MITRE ATT&CK Enterprise techniques whose primary tactic is Stealth: detection with open-source tooling and cyber range exercises.
Detecting T1006 Direct Volume Access on Network Devices and Windows, using telemetry such as Process Creation, Command Execution and Process Access. Covers the ATT&CK mitigations Behavior Prevention on Endpoint and User Account Management and how to rehearse the detection in a cyber range.
Detecting T1014 Rootkit on Linux, macOS and Windows, using telemetry such as Process Creation, Module Load and File Creation. Covers how to rehearse the detection in a cyber range.
Detecting T1027 Obfuscated Files or Information on ESXi, Linux, macOS and Network Devices and other platforms, using telemetry such as Process Creation, Command Execution and File Creation. Covers its 18 sub-techniques, the ATT&CK mitigations Audit and Behavior Prevention on Endpoint, and how to rehearse the detection in a cyber range.
Detecting T1036 Masquerading on Containers, ESXi, Linux and macOS and other platforms, using telemetry such as Process Creation, Command Execution and File Modification. Covers its 12 sub-techniques, the ATT&CK mitigations Audit and Behavior Prevention on Endpoint, and how to rehearse the detection in a cyber range.
Detecting T1055 Process Injection on Linux, macOS and Windows, using telemetry such as Process Creation, Module Load and Process Access. Covers its 12 sub-techniques, the ATT&CK mitigations Behavior Prevention on Endpoint and Privileged Account Management, and how to rehearse the detection in a cyber range.
Detecting T1070 Indicator Removal on Containers, ESXi, Linux and macOS and other platforms, using telemetry such as File Modification, Windows Registry Key Modification and File Metadata. Covers its 8 sub-techniques, the ATT&CK mitigations Restrict File and Directory Permissions and Remote Data Storage, and how to rehearse the detection in a cyber range.
Detecting T1078 Valid Accounts on Containers, ESXi, IaaS and Identity Provider and other platforms, using telemetry such as Process Creation, Logon Session Creation and User Account Authentication. Covers its 4 sub-techniques, the ATT&CK mitigations User Account Management and Privileged Account Management, and how to rehearse the detection in a cyber range.
Detecting T1127 Trusted Developer Utilities Proxy Execution on Windows, using telemetry such as Process Creation, Module Load and Network Connection Creation. Covers its 3 sub-techniques, the ATT&CK mitigations Execution Prevention and Disable or Remove Feature or Program, and how to rehearse the detection in a cyber range.
Detecting T1134 Access Token Manipulation on Windows, using telemetry such as Process Creation, Process Access and OS API Execution. Covers its 5 sub-techniques, the ATT&CK mitigations User Account Management and Privileged Account Management, and how to rehearse the detection in a cyber range.
Detecting T1140 Deobfuscate/Decode Files or Information on ESXi, Linux, macOS and Windows, using telemetry such as Process Creation, File Creation and Command Execution. Covers how to rehearse the detection in a cyber range.
Detecting T1197 BITS Jobs on Windows, using telemetry such as Process Creation, Network Connection Creation and Command Execution. Covers the ATT&CK mitigations User Account Management and Operating System Configuration and how to rehearse the detection in a cyber range.
Detecting T1202 Indirect Command Execution on Windows, using telemetry such as Process Creation, Network Connection Creation and File Creation. Covers how to rehearse the detection in a cyber range.
Detecting T1205 Traffic Signaling on Linux, macOS, Network Devices and Windows, using telemetry such as Process Creation, Command Execution and Network Connection Creation. Covers its 2 sub-techniques, the ATT&CK mitigations Disable or Remove Feature or Program and Filter Network Traffic, and how to rehearse the detection in a cyber range.
Detecting T1211 Exploitation for Stealth on Linux, Windows, macOS and SaaS and other platforms, using telemetry such as Process Creation, Module Load and Application Log Content. Covers the ATT&CK mitigations Update Software and Exploit Protection and how to rehearse the detection in a cyber range.
