MITRE ATT&CK Enterprise techniques whose primary tactic is Initial Access: detection with open-source tooling and cyber range exercises.
Detecting T1189 Drive-by Compromise on Identity Provider, Linux, macOS and Windows, using telemetry such as Network Connection Creation, Process Creation and Network Traffic Content. Covers the ATT&CK mitigations Update Software and Restrict Web-Based Content and how to rehearse the detection in a cyber range.
Detecting T1190 Exploit Public-Facing Application on Containers, ESXi, IaaS and Linux and other platforms, using telemetry such as Network Connection Creation, Network Traffic Content and Process Creation. Covers the ATT&CK mitigations Update Software and Network Segmentation and how to rehearse the detection in a cyber range.
Detecting T1195 Supply Chain Compromise on Linux, Windows, macOS and SaaS, using telemetry such as Process Creation, Network Traffic Flow and File Creation. Covers its 3 sub-techniques, the ATT&CK mitigations Update Software and User Account Management, and how to rehearse the detection in a cyber range.
Detecting T1199 Trusted Relationship on IaaS, Identity Provider, Linux and macOS and other platforms, using telemetry such as Network Connection Creation, Network Traffic Content and Application Log Content. Covers the ATT&CK mitigations User Account Management and Network Segmentation and how to rehearse the detection in a cyber range.
Detecting T1200 Hardware Additions on Windows, Linux and macOS, using telemetry such as Network Connection Creation, Process Creation and Application Log Content. Covers the ATT&CK mitigations Limit Access to Resource Over Network and Limit Hardware Installation and how to rehearse the detection in a cyber range.
Detecting T1566 Phishing on Identity Provider, Linux, macOS and Office Suite and other platforms, using telemetry such as Process Creation, Application Log Content and File Creation. Covers its 4 sub-techniques, the ATT&CK mitigations Restrict Web-Based Content and User Training, and how to rehearse the detection in a cyber range.
Detecting T1659 Content Injection on Linux, macOS and Windows, using telemetry such as Network Traffic Content, Process Creation and File Creation. Covers the ATT&CK mitigations Restrict Web-Based Content and Encrypt Sensitive Information and how to rehearse the detection in a cyber range.
Detecting T1669 Wi-Fi Networks on Linux, Network Devices, Windows and macOS, using telemetry such as Network Connection Creation, Network Traffic Content and Network Traffic Flow. Covers the ATT&CK mitigations Network Segmentation and Multi-factor Authentication and how to rehearse the detection in a cyber range.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.