MITRE ATT&CK®
Corelight’s coverage includes comprehensive approaches to uncover over 100 techniques, with exceptional visibility into adversary methods used for Defense Evasion, Credential Access, Discovery, and Command and Control.
| Initial access | Defense impairment | Credential access | Discovery | Lateral movement | C2 | Stealth |
|---|---|---|---|---|---|---|
| Content Injection | Domain or Tenant Policy Modification |
Adversary-in-the-Middle | Account Discovery | Exploitation of Remote Services |
Application Layer Protocol |
Access Token Manipulation |
| Drive-by Compromise | File and Directory Permissions Modification |
Brute Force | Cloud Infrastructure Discovery |
Internal Spearphishing | Content Injection | BITS Jobs |
| Exploit Public- Facing Application |
Modify Authentication Process |
Credentials from Password Stores |
Cloud Service Dashboard |
Lateral Tool Transfer | Data Encoding | Build Image on Host |
| External Remote Services |
Modify Cloud Compute Infrastructure |
Exploitation for Credential Access |
Cloud Service Discovery | Remote Service Session Hijacking |
Data Obfuscation | Delay Execution |
| Hardware Additions | Modify Cloud Resource Hierarchy |
Forced Authentication | Cloud Storage Object Discovery |
Remote Services | Dynamic Resolution | Execution Guardrails |
| Phishing | Modify Registry | Input Capture | Container and Resource Discovery |
Software Deployment Tools |
Encrypted Channel | Exploitation for Stealth |
| Supply Chain Compromise |
Modify System Image | Modify Authentication Processes |
Domain Trust Discovery | Taint Shared Content | Fallback Channels | Hide Artifacts |
| Trusted Relationship | Network Boundary Bridging |
Multi-Factor Authentication Interception |
File and Directory Discovery |
User Alternate Authentication Material |
Hide Infrastructure | Hijack Execution Flow |
| Valid Accounts | Rogue Domain Controller |
Multi-Factor Request Generation |
Group Policy Discovery | Ingress Tool Transfer | Indicator Removal | |
| Wi-Fi Networks | Subvert Trust Controls | OS Credential Dumping | Local Storage Discovery | Multi-Stage Channels | Indirect Command Execution |
|
| Steal Application Access Token |
Log Enumeration | Non-Application Layer Protocol |
Masquerading | |||
| Steal or Forge Authentication Certificates |
Network Service Discovery |
Non-Standard Port | Obfuscated Files or Information |
|||
| Steal or Forge Kerberos Tickets |
Network Share Discovery |
Protocol Tunneling | Pre-OS Boot | |||
| Steal Web Session Cookie |
Password Policy Discovery |
Proxy | System Binary Proxy Execution |
|||
| Unsecured Credentials | Permission Groups Discovery |
Remote Access Tools | System Script Proxy Execution |
|||
| Process Discovery | Traffic Signaling | Template Injection | ||||
| Query Registry | Web Service | Traffic Signaling | ||||
| Remote System Discovery |
Trusted Developer Utilities Proxy Execution |
|||||
| Software Discovery | Unused/Unsupported Cloud Regions |
|||||
| System Information Discovery |
Valid Accounts | |||||
| System Location Discovery |
Virtualization/ Sandbox Evasion |
|||||
| System Network Configuration Discovery |
XSL Script Processing | |||||
| System Network Connections Discovery |
||||||
| System Owner/ User Discovery |
||||||
| System Service Discovery |
||||||
| System Time Discovery | ||||||
| Virtual Machine Discovery |
||||||
| Virtualization/ Sandbox Evasion |
Initial access
- Content Injection
- Drive-by Compromise
- Exploit Public-
Facing Application - External Remote
Services - Hardware Additions
- Phishing
- Supply Chain
Compromise - Trusted Relationship
- Valid Accounts
- Wi-Fi Networks
Defense impairment
- Domain or Tenant
Policy Modification - File and Directory
Permissions Modification - Modify Authentication
Process - Modify Cloud
Compute Infrastructure - Modify Cloud
Resource Hierarchy - Modify Registry
- Modify System Image
- Network Boundary
Bridging - Rogue Domain
Controller - Subvert Trust Controls
Credential access
- Adversary-in-the-Middle
- Brute Force
- Credentials from
Password Stores - Exploitation for
Credential Access - Forced Authentication
