MITRE ATT&CK™ Framework

Visit our interactive MITRE ATT&CK navigator.

Corelight excels at spotting C2, Discovery, and more:

INITIAL ACCESS

Drive-by Compromise Exploit Public-Facing Application External Remote Services Phishing Valid Accounts

DEFENSE EVASION

Exploitation for Defense Evasion Hijack Execution Flow Indicator Removal on Host Masquerading Modify Authentication Process Modify Registry Process Injection Rogue Domain Controller Subvert Trust Controls Valid Accounts

CREDENTIAL ACCESS

Brute Force Credentials from Password Stores Forced Authentication Man-in-the-Middle Modify Authentication Processes OS Credential Dumping Steal or Forge Kerberos Tickets

DISCOVERY

Account Discovery Domain Trust Discovery File and Directory Discovery Network Service Scanning Network Share Discovery Password Policy Discovery Permission Groups Discovery Remote System Discovery System Information Discovery System Location Discovery System Location Discovery System Network Configuration Discovery System Network Connections DiscoverySystem Time Discovery

LATERAL MOVEMENT

Exploitation of Remote Services Lateral Tool Transfer Remote Service Session Hijacking Remote Services

Application Layer Protocol Data Encoding Dynamic Resolution Encrypted Channel Fallback Channels Ingress Tool Transfer Non-Application Layer Protocol Non-Standard Port Protocol Tunneling Proxy Web Service

Additional coverage

Reconnaissance

Active Scanning
Gather Victim Network Information
Search Open Technical Databases
Search Open Websites/Domains

Execution

Command and Scripting Interpreter
Inter-Process Communication
Scheduled Task/Job
System Services
User Execution
Windows Management Instrumentation

Persistence

Boot or Logon Autostart Execution
Create or Modify System Process
Event Triggered Execution
External Remote Services
Hijack Execution Flow
Modify Authentication Process
Office Application Startup
Scheduled Task/Job
Valid Accounts

Privilege Escalation

Boot or Logon Autostart Execution
Create or Modify System Process
Event Triggered Execution
External Remote Services
Hijack Execution Flow
Process Injection
Scheduled Task/Job
Valid Accounts

Collection

Archive Collected Data
Data from Local System
Data from Network Shared Drive
Data Staged
Man-in-the-Middle

Exfiltration

Automated Exfiltration
Data Transfer Size Limits
Exfiltration Over Alternative Protocol
Exfiltration Over C2 Channel
Exfiltration Over Web Service
Transfer Data to Cloud Account

Impact

Endpoint Denial of Service
Resource Hijacking

Corelight’s MITRE ATT&CK approach

Corelight drives broad coverage across the MITRE ATT&CK TTPs using an approach focused on visibility and explainable, evidence-based analytics. The foundation of this approach is Zeek® network telemetry, data that captures activity across a broad set of network protocols and fuels advanced analytics. With these analytics, Corelight provides machine learning models, behavioral alerts, and Suricata-based IDS and SIEM rules to detect the relevant ATT&CK tactics, techniques, and procedures. Corelight’s Open NDR Platform allows you to build your own detection content or use community contributions such as MITRE’s BZAR package.