (T1542.004)
• Detecting and Mitigating TFTP Boot Abuse (T1542.005)
• Detecting and Mitigating System Process Persistence (T1543)
• Detecting and Mitigating Launch Agent Abuse on macOS (T1543.001)
• Detecting and Mitigating Malicious Systemd Services (T1543.002)
• Detecting and Mitigating Malicious Windows Services (T1543.003)
• Detecting and Mitigating Launch Daemon Abuse (T1543.004)
• Detecting and Mitigating Container Service Abuse (T1543.005)
• Detecting and Mitigating Event Triggered Execution (T1546)
• Detecting Default File Association Hijacking (T1546.001)
• Detecting and Mitigating Screensaver Persistence (T1546.002)
• Detecting and Mitigating WMI Event Subscriptions (T1546.003)
• Detecting and Mitigating Shell Configuration Persistence (T1546.004)
• Detecting and Mitigating Trap Command Abuse (T1546.005)
• Detecting and Mitigating LC_LOAD_DYLIB Addition (T1546.006)
• Detecting and Mitigating Netsh Helper DLL Abuse (T1546.007)
• Detecting and Mitigating Accessibility Features Abuse (T1546.008)
• Detecting and Mitigating AppCert DLLs Abuse (T1546.009)
• Detecting and Mitigating AppInit DLLs Abuse (T1546.010)
• Detecting and Mitigating Application Shimming Abuse (T1546.011)
• Detecting and Mitigating IFEO Injection (T1546.012)
• Detecting and Mitigating PowerShell Profile Abuse (T1546.013)
• Detecting and Mitigating Emond Abuse on macOS (T1546.014)
• Detecting and Mitigating COM Hijacking (T1546.015)
• Detecting and Mitigating Installer Package Abuse (T1546.016)
• Detecting and Mitigating Udev Rules Abuse on Linux (T1546.017)
• Detecting and Mitigating Python Startup Hooks (T1546.018)
• Detecting and Mitigating Boot or Logon Autostart (T1547)
• Detecting and Mitigating Registry Run Keys and Startup Folders (T1547.001)
• Detecting and Mitigating Authentication Package Abuse (T1547.002)
• Detecting and Mitigating Time Provider Abuse (T1547.003)
• Detecting and Mitigating Winlogon Helper DLL Abuse (T1547.004)
• Detecting and Mitigating Security Support Provider Abuse (T1547.005)
• Detecting Malicious Kernel Modules and Extensions (T1547.006)
• Detecting and Mitigating Re-opened Applications Persistence (T1547.007)
• Detecting and Mitigating LSASS Driver Persistence (T1547.008)
• Detecting Shortcut Modification Persistence on Windows (T1547.009)
• Detecting Port Monitor Persistence on Windows (T1547.010)
• Detecting and Mitigating Print Processor Abuse (T1547.012)
• Detecting XDG Autostart Entry Persistence on Linux (T1547.013)
• Detecting Active Setup Persistence on Windows (T1547.014)
• Detecting Malicious Login Items on macOS (T1547.015)
• Abuse Elevation Control Mechanism: A Defender's Guide (T1548)
• Auditing Setuid and Setgid Binaries on Linux and macOS (T1548.001)
• Detecting and Mitigating UAC Bypass on Windows (T1548.002)
• Sudo Caching and Sudoers Abuse: Detection and Hardening (T1548.003)
• Elevated Execution with Prompt on macOS: Detection and Defense (T1548.004)
• Temporary Elevated Cloud Access: Detecting Role Abuse (T1548.005)
• Detecting TCC Manipulation on macOS (T1548.006)
• Use Alternate Authentication Material: A Defender's Guide (T1550)
• Stolen Application Access Tokens: Detection and Defense (T1550.001)
• Detecting and Mitigating Pass the Hash Attacks (T1550.002)
• Detecting and Mitigating Pass the Ticket Attacks (T1550.003)
• Stolen Web Session Cookies: Detection and Defense (T1550.004)
• Unsecured Credentials: Where They Hide and How to Find Them (T1552)
• Credentials in Files: Detection and Prevention (T1552.001)
• Finding Credentials Stored in the Windows Registry (T1552.002)
