T1007 System service discovery
Detecting T1007 System Service Discovery on Linux, macOS and Windows, using telemetry such as Process Creation and Command Execution. Covers how to rehearse the detection in a cyber range.
Discovery
MITRE ATT&CK Enterprise techniques whose primary tactic is Discovery: detection with open-source tooling and cyber range exercises.
T1010 Application window discovery
Detecting T1010 Application Window Discovery on Linux, macOS and Windows, using telemetry such as Process Creation, Command Execution and OS API Execution. Covers how to rehearse the detection in a cyber range.
T1012 Query registry
Detecting T1012 Query Registry on Windows, using telemetry such as Process Creation, Command Execution and Windows Registry Key Modification. Covers how to rehearse the detection in a cyber range.
T1016 System network configuration discovery
Detecting T1016 System Network Configuration Discovery on ESXi, Linux, macOS and Network Devices and other platforms, using telemetry such as Process Creation and Command Execution. Covers its 2 sub-techniques and how to rehearse the detection in a cyber range.
T1018 Remote system discovery
Detecting T1018 Remote System Discovery on ESXi, Linux, macOS and Network Devices and other platforms, using telemetry such as Process Creation, Command Execution and File Access. Covers how to rehearse the detection in a cyber range.
T1033 System owner/user discovery
Detecting T1033 System Owner/User Discovery on Linux, macOS, Network Devices and Windows, using telemetry such as Process Creation, Command Execution and OS API Execution. Covers how to rehearse the detection in a cyber range.
T1046 Network service discovery
Detecting T1046 Network Service Discovery on Containers, IaaS, Linux and macOS and other platforms, using telemetry such as Process Creation, Network Traffic Content and Network Connection Creation. Covers the ATT&CK mitigations Network Segmentation and Network Intrusion Prevention and how to rehearse the detection in a cyber range.
T1049 System network connections discovery
Detecting T1049 System Network Connections Discovery on ESXi, IaaS, Linux and macOS and other platforms, using telemetry such as Process Creation, Command Execution and Network Traffic Content. Covers how to rehearse the detection in a cyber range.
T1057 Process discovery
Detecting T1057 Process Discovery on ESXi, Linux, macOS and Network Devices and other platforms, using telemetry such as Process Creation, Command Execution and File Access. Covers how to rehearse the detection in a cyber range.
T1069 Permission groups discovery
Detecting T1069 Permission Groups Discovery on Containers, IaaS, Identity Provider and Linux and other platforms, using telemetry such as Process Creation and Command Execution. Covers its 3 sub-techniques and how to rehearse the detection in a cyber range.
T1082 System information discovery
Detecting T1082 System Information Discovery on ESXi, IaaS, Linux and macOS and other platforms, using telemetry such as Process Creation, Command Execution and Windows Registry Key Modification. Covers how to rehearse the detection in a cyber range.
T1083 File and directory discovery
Detecting T1083 File and Directory Discovery on ESXi, Linux, macOS and Network Devices and other platforms, using telemetry such as Process Creation, Command Execution and File Access. Covers how to rehearse the detection in a cyber range.
T1087 Account discovery
Detecting T1087 Account Discovery on ESXi, IaaS, Identity Provider and Linux and other platforms, using telemetry such as Process Creation, Command Execution and File Access. Covers its 4 sub-techniques, the ATT&CK mitigations User Account Management and Operating System Configuration, and how to rehearse the detection in a cyber range.
T1120 Peripheral device discovery
Detecting T1120 Peripheral Device Discovery on Linux, macOS and Windows, using telemetry such as Process Creation, File Access and Process Access. Covers how to rehearse the detection in a cyber range.
T1124 System time discovery
Detecting T1124 System Time Discovery on ESXi, Linux, macOS and Network Devices and other platforms, using telemetry such as Process Creation, Command Execution and OS API Execution. Covers how to rehearse the detection in a cyber range.
T1135 Network share discovery
Detecting T1135 Network Share Discovery on Linux, macOS and Windows, using telemetry such as Process Creation, Command Execution and OS API Execution. Covers the ATT&CK mitigation Operating System Configuration and how to rehearse the detection in a cyber range.
