creator/Anthropic-Cybersecurity-Skills
1
0
Fork 0
mirror of https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git synced 2026-06-10 21:24:56 +03:00
Code Issues Packages Projects Releases Wiki Activity
Files
0bf1fa2a41b891a9d8dc3cc5807ba050ba328ce4
Anthropic-Cybersecurity-Skills/mappings/attack-navigator-layer.json
T

3594 lines
95 KiB
JSON
Raw Blame History

{
"name": "Anthropic Cybersecurity Skills - ATT&CK Coverage",
"versions": {
"attack": "14",
"navigator": "4.9.1",
"layer": "4.5"
},
"domain": "enterprise-attack",
"description": "MITRE ATT&CK technique coverage map for the Anthropic Cybersecurity Skills repository. Each technique is scored by the number of skills that reference it. Higher scores (darker colors) indicate more comprehensive coverage across multiple training skills.",
"filters": {
"platforms": [
"Linux",
"macOS",
"Windows",
"Network",
"PRE",
"Containers",
"Office 365",
"SaaS",
"Google Workspace",
"IaaS",
"Azure AD"
]
},
"sorting": 3,
"layout": {
"layout": "side",
"showID": true,
"showName": true,
"showAggregateScores": false,
"countUnscored": false,
"aggregateFunction": "average",
"expandedSubtechniques": "annotated"
},
"hideDisabled": false,
"techniques": [
{
"techniqueID": "T1003",
"score": 42,
"comment": "OS Credential Dumping - Referenced in 11 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "11"
},
{
"name": "skills",
"value": "building-attack-pattern-library-from-cti-reports, building-detection-rules-with-sigma, detecting-container-escape-with-falco-rules, detecting-credential-dumping-techniques, detecting-credential-dumping-with-edr (+6 more)"
}
]
},
{
"techniqueID": "T1003.001",
"score": 46,
"comment": "LSASS Memory - Referenced in 12 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "12"
},
{
"name": "skills",
"value": "building-attack-pattern-library-from-cti-reports, building-detection-rule-with-splunk-spl, building-detection-rules-with-sigma, conducting-full-scope-red-team-engagement, conducting-internal-network-penetration-test (+7 more)"
}
]
},
{
"techniqueID": "T1003.002",
"score": 8,
"comment": "SAM - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "detecting-credential-dumping-with-edr, detecting-t1003-credential-dumping-with-edr"
}
]
},
{
"techniqueID": "T1003.003",
"score": 8,
"comment": "NTDS - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "detecting-credential-dumping-with-edr, detecting-t1003-credential-dumping-with-edr"
}
]
},
{
"techniqueID": "T1003.004",
"score": 12,
"comment": "LSA Secrets - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "detecting-credential-dumping-with-edr, detecting-t1003-credential-dumping-with-edr, performing-credential-access-with-lazagne"
}
]
},
{
"techniqueID": "T1003.005",
"score": 8,
"comment": "Cached Domain Credentials - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "detecting-credential-dumping-with-edr, detecting-t1003-credential-dumping-with-edr"
}
]
},
{
"techniqueID": "T1003.006",
"score": 50,
"comment": "DCSync - Referenced in 13 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "13"
},
{
"name": "skills",
"value": "analyzing-windows-event-logs-in-splunk, conducting-domain-persistence-with-dcsync, conducting-full-scope-red-team-engagement, conducting-internal-network-penetration-test, detecting-credential-dumping-with-edr (+8 more)"
}
]
},
{
"techniqueID": "T1005",
"score": 8,
"comment": "Data from Local System - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "conducting-malware-incident-response, detecting-container-escape-with-falco-rules"
}
]
},
{
"techniqueID": "T1016",
"score": 12,
"comment": "System Network Configuration Discovery - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "conducting-full-scope-red-team-engagement, conducting-internal-reconnaissance-with-bloodhound-ce, exploiting-active-directory-with-bloodhound"
}
]
},
{
"techniqueID": "T1018",
"score": 15,
"comment": "Remote System Discovery - Referenced in 4 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "4"
},
{
"name": "skills",
"value": "conducting-full-scope-red-team-engagement, conducting-internal-reconnaissance-with-bloodhound-ce, exploiting-active-directory-with-bloodhound, performing-active-directory-bloodhound-analysis"
}
]
},
{
"techniqueID": "T1020",
"score": 4,
"comment": "Automated Exfiltration - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "hunting-for-data-exfiltration-indicators"
}
]
},
{
"techniqueID": "T1021",
"score": 38,
"comment": "Remote Services - Referenced in 10 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "10"
},
{
"name": "skills",
"value": "detecting-lateral-movement-in-network, detecting-lateral-movement-with-splunk, detecting-service-account-abuse, exploiting-constrained-delegation-abuse, implementing-continuous-security-validation-with-bas (+5 more)"
}
]
},
{
"techniqueID": "T1021.001",
"score": 31,
"comment": "Remote Desktop Protocol - Referenced in 8 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "8"
},
{
"name": "skills",
"value": "analyzing-windows-event-logs-in-splunk, building-attack-pattern-library-from-cti-reports, detecting-lateral-movement-with-splunk, executing-red-team-exercise, implementing-mitre-attack-coverage-mapping (+3 more)"
}
]
},
{
"techniqueID": "T1021.002",
"score": 46,
"comment": "SMB/Windows Admin Shares - Referenced in 12 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "12"
},
{
"name": "skills",
"value": "analyzing-windows-event-logs-in-splunk, building-attack-pattern-library-from-cti-reports, building-detection-rule-with-splunk-spl, conducting-full-scope-red-team-engagement, conducting-internal-network-penetration-test (+7 more)"
}
]
},
{
"techniqueID": "T1021.003",
"score": 12,
"comment": "DCOM - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "detecting-lateral-movement-with-splunk, performing-lateral-movement-detection, performing-lateral-movement-with-wmiexec"
}
]
},
{
"techniqueID": "T1021.004",
"score": 4,
"comment": "SSH - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "detecting-lateral-movement-with-splunk"
}
]
},
{
"techniqueID": "T1021.006",
"score": 12,
"comment": "Windows Remote Management - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "building-attack-pattern-library-from-cti-reports, detecting-lateral-movement-with-splunk, performing-lateral-movement-detection"
}
]
},
{
"techniqueID": "T1027",
"score": 8,
"comment": "Obfuscated Files or Information - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "analyzing-apt-group-with-mitre-navigator, conducting-full-scope-red-team-engagement"
}
]
},
{
"techniqueID": "T1029",
"score": 4,
"comment": "Scheduled Transfer - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "hunting-for-data-exfiltration-indicators"
}
]
},
{
"techniqueID": "T1030",
"score": 4,
"comment": "Data Transfer Size Limits - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "hunting-for-data-exfiltration-indicators"
}
]
},
{
"techniqueID": "T1033",
"score": 8,
"comment": "System Owner/User Discovery - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "conducting-internal-reconnaissance-with-bloodhound-ce, exploiting-active-directory-with-bloodhound"
}
]
},
{
"techniqueID": "T1036",
"score": 12,
