Detection & response
Turn logs and intelligence into investigations and a coordinated response.
Abuse Elevation Control Mechanism
Elevation-control abuse bypasses or misuses mechanisms governing privileged execution.
Access Token Manipulation
Access token manipulation changes or adopts operating-system security contexts.
Account Manipulation
Account manipulation changes identity settings to preserve or expand access.
Alert triage
Decide what the signal means, how urgent it is, and who owns the next step.
Application security logging
Application security logging records meaningful decisions and events that infrastructure logs cannot fully explain.
Archive Collected Data
Archiving collected data packages information for easier staging or transfer.
Audio Capture
Audio capture records conversations or other sound available through an accessed device or application.
Automated Collection
Automated collection repeatedly gathers internal information according to rules or triggers.
BITS Jobs
BITS job abuse uses Windows background transfer functionality for unauthorized transfers or recurring activity.
Boot or Logon Autostart Execution
Boot or logon autostart execution runs a program when a system starts or a user signs in.
Boot or Logon Initialization Scripts
Boot and logon initialization scripts can establish repeatable execution when a machine starts or a user signs in.
Browser Session Hijacking
Browser session hijacking interferes with an active browser session or its content.
Build Image on Host
Building an image on a host creates a workload artifact locally rather than retrieving the completed image from a registry.
Clipboard Data
Clipboard collection captures information users copy between applications.
Cloud audit logs
Control-plane and data-plane records answer different questions.
Cloud incident response
Investigate identities, APIs, and delegated access as well as workloads.
Command and Scripting Interpreter
Interpreter abuse runs commands through shells and scripting environments already available on a host.
Compromise Host Software Binary
Host software binary compromise replaces or modifies an existing executable to retain access or introduce unauthorized behavior.
Container Administration Command
Container administration abuse uses management interfaces to run commands inside workloads.
Create Account
Unauthorized account creation establishes a new identity that can retain access independently of the original compromised credential.
Create or Modify System Process
Creating or modifying a system process establishes execution through services or daemons.
Data exfiltration
Distinguish accessing, staging, and transferring information.
Data from Cloud Storage
Collection from cloud storage reads information through managed storage services.
Data from Configuration Repository
Configuration repository collection retrieves management data that can reveal device settings, relationships, or secrets.
Data from Information Repositories
Collection from information repositories targets collaboration and knowledge systems where organizations accumulate valuable material.
Data from Local System
Collection from a local system gathers information available on the compromised host.
Data from Network Shared Drive
Collection from network shared drives accesses information on remote file resources.
Data from Removable Media
Collection from removable media targets information available on attached storage.
Data Staged
Data staging collects information in a location convenient for later transfer.
Deobfuscate/Decode Files or Information
Deobfuscation restores transformed content so it can be used during an operation.
Deploy Container
Unauthorized container deployment introduces a new workload through orchestration or runtime authority.
Detection engineering
Build and test signals that lead to useful investigations.
Direct Volume Access
Direct volume access reads storage below ordinary file access paths.
Domain or Tenant Policy Modification
Domain or tenant policy modification alters centralized identity and security settings.
Email Collection
Email collection accesses messages or mailbox data that may contain sensitive business and recovery information.
Endpoint detection and response
Investigate host behavior and apply controlled response actions.
Eradication and recovery
Remove the causes and surviving access before restoring trustworthy service.
Escape to Host
Container escape crosses the intended workload-to-host boundary.
Evaluating information sources
Know where a claim came from and what it can actually support.
Event Triggered Execution
Event-triggered execution connects code to a system or application event.
Execution Guardrails
Execution guardrails make a payload run only when selected environmental conditions are met.
Exploit Public-Facing Application
Exploitation of a public-facing application turns a reachable weakness into an initial access path.
Exploitation for Client Execution
Client application exploitation uses a vulnerability in software that processes content on an endpoint.
Exploitation for Privilege Escalation
Privilege-escalation exploitation uses a vulnerability to gain authority beyond the initial execution context.
Exploitation for Stealth
Exploitation for stealth targets weaknesses that help an actor avoid visibility or hide access.
Exploitation of Remote Services
Remote service exploitation uses a vulnerability in another reachable system after access to the environment.
External Remote Services
External remote service abuse uses internet-accessible access mechanisms to obtain or retain internal access.
File and Directory Permissions Modification
Permission modification changes file or directory access rules to enable unauthorized activity.