- Input Capture
- Modify Authentication
Processes - Multi-Factor
Authentication
Interception - Multi-Factor
Request Generation - OS Credential Dumping
- Steal Application
Access Token - Steal or Forge
Authentication
Certificates - Steal or Forge
Kerberos Tickets - Steal Web
Session Cookie - Unsecured Credentials
Discovery
- Account Discovery
- Cloud Infrastructure
Discovery - Cloud Service
Dashboard - Cloud Service Discovery
- Cloud Storage
Object Discovery - Container and
Resource Discovery - Domain Trust Discovery
- File and
Directory Discovery - Group Policy Discovery
- Local Storage Discovery
- Log Enumeration
- Network Service
Discovery - Network Share
Discovery - Password Policy
Discovery - Permission
Groups Discovery - Process Discovery
- Query Registry
- Remote System
Discovery - Software Discovery
- System Information
Discovery - System Location
Discovery - System Network
Configuration Discovery - System Network
Connections Discovery - System Owner/
User Discovery - System Service
Discovery - System Time Discovery
- Virtual Machine
Discovery - Virtualization/
Sandbox Evasion
Lateral movement
- Exploitation of
Remote Services - Internal Spearphishing
- Lateral Tool Transfer
- Remote Service
Session Hijacking - Remote Services
- Software
Deployment Tools - Taint Shared Content
- User Alternate
Authentication Material
C2
- Application Layer
Protocol - Content Injection
- Data Encoding
- Data Obfuscation
- Dynamic Resolution
- Encrypted Channel
- Fallback Channels
- Hide Infrastructure
- Ingress Tool Transfer
- Multi-Stage Channels
- Non-Application
Layer Protocol - Non-Standard Port
- Protocol Tunneling
- Proxy
- Remote Access Tools
- Traffic Signaling
- Web Service
Stealth
- Access Token
Manipulation - BITS Jobs
- Build Image on Host
- Delay Execution
- Execution Guardrails
- Exploitation for Stealth
- Hide Artifacts
- Hijack Execution Flow
- Indicator Removal
- Indirect Command
Execution - Masquerading
- Obfuscated Files
or Information - Pre-OS Boot
- System Binary
Proxy Execution - System Script
Proxy Execution - Template Injection
- Traffic Signaling
- Trusted Developer
Utilities Proxy Execution - Unused/Unsupported
Cloud Regions - Valid Accounts
- Virtualization/
Sandbox Evasion - XSL Script Processing
Additional areas of coverage:
| Reconnaissance | Execution | Persistence | Privilege Escalation | Collection | Exfiltration | Impact | Resource Development |
|---|---|---|---|---|---|---|---|
| Active Scanning | Cloud Administration Command |
Account Manipulation | Abuse Elevation Control Mechanism |
Adversary-in-the-Middle | Automated Exfiltration | Account Access Removal | Compromise Accounts |
| Gather Victim Host Information |
Command and Scripting Interpreter |
BITS Jobs | Access Token Manipulation |
Archive Collected Data | Data Transfer Size Limits |
Data Destruction | Develop Capabilities |
| Gather Victim Identity Information |
Container Administration Command |
Boot or Logon Autostart Execution |
Account Manipulation | Automated Collection | Exfiltration Over Alternative Protocol |
Data Encrypted for Impact |
|
| Gather Victim Network Information |
Deploy Container | Boot or Logon Initialization Scripts |
Boot or Logon Autostart Execution |
Browser Session Hijacking |
Exfiltration Over C2 Channel |
Data Manipulation | |
| Gather Victim Org Information |
ESXi Administration Command |
Cloud Application Integration |
Boot or Logon Initialization |
Data from Cloud Storage |
Exfiltration Over Other Network Medium |
Defacement | |
| Phishing for Information | Exploitation for Client Execution |
Create Account | Create or Modify System Process |
Data from Configuration Repository |
Exfiltration Over Web Service |
Disk Wipe | |
| Query Public AI Services | Inter-Process Communication |
Create or Modify System Process |
Domain or Tenant Policy Modification |
Data from Information Repositories |
Transfer Data to Cloud Account |
Email Bombing | |
| Search Open Technical Databases |
Poisoned Pipeline Execution |
Event Triggered Execution |
Escape to Host | Data from Local System | Endpoint Denial of Service |
||
| Search Open Websites/Domains |