"comment": "Masquerading - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "detecting-evasion-techniques-in-endpoint-logs, implementing-mitre-attack-coverage-mapping, implementing-siem-use-cases-for-detection"
}
]
},
{
"techniqueID": "T1036.005",
"score": 4,
"comment": "Match Legitimate Name or Location - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "detecting-process-injection-techniques"
}
]
},
{
"techniqueID": "T1040",
"score": 4,
"comment": "Network Sniffing - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "implementing-continuous-security-validation-with-bas"
}
]
},
{
"techniqueID": "T1041",
"score": 35,
"comment": "Exfiltration Over C2 Channel - Referenced in 9 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "9"
},
{
"name": "skills",
"value": "analyzing-ransomware-network-indicators, building-attack-pattern-library-from-cti-reports, conducting-full-scope-red-team-engagement, conducting-malware-incident-response, executing-red-team-exercise (+4 more)"
}
]
},
{
"techniqueID": "T1047",
"score": 19,
"comment": "Windows Management Instrumentation - Referenced in 5 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "5"
},
{
"name": "skills",
"value": "conducting-full-scope-red-team-engagement, detecting-lateral-movement-with-splunk, performing-lateral-movement-detection, performing-lateral-movement-with-wmiexec, performing-purple-team-exercise"
}
]
},
{
"techniqueID": "T1048",
"score": 19,
"comment": "Exfiltration Over Alternative Protocol - Referenced in 5 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "5"
},
{
"name": "skills",
"value": "building-detection-rule-with-splunk-spl, conducting-full-scope-red-team-engagement, hunting-for-data-exfiltration-indicators, implementing-continuous-security-validation-with-bas, implementing-mitre-attack-coverage-mapping"
}
]
},
{
"techniqueID": "T1048.001",
"score": 4,
"comment": "Symmetric Encrypted Non-C2 - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "hunting-for-data-exfiltration-indicators"
}
]
},
{
"techniqueID": "T1048.002",
"score": 4,
"comment": "Asymmetric Encrypted Non-C2 - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "hunting-for-data-exfiltration-indicators"
}
]
},
{
"techniqueID": "T1048.003",
"score": 19,
"comment": "Unencrypted/Obfuscated Non-C2 - Referenced in 5 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "5"
},
{
"name": "skills",
"value": "conducting-full-scope-red-team-engagement, hunting-for-data-exfiltration-indicators, hunting-for-dns-tunneling-with-zeek, implementing-continuous-security-validation-with-bas, implementing-mitre-attack-coverage-mapping"
}
]
},
{
"techniqueID": "T1052",
"score": 4,
"comment": "Exfiltration Over Physical Medium - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "hunting-for-data-exfiltration-indicators"
}
]
},
{
"techniqueID": "T1053",
"score": 23,
"comment": "Scheduled Task/Job - Referenced in 6 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "6"
},
{
"name": "skills",
"value": "analyzing-apt-group-with-mitre-navigator, analyzing-persistence-mechanisms-in-linux, hunting-for-persistence-mechanisms-in-windows, implementing-mitre-attack-coverage-mapping, implementing-siem-use-cases-for-detection (+1 more)"
}
]
},
{
"techniqueID": "T1053.002",
"score": 4,
"comment": "At - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "hunting-for-scheduled-task-persistence"
}
]
},
{
"techniqueID": "T1053.003",
"score": 8,
"comment": "Cron - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "hunting-for-scheduled-task-persistence, performing-privilege-escalation-on-linux"
}
]
},
{
"techniqueID": "T1053.005",
"score": 62,
"comment": "Scheduled Task - Referenced in 16 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "16"
},
{
"name": "skills",
"value": "analyzing-apt-group-with-mitre-navigator, analyzing-windows-event-logs-in-splunk, building-attack-pattern-library-from-cti-reports, building-detection-rule-with-splunk-spl, conducting-full-scope-red-team-engagement (+11 more)"
}
]
},
{
"techniqueID": "T1055",
"score": 65,
"comment": "Process Injection - Referenced in 17 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "17"
},
{
"name": "skills",
"value": "building-attack-pattern-library-from-cti-reports, building-red-team-c2-infrastructure-with-havoc, conducting-full-scope-red-team-engagement, detecting-evasion-techniques-in-endpoint-logs, detecting-process-hollowing-technique (+12 more)"
}
]
},
{
"techniqueID": "T1055.001",
"score": 15,
"comment": "DLL Injection - Referenced in 4 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "4"
},
{
"name": "skills",
"value": "detecting-process-hollowing-technique, detecting-process-injection-techniques, detecting-t1055-process-injection-with-sysmon, hunting-for-process-injection-techniques"
}
]
},
{
"techniqueID": "T1055.002",
"score": 8,
"comment": "Portable Executable Injection - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "detecting-process-injection-techniques, detecting-t1055-process-injection-with-sysmon"
}
]
},
{
"techniqueID": "T1055.003",
"score": 12,
"comment": "Thread Execution Hijacking - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "detecting-process-hollowing-technique, detecting-process-injection-techniques, detecting-t1055-process-injection-with-sysmon"
}
]
},
{
"techniqueID": "T1055.004",
"score": 12,
"comment": "APC Injection - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "detecting-process-hollowing-technique, detecting-process-injection-techniques, detecting-t1055-process-injection-with-sysmon"
}
]
},
{
"techniqueID": "T1055.005",
"score": 8,
"comment": "Thread Local Storage - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "detecting-process-injection-techniques, detecting-t1055-process-injection-with-sysmon"
}
]
},
{
"techniqueID": "T1055.008",
"score": 4,
"comment": "Ptrace System Calls - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "detecting-process-injection-techniques"
}
]
},
{
"techniqueID": "T1055.009",
"score": 4,
"comment": "Proc Memory - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "detecting-process-injection-techniques"
}
]
},
{
"techniqueID": "T1055.011",
"score": 4,
"comment": "Extra Window Memory Injection - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "detecting-process-injection-techniques"
}
]
},
{
"techniqueID": "T1055.012",
"score": 23,
"comment": "Process Hollowing - Referenced in 6 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "6"
},
{
"name": "skills",
"value": "conducting-malware-incident-response, detecting-fileless-malware-techniques, detecting-process-hollowing-technique, detecting-process-injection-techniques, detecting-t1055-process-injection-with-sysmon (+1 more)"
}
]
},
{
"techniqueID": "T1055.013",
"score": 12,
"comment": "Process Doppelganging - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "detecting-process-hollowing-technique, detecting-process-injection-techniques, detecting-t1055-process-injection-with-sysmon"
}
]
},
{
"techniqueID": "T1055.014",
"score": 4,
"comment": "VDSO Hijacking - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "detecting-process-injection-techniques"
}
]
},
{
"techniqueID": "T1055.015",
"score": 8,
"comment": "ListPlanting - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "detecting-process-injection-techniques, detecting-t1055-process-injection-with-sysmon"