Detecting T1216 System Script Proxy Execution on Windows, using telemetry such as Process Creation, Command Execution and Module Load. Covers its 2 sub-techniques, the ATT&CK mitigation Execution Prevention, and how to rehearse the detection in a cyber range.
Detecting T1218 System Binary Proxy Execution on Linux, macOS and Windows, using telemetry such as Process Creation, Network Connection Creation and Module Load. Covers its 14 sub-techniques, the ATT&CK mitigations Execution Prevention and Privileged Account Management, and how to rehearse the detection in a cyber range.
Detecting T1220 XSL Script Processing on Windows, using telemetry such as Process Creation and Module Load. Covers the ATT&CK mitigation Execution Prevention and how to rehearse the detection in a cyber range.
Detecting T1221 Template Injection on Windows, using telemetry such as Process Creation and Network Connection Creation. Covers the ATT&CK mitigations Disable or Remove Feature or Program and User Training and how to rehearse the detection in a cyber range.
Detecting T1480 Execution Guardrails on ESXi, Linux, macOS and Windows, using telemetry such as Process Creation, Command Execution and File Creation. Covers its 2 sub-techniques, the ATT&CK mitigation Do Not Mitigate, and how to rehearse the detection in a cyber range.
Detecting T1497 Virtualization/Sandbox Evasion on Linux, macOS and Windows, using telemetry such as Process Creation, Command Execution and Module Load. Covers its 3 sub-techniques and how to rehearse the detection in a cyber range.
Detecting T1535 Unused/Unsupported Cloud Regions on IaaS, using telemetry such as Network Connection Creation, User Account Metadata and Cloud Storage Creation. Covers the ATT&CK mitigation Software Configuration and how to rehearse the detection in a cyber range.
Detecting T1542 Pre-OS Boot on Linux, macOS, Network Devices and Windows, using telemetry such as Process Creation, Command Execution and File Creation. Covers its 5 sub-techniques, the ATT&CK mitigations Audit and Privileged Account Management, and how to rehearse the detection in a cyber range.
Detecting T1564 Hide Artifacts on ESXi, Linux, macOS and Office Suite and other platforms, using telemetry such as Process Creation, Command Execution and File Creation. Covers its 14 sub-techniques, the ATT&CK mitigations Audit and Antivirus/Antimalware, and how to rehearse the detection in a cyber range.
Detecting T1574 Hijack Execution Flow on Linux, macOS and Windows, using telemetry such as Process Creation, Module Load and File Creation. Covers its 12 sub-techniques, the ATT&CK mitigations Audit and Behavior Prevention on Endpoint, and how to rehearse the detection in a cyber range.
Detecting T1612 Build Image on Host on Containers, using telemetry such as Network Connection Creation and Image Creation. Covers the ATT&CK mitigations Audit and Privileged Account Management and how to rehearse the detection in a cyber range.
Detecting T1620 Reflective Code Loading on Linux, macOS and Windows, using telemetry such as Process Creation, Module Load and Process Access. Covers how to rehearse the detection in a cyber range.
Detecting T1622 Debugger Evasion on Linux, macOS and Windows, using telemetry such as Process Creation, OS API Execution and File Access. Covers how to rehearse the detection in a cyber range.
Detecting T1678 Delay Execution on Linux, macOS and Windows, using telemetry such as Process Creation, Module Load and Script Execution. Covers how to rehearse the detection in a cyber range.
Detecting T1679 Selective Exclusion on Windows, using telemetry such as Process Creation, Command Execution and File Modification. Covers how to rehearse the detection in a cyber range.
Detecting T1684 Social Engineering on Linux, macOS, Office Suite and SaaS and other platforms, using telemetry such as Process Creation, Command Execution and File Creation. Covers its 2 sub-techniques, the ATT&CK mitigations Audit and User Training, and how to rehearse the detection in a cyber range.
Detecting T1696 Anti-Automation Evasion on SaaS. Covers its 2 sub-techniques, the ATT&CK mitigations Filter Network Traffic and Network Intrusion Prevention, and how to rehearse the detection in a cyber range.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.