• Passwords in Shell History: Detection and Prevention (T1552.003)
• Private Key Theft: Detection and Protection (T1552.004)
• Protecting the Cloud Instance Metadata API From Abuse (T1552.005)
• Group Policy Preferences Passwords: Detection and Cleanup (T1552.006)
• Detecting and Mitigating Container API Credential Theft (T1552.007)
• Finding Credentials Shared in Chat Messages (T1552.008)
• Detecting and Mitigating Subverted Trust Controls (T1553)
• Detecting and Mitigating macOS Gatekeeper Bypass (T1553.001)
• When Attackers Sign Their Malware: Code Signing (T1553.002)
• Detecting SIP and Trust Provider Hijacking on Windows (T1553.003)
• Detecting Rogue Root Certificates on Your Systems (T1553.004)
• Detecting and Mitigating Mark-of-the-Web Bypass (T1553.005)
• Detecting Code Signing Policy Modification (T1553.006)
• Detecting Compromised Host Software Binaries (T1554)
• Defending Password Stores from Credential Theft (T1555)
• Protecting the macOS Keychain from Credential Theft (T1555.001)
• Understanding Securityd Memory Credential Theft (T1555.002)
• Protecting Browser Saved Passwords from Theft (T1555.003)
• Detecting Windows Credential Manager Theft (T1555.004)
• Defending Password Managers from Credential Theft (T1555.005)
• Detecting Theft from Cloud Secrets Managers (T1555.006)
• Detecting and Mitigating Authentication Process Tampering (T1556)
• Detecting Domain Controller Authentication Patching (T1556.001)
• Detecting Malicious Password Filter DLLs (T1556.002)
• Detecting Pluggable Authentication Module Tampering (T1556.003)
• Detecting Network Device Authentication Backdoors (T1556.004)
• Auditing Active Directory Reversible Encryption (T1556.005)
• Detecting MFA Tampering and Fail-Open Bypass (T1556.006)
• Detecting Hybrid Identity Backdoors in Entra ID and AD FS (T1556.007)
• Detecting Malicious Network Provider DLLs on Windows (T1556.008)
• Detecting Conditional Access Policy Tampering (T1556.009)
• Detecting and Mitigating Adversary-in-the-Middle Attacks (T1557)
• Detecting LLMNR, NBT-NS and mDNS Poisoning and SMB Relay (T1557.001)
• Detecting and Mitigating ARP Cache Poisoning (T1557.002)
• Detecting and Mitigating DHCP Spoofing (T1557.003)
• Detecting and Mitigating Evil Twin Wi-Fi (T1557.004)
• Detecting and Mitigating Kerberos Ticket Theft (T1558)
• Detecting and Mitigating Golden Ticket Forgery (T1558.001)
• Detecting and Mitigating Silver Ticket Forgery (T1558.002)
• Detecting and Mitigating Kerberoasting (T1558.003)
• Detecting and Mitigating AS-REP Roasting (T1558.004)
• Detecting and Mitigating Kerberos Ccache Theft (T1558.005)
• Detecting and Mitigating IPC Abuse for Execution (T1559)
• Detecting and Mitigating COM Abuse for Execution (T1559.001)
• Detecting and Mitigating DDE Abuse in Office (T1559.002)
• Detecting and Mitigating XPC Services Abuse (T1559.003)
• Detecting and Mitigating Archived Data Staging (T1560)
• Detecting and Mitigating Archive via Utility (T1560.001)
• Detecting and Mitigating Archive via Library (T1560.002)
• Detecting and Mitigating Custom Archive Methods (T1560.003)
• Detecting and Mitigating Disk Wipe Attacks (T1561)
• Detecting and Mitigating Disk Content Wipe (T1561.001)
• Detecting and Mitigating Disk Structure Wipe (T1561.002)
• Detecting and Mitigating Remote Session Hijacking (T1563)
• Detecting and Mitigating SSH Hijacking (T1563.001)
• Detecting and Mitigating RDP Session Hijacking (T1563.002)
• Detecting and Mitigating Hidden Artifacts (T1564)
• Detecting and Mitigating Hidden Files and Directories (T1564.001)