T1201 Password policy discovery
Detecting T1201 Password Policy Discovery on Windows, Linux, macOS and IaaS and other platforms, using telemetry such as Process Creation, Command Execution and User Account Metadata. Covers the ATT&CK mitigation Password Policies and how to rehearse the detection in a cyber range.
T1217 Browser information discovery
Detecting T1217 Browser Information Discovery on Linux, macOS and Windows, using telemetry such as Process Creation, Command Execution and File Access. Covers how to rehearse the detection in a cyber range.
T1482 Domain trust discovery
Detecting T1482 Domain Trust Discovery on Windows, using telemetry such as Process Creation, Command Execution and Process Access. Covers the ATT&CK mitigations Network Segmentation and Audit and how to rehearse the detection in a cyber range.
T1518 Software discovery
Detecting T1518 Software Discovery on ESXi, IaaS, Linux and macOS and other platforms, using telemetry such as Process Creation, Command Execution and Application Log Content. Covers its 2 sub-techniques and how to rehearse the detection in a cyber range.
T1526 Cloud service discovery
Detecting T1526 Cloud Service Discovery on IaaS, Identity Provider, Office Suite and SaaS, using telemetry such as Cloud Service Enumeration, User Account Metadata and Logon Session Creation. Covers how to rehearse the detection in a cyber range.
T1538 Cloud service dashboard
Detecting T1538 Cloud Service Dashboard on IaaS, SaaS, Office Suite and Identity Provider, using telemetry such as User Account Authentication, Application Log Content and Logon Session Creation. Covers the ATT&CK mitigation User Account Management and how to rehearse the detection in a cyber range.
T1580 Cloud infrastructure discovery
Detecting T1580 Cloud Infrastructure Discovery on IaaS, using telemetry such as Instance Enumeration, Cloud Storage Enumeration and Instance Metadata. Covers the ATT&CK mitigation User Account Management and how to rehearse the detection in a cyber range.
T1613 Container and resource discovery
Detecting T1613 Container and Resource Discovery on Containers, using telemetry such as Pod Enumeration and Container Enumeration. Covers the ATT&CK mitigations User Account Management and Network Segmentation and how to rehearse the detection in a cyber range.
T1614 System location discovery
Detecting T1614 System Location Discovery on IaaS, Linux, macOS and Windows, using telemetry such as Process Creation, Command Execution and Network Traffic Content. Covers its 1 sub-technique and how to rehearse the detection in a cyber range.
T1615 Group Policy discovery
Detecting T1615 Group Policy Discovery on Windows, using telemetry such as Process Creation, Command Execution and Network Traffic Content. Covers how to rehearse the detection in a cyber range.
T1619 Cloud storage object discovery
Detecting T1619 Cloud Storage Object Discovery on IaaS, using telemetry such as Cloud Storage Enumeration and Cloud Storage Access. Covers the ATT&CK mitigation User Account Management and how to rehearse the detection in a cyber range.
T1652 Device driver discovery
Detecting T1652 Device Driver Discovery on Linux, macOS and Windows, using telemetry such as Process Creation, Command Execution and File Access. Covers how to rehearse the detection in a cyber range.
T1654 Log enumeration
Detecting T1654 Log Enumeration on ESXi, IaaS, Linux and macOS and other platforms, using telemetry such as Process Creation, Command Execution and File Access. Covers the ATT&CK mitigation User Account Management and how to rehearse the detection in a cyber range.
T1673 Virtual machine discovery
Detecting T1673 Virtual Machine Discovery on ESXi, Linux, macOS and Windows, using telemetry such as Process Creation and Command Execution. Covers how to rehearse the detection in a cyber range.
T1680 Local storage discovery
Detecting T1680 Local Storage Discovery on ESXi, IaaS, Linux and macOS and other platforms, using telemetry such as Process Creation, Command Execution and User Account Authentication. Covers how to rehearse the detection in a cyber range.