Scheduled Task/Job | Exclusive Control | Event Triggered Execution |
Data from Network Shared Drive |
Financial Theft | ||
| Search Threat Vendor Data |
Serverless Execution | External Remote Services |
Process Injection | Data Staged | Firmware Corruption | ||
| Search Victim- Owned Websites |
Shared Modules | Implant Internal Image | Scheduled Task/Job | Email Collection | Inhibit System Recovery | ||
| Software Deployment Tools |
Modify Authentication Process |
Valid Accounts | Input Capture | Network Denial of Service |
|||
| System Services | Modify Registry | Resource Hijacking | |||||
| User Execution | Office Application Startup |
Service Stop | |||||
| Windows Management Instrumentation |
Pre-OS Boot | System Shutdown | |||||
| Scheduled Task/Job | |||||||
| Server Software Component |
|||||||
| Software Extensions | |||||||
| Traffic Signaling | |||||||
| Valid Accounts |
Reconnaissance
- Active Scanning
- Gather Victim
Host Information - Gather Victim
Identity Information - Gather Victim
Network Information - Gather Victim
Org Information - Phishing for Information
- Query Public AI Services
- Search Open
Technical Databases - Search Open
Websites/Domains - Search Threat
Vendor Data - Search Victim-
Owned Websites
Execution
- Cloud Administration
Command - Command and
Scripting Interpreter - Container
Administration
Command - Deploy Container
- ESXi Administration
Command - Exploitation for
Client Execution - Inter-Process
Communication - Poisoned Pipeline
Execution - Scheduled Task/Job
- Serverless Execution
- Shared Modules
- Software
Deployment Tools - System Services
- User Execution
- Windows Management
Instrumentation
Persistence
- Account Manipulation
- BITS Jobs
- Boot or Logon
Autostart Execution - Boot or Logon
Initialization Scripts - Cloud Application
Integration - Create Account
- Create or Modify
System Process - Event Triggered
Execution - Exclusive Control
- External Remote
Services - Implant Internal Image
- Modify Authentication
Process - Modify Registry
- Office Application
Startup - Pre-OS Boot
- Scheduled Task/Job
- Server Software
Component - Software Extensions
- Traffic Signaling
- Valid Accounts
Privilege Escalation
- Abuse Elevation
Control Mechanism - Access Token
Manipulation - Account Manipulation
- Boot or Logon
Autostart Execution - Boot or
Logon Initialization - Create or Modify
System Process - Domain or Tenant
Policy Modification - Escape to Host
- Event Triggered
Execution - Process Injection
- Scheduled Task/Job
- Valid Accounts
Collection
- Adversary-in-the-Middle
- Archive Collected Data
- Automated Collection
- Browser Session
Hijacking - Data from
Cloud Storage - Data from
Configuration Repository - Data from
Information Repositories - Data from Local System
- Data from Network
Shared Drive - Data Staged
- Email Collection
- Input Capture
Exfiltration
- Automated Exfiltration
- Data Transfer
Size Limits - Exfiltration Over
Alternative Protocol - Exfiltration Over
C2 Channel - Exfiltration Over Other
Network Medium - Exfiltration Over
Web Service - Transfer Data to
Cloud Account
Impact
- Account Access Removal
- Data Destruction
- Data Encrypted
for Impact - Data Manipulation
- Defacement
- Disk Wipe
- Email Bombing
- Endpoint Denial
of Service - Financial Theft
- Firmware Corruption
- Inhibit System Recovery
- Network Denial
of Service - Resource Hijacking
- Service Stop
- System Shutdown
Resource Development
- Compromise Accounts
- Develop Capabilities
Corelight’s MITRE ATT&CK approach
Corelight drives broad coverage across the MITRE ATT&CK TTPs using an approach focused on visibility and explainable, evidence-based analytics. The foundation of this approach is Zeek® network telemetry, data that captures activity across a broad set of network protocols and fuels advanced analytics. With these analytics, Corelight provides machine learning models, behavioral alerts, and Suricata-based IDS and SIEM rules to detect the relevant ATT&CK tactics, techniques, and procedures. Corelight’s Open NDR Platform allows you to build your own detection content or use community contributions such as MITRE’s BZAR package.
