Threats Consequences Barriers

Threats Library

Reusable threat definitions (causes on the left side of bow-tie diagrams).

Add Threat

Tags: clear tags
Clear all
658 threats — page 1 of 14
Name Category Tags Description
Archive Collected Data Collection
mitre-attack T1560
An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing t… Edit
Archive Collected Data: Archive via Custom Method Collection
mitre-attack T1560.003
An adversary may compress or encrypt data that is collected prior to exfiltration using a custom met… Edit
Archive Collected Data: Archive via Library Collection
mitre-attack T1560.002
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party li… Edit
Archive Collected Data: Archive via Utility Collection
mitre-attack T1560.001
Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many … Edit
Audio Capture Collection
mitre-attack T1123
An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applica… Edit
Automated Collection Collection
mitre-attack T1119
Once established within a system or network, an adversary may use automated techniques for collectin… Edit
Browser Session Hijacking Collection
mitre-attack T1185
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser sof… Edit
Clipboard Data Collection
mitre-attack T1115
Adversaries may collect data stored in the clipboard from users copying information within or betwee… Edit
Data Staged Collection
mitre-attack T1074
Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data … Edit
Data Staged: Local Data Staging Collection
mitre-attack T1074.001
Adversaries may stage collected data in a central location or directory on the local system prior to… Edit
Data Staged: Remote Data Staging Collection
mitre-attack T1074.002
Adversaries may stage data collected from multiple systems in a central location or directory on one… Edit
Data from Cloud Storage Collection
mitre-attack T1530
Adversaries may access data from cloud storage. Many IaaS providers offer solutions for online data … Edit
Data from Configuration Repository Collection
mitre-attack T1602
Adversaries may collect data related to managed devices from configuration repositories. Configurati… Edit
Data from Configuration Repository: Network Device Configuration Dump Collection
mitre-attack T1602.002
Adversaries may access network configuration files to collect sensitive data about the device and th… Edit
Data from Configuration Repository: SNMP (MIB Dump) Collection
mitre-attack T1602.001
Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable informa… Edit
Data from Information Repositories Collection
mitre-attack T1213
Adversaries may leverage information repositories to mine valuable information. Information reposito… Edit
Data from Information Repositories: Code Repositories Collection
mitre-attack T1213.003
Adversaries may leverage code repositories to collect valuable information. Code repositories are to… Edit
Data from Information Repositories: Confluence Collection
mitre-attack T1213.001
Adversaries may leverage Confluence repositories to mine valuable information. Often found in develo… Edit
Data from Information Repositories: Customer Relationship Management Software Collection
mitre-attack T1213.004
Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable informatio… Edit
Data from Information Repositories: Databases Collection
mitre-attack T1213.006
Adversaries may leverage databases to mine valuable information. These databases may be hosted on-pr… Edit
Data from Information Repositories: Messaging Applications Collection
mitre-attack T1213.005
Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and … Edit
Data from Information Repositories: Sharepoint Collection
mitre-attack T1213.002
Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePo… Edit
Data from Local System Collection
mitre-attack T1005
Adversaries may search local system sources, such as file systems, configuration files, local databa… Edit
Data from Network Shared Drive Collection
mitre-attack T1039
Adversaries may search network shares on computers they have compromised to find files of interest. … Edit
Data from Removable Media Collection
mitre-attack T1025
Adversaries may search connected removable media on computers they have compromised to find files of… Edit
Email Collection Collection
mitre-attack T1114
Adversaries may target user email to collect sensitive information. Emails may contain sensitive dat… Edit
Email Collection: Email Forwarding Rule Collection
mitre-attack T1114.003
Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse… Edit
Email Collection: Local Email Collection Collection
mitre-attack T1114.001
Adversaries may target user email on local systems to collect sensitive information. Files containin… Edit
Email Collection: Remote Email Collection Collection
mitre-attack T1114.002
Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive info… Edit
Input Capture Collection
mitre-attack T1056
Adversaries may use methods of capturing user input to obtain credentials or collect information. Du… Edit
Input Capture: Credential API Hooking Collection
mitre-attack T1056.004
Adversaries may hook into Windows application programming interface (API) functions and Linux system… Edit
Input Capture: GUI Input Capture Collection
mitre-attack T1056.002
Adversaries may mimic common operating system GUI components to prompt users for credentials with a … Edit
Input Capture: Keylogging Collection
mitre-attack T1056.001
Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is l… Edit
Input Capture: Web Portal Capture Collection
mitre-attack T1056.003
Adversaries may install code on externally facing portals, such as a VPN login page, to capture and … Edit
Screen Capture Collection
mitre-attack T1113
Adversaries may attempt to take screen captures of the desktop to gather information over the course… Edit
Video Capture Collection
mitre-attack T1125
An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or a… Edit
Application Layer Protocol Command And Control
mitre-attack T1071
Adversaries may communicate using OSI application layer protocols to avoid detection/network filteri… Edit
Application Layer Protocol: DNS Command And Control
mitre-attack T1071.004
Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid d… Edit
Application Layer Protocol: File Transfer Protocols Command And Control
mitre-attack T1071.002
Adversaries may communicate using application layer protocols associated with transferring files to … Edit
Application Layer Protocol: Mail Protocols Command And Control
mitre-attack T1071.003
Adversaries may communicate using application layer protocols associated with electronic mail delive… Edit
Application Layer Protocol: Publish/Subscribe Protocols Command And Control
mitre-attack T1071.005
Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid d… Edit
Application Layer Protocol: Web Protocols Command And Control
mitre-attack T1071.001
Adversaries may communicate using application layer protocols associated with web traffic to avoid d… Edit
Communication Through Removable Media Command And Control
mitre-attack T1092
Adversaries can perform command and control between compromised hosts on potentially disconnected ne… Edit
Data Encoding Command And Control
mitre-attack T1132
Adversaries may encode data to make the content of command and control traffic more difficult to det… Edit
Data Encoding: Non-Standard Encoding Command And Control
mitre-attack T1132.002
Adversaries may encode data with a non-standard data encoding system to make the content of command … Edit
Data Encoding: Standard Encoding Command And Control
mitre-attack T1132.001
Adversaries may encode data with a standard data encoding system to make the content of command and … Edit
Data Obfuscation Command And Control
mitre-attack T1001
Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command a… Edit
Data Obfuscation: Junk Data Command And Control
mitre-attack T1001.001
Adversaries may add junk data to protocols used for command and control to make detection more diffi… Edit
Data Obfuscation: Protocol or Service Impersonation Command And Control
mitre-attack T1001.003
Adversaries may impersonate legitimate protocols or web service traffic to disguise command and cont… Edit
Data Obfuscation: Steganography Command And Control
mitre-attack T1001.002
Adversaries may use steganographic techniques to hide command and control traffic to make detection … Edit
1 2 3 … 14 Next →

658 total