MITRE ATT&CK Enterprise techniques whose primary tactic is Defense Impairment: detection with open-source tooling and cyber range exercises.
Detecting T1112 Modify Registry on Windows, using telemetry such as Process Creation and Windows Registry Key Modification. Covers the ATT&CK mitigation Restrict Registry Permissions and how to rehearse the detection in a cyber range.
Detecting T1207 Rogue Domain Controller on Windows, using telemetry such as Network Traffic Content, Active Directory Object Modification and Active Directory Object Creation. Covers how to rehearse the detection in a cyber range.
Detecting T1222 File and Directory Permissions Modification on ESXi, Linux, macOS and Windows, using telemetry such as Command Execution, Process Creation and Active Directory Object Modification. Covers its 2 sub-techniques, the ATT&CK mitigations Privileged Account Management and Restrict File and Directory Permissions, and how to rehearse the detection in a cyber range.
Detecting T1484 Domain or Tenant Policy Modification on Windows and Identity Provider, using telemetry such as Process Creation, File Modification and Application Log Content. Covers its 2 sub-techniques, the ATT&CK mitigations Privileged Account Management and Audit, and how to rehearse the detection in a cyber range.
Detecting T1553 Subvert Trust Controls on Linux, macOS and Windows, using telemetry such as Command Execution, Process Creation and Windows Registry Key Modification. Covers its 6 sub-techniques, the ATT&CK mitigations Privileged Account Management and Software Configuration, and how to rehearse the detection in a cyber range.
Detecting T1556 Modify Authentication Process on IaaS, Identity Provider, Linux and macOS and other platforms, using telemetry such as Process Creation, File Modification and Windows Registry Key Modification. Covers its 9 sub-techniques, the ATT&CK mitigations Privileged Account Management and Audit, and how to rehearse the detection in a cyber range.
Detecting T1578 Modify Cloud Compute Infrastructure on IaaS, using telemetry such as Snapshot Deletion, Snapshot Creation and Cloud Service Metadata. Covers its 5 sub-techniques, the ATT&CK mitigations Audit and User Account Management, and how to rehearse the detection in a cyber range.
Detecting T1599 Network Boundary Bridging on Network Devices, using telemetry such as Network Traffic Content and Network Traffic Flow. Covers its 1 sub-technique, the ATT&CK mitigations Privileged Account Management and Multi-factor Authentication, and how to rehearse the detection in a cyber range.
Detecting T1600 Weaken Encryption on Network Devices, using telemetry such as File Modification, Network Traffic Content and Module Load. Covers its 2 sub-techniques and how to rehearse the detection in a cyber range.
Detecting T1601 Modify System Image on Network Devices, using telemetry such as Command Execution and File Modification. Covers its 2 sub-techniques, the ATT&CK mitigations Privileged Account Management and Multi-factor Authentication, and how to rehearse the detection in a cyber range.
Detecting T1647 Plist File Modification on macOS, using telemetry such as Command Execution, Process Creation and File Modification. Covers the ATT&CK mitigation Application Developer Guidance and how to rehearse the detection in a cyber range.
Detecting T1666 Modify Cloud Resource Hierarchy on IaaS, using telemetry such as Cloud Service Modification. Covers the ATT&CK mitigations Audit and User Account Management and how to rehearse the detection in a cyber range.
Detecting T1685 Disable or Modify Tools on Containers, ESXi, IaaS and Linux and other platforms, using telemetry such as Command Execution, Process Creation and Windows Registry Key Modification. Covers its 7 sub-techniques, the ATT&CK mitigations Audit and User Account Management, and how to rehearse the detection in a cyber range.
Detecting T1686 Disable or Modify System Firewall on ESXi, Linux, macOS and Network Devices and other platforms, using telemetry such as Command Execution, Process Creation and Windows Registry Key Modification. Covers its 3 sub-techniques, the ATT&CK mitigations Audit and User Account Management, and how to rehearse the detection in a cyber range.
Detecting T1687 Exploitation for Defense Impairment on IaaS, Linux, macOS and SaaS and other platforms, using telemetry such as Command Execution, Process Creation and Application Log Content. Covers how to rehearse the detection in a cyber range.
Detecting T1688 Safe Mode Boot on Windows, using telemetry such as Process Creation, Windows Registry Key Modification and Windows Registry Key Creation. Covers the ATT&CK mitigations Privileged Account Management and Software Configuration and how to rehearse the detection in a cyber range.
Detecting T1689 Downgrade Attack on macOS, Windows and Linux, using telemetry such as Command Execution, Process Creation and Windows Registry Key Modification. Covers the ATT&CK mitigations Software Configuration and Disable or Remove Feature or Program and how to rehearse the detection in a cyber range.
Detecting T1690 Prevent Command History Logging on ESXi, Linux, macOS and Network Devices and other platforms, using telemetry such as Command Execution and Process Creation. Covers the ATT&CK mitigations Operating System Configuration and Environment Variable Permissions and how to rehearse the detection in a cyber range.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.