Threats Consequences Barriers

Threats Library

Reusable threat definitions (causes on the left side of bow-tie diagrams).

Add Threat

Tags: clear tags
Clear all
658 threats — page 2 of 14
Name Category Tags Description
Dynamic Resolution Command And Control
mitre-attack T1568
Adversaries may dynamically establish connections to command and control infrastructure to evade com… Edit
Dynamic Resolution: DNS Calculation Command And Control
mitre-attack T1568.003
Adversaries may perform calculations on addresses returned in DNS results to determine which port an… Edit
Dynamic Resolution: Domain Generation Algorithms Command And Control
mitre-attack T1568.002
Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destinatio… Edit
Dynamic Resolution: Fast Flux DNS Command And Control
mitre-attack T1568.001
Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly c… Edit
Encrypted Channel Command And Control
mitre-attack T1573
Adversaries may employ an encryption algorithm to conceal command and control traffic rather than re… Edit
Encrypted Channel: Asymmetric Cryptography Command And Control
mitre-attack T1573.002
Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffi… Edit
Encrypted Channel: Symmetric Cryptography Command And Control
mitre-attack T1573.001
Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic… Edit
Fallback Channels Command And Control
mitre-attack T1008
Adversaries may use fallback or alternate communication channels if the primary channel is compromis… Edit
Hide Infrastructure Command And Control
mitre-attack T1665
Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastr… Edit
Ingress Tool Transfer Command And Control
mitre-attack T1105
Adversaries may transfer tools or other files from an external system into a compromised environment… Edit
Multi-Stage Channels Command And Control
mitre-attack T1104
Adversaries may create multiple stages for command and control that are employed under different con… Edit
Non-Application Layer Protocol Command And Control
mitre-attack T1095
Adversaries may use an OSI non-application layer protocol for communication between host and C2 serv… Edit
Non-Standard Port Command And Control
mitre-attack T1571
Adversaries may communicate using a protocol and port pairing that are typically not associated. For… Edit
Protocol Tunneling Command And Control
mitre-attack T1572
Adversaries may tunnel network communications to and from a victim system within a separate protocol… Edit
Proxy Command And Control
mitre-attack T1090
Adversaries may use a connection proxy to direct network traffic between systems or act as an interm… Edit
Proxy: Domain Fronting Command And Control
mitre-attack T1090.004
Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other serv… Edit
Proxy: External Proxy Command And Control
mitre-attack T1090.002
Adversaries may use an external proxy to act as an intermediary for network communications to a comm… Edit
Proxy: Internal Proxy Command And Control
mitre-attack T1090.001
Adversaries may use an internal proxy to direct command and control traffic between two or more syst… Edit
Proxy: Multi-hop Proxy Command And Control
mitre-attack T1090.003
Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typical… Edit
Remote Access Tools Command And Control
mitre-attack T1219
An adversary may use legitimate remote access tools to establish an interactive command and control … Edit
Remote Access Tools: IDE Tunneling Command And Control
mitre-attack T1219.001
Adversaries may abuse Integrated Development Environment (IDE) software with remote development feat… Edit
Remote Access Tools: Remote Access Hardware Command And Control
mitre-attack T1219.003
An adversary may use legitimate remote access hardware to establish an interactive command and contr… Edit
Remote Access Tools: Remote Desktop Software Command And Control
mitre-attack T1219.002
An adversary may use legitimate desktop support software to establish an interactive command and con… Edit
Web Service Command And Control
mitre-attack T1102
Adversaries may use an existing, legitimate external Web service as a means for relaying data to/fro… Edit
Web Service: Bidirectional Communication Command And Control
mitre-attack T1102.002
Adversaries may use an existing, legitimate external Web service as a means for sending commands to … Edit
Web Service: Dead Drop Resolver Command And Control
mitre-attack T1102.001
Adversaries may use an existing, legitimate external Web service to host information that points to … Edit
Web Service: One-Way Communication Command And Control
mitre-attack T1102.003
Adversaries may use an existing, legitimate external Web service as a means for sending commands to … Edit
Adversary-in-the-Middle Credential Access
mitre-attack T1557
Adversaries may attempt to position themselves between two or more networked devices using an advers… Edit
Adversary-in-the-Middle: ARP Cache Poisoning Credential Access
mitre-attack T1557.002
Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the c… Edit
Adversary-in-the-Middle: DHCP Spoofing Credential Access
mitre-attack T1557.003
Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configu… Edit
Adversary-in-the-Middle: Evil Twin Credential Access
mitre-attack T1557.004
Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malic… Edit
Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay Credential Access
mitre-attack T1557.001
By responding to LLMNR/NBT-NS network traffic, adversaries may spoof an authoritative source for nam… Edit
Brute Force Credential Access
mitre-attack T1110
Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or … Edit
Brute Force: Credential Stuffing Credential Access
mitre-attack T1110.004
Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to t… Edit
Brute Force: Password Cracking Credential Access
mitre-attack T1110.002
Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext pa… Edit
Brute Force: Password Guessing Credential Access
mitre-attack T1110.001
Adversaries with no prior knowledge of legitimate credentials within the system or environment may g… Edit
Brute Force: Password Spraying Credential Access
mitre-attack T1110.003
Adversaries may use a single or small list of commonly used passwords against many different account… Edit
Credentials from Password Stores Credential Access
mitre-attack T1555
Adversaries may search for common password storage locations to obtain user credentials. Passwords a… Edit
Credentials from Password Stores: Cloud Secrets Management Stores Credential Access
mitre-attack T1555.006
Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secret… Edit
Credentials from Password Stores: Credentials from Web Browsers Credential Access
mitre-attack T1555.003
Adversaries may acquire credentials from web browsers by reading files specific to the target browse… Edit
Credentials from Password Stores: Keychain Credential Access
mitre-attack T1555.001
Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS cred… Edit
Credentials from Password Stores: Password Managers Credential Access
mitre-attack T1555.005
Adversaries may acquire user credentials from third-party password managers. Password managers are a… Edit
Credentials from Password Stores: Securityd Memory Credential Access
mitre-attack T1555.002
An adversary with root access may gather credentials by reading securityd’s memory. securityd is a s… Edit
Credentials from Password Stores: Windows Credential Manager Credential Access
mitre-attack T1555.004
Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stor… Edit
Exploitation for Credential Access Credential Access
mitre-attack T1212
Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation … Edit
Forced Authentication Credential Access
mitre-attack T1187
Adversaries may gather credential material by invoking or forcing a user to automatically provide au… Edit
Forge Web Credentials Credential Access
mitre-attack T1606
Adversaries may forge credential materials that can be used to gain access to web applications or In… Edit
Forge Web Credentials: SAML Tokens Credential Access
mitre-attack T1606.002
An adversary may forge SAML tokens with any permissions claims and lifetimes if they possess a valid… Edit
Forge Web Credentials: Web Cookies Credential Access
mitre-attack T1606.001
Adversaries may forge web cookies that can be used to gain access to web applications or Internet se… Edit
Modify Authentication Process Credential Access
mitre-attack T1556
Adversaries may modify authentication mechanisms and processes to access user credentials or enable … Edit
← Prev 1 2 3 4 … 14 Next →

658 total