MITRE ATT&CK Enterprise techniques whose primary tactic is Command and Control: detection with open-source tooling and cyber range exercises.
Detecting T1001 Data Obfuscation on ESXi, Linux, macOS and Windows, using telemetry such as Network Connection Creation, Process Creation and Network Traffic Content. Covers its 3 sub-techniques, the ATT&CK mitigation Network Intrusion Prevention, and how to rehearse the detection in a cyber range.
Detecting T1008 Fallback Channels on ESXi, Linux, macOS and Windows, using telemetry such as Network Connection Creation and Network Traffic Flow. Covers the ATT&CK mitigation Network Intrusion Prevention and how to rehearse the detection in a cyber range.
Detecting T1071 Application Layer Protocol on Linux, macOS, Windows and Network Devices and other platforms, using telemetry such as Network Connection Creation, Process Creation and Network Traffic Flow. Covers its 5 sub-techniques, the ATT&CK mitigations Network Intrusion Prevention and Filter Network Traffic, and how to rehearse the detection in a cyber range.
Detecting T1090 Proxy on ESXi, Linux, macOS and Network Devices and other platforms, using telemetry such as Network Connection Creation, Process Creation and Network Traffic Flow. Covers its 4 sub-techniques, the ATT&CK mitigations Network Intrusion Prevention and Filter Network Traffic, and how to rehearse the detection in a cyber range.
Detecting T1092 Communication Through Removable Media on Linux, macOS and Windows, using telemetry such as Process Creation, File Creation and Drive Creation. Covers the ATT&CK mitigations Disable or Remove Feature or Program and Operating System Configuration and how to rehearse the detection in a cyber range.
Detecting T1095 Non-Application Layer Protocol on ESXi, Linux, macOS and Network Devices and other platforms, using telemetry such as Network Connection Creation, Network Traffic Flow and Network Traffic Content. Covers the ATT&CK mitigations Network Intrusion Prevention and Filter Network Traffic and how to rehearse the detection in a cyber range.
Detecting T1102 Web Service on ESXi, Linux, macOS and Windows, using telemetry such as Network Connection Creation, Network Traffic Flow and Network Traffic Content. Covers its 3 sub-techniques, the ATT&CK mitigations Network Intrusion Prevention and Restrict Web-Based Content, and how to rehearse the detection in a cyber range.
Detecting T1104 Multi-Stage Channels on Linux, macOS, Windows and ESXi, using telemetry such as Network Connection Creation, Process Creation and Network Traffic Flow. Covers the ATT&CK mitigation Network Intrusion Prevention and how to rehearse the detection in a cyber range.
Detecting T1105 Ingress Tool Transfer on ESXi, Linux, macOS and Network Devices and other platforms, using telemetry such as Network Connection Creation, Process Creation and Network Traffic Flow. Covers the ATT&CK mitigations Network Intrusion Prevention and Filter Network Traffic and how to rehearse the detection in a cyber range.
Detecting T1132 Data Encoding on ESXi, Linux, macOS and Windows, using telemetry such as Network Connection Creation, Process Creation and Network Traffic Content. Covers its 2 sub-techniques, the ATT&CK mitigation Network Intrusion Prevention, and how to rehearse the detection in a cyber range.
Detecting T1219 Remote Access Tools on Linux, macOS and Windows, using telemetry such as Network Connection Creation, Process Creation and File Creation. Covers its 3 sub-techniques, the ATT&CK mitigations Network Intrusion Prevention and Filter Network Traffic, and how to rehearse the detection in a cyber range.
Detecting T1568 Dynamic Resolution on ESXi, Linux, macOS and Windows, using telemetry such as Network Connection Creation, Process Creation and Network Traffic Flow. Covers its 3 sub-techniques, the ATT&CK mitigations Network Intrusion Prevention and Restrict Web-Based Content, and how to rehearse the detection in a cyber range.
Detecting T1571 Non-Standard Port on ESXi, Linux, macOS and Windows, using telemetry such as Network Connection Creation, Process Creation and Network Traffic Flow. Covers the ATT&CK mitigations Network Intrusion Prevention and Network Segmentation and how to rehearse the detection in a cyber range.
Detecting T1572 Protocol Tunneling on ESXi, Linux, macOS and Windows, using telemetry such as Network Connection Creation, Process Creation and Network Traffic Flow. Covers the ATT&CK mitigations Network Intrusion Prevention and Filter Network Traffic and how to rehearse the detection in a cyber range.
Detecting T1573 Encrypted Channel on ESXi, Linux, macOS and Network Devices and other platforms, using telemetry such as Network Connection Creation, Process Creation and Network Traffic Flow. Covers its 2 sub-techniques, the ATT&CK mitigations Network Intrusion Prevention and SSL/TLS Inspection, and how to rehearse the detection in a cyber range.
Detecting T1665 Hide Infrastructure on ESXi, Linux, macOS and Network Devices and other platforms, using telemetry such as Network Connection Creation, Process Creation and Network Traffic Content. Covers how to rehearse the detection in a cyber range.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.