• Detecting and Mitigating Hidden User Accounts (T1564.002)
• Detecting and Mitigating Hidden Windows (T1564.003)
• Detecting and Mitigating NTFS Attribute Hiding (T1564.004)
• Detecting and Mitigating Hidden File Systems (T1564.005)
• Detecting and Mitigating Hidden Virtual Machines (T1564.006)
• Detecting and Mitigating VBA Stomping (T1564.007)
• Email Hiding Rules in Compromised Mailboxes (T1564.008)
• Resource Forking on macOS: Hidden Data in Files (T1564.009)
• Process Argument Spoofing on Windows (T1564.010)
• Ignore Process Interrupts: nohup and Friends (T1564.011)
• File and Path Exclusions: Hiding in AV Blind Spots (T1564.012)
• Bind Mounts That Hide Linux Processes (T1564.013)
• Extended Attributes: Hidden Payloads in Plain Files (T1564.014)
• Data Manipulation: Defending the Integrity of Your Data (T1565)
• Stored Data Manipulation: Protecting Data at Rest (T1565.001)
• Transmitted Data Manipulation: Integrity in Transit (T1565.002)
• Runtime Data Manipulation: When the Viewer Lies (T1565.003)
• Phishing (T1566): Detection and Mitigation for Defenders
• Spearphishing Attachment: Detection and Defense (T1566.001)
• Spearphishing Link: Detecting Malicious Links in Mail (T1566.002)
• Spearphishing via Service: Personal Webmail and Social (T1566.003)
• Spearphishing Voice: Phone Calls as a Way In (T1566.004)
• Exfiltration Over Web Service: Detecting Data Leaving (T1567)
• Exfiltration to a Code Repository: Detecting It (T1567.001)
• Exfiltration to Cloud Storage: Detection and Controls (T1567.002)
• Exfiltration to Text Storage Sites like Pastebin (T1567.003)
• Exfiltration Over Webhook: Slack, Discord and More (T1567.004)
• Dynamic Resolution: Detecting Shifting C2 Destinations (T1568)
• Fast Flux DNS: Spotting Rotating IPs (T1568.001)
• Domain Generation Algorithms: Detecting DGA Traffic (T1568.002)
• DNS Calculation: Ports Derived from DNS Answers (T1568.003)
• System Services: Abuse of Services and Daemons (T1569)
• Launchctl Abuse on macOS: Detection Basics (T1569.001)
• Service Execution on Windows: Detecting It (T1569.002)
• Systemctl Abuse on Linux: What to Watch (T1569.003)
• Lateral Tool Transfer: Spotting File Movement Inside (T1570)
• Detecting Non-Standard Port Use for C2 (T1571)
• Protocol Tunneling (T1572): Detection and Mitigation Guide
• Encrypted Channel (T1573): Spotting Hidden C2 Traffic
• Symmetric Cryptography in C2 (T1573.001) for Defenders
• Asymmetric Cryptography in C2 (T1573.002) for Defenders
• Hijack Execution Flow (T1574): A Defender Guide
• DLL Hijacking and Side-Loading (T1574.001) Defender Guide
• Dylib Hijacking on macOS (T1574.004) for Defenders
• Installer File Permissions Weakness (T1574.005) Guide
• Dynamic Linker Hijacking (T1574.006): LD_PRELOAD and DYLD
• PATH Interception (T1574.007): Detection and Mitigation
• Search Order Hijacking (T1574.008): Detect and Prevent
• Unquoted Path Interception (T1574.009): Find and Fix
• Services File Permissions Weakness (T1574.010) Guide
• Services Registry Permissions Weakness (T1574.011) Guide
• COR_PROFILER Hijacking (T1574.012) Detection Guide
• KernelCallbackTable Hijacking (T1574.013) for Defenders
• AppDomainManager Injection (T1574.014) Defender Guide
• Modify Cloud Compute Infrastructure (T1578): Detect and Limit
• Create Snapshot (T1578.001): Cloud Defense Evasion
• Create Cloud Instance (T1578.002): Spot Rogue VMs
• Delete Cloud Instance (T1578.003): Evidence Destruction
• Revert Cloud Instance (T1578.004) Detection Basics
• Modify Cloud Compute Configurations (T1578.005) Guide
