MITRE ATT&CK Enterprise techniques whose primary tactic is Impact: detection with open-source tooling and cyber range exercises.
Detecting T1485 Data Destruction on Containers, ESXi, IaaS and Linux and other platforms, using telemetry such as Process Creation, Command Execution and File Creation. Covers its 1 sub-technique, the ATT&CK mitigations Data Backup and User Account Management, and how to rehearse the detection in a cyber range.
Detecting T1486 Data Encrypted for Impact on ESXi, IaaS, Linux and macOS and other platforms, using telemetry such as Process Creation, Command Execution and File Creation. Covers the ATT&CK mitigations Data Backup and Behavior Prevention on Endpoint and how to rehearse the detection in a cyber range.
Detecting T1489 Service Stop on ESXi, IaaS, Linux and macOS and other platforms, using telemetry such as Process Creation, File Deletion and Process Termination. Covers the ATT&CK mitigations User Account Management and Restrict File and Directory Permissions and how to rehearse the detection in a cyber range.
Detecting T1490 Inhibit System Recovery on Containers, ESXi, IaaS and Linux and other platforms, using telemetry such as Process Creation, Command Execution and File Deletion. Covers the ATT&CK mitigations Data Backup and User Account Management and how to rehearse the detection in a cyber range.
Detecting T1491 Defacement on Windows, IaaS, Linux and macOS and other platforms, using telemetry such as Process Creation, Network Traffic Content and Application Log Content. Covers its 2 sub-techniques, the ATT&CK mitigation Data Backup, and how to rehearse the detection in a cyber range.
Detecting T1495 Firmware Corruption on Linux, macOS, Network Devices and Windows, using telemetry such as Process Creation, Network Traffic Content and Driver Load. Covers the ATT&CK mitigations Update Software and Boot Integrity and how to rehearse the detection in a cyber range.
Detecting T1496 Resource Hijacking on Windows, IaaS, Linux and macOS and other platforms, using telemetry such as Process Creation, Application Log Content and Network Traffic Content. Covers its 4 sub-techniques and how to rehearse the detection in a cyber range.
Detecting T1498 Network Denial of Service on Windows, IaaS, Linux and macOS and other platforms, using telemetry such as Process Creation, Network Connection Creation and Network Traffic Flow. Covers its 2 sub-techniques, the ATT&CK mitigation Filter Network Traffic, and how to rehearse the detection in a cyber range.
Detecting T1499 Endpoint Denial of Service on Windows, Linux, macOS and Containers and other platforms, using telemetry such as Process Creation, Application Log Content and Network Traffic Flow. Covers its 4 sub-techniques, the ATT&CK mitigation Filter Network Traffic, and how to rehearse the detection in a cyber range.
Detecting T1529 System Shutdown/Reboot on ESXi, Linux, macOS and Network Devices and other platforms, using telemetry such as Process Creation, Command Execution and Host Status. Covers how to rehearse the detection in a cyber range.
Detecting T1531 Account Access Removal on Linux, macOS, Windows and SaaS and other platforms, using telemetry such as Process Creation, Command Execution and User Account Authentication. Covers how to rehearse the detection in a cyber range.
Detecting T1561 Disk Wipe on Linux, macOS, Windows and Network Devices, using telemetry such as Process Creation, Command Execution and User Account Authentication. Covers its 2 sub-techniques, the ATT&CK mitigation Data Backup, and how to rehearse the detection in a cyber range.
Detecting T1565 Data Manipulation on Linux, macOS and Windows, using telemetry such as Network Traffic Content, File Creation and File Modification. Covers its 3 sub-techniques, the ATT&CK mitigations Restrict File and Directory Permissions and Network Segmentation, and how to rehearse the detection in a cyber range.
Detecting T1657 Financial Theft on Linux, macOS, Office Suite and SaaS and other platforms, using telemetry such as Process Creation, Command Execution and Application Log Content. Covers the ATT&CK mitigations User Account Management and User Training and how to rehearse the detection in a cyber range.
Detecting T1667 Email Bombing on Linux, Office Suite, Windows and macOS, using telemetry such as Application Log Content and File Creation. Covers the ATT&CK mitigations User Training and Software Configuration and how to rehearse the detection in a cyber range.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.