}
]
},
{
"techniqueID": "T1059",
"score": 38,
"comment": "Command and Scripting Interpreter - Referenced in 10 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "10"
},
{
"name": "skills",
"value": "analyzing-apt-group-with-mitre-navigator, analyzing-threat-actor-ttps-with-mitre-attack, analyzing-windows-event-logs-in-splunk, building-incident-timeline-with-timesketch, deobfuscating-powershell-obfuscated-malware (+5 more)"
}
]
},
{
"techniqueID": "T1059.001",
"score": 100,
"comment": "PowerShell - Referenced in 26 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "26"
},
{
"name": "skills",
"value": "analyzing-apt-group-with-mitre-navigator, analyzing-macro-malware-in-office-documents, analyzing-powershell-empire-artifacts, analyzing-security-logs-with-splunk, analyzing-threat-actor-ttps-with-mitre-navigator (+21 more)"
}
]
},
{
"techniqueID": "T1059.003",
"score": 12,
"comment": "Windows Command Shell - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "building-attack-pattern-library-from-cti-reports, detecting-suspicious-powershell-execution, mapping-mitre-attack-techniques"
}
]
},
{
"techniqueID": "T1059.005",
"score": 15,
"comment": "Visual Basic - Referenced in 4 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "4"
},
{
"name": "skills",
"value": "analyzing-macro-malware-in-office-documents, executing-red-team-exercise, hunting-for-lolbins-execution-in-endpoint-logs, mapping-mitre-attack-techniques"
}
]
},
{
"techniqueID": "T1068",
"score": 31,
"comment": "Exploitation for Privilege Escalation - Referenced in 8 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "8"
},
{
"name": "skills",
"value": "conducting-full-scope-red-team-engagement, detecting-container-escape-attempts, detecting-privilege-escalation-attempts, detecting-privilege-escalation-in-kubernetes-pods, exploiting-nopac-cve-2021-42278-42287 (+3 more)"
}
]
},
{
"techniqueID": "T1069.001",
"score": 4,
"comment": "Local Groups - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-active-directory-bloodhound-analysis"
}
]
},
{
"techniqueID": "T1069.002",
"score": 15,
"comment": "Domain Groups - Referenced in 4 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "4"
},
{
"name": "skills",
"value": "conducting-internal-reconnaissance-with-bloodhound-ce, exploiting-active-directory-with-bloodhound, performing-active-directory-bloodhound-analysis, performing-kerberoasting-attack"
}
]
},
{
"techniqueID": "T1070",
"score": 12,
"comment": "Indicator Removal - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "detecting-evasion-techniques-in-endpoint-logs, implementing-siem-use-cases-for-detection, implementing-velociraptor-for-ir-collection"
}
]
},
{
"techniqueID": "T1070.001",
"score": 12,
"comment": "Clear Windows Event Logs - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "detecting-evasion-techniques-in-endpoint-logs, implementing-mitre-attack-coverage-mapping, performing-purple-team-exercise"
}
]
},
{
"techniqueID": "T1070.004",
"score": 4,
"comment": "File Deletion - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "implementing-threat-modeling-with-mitre-attack"
}
]
},
{
"techniqueID": "T1070.006",
"score": 8,
"comment": "Timestomping - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "detecting-evasion-techniques-in-endpoint-logs, hunting-for-defense-evasion-via-timestomping"
}
]
},
{
"techniqueID": "T1071",
"score": 38,
"comment": "Application Layer Protocol - Referenced in 10 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "10"
},
{
"name": "skills",
"value": "analyzing-apt-group-with-mitre-navigator, analyzing-network-covert-channels-in-malware, analyzing-ransomware-network-indicators, analyzing-threat-actor-ttps-with-mitre-attack, hunting-advanced-persistent-threats (+5 more)"
}
]
},
{
"techniqueID": "T1071.001",
"score": 46,
"comment": "Web Protocols - Referenced in 12 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "12"
},
{
"name": "skills",
"value": "analyzing-apt-group-with-mitre-navigator, building-c2-infrastructure-with-sliver-framework, building-red-team-c2-infrastructure-with-havoc, conducting-malware-incident-response, detecting-process-injection-techniques (+7 more)"
}
]
},
{
"techniqueID": "T1071.004",
"score": 27,
"comment": "DNS - Referenced in 7 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "7"
},
{
"name": "skills",
"value": "building-attack-pattern-library-from-cti-reports, building-c2-infrastructure-with-sliver-framework, hunting-for-beaconing-with-frequency-analysis, hunting-for-command-and-control-beaconing, hunting-for-dns-tunneling-with-zeek (+2 more)"
}
]
},
{
"techniqueID": "T1074",
"score": 12,
"comment": "Data Staged - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "building-attack-pattern-library-from-cti-reports, executing-red-team-exercise, hunting-for-data-staging-before-exfiltration"
}
]
},
{
"techniqueID": "T1074.001",
"score": 4,
"comment": "Local Data Staging - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "hunting-for-data-staging-before-exfiltration"
}
]
},
{
"techniqueID": "T1074.002",
"score": 4,
"comment": "Remote Data Staging - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "hunting-for-data-staging-before-exfiltration"
}
]
},
{
"techniqueID": "T1078",
"score": 50,
"comment": "Valid Accounts - Referenced in 13 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "13"
},
{
"name": "skills",
"value": "analyzing-apt-group-with-mitre-navigator, analyzing-windows-event-logs-in-splunk, conducting-full-scope-red-team-engagement, conducting-internal-network-penetration-test, detecting-insider-threat-behaviors (+8 more)"
}
]
},
{
"techniqueID": "T1078.001",
"score": 4,
"comment": "Default Accounts - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "detecting-service-account-abuse"
}
]
},
{
"techniqueID": "T1078.002",
"score": 23,
"comment": "Domain Accounts - Referenced in 6 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "6"
},
{
"name": "skills",
"value": "conducting-domain-persistence-with-dcsync, detecting-service-account-abuse, exploiting-active-directory-certificate-services-esc1, exploiting-constrained-delegation-abuse, exploiting-nopac-cve-2021-42278-42287 (+1 more)"
}
]
},
{
"techniqueID": "T1078.004",
"score": 12,
"comment": "Cloud Accounts - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "detecting-azure-service-principal-abuse, implementing-mitre-attack-coverage-mapping, implementing-threat-modeling-with-mitre-attack"
}
]
},
{
"techniqueID": "T1082",
"score": 4,
"comment": "System Information Discovery - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "conducting-full-scope-red-team-engagement"
}
]
},
{
"techniqueID": "T1087",
"score": 8,
"comment": "Account Discovery - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "conducting-full-scope-red-team-engagement, implementing-continuous-security-validation-with-bas"
}
]
},
{
"techniqueID": "T1087.002",
"score": 23,
"comment": "Domain Account - Referenced in 6 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "6"
},
{
"name": "skills",
"value": "conducting-internal-reconnaissance-with-bloodhound-ce, exploiting-active-directory-certificate-services-esc1, exploiting-active-directory-with-bloodhound, exploiting-kerberoasting-with-impacket, performing-active-directory-bloodhound-analysis (+1 more)"