• Cloud Infrastructure Discovery (T1580): Detection Guide
• Acquire Infrastructure (T1583): What Defenders Can Do
• Acquire Domains (T1583.001): Lookalikes and Expired Names
• Acquire DNS Server (T1583.002): What Defenders See
• Acquire Virtual Private Servers (T1583.003) Guide
• Acquire Servers (T1583.004): Pre-Attack Infrastructure
• Botnets Rented by Attackers: Defending Against T1583.005
• Attacker Web Service Accounts: Defending Against T1583.006
• Attacker Serverless Infrastructure: T1583.007 Explained
• Malvertising and Fake Software Ads: T1583.008 Guide
• Compromised Third-Party Infrastructure: T1584 Guide for Defenders
• Domain and Subdomain Hijacking: Defending Against T1584.001
• Compromised DNS Servers: Defending Against T1584.002
• Compromised VPS Hosts: Defending Against T1584.003
• Compromised Servers: Defending Against T1584.004
• Building a Botnet from Compromised Systems: T1584.005
• Hijacked Web Service Accounts: Defending Against T1584.006
• Compromised Serverless Functions: T1584.007 for Defenders
• Compromised Routers and Network Devices: T1584.008
• Fake Accounts and Personas: Defending Against T1585
• Fake Social Media Personas: Defending Against T1585.001
• Attacker-Created Email Accounts: Defending Against T1585.002
• Attacker-Created Cloud Accounts: Defending Against T1585.003
• Compromised Accounts as Attack Infrastructure: T1586 Explained
• Hijacked Social Media Accounts: Defending Against T1586.001
• Hijacked Email Accounts: Defending Against T1586.002
• Hijacked Cloud Accounts: Defending Against T1586.003
• Attackers Who Build Their Own Tools: Understanding T1587
• Custom Malware Development: Defending Against T1587.001
• Self-Signed Code Signing Certificates: Defending Against T1587.002
• Self-Signed TLS Certificates: Defending Against T1587.003
• Custom Exploit Development: Defending Against T1587.004
• When Attackers Buy or Steal Tools: Understanding T1588
• Bought or Stolen Malware: Defending Against T1588.001
• Dual-Use Tools in Attacks: Defending Against T1588.002
• Stolen Code Signing Certificates: Defending Against T1588.003
• Digital Certificates Obtained by Adversaries (T1588.004)
• Detecting and Mitigating Acquired Exploits (T1588.005)
• Vulnerability Research by Adversaries (T1588.006) and Your Response
• Adversary Use of Generative AI (T1588.007) and Defender Responses
• Gather Victim Identity Information (T1589): Detection and Mitigation
• Detecting and Reducing Credential Gathering (T1589.001)
• Email Address Harvesting (T1589.002): Detection and Mitigation
• Employee Name Gathering (T1589.003): What Defenders Can Do
• Gather Victim Network Information (T1590): Detection and Mitigation
• Domain Properties Reconnaissance (T1590.001) for Defenders
• DNS Reconnaissance (T1590.002): Detection and Mitigation
• Network Trust Dependencies as a Recon Target (T1590.003)
• Network Topology Reconnaissance (T1590.004) and Defenses
• IP Address Reconnaissance (T1590.005): Detect and Reduce
• Network Security Appliance Recon (T1590.006): What to Know
• Gather Victim Org Information (T1591): Detection and Mitigation
• Physical Location Reconnaissance (T1591.001): Defender Notes
• Business Relationship Recon (T1591.002) and Supply Chain Risk
• Business Tempo Reconnaissance (T1591.003): Defender Notes
• Role Identification Reconnaissance (T1591.004) for Defenders
• Gather Victim Host Information (T1592): Detection and Mitigation
• Host Hardware Reconnaissance (T1592.001) for Defenders
• Software Reconnaissance (T1592.002): Detect, Reduce, and Inventory