Hardware Additions
Hardware additions introduce devices that can create an unauthorized access or collection path.
Hide Artifacts
Artifact hiding uses system features or configuration to make activity less visible.
Hijack Execution Flow
Execution-flow hijacking changes how an operating system or application selects code to run.
Implant Internal Image
Implanting an internal image introduces malicious content into reusable cloud or container images.
Incident containment
Limit the attacker’s access and the harm while preserving investigation options.
Incident playbooks
Turn a recurring incident pattern into an adaptable response guide.
Incident reporting and handover
Separate facts, judgments, unknowns, and recommendations.
Incident response
Follow an account-compromise example to understand investigation, containment, recovery, communication, and incident ownership.
Indicator Removal
Indicator removal selectively changes or deletes traces of activity.
Indicators of compromise
A technical clue becomes useful when its context and confidence are known.
Indirect Command Execution
Indirect command execution uses a utility as an intermediary to run instructions.
Inter-Process Communication
Inter-process communication abuse uses interfaces between local applications to trigger unauthorized operations.
Internal Spearphishing
Internal spearphishing sends deceptive messages through already-accessed internal accounts or systems.
Lateral movement
A foothold may become access to additional systems or identities.
Lateral Tool Transfer
Lateral tool transfer copies files between systems already inside an accessed environment.
Log correlation
Join events using trustworthy identifiers, time, and semantics.
Logs and telemetry
Records support investigation only when you know what they represent.
Masquerading
Masquerading makes an artifact appear legitimate through names, locations, metadata, or presentation.
MITRE ATT&CK
Use a shared vocabulary for adversary behavior and defensive coverage.
Modify Authentication Process
Authentication-process modification alters how a system verifies identities or handles credentials.
Modify Cloud Compute Infrastructure
Cloud compute modification changes infrastructure to enable access or reduce visibility.
Modify Registry
Registry modification changes Windows settings that can affect startup, security, or application behavior.
Modify System Image
System-image modification alters embedded or network-device operating software.
Native API
Native API abuse uses operating-system interfaces to perform unauthorized operations.
Network Boundary Bridging
Network boundary bridging abuses devices or relationships that separate network segments.
Obfuscated Files or Information
File and information obfuscation changes how a payload or its content appears to analysis tools.
Office Application Startup
Office application startup mechanisms can trigger code when the application launches or specific features load.
Open-source intelligence
Analyze publicly accessible information with source and privacy discipline.
Persistence
Look for access that survives the first cleanup action.
Pre-OS Boot
Pre-operating-system persistence runs through firmware or startup components before ordinary operating-system controls.
Process Injection
Process injection executes code inside another running process.
Remote Service Session Hijacking
Remote-session hijacking takes over an already-established access session.
Remote Services
Remote service abuse uses management or access services to reach another system.
Replication Through Removable Media
Removable-media replication carries malicious content between systems through attached storage.
Rogue Domain Controller
A rogue domain controller introduces unauthorized directory replication or control relationships.
Rootkit
Rootkits conceal activity by interfering with visibility at privileged layers.
Scheduled Task/Job
Scheduled task abuse uses operating-system scheduling to run code once or repeatedly.
Screen Capture
Screen capture collects what is visible on a user's display.
Security information and event management
Centralize records and detection workflows without confusing collection with certainty.
Security operations centers
A team and operating model for finding and responding to security problems.
Security operations metrics
Measure detection and response without rewarding the wrong behavior.
Security orchestration and automation
Connect tools and automate defined steps with boundaries and auditability.
Server Software Component
Server component abuse places unauthorized behavior inside an extensible server feature.
Shared Modules
Shared-module abuse loads malicious code into another application's process.
SOC roles and escalation
Match the case to the right expertise and authority.
Software Deployment Tools
Software deployment tool abuse turns centralized management authority into execution across many systems.
Software Extensions
Software extension abuse introduces persistent or privileged behavior through plugins that users and applications may trust.
Subvert Trust Controls
Trust-control subversion changes mechanisms that warn about or block untrusted content.
Supply Chain Compromise
Supply chain compromise introduces malicious changes before software or products reach consumers.
System Binary Proxy Execution
System binary proxy execution uses a trusted executable to run untrusted content.
System Script Proxy Execution
System script proxy execution uses trusted scripts as intermediaries for untrusted behavior.
System Services
System service execution runs code through operating-system service mechanisms.
Showing 100 of 115 matching notes