}
]
},
{
"techniqueID": "T1087.004",
"score": 8,
"comment": "Cloud Account - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "detecting-azure-service-principal-abuse, implementing-mitre-attack-coverage-mapping"
}
]
},
{
"techniqueID": "T1090",
"score": 4,
"comment": "Proxy - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "implementing-mitre-attack-coverage-mapping"
}
]
},
{
"techniqueID": "T1090.002",
"score": 8,
"comment": "External Proxy - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "building-c2-infrastructure-with-sliver-framework, building-red-team-c2-infrastructure-with-havoc"
}
]
},
{
"techniqueID": "T1090.004",
"score": 4,
"comment": "Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "hunting-for-domain-fronting-c2-traffic"
}
]
},
{
"techniqueID": "T1091",
"score": 4,
"comment": "Replication Through Removable Media - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-physical-intrusion-assessment"
}
]
},
{
"techniqueID": "T1095",
"score": 8,
"comment": "Non-Application Layer Protocol - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "hunting-for-command-and-control-beaconing, hunting-for-unusual-network-connections"
}
]
},
{
"techniqueID": "T1098",
"score": 19,
"comment": "Account Manipulation - Referenced in 5 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "5"
},
{
"name": "skills",
"value": "analyzing-windows-event-logs-in-splunk, conducting-domain-persistence-with-dcsync, hunting-for-t1098-account-manipulation, implementing-mitre-attack-coverage-mapping, performing-active-directory-compromise-investigation"
}
]
},
{
"techniqueID": "T1098.001",
"score": 12,
"comment": "Additional Cloud Credentials - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "conducting-cloud-penetration-testing, detecting-azure-service-principal-abuse, implementing-mitre-attack-coverage-mapping"
}
]
},
{
"techniqueID": "T1098.002",
"score": 4,
"comment": "Additional Email Delegate Permissions - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "detecting-email-forwarding-rules-attack"
}
]
},
{
"techniqueID": "T1102",
"score": 4,
"comment": "Web Service - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "hunting-for-living-off-the-cloud-techniques"
}
]
},
{
"techniqueID": "T1105",
"score": 23,
"comment": "Ingress Tool Transfer - Referenced in 6 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "6"
},
{
"name": "skills",
"value": "building-c2-infrastructure-with-sliver-framework, building-red-team-c2-infrastructure-with-havoc, detecting-living-off-the-land-with-lolbas, implementing-mitre-attack-coverage-mapping, implementing-siem-use-cases-for-detection (+1 more)"
}
]
},
{
"techniqueID": "T1110",
"score": 15,
"comment": "Brute Force - Referenced in 4 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "4"
},
{
"name": "skills",
"value": "analyzing-windows-event-logs-in-splunk, conducting-internal-network-penetration-test, implementing-mitre-attack-coverage-mapping, performing-alert-triage-with-elastic-siem"
}
]
},
{
"techniqueID": "T1110.001",
"score": 15,
"comment": "Password Guessing - Referenced in 4 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "4"
},
{
"name": "skills",
"value": "analyzing-windows-event-logs-in-splunk, building-detection-rule-with-splunk-spl, implementing-siem-use-cases-for-detection, performing-false-positive-reduction-in-siem"
}
]
},
{
"techniqueID": "T1110.002",
"score": 4,
"comment": "Password Cracking - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "exploiting-kerberoasting-with-impacket"
}
]
},
{
"techniqueID": "T1110.003",
"score": 4,
"comment": "Password Spraying - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "implementing-siem-use-cases-for-detection"
}
]
},
{
"techniqueID": "T1112",
"score": 4,
"comment": "Modify Registry - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "detecting-fileless-malware-techniques"
}
]
},
{
"techniqueID": "T1114.002",
"score": 4,
"comment": "Remote Email Collection - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "detecting-email-forwarding-rules-attack"
}
]
},
{
"techniqueID": "T1114.003",
"score": 8,
"comment": "Email Forwarding Rule - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "detecting-business-email-compromise, detecting-email-forwarding-rules-attack"
}
]
},
{
"techniqueID": "T1127",
"score": 8,
"comment": "Trusted Developer Utilities Proxy Execution - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "detecting-evasion-techniques-in-endpoint-logs, detecting-living-off-the-land-with-lolbas"
}
]
},
{
"techniqueID": "T1127.001",
"score": 4,
"comment": "MSBuild - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "hunting-for-lolbins-execution-in-endpoint-logs"
}
]
},
{
"techniqueID": "T1132",
"score": 4,
"comment": "Data Encoding - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "hunting-for-command-and-control-beaconing"
}
]
},
{
"techniqueID": "T1132.001",
"score": 4,
"comment": "Standard Encoding - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "building-c2-infrastructure-with-sliver-framework"
}
]
},
{
"techniqueID": "T1133",
"score": 4,
"comment": "External Remote Services - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-threat-landscape-assessment-for-sector"
}
]
},
{
"techniqueID": "T1134",
"score": 8,
"comment": "Access Token Manipulation - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "analyzing-windows-event-logs-in-splunk, detecting-privilege-escalation-attempts"
}
]
},
{
"techniqueID": "T1134.001",
"score": 4,
"comment": "Token Impersonation/Theft - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "exploiting-constrained-delegation-abuse"
}
]
},
{
"techniqueID": "T1134.005",
"score": 4,
"comment": "SID-History Injection - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-active-directory-compromise-investigation"
}
]
},
{
"techniqueID": "T1136",
"score": 8,
"comment": "Create Account - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "detecting-privilege-escalation-in-kubernetes-pods, implementing-mitre-attack-coverage-mapping"
}
]
},
{
"techniqueID": "T1136.001",
"score": 4,
"comment": "Local Account - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "analyzing-windows-event-logs-in-splunk"
}
]
},
{
"techniqueID": "T1136.002",
"score": 4,
"comment": "Domain Account - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "exploiting-nopac-cve-2021-42278-42287"
}
]
},
{
"techniqueID": "T1140",
"score": 12,
"comment": "Deobfuscate/Decode Files or Information - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "detecting-living-off-the-land-with-lolbas, hunting-for-living-off-the-land-binaries, hunting-for-lolbins-execution-in-endpoint-logs"
}
]
},
{
"techniqueID": "T1190",
"score": 15,
"comment": "Exploit Public-Facing Application - Referenced in 4 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "4"
},
{
"name": "skills",
"value": "conducting-full-scope-red-team-engagement, exploiting-ms17-010-eternalblue-vulnerability, hunting-for-webshell-activity, performing-threat-landscape-assessment-for-sector"
}
]
},
{
"techniqueID": "T1195",
"score": 8,