• Firmware Reconnaissance (T1592.003): What Defenders Should Know
• Client Configuration Reconnaissance (T1592.004) for Defenders
• Search Open Websites and Domains (T1593): Defender Guide
• Social Media Reconnaissance (T1593.001): Notes for Defenders
• Search Engine Reconnaissance (T1593.002): Detect and Reduce
• Public Code Repository Reconnaissance (T1593.003): Defenders
• Searching Victim-Owned Websites (T1594): Detection and Mitigation
• Detecting and Reducing Active Scanning Exposure (T1595)
• Detecting and Reducing Exposure to IP Block Scanning (T1595.001)
• Defending Against Vulnerability Scanning of Your Systems (T1595.002)
• Detecting and Mitigating Wordlist Scanning (T1595.003)
• Search Open Technical Databases and What It Says About You (T1596)
• Reducing What DNS and Passive DNS Reveal About You (T1596.001)
• WHOIS Reconnaissance and How to Limit It (T1596.002)
• Digital Certificate Reconnaissance and Your Exposure (T1596.003)
• CDN Reconnaissance and Misconfiguration Leaks (T1596.004)
• Scan Databases: What Internet Surveys Publish About You (T1596.005)
• Search Closed Sources: Paid and Underground Data About You (T1597)
• Threat Intel Vendor Data as a Reconnaissance Source (T1597.001)
• Purchased Technical Data and Leaked Credentials Risk (T1597.002)
• Detecting and Mitigating Phishing for Information (T1598)
• Spearphishing via Third-Party Services for Information (T1598.001)
• Spearphishing Attachments That Harvest Information (T1598.002)
• Detecting and Mitigating Spearphishing Links for Information (T1598.003)
• Spearphishing by Voice: Vishing for Information (T1598.004)
• Detecting and Mitigating Network Boundary Bridging (T1599)
• Network Address Translation Traversal on Network Devices (T1599.001)
• Detecting and Mitigating Weakened Encryption on Network Devices (T1600)
• Reduce Key Space: Shrinking Encryption Strength on Devices (T1600.001)
• Disable Crypto Hardware on Network Devices (T1600.002)
• Detecting and Mitigating Modified Network Device Images (T1601)
• Detecting and Mitigating Patched Network Device Images (T1601.001)
• Detecting and Preventing Downgraded Network Device Images (T1601.002)
• Protecting Network Configuration Repositories (T1602)
• Detecting and Preventing SNMP MIB Dumps (T1602.001)
• Detecting and Preventing Network Device Configuration Dumps (T1602.002)
• Detecting and Mitigating Forged Web Credentials (T1606)
• Detecting and Mitigating Forged Web Cookies (T1606.001)
• Detecting and Mitigating Forged SAML Tokens (T1606.002)
• Understanding Stage Capabilities Before an Attack Reaches You (T1608)
• Detecting and Mitigating Staged Malware Uploads (T1608.001)
• Detecting and Mitigating Staged Tool Uploads (T1608.002)
• Understanding Adversary-Installed TLS Certificates (T1608.003)
• Detecting and Mitigating Staged Drive-by Targets (T1608.004)
• Detecting and Mitigating Staged Link Targets (T1608.005)
• Detecting and Mitigating SEO Poisoning (T1608.006)
• Understanding AI Result Poisoning (T1608.007)
• Detecting and Mitigating Container Administration Commands (T1609)
• Detecting and Mitigating Malicious Container Deployment (T1610)
• Detecting and Mitigating Container Escape to Host (T1611)
• Detecting and Mitigating Image Builds on the Host (T1612)
• Detecting and Mitigating Container and Resource Discovery (T1613)
• Understanding System Location Discovery (T1614)
• Detecting and Mitigating System Language Discovery (T1614.001)
• Detecting and Mitigating Group Policy Discovery (T1615)
• Detecting Cloud Storage Object Discovery (T1619)
