MITRE ATT&CK Enterprise techniques whose primary tactic is Execution: detection with open-source tooling and cyber range exercises.
Detecting T1047 Windows Management Instrumentation on Windows, using telemetry such as Process Creation, Network Connection Creation and WMI Creation. Covers the ATT&CK mitigations User Account Management and Privileged Account Management and how to rehearse the detection in a cyber range.
Detecting T1053 Scheduled Task/Job on Containers, ESXi, Linux and macOS and other platforms, using telemetry such as Process Creation, Command Execution and File Creation. Covers its 5 sub-techniques, the ATT&CK mitigations User Account Management and Privileged Account Management, and how to rehearse the detection in a cyber range.
Detecting T1059 Command and Scripting Interpreter on Containers, ESXi, IaaS and Identity Provider and other platforms, using telemetry such as Process Creation, Command Execution and User Account Authentication. Covers its 13 sub-techniques, the ATT&CK mitigations Privileged Account Management and Execution Prevention, and how to rehearse the detection in a cyber range.
Detecting T1072 Software Deployment Tools on Linux, macOS, Network Devices and SaaS and other platforms, using telemetry such as Process Creation, Command Execution and Application Log Content. Covers the ATT&CK mitigations User Account Management and Privileged Account Management and how to rehearse the detection in a cyber range.
Detecting T1106 Native API on Linux, macOS and Windows, using telemetry such as Process Creation, Module Load and Process Access. Covers the ATT&CK mitigations Execution Prevention and Behavior Prevention on Endpoint and how to rehearse the detection in a cyber range.
Detecting T1129 Shared Modules on Linux, macOS and Windows, using telemetry such as Process Creation, Network Connection Creation and Network Traffic Content. Covers the ATT&CK mitigation Execution Prevention and how to rehearse the detection in a cyber range.
Detecting T1203 Exploitation for Client Execution on Linux, macOS and Windows, using telemetry such as Process Creation, Application Log Content and Network Connection Creation. Covers the ATT&CK mitigations Update Software and Application Isolation and Sandboxing and how to rehearse the detection in a cyber range.
Detecting T1204 User Execution on Linux, Windows, macOS and IaaS and other platforms, using telemetry such as Process Creation, Application Log Content and Network Connection Creation. Covers its 5 sub-techniques, the ATT&CK mitigations Execution Prevention and Behavior Prevention on Endpoint, and how to rehearse the detection in a cyber range.
Detecting T1559 Inter-Process Communication on Linux, macOS and Windows, using telemetry such as Process Creation, File Access and Script Execution. Covers its 3 sub-techniques, the ATT&CK mitigations Privileged Account Management and Behavior Prevention on Endpoint, and how to rehearse the detection in a cyber range.
Detecting T1569 System Services on Windows, macOS and Linux, using telemetry such as Process Creation, File Modification and Windows Registry Key Modification. Covers its 3 sub-techniques, the ATT&CK mitigations User Account Management and Privileged Account Management, and how to rehearse the detection in a cyber range.
Detecting T1609 Container Administration Command on Containers, using telemetry such as Process Creation and Command Execution. Covers the ATT&CK mitigations User Account Management and Privileged Account Management and how to rehearse the detection in a cyber range.
Detecting T1610 Deploy Container on Containers, using telemetry such as Process Creation, Application Log Content and Network Traffic Content. Covers the ATT&CK mitigations User Account Management and Audit and how to rehearse the detection in a cyber range.
Detecting T1648 Serverless Execution on SaaS, IaaS and Office Suite, using telemetry such as Application Log Content and Cloud Service Modification. Covers the ATT&CK mitigations User Account Management and Account Use Policies and how to rehearse the detection in a cyber range.
Detecting T1651 Cloud Administration Command on IaaS, using telemetry such as Process Creation, Command Execution and Script Execution. Covers the ATT&CK mitigation Privileged Account Management and how to rehearse the detection in a cyber range.
Detecting T1674 Input Injection on Windows, macOS and Linux, using telemetry such as Process Creation, Command Execution and Script Execution. Covers the ATT&CK mitigations Execution Prevention and Limit Hardware Installation and how to rehearse the detection in a cyber range.
Detecting T1675 ESXi Administration Command on ESXi, using telemetry such as Application Log Content. Covers the ATT&CK mitigation User Account Management and how to rehearse the detection in a cyber range.
Detecting T1677 Poisoned Pipeline Execution on SaaS, using telemetry such as Command Execution, Cloud Service Modification and File Metadata. Covers the ATT&CK mitigations User Account Management and Software Configuration and how to rehearse the detection in a cyber range.
Detecting T1698 Indirect Prompt Injection on Windows and SaaS. Covers the ATT&CK mitigations User Account Management and Privileged Account Management and how to rehearse the detection in a cyber range.
Detecting T1699 Direct Prompt Injection on Windows and SaaS. Covers the ATT&CK mitigations User Account Management and Privileged Account Management and how to rehearse the detection in a cyber range.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.