"comment": "Supply Chain Compromise - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "analyzing-supply-chain-malware-artifacts, performing-threat-landscape-assessment-for-sector"
}
]
},
{
"techniqueID": "T1195.001",
"score": 4,
"comment": "Compromise Software Dependencies - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "hunting-for-supply-chain-compromise"
}
]
},
{
"techniqueID": "T1195.002",
"score": 4,
"comment": "Compromise Software Supply Chain - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "hunting-for-supply-chain-compromise"
}
]
},
{
"techniqueID": "T1197",
"score": 8,
"comment": "BITS Jobs - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "hunting-for-living-off-the-land-binaries, hunting-for-lolbins-execution-in-endpoint-logs"
}
]
},
{
"techniqueID": "T1199",
"score": 8,
"comment": "Trusted Relationship - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "hunting-for-supply-chain-compromise, performing-physical-intrusion-assessment"
}
]
},
{
"techniqueID": "T1200",
"score": 4,
"comment": "Hardware Additions - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-physical-intrusion-assessment"
}
]
},
{
"techniqueID": "T1204.001",
"score": 4,
"comment": "Malicious Link - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "conducting-spearphishing-simulation-campaign"
}
]
},
{
"techniqueID": "T1204.002",
"score": 23,
"comment": "Malicious File - Referenced in 6 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "6"
},
{
"name": "skills",
"value": "analyzing-macro-malware-in-office-documents, conducting-full-scope-red-team-engagement, conducting-spearphishing-simulation-campaign, implementing-siem-use-cases-for-detection, performing-dynamic-analysis-with-any-run (+1 more)"
}
]
},
{
"techniqueID": "T1210",
"score": 8,
"comment": "Exploitation of Remote Services - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "exploiting-ms17-010-eternalblue-vulnerability, exploiting-zerologon-vulnerability-cve-2020-1472"
}
]
},
{
"techniqueID": "T1213",
"score": 4,
"comment": "Data from Information Repositories - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "conducting-full-scope-red-team-engagement"
}
]
},
{
"techniqueID": "T1218",
"score": 23,
"comment": "System Binary Proxy Execution - Referenced in 6 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "6"
},
{
"name": "skills",
"value": "detecting-evasion-techniques-in-endpoint-logs, detecting-living-off-the-land-with-lolbas, hunting-advanced-persistent-threats, hunting-for-living-off-the-land-binaries, hunting-for-lolbins-execution-in-endpoint-logs (+1 more)"
}
]
},
{
"techniqueID": "T1218.001",
"score": 8,
"comment": "Compiled HTML File - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "hunting-for-living-off-the-land-binaries, hunting-for-lolbins-execution-in-endpoint-logs"
}
]
},
{
"techniqueID": "T1218.002",
"score": 4,
"comment": "Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "hunting-for-living-off-the-land-binaries"
}
]
},
{
"techniqueID": "T1218.003",
"score": 8,
"comment": "CMSTP - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "hunting-for-living-off-the-land-binaries, hunting-for-lolbins-execution-in-endpoint-logs"
}
]
},
{
"techniqueID": "T1218.005",
"score": 12,
"comment": "Mshta - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "detecting-fileless-malware-techniques, hunting-for-living-off-the-land-binaries, hunting-for-lolbins-execution-in-endpoint-logs"
}
]
},
{
"techniqueID": "T1218.010",
"score": 8,
"comment": "Regsvr32 - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "hunting-for-living-off-the-land-binaries, hunting-for-lolbins-execution-in-endpoint-logs"
}
]
},
{
"techniqueID": "T1218.011",
"score": 12,
"comment": "Rundll32 - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "hunting-for-living-off-the-land-binaries, hunting-for-lolbins-execution-in-endpoint-logs, performing-dynamic-analysis-with-any-run"
}
]
},
{
"techniqueID": "T1222.001",
"score": 4,
"comment": "Windows - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "conducting-domain-persistence-with-dcsync"
}
]
},
{
"techniqueID": "T1482",
"score": 12,
"comment": "Domain Trust Discovery - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "conducting-internal-reconnaissance-with-bloodhound-ce, exploiting-active-directory-with-bloodhound, performing-active-directory-bloodhound-analysis"
}
]
},
{
"techniqueID": "T1484",
"score": 8,
"comment": "Domain Policy Modification - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "exploiting-active-directory-certificate-services-esc1, performing-active-directory-vulnerability-assessment"
}
]
},
{
"techniqueID": "T1484.001",
"score": 4,
"comment": "Group Policy Modification - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-active-directory-compromise-investigation"
}
]
},
{
"techniqueID": "T1485",
"score": 4,
"comment": "Data Destruction - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "hunting-for-shadow-copy-deletion"
}
]
},
{
"techniqueID": "T1486",
"score": 23,
"comment": "Data Encrypted for Impact - Referenced in 6 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "6"
},
{
"name": "skills",
"value": "conducting-full-scope-red-team-engagement, hunting-for-shadow-copy-deletion, implementing-honeypot-for-ransomware-detection, implementing-mitre-attack-coverage-mapping, performing-purple-team-exercise (+1 more)"
}
]
},
{
"techniqueID": "T1489",
"score": 4,
"comment": "Service Stop - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "conducting-full-scope-red-team-engagement"
}
]
},
{
"techniqueID": "T1490",
"score": 12,
"comment": "Inhibit System Recovery - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "building-soc-playbook-for-ransomware, hunting-for-shadow-copy-deletion, performing-purple-team-exercise"
}
]
},
{
"techniqueID": "T1497",
"score": 4,
"comment": "Virtualization/Sandbox Evasion - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "analyzing-malware-sandbox-evasion-techniques"
}
]
},
{
"techniqueID": "T1505.003",
"score": 8,
"comment": "Web Shell - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "building-attack-pattern-library-from-cti-reports, hunting-for-webshell-activity"
}
]
},
{
"techniqueID": "T1528",
"score": 4,
"comment": "Steal Application Access Token - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "detecting-azure-service-principal-abuse"
}
]
},
{
"techniqueID": "T1530",
"score": 12,
"comment": "Data from Cloud Storage Object - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "detecting-insider-threat-behaviors, implementing-mitre-attack-coverage-mapping, performing-cloud-incident-containment-procedures"
}
]
},
{
"techniqueID": "T1534",
"score": 4,
"comment": "Internal Spearphishing - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "implementing-mitre-attack-coverage-mapping"
}
]
},
{
"techniqueID": "T1537",
"score": 19,
"comment": "Transfer Data to Cloud Account - Referenced in 5 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "5"
},
{
"name": "skills",
"value": "hunting-for-data-exfiltration-indicators, hunting-for-living-off-the-cloud-techniques, implementing-mitre-attack-coverage-mapping, implementing-threat-modeling-with-mitre-attack, performing-cloud-incident-containment-procedures"
}
]
},
{
"techniqueID": "T1539",
"score": 8,