• Detecting and Mitigating Reflective Code Loading (T1620)
• Detecting and Mitigating MFA Fatigue Attacks (T1621)
• Understanding Debugger Evasion in Malware (T1622)
• Detecting Malicious Plist File Modification on macOS (T1647)
• Detecting and Mitigating Serverless Execution Abuse (T1648)
• Detecting and Mitigating Stolen or Forged Auth Certificates (T1649)
• Understanding Acquire Access and Initial Access Brokers (T1650)
• Detecting and Mitigating Cloud Administration Command Abuse (T1651)
• Understanding Device Driver Discovery (T1652)
• Detecting Malicious Power Settings Changes (T1653)
• Detecting and Mitigating Log Enumeration (T1654)
• Detecting and Reducing Financial Theft (MITRE ATT&CK T1657)
• Detecting and Mitigating Content Injection (MITRE ATT&CK T1659)
• Detecting and Mitigating Hide Infrastructure (MITRE ATT&CK T1665)
• Detecting Modify Cloud Resource Hierarchy (MITRE ATT&CK T1666)
• Detecting and Mitigating Email Bombing (MITRE ATT&CK T1667)
• Detecting and Mitigating Exclusive Control (MITRE ATT&CK T1668)
• Detecting and Mitigating Wi-Fi Network Access (MITRE ATT&CK T1669)
• Detecting Cloud Application Integration Abuse (MITRE ATT&CK T1671)
• Detecting Virtual Machine Discovery (MITRE ATT&CK T1673)
• Detecting and Mitigating Input Injection (MITRE ATT&CK T1674)
• Detecting ESXi Administration Command Abuse (MITRE ATT&CK T1675)
• Detecting and Mitigating Poisoned Pipeline Execution (T1677)
• Detecting and Mitigating Delay Execution (MITRE ATT&CK T1678)
• Detecting and Mitigating Selective Exclusion (MITRE ATT&CK T1679)
• Detecting Local Storage Discovery (MITRE ATT&CK T1680)
• Understanding Search Threat Vendor Data (MITRE ATT&CK T1681)
• Understanding Query Public AI Services (MITRE ATT&CK T1682)
• Understanding Generate Content (MITRE ATT&CK T1683)
• Understanding Written Content Generation (MITRE ATT&CK T1683.001)
• Understanding Audio-Visual Content Generation (MITRE ATT&CK T1683.002)
• Detecting and Mitigating Social Engineering (MITRE ATT&CK T1684)
• Detecting and Mitigating Impersonation (MITRE ATT&CK T1684.001)
• Detecting and Mitigating Email Spoofing (MITRE ATT&CK T1684.002)
• Detecting and Mitigating Disable or Modify Tools (MITRE ATT&CK T1685)
• Detecting Disabled or Modified Windows Event Log (T1685.001)
• Detecting Disable or Modify Cloud Log (MITRE ATT&CK T1685.002)
• Detecting Modified or Spoofed Security Tool UI (MITRE ATT&CK T1685.003)
• Detecting Disabled or Modified Linux Audit System (T1685.004)
• Detecting Cleared Windows Event Logs (MITRE ATT&CK T1685.005)
• Detecting Cleared Linux or macOS System Logs (MITRE ATT&CK T1685.006)
• Impair Autonomous Defenses: Prompt Tricks in Malware (T1685.007)
• Detecting and Mitigating Firewall Tampering (T1686)
• Detecting Cloud Firewall Tampering (T1686.001)
• Detecting Network Device Firewall Changes (T1686.002)
• Detecting Windows Host Firewall Tampering (T1686.003)
• Detecting Exploitation for Defense Impairment (T1687)
• Detecting and Mitigating Safe Mode Boot Abuse (T1688)
• Detecting and Preventing Downgrade Attacks (T1689)
• Detecting Prevented Command History Logging (T1690)
• Anti-Automation Evasion and CAPTCHA Abuse (T1696)
• Automate CAPTCHA Completion Defenses (T1696.001)
• Avoid CAPTCHA: Spotting Human-Mimicking Bots (T1696.002)
• Steal Application Specific Passwords and MFA Bypass (T1697)
• Defending AI Agents From Indirect Prompt Injection (T1698)
• Direct Prompt Injection: Controls for AI Systems (T1699)
• Stopping AI-Enabled Exfiltration by Enterprise Agents (T1700)

Frequently asked questions

Last reviewed: 19 October 2026.