MITRE ATT&CK Enterprise techniques whose primary tactic is Persistence: detection with open-source tooling and cyber range exercises.
Detecting T1037 Boot or Logon Initialization Scripts on ESXi, Linux, macOS and Network Devices and other platforms, using telemetry such as Process Creation, File Modification and Windows Registry Key Modification. Covers its 5 sub-techniques, the ATT&CK mitigations Restrict File and Directory Permissions and Restrict Registry Permissions, and how to rehearse the detection in a cyber range.
Detecting T1098 Account Manipulation on Containers, ESXi, IaaS and Identity Provider and other platforms, using telemetry such as Process Creation, File Modification and User Account Modification. Covers its 7 sub-techniques, the ATT&CK mitigations Disable or Remove Feature or Program and Privileged Account Management, and how to rehearse the detection in a cyber range.
Detecting T1133 External Remote Services on Containers, Linux, macOS and Windows, using telemetry such as Application Log Content, Network Traffic Flow and Network Connection Creation. Covers the ATT&CK mitigations Disable or Remove Feature or Program and Network Segmentation and how to rehearse the detection in a cyber range.
Detecting T1136 Create Account on Windows, IaaS, Linux and macOS and other platforms, using telemetry such as Process Creation, Command Execution and File Modification. Covers its 3 sub-techniques, the ATT&CK mitigations Privileged Account Management and Multi-factor Authentication, and how to rehearse the detection in a cyber range.
Detecting T1137 Office Application Startup on Windows and Office Suite, using telemetry such as Process Creation, File Creation and Windows Registry Key Modification. Covers its 6 sub-techniques, the ATT&CK mitigations Disable or Remove Feature or Program and Update Software, and how to rehearse the detection in a cyber range.
Detecting T1176 Software Extensions on Linux, macOS and Windows, using telemetry such as Process Creation, Command Execution and File Creation. Covers its 2 sub-techniques, the ATT&CK mitigations Audit and Limit Software Installation, and how to rehearse the detection in a cyber range.
Detecting T1505 Server Software Component on Windows, Linux, macOS and Network Devices and other platforms, using telemetry such as Process Creation, Command Execution and Application Log Content. Covers its 6 sub-techniques, the ATT&CK mitigations Audit and Disable or Remove Feature or Program, and how to rehearse the detection in a cyber range.
Detecting T1525 Implant Internal Image on IaaS and Containers, using telemetry such as Image Modification, Instance Start and Image Creation. Covers the ATT&CK mitigations Audit and Privileged Account Management and how to rehearse the detection in a cyber range.
Detecting T1543 Create or Modify System Process on Containers, Linux, macOS and Windows, using telemetry such as Process Creation, Command Execution and File Modification. Covers its 5 sub-techniques, the ATT&CK mitigations Audit and Privileged Account Management, and how to rehearse the detection in a cyber range.
Detecting T1547 Boot or Logon Autostart Execution on Linux, macOS, Windows and Network Devices, using telemetry such as Process Creation, File Modification and File Creation. Covers its 14 sub-techniques and how to rehearse the detection in a cyber range.
Detecting T1554 Compromise Host Software Binary on ESXi, Linux, macOS and Windows, using telemetry such as Process Creation, File Modification and File Creation. Covers the ATT&CK mitigation Code Signing and how to rehearse the detection in a cyber range.
Detecting T1653 Power Settings on Windows, Linux, macOS and Network Devices, using telemetry such as Process Creation, Command Execution and File Modification. Covers the ATT&CK mitigation Audit and how to rehearse the detection in a cyber range.
Detecting T1668 Exclusive Control on Linux, macOS and Windows, using telemetry such as Process Creation, Command Execution and Process Termination. Covers how to rehearse the detection in a cyber range.
Detecting T1671 Cloud Application Integration on Office Suite and SaaS, using telemetry such as Application Log Content, Active Directory Object Modification and Cloud Service Modification. Covers the ATT&CK mitigations Audit and Disable or Remove Feature or Program and how to rehearse the detection in a cyber range.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.