"comment": "Steal Web Session Cookie - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "performing-credential-access-with-lazagne, performing-initial-access-with-evilginx3"
}
]
},
{
"techniqueID": "T1543",
"score": 8,
"comment": "Create or Modify System Process - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "analyzing-persistence-mechanisms-in-linux, hunting-for-persistence-mechanisms-in-windows"
}
]
},
{
"techniqueID": "T1543.002",
"score": 4,
"comment": "Systemd Service - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-privilege-escalation-on-linux"
}
]
},
{
"techniqueID": "T1543.003",
"score": 12,
"comment": "Windows Service - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "hunting-for-persistence-mechanisms-in-windows, hunting-for-unusual-service-installations, implementing-mitre-attack-coverage-mapping"
}
]
},
{
"techniqueID": "T1546",
"score": 4,
"comment": "Event Triggered Execution - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "analyzing-persistence-mechanisms-in-linux"
}
]
},
{
"techniqueID": "T1546.003",
"score": 19,
"comment": "WMI Event Subscription - Referenced in 5 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "5"
},
{
"name": "skills",
"value": "analyzing-windows-event-logs-in-splunk, detecting-fileless-malware-techniques, detecting-wmi-persistence, hunting-for-persistence-mechanisms-in-windows, hunting-for-persistence-via-wmi-subscriptions"
}
]
},
{
"techniqueID": "T1546.010",
"score": 4,
"comment": "AppInit DLLs - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "hunting-for-persistence-mechanisms-in-windows"
}
]
},
{
"techniqueID": "T1546.012",
"score": 8,
"comment": "IFEO Injection - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "hunting-for-persistence-mechanisms-in-windows, hunting-for-registry-persistence-mechanisms"
}
]
},
{
"techniqueID": "T1546.015",
"score": 8,
"comment": "COM Hijacking - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "hunting-for-persistence-mechanisms-in-windows, hunting-for-registry-persistence-mechanisms"
}
]
},
{
"techniqueID": "T1547",
"score": 23,
"comment": "Boot or Logon Autostart Execution - Referenced in 6 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "6"
},
{
"name": "skills",
"value": "analyzing-apt-group-with-mitre-navigator, analyzing-malware-persistence-with-autoruns, hunting-advanced-persistent-threats, hunting-for-persistence-mechanisms-in-windows, implementing-siem-use-cases-for-detection (+1 more)"
}
]
},
{
"techniqueID": "T1547.001",
"score": 50,
"comment": "Registry Run Keys / Startup Folder - Referenced in 13 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "13"
},
{
"name": "skills",
"value": "analyzing-apt-group-with-mitre-navigator, analyzing-windows-event-logs-in-splunk, building-attack-pattern-library-from-cti-reports, conducting-full-scope-red-team-engagement, hunting-for-persistence-mechanisms-in-windows (+8 more)"
}
]
},
{
"techniqueID": "T1547.004",
"score": 8,
"comment": "Winlogon Helper DLL - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "hunting-for-persistence-mechanisms-in-windows, hunting-for-registry-persistence-mechanisms"
}
]
},
{
"techniqueID": "T1547.005",
"score": 4,
"comment": "Security Support Provider - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "hunting-for-persistence-mechanisms-in-windows"
}
]
},
{
"techniqueID": "T1548",
"score": 15,
"comment": "Abuse Elevation Control Mechanism - Referenced in 4 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "4"
},
{
"name": "skills",
"value": "detecting-container-escape-attempts, detecting-privilege-escalation-in-kubernetes-pods, detecting-t1548-abuse-elevation-control-mechanism, performing-privilege-escalation-assessment"
}
]
},
{
"techniqueID": "T1548.001",
"score": 12,
"comment": "Setuid and Setgid - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "detecting-privilege-escalation-in-kubernetes-pods, detecting-t1548-abuse-elevation-control-mechanism, performing-privilege-escalation-on-linux"
}
]
},
{
"techniqueID": "T1548.002",
"score": 12,
"comment": "Bypass User Account Control - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "conducting-full-scope-red-team-engagement, detecting-privilege-escalation-attempts, detecting-t1548-abuse-elevation-control-mechanism"
}
]
},
{
"techniqueID": "T1548.003",
"score": 12,
"comment": "Sudo and Sudo Caching - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "detecting-t1548-abuse-elevation-control-mechanism, performing-privilege-escalation-assessment, performing-privilege-escalation-on-linux"
}
]
},
{
"techniqueID": "T1548.004",
"score": 4,
"comment": "Elevated Execution with Prompt - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "detecting-t1548-abuse-elevation-control-mechanism"
}
]
},
{
"techniqueID": "T1550",
"score": 4,
"comment": "Use Alternate Authentication Material - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-lateral-movement-detection"
}
]
},
{
"techniqueID": "T1550.002",
"score": 35,
"comment": "Pass the Hash - Referenced in 9 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "9"
},
{
"name": "skills",
"value": "analyzing-windows-event-logs-in-splunk, building-attack-pattern-library-from-cti-reports, conducting-full-scope-red-team-engagement, detecting-lateral-movement-in-network, detecting-pass-the-hash-attacks (+4 more)"
}
]
},
{
"techniqueID": "T1550.003",
"score": 15,
"comment": "Pass the Ticket - Referenced in 4 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "4"
},
{
"name": "skills",
"value": "conducting-pass-the-ticket-attack, detecting-pass-the-hash-attacks, detecting-pass-the-ticket-attacks, exploiting-constrained-delegation-abuse"
}
]
},
{
"techniqueID": "T1550.004",
"score": 4,
"comment": "Web Session Cookie - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-initial-access-with-evilginx3"
}
]
},
{
"techniqueID": "T1552",
"score": 4,
"comment": "Unsecured Credentials - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-cloud-incident-containment-procedures"
}
]
},
{
"techniqueID": "T1552.001",
"score": 4,
"comment": "Credentials In Files - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-credential-access-with-lazagne"
}
]
},
{
"techniqueID": "T1552.002",
"score": 4,
"comment": "Credentials in Registry - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-credential-access-with-lazagne"
}
]
},
{
"techniqueID": "T1552.005",
"score": 4,
"comment": "Cloud Instance Metadata API - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "conducting-cloud-penetration-testing"
}
]
},
{
"techniqueID": "T1555",
"score": 4,
"comment": "Credentials from Password Stores - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-credential-access-with-lazagne"
}
]
},
{
"techniqueID": "T1555.003",
"score": 4,
"comment": "Web Browsers - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-credential-access-with-lazagne"
}
]
},
{
"techniqueID": "T1555.004",
"score": 4,
"comment": "Windows Credential Manager - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-credential-access-with-lazagne"
}
]
},
{
"techniqueID": "T1556",
"score": 4,
"comment": "Modify Authentication Process - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-initial-access-with-evilginx3"
}
]
},
{
"techniqueID": "T1557",
"score": 4,
"comment": "Adversary-in-the-Middle - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-initial-access-with-evilginx3"
}
]
},
{
"techniqueID": "T1557.001",
"score": 8,
"comment": "LLMNR/NBT-NS Poisoning - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "conducting-internal-network-penetration-test, hunting-for-ntlm-relay-attacks"
}
]
},
{
"techniqueID": "T1558",
"score": 19,
"comment": "Steal or Forge Kerberos Tickets - Referenced in 5 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "5"
},
{
"name": "skills",
"value": "analyzing-windows-event-logs-in-splunk, conducting-pass-the-ticket-attack, exploiting-kerberoasting-with-impacket, exploiting-nopac-cve-2021-42278-42287, performing-lateral-movement-detection"
}
]
},
{
"techniqueID": "T1558.001",
"score": 27,
"comment": "Golden Ticket - Referenced in 7 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "7"
},
{
"name": "skills",
"value": "analyzing-windows-event-logs-in-splunk, conducting-domain-persistence-with-dcsync, detecting-golden-ticket-forgery, detecting-kerberoasting-attacks, detecting-mimikatz-execution-patterns (+2 more)"
}
]
},
{
"techniqueID": "T1558.002",
"score": 4,
"comment": "Silver Ticket - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-active-directory-compromise-investigation"
}
]
},
{
"techniqueID": "T1558.003",
"score": 54,
"comment": "Kerberoasting - Referenced in 14 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "14"
},
{
"name": "skills",
"value": "analyzing-windows-event-logs-in-splunk, building-attack-pattern-library-from-cti-reports, conducting-full-scope-red-team-engagement, conducting-internal-network-penetration-test, detecting-kerberoasting-attacks (+9 more)"
}
]
},
{
"techniqueID": "T1558.004",
"score": 4,
"comment": "AS-REP Roasting - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "detecting-kerberoasting-attacks"
}
]
},
{
"techniqueID": "T1560",
"score": 8,
"comment": "Archive Collected Data - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "conducting-full-scope-red-team-engagement, hunting-for-data-staging-before-exfiltration"
}
]
},
{
"techniqueID": "T1562",
"score": 4,
"comment": "Impair Defenses - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "detecting-evasion-techniques-in-endpoint-logs"
}
]
},
{
"techniqueID": "T1562.001",
"score": 4,
"comment": "Disable or Modify Tools - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "detecting-suspicious-powershell-execution"
}
]
},
{
"techniqueID": "T1566",
"score": 23,
"comment": "Phishing - Referenced in 6 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "6"
},
{
"name": "skills",
"value": "analyzing-apt-group-with-mitre-navigator, analyzing-threat-actor-ttps-with-mitre-attack, analyzing-threat-landscape-with-misp, building-attack-pattern-library-from-cti-reports, implementing-mitre-attack-coverage-mapping (+1 more)"
}
]
},
{
"techniqueID": "T1566.001",
"score": 58,
"comment": "Spearphishing Attachment - Referenced in 15 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "15"
},
{
"name": "skills",
"value": "analyzing-apt-group-with-mitre-navigator, analyzing-macro-malware-in-office-documents, analyzing-threat-actor-ttps-with-mitre-navigator, building-attack-pattern-library-from-cti-reports, conducting-full-scope-red-team-engagement (+10 more)"
}
]
},
{
"techniqueID": "T1566.002",
"score": 23,
"comment": "Spearphishing Link - Referenced in 6 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "6"
},
{
"name": "skills",
"value": "building-attack-pattern-library-from-cti-reports, conducting-spearphishing-simulation-campaign, hunting-for-spearphishing-indicators, implementing-continuous-security-validation-with-bas, implementing-mitre-attack-coverage-mapping (+1 more)"
}
]
},
{
"techniqueID": "T1566.003",
"score": 12,
"comment": "Spearphishing via Service - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "conducting-spearphishing-simulation-campaign, hunting-for-spearphishing-indicators, implementing-continuous-security-validation-with-bas"
}
]
},
{
"techniqueID": "T1566.004",
"score": 4,
"comment": "Spearphishing Voice - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "conducting-social-engineering-pretext-call"
}
]
},
{
"techniqueID": "T1567",
"score": 15,
"comment": "Exfiltration Over Web Service - Referenced in 4 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "4"
},
{
"name": "skills",
"value": "detecting-insider-threat-behaviors, hunting-for-data-exfiltration-indicators, hunting-for-living-off-the-cloud-techniques, implementing-continuous-security-validation-with-bas"
}
]
},
{
"techniqueID": "T1567.002",
"score": 4,
"comment": "Exfiltration to Cloud Storage - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "hunting-for-data-exfiltration-indicators"
}
]
},
{
"techniqueID": "T1568",
"score": 8,
"comment": "Dynamic Resolution - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "hunting-for-command-and-control-beaconing, implementing-mitre-attack-coverage-mapping"
}
]
},
{
"techniqueID": "T1568.002",
"score": 4,
"comment": "Domain Generation Algorithms - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "hunting-for-beaconing-with-frequency-analysis"
}
]
},
{
"techniqueID": "T1569.002",
"score": 12,
"comment": "Service Execution - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "detecting-lateral-movement-in-network, detecting-lateral-movement-with-splunk, exploiting-ms17-010-eternalblue-vulnerability"
}
]
},
{
"techniqueID": "T1570",
"score": 12,
"comment": "Lateral Tool Transfer - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "detecting-lateral-movement-in-network, detecting-lateral-movement-with-splunk, performing-lateral-movement-with-wmiexec"
}
]
},
{
"techniqueID": "T1571",
"score": 8,
"comment": "Non-Standard Port - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "hunting-for-unusual-network-connections, implementing-mitre-attack-coverage-mapping"
}
]
},
{
"techniqueID": "T1572",
"score": 15,
"comment": "Protocol Tunneling - Referenced in 4 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "4"
},
{
"name": "skills",
"value": "building-c2-infrastructure-with-sliver-framework, hunting-for-command-and-control-beaconing, hunting-for-dns-tunneling-with-zeek, implementing-mitre-attack-coverage-mapping"
}
]
},
{
"techniqueID": "T1573",
"score": 15,
"comment": "Encrypted Channel - Referenced in 4 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "4"
},
{
"name": "skills",
"value": "analyzing-ransomware-network-indicators, hunting-for-beaconing-with-frequency-analysis, hunting-for-command-and-control-beaconing, implementing-mitre-attack-coverage-mapping"
}
]
},
{
"techniqueID": "T1573.002",
"score": 8,
"comment": "Asymmetric Cryptography - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "building-c2-infrastructure-with-sliver-framework, building-red-team-c2-infrastructure-with-havoc"
}
]
},
{
"techniqueID": "T1574",
"score": 4,
"comment": "Hijack Execution Flow - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "analyzing-persistence-mechanisms-in-linux"
}
]
},
{
"techniqueID": "T1574.001",
"score": 8,
"comment": "DLL Search Order Hijacking - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "detecting-dll-sideloading-attacks, hunting-for-persistence-mechanisms-in-windows"
}
]
},
{
"techniqueID": "T1574.002",
"score": 15,
"comment": "DLL Side-Loading - Referenced in 4 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "4"
},
{
"name": "skills",
"value": "analyzing-windows-event-logs-in-splunk, building-attack-pattern-library-from-cti-reports, detecting-dll-sideloading-attacks, implementing-siem-use-cases-for-detection"
}
]
},
{
"techniqueID": "T1574.006",
"score": 8,
"comment": "Dynamic Linker Hijacking - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "detecting-dll-sideloading-attacks, performing-privilege-escalation-on-linux"
}
]
},
{
"techniqueID": "T1574.008",
"score": 4,
"comment": "Path Interception by Search Order Hijacking - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "detecting-dll-sideloading-attacks"
}
]
},
{
"techniqueID": "T1574.009",
"score": 4,
"comment": "Unquoted Service Path - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "detecting-privilege-escalation-attempts"
}
]
},
{
"techniqueID": "T1578",
"score": 4,
"comment": "Modify Cloud Compute Infrastructure - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-cloud-incident-containment-procedures"
}
]
},
{
"techniqueID": "T1580",
"score": 4,
"comment": "Cloud Infrastructure Discovery - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "implementing-mitre-attack-coverage-mapping"
}
]
},
{
"techniqueID": "T1583.001",
"score": 15,
"comment": "Domains - Referenced in 4 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "4"
},
{
"name": "skills",
"value": "building-red-team-c2-infrastructure-with-havoc, conducting-full-scope-red-team-engagement, conducting-spearphishing-simulation-campaign, implementing-mitre-attack-coverage-mapping"
}
]
},
{
"techniqueID": "T1583.003",
"score": 4,
"comment": "Virtual Private Server - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "building-red-team-c2-infrastructure-with-havoc"
}
]
},
{
"techniqueID": "T1585.002",
"score": 4,
"comment": "Email Accounts - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "conducting-spearphishing-simulation-campaign"
}
]
},
{
"techniqueID": "T1587.001",
"score": 8,
"comment": "Malware - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "building-red-team-c2-infrastructure-with-havoc, conducting-full-scope-red-team-engagement"
}
]
},
{
"techniqueID": "T1589",
"score": 12,
"comment": "Gather Victim Identity Information - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "conducting-full-scope-red-team-engagement, conducting-social-engineering-pretext-call, performing-open-source-intelligence-gathering"
}
]
},
{
"techniqueID": "T1590",
"score": 4,
"comment": "Gather Victim Network Information - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-open-source-intelligence-gathering"
}
]
},
{
"techniqueID": "T1591",
"score": 12,
"comment": "Gather Victim Org Information - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "collecting-open-source-intelligence, conducting-social-engineering-pretext-call, performing-open-source-intelligence-gathering"
}
]
},
{
"techniqueID": "T1592",
"score": 4,
"comment": "Gather Victim Host Information - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-open-source-intelligence-gathering"
}
]
},
{
"techniqueID": "T1593",
"score": 8,
"comment": "Search Open Websites/Domains - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "conducting-full-scope-red-team-engagement, performing-open-source-intelligence-gathering"
}
]
},
{
"techniqueID": "T1594",
"score": 4,
"comment": "Search Victim-Owned Websites - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-open-source-intelligence-gathering"
}
]
},
{
"techniqueID": "T1595.001",
"score": 4,
"comment": "Scanning IP Blocks - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-open-source-intelligence-gathering"
}
]
},
{
"techniqueID": "T1595.002",
"score": 4,
"comment": "Vulnerability Scanning - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-open-source-intelligence-gathering"
}
]
},
{
"techniqueID": "T1596",
"score": 4,
"comment": "Search Open Technical Databases - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "performing-open-source-intelligence-gathering"
}
]
},
{
"techniqueID": "T1598",
"score": 4,
"comment": "Phishing for Information - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "conducting-social-engineering-pretext-call"
}
]
},
{
"techniqueID": "T1598.003",
"score": 8,
"comment": "Spearphishing Link/Voice - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "conducting-social-engineering-pretext-call, conducting-spearphishing-simulation-campaign"
}
]
},
{
"techniqueID": "T1608.001",
"score": 4,
"comment": "Upload Malware - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "conducting-spearphishing-simulation-campaign"
}
]
},
{
"techniqueID": "T1608.005",
"score": 4,
"comment": "Link Target - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "conducting-spearphishing-simulation-campaign"
}
]
},
{
"techniqueID": "T1610",
"score": 8,
"comment": "Deploy Container - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "detecting-container-escape-attempts, detecting-container-escape-with-falco-rules"
}
]
},
{
"techniqueID": "T1611",
"score": 8,
"comment": "Escape to Host - Referenced in 2 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "2"
},
{
"name": "skills",
"value": "detecting-container-escape-attempts, detecting-container-escape-with-falco-rules"
}
]
},
{
"techniqueID": "T1615",
"score": 12,
"comment": "Group Policy Discovery - Referenced in 3 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "3"
},
{
"name": "skills",
"value": "conducting-internal-reconnaissance-with-bloodhound-ce, exploiting-active-directory-with-bloodhound, performing-active-directory-bloodhound-analysis"
}
]
},
{
"techniqueID": "T1649",
"score": 4,
"comment": "Steal or Forge Authentication Certificates - Referenced in 1 skill(s)",
"enabled": true,
"metadata": [
{
"name": "skill_count",
"value": "1"
},
{
"name": "skills",
"value": "exploiting-active-directory-certificate-services-esc1"
}
]
}
],
"gradient": {
"colors": [
"#cfe2f3",
"#6fa8dc",
"#1155cc"
],
"minValue": 1,
"maxValue": 100
},
"legendItems": [
{
"label": "1-2 skills (Low coverage)",
"color": "#cfe2f3"
},
{
"label": "3-5 skills (Moderate coverage)",
"color": "#6fa8dc"
},
{
"label": "6-10 skills (Good coverage)",
"color": "#3d85c6"
},
{
"label": "11+ skills (Strong coverage)",
"color": "#1155cc"
}
],
"showTacticRowBackground": true,
"tacticRowBackground": "#205080",
"selectTechniquesAcrossTactics": true,
"selectSubtechniquesWithParent": true,
"selectVisibleTechniques": false,
"metadata": [
{
"name": "repository",
"value": "Anthropic-Cybersecurity-Skills"
},
{
"name": "total_techniques",
"value": "218"
},
{
"name": "total_skills_scanned",
"value": "742"
},
{
"name": "generated_date",
"value": "2026-03-11"
},
{
"name": "attack_version",
"value": "14"
},
{
"name": "description",
"value": "Auto-generated from skill SKILL.md files referencing ATT&CK technique IDs"
}
],
"links": [
{
"label": "Repository",
"url": "https://github.com/anthropics/cybersecurity-skills"
},
{
"label": "ATT&CK Navigator",
"url": "https://mitre-attack.github.io/attack-navigator/"
}
]
}
Reference in New Issue View Git Blame Copy Permalink