| PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
Local Account - T1087.001 (25659dd6-ea12-45c4-97e6-381e3e4b593e) |
Attack Pattern |
1 |
| Keylogging - T1056.001 (09a60ea3-a8d1-4ae5-976e-5783248b72a4) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| LLMNR/NBT-NS Poisoning and SMB Relay - T1557.001 (650c784b-7504-4df7-ab2c-4ea882384d1e) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| Process Injection - T1055 (43e7dc91-05b2-474c-b9ac-2ed4fe101f4d) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| Brute Force - T1110 (a93494bb-4b80-4ea1-8695-3236a49916fd) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| Exploitation of Remote Services - T1210 (9db0cf3a-a3c9-4012-8268-123b9db6fd82) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| Access Token Manipulation - T1134 (dcaa092b-7de9-4a21-977f-7fcb77e89c48) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| System Information Discovery - T1082 (354a7f88-63fb-41b5-a801-ce3b377b36f1) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| System Network Configuration Discovery - T1016 (707399d6-ab3e-4963-9315-d9d3818cd6a0) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
Create Process with Token - T1134.002 (677569f9-a8b0-459e-ab24-7f18091fa7bf) |
Attack Pattern |
1 |
| Windows Management Instrumentation Event Subscription - T1546.003 (910906dd-8c0a-475a-9cc1-5e029e2fad58) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
Domain Trust Discovery - T1482 (767dbf9e-df3f-45cb-8998-4903ab5f80c0) |
Attack Pattern |
1 |
| Domain Account - T1087.002 (21875073-b0ee-49e3-9077-1e2a885359af) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| LSASS Memory - T1003.001 (65f2d882-3f41-4d48-8a06-29af77ec9f90) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| Network Service Discovery - T1046 (e3a12395-188d-4051-9a16-ea8e14d07b88) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| Windows Management Instrumentation - T1047 (01a5a209-b94c-450b-b7f9-946497d91055) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| Service Execution - T1569.002 (f1951e8a-500e-4a26-8803-76d95c4554b4) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| Credentials from Password Stores - T1555 (3fc9b85a-2862-4363-a64d-d692e3ffbee0) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| Proxy - T1090 (731f4f55-b6d0-41d1-a7a9-072a66389aea) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| Automated Collection - T1119 (30208d3e-0d6b-43c8-883e-44462a514619) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| Archive via Utility - T1560.001 (00f90846-cbd1-4fc5-9233-df5c2bf2a662) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| File and Directory Discovery - T1083 (7bc57495-ea59-4380-be31-a64af124ef18) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| System Service Discovery - T1007 (322bad5a-1c49-4d23-ab79-76d641794afa) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| Bypass User Account Control - T1548.002 (120d5519-3098-4e1c-9191-2aa61232f073) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
Pass the Hash - T1550.002 (e624264c-033a-424d-9fd7-fc9c3bbdb03e) |
Attack Pattern |
1 |
| Password Policy Discovery - T1201 (b6075259-dba3-44e9-87c7-e954f37ec0d5) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| Credentials In Files - T1552.001 (837f9164-50af-4ac0-8219-379d8a74cefc) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| System Network Connections Discovery - T1049 (7e150503-88e7-4861-866b-ff1ac82c4475) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| Exploitation for Privilege Escalation - T1068 (b21c3b2d-02e6-45b1-980b-e69051040839) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| Local Groups - T1069.001 (a01bf75f-00b2-4568-a58f-565ff9bf202b) |
Attack Pattern |
PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
1 |
| PoshC2 - S0378 (4b57c098-f043-4da2-83ef-7588a6d426bc) |
mitre-tool |
Network Sniffing - T1040 (3257eb21-f9a7-4430-8de1-d8b6e288f529) |
Attack Pattern |
1 |
| Account Discovery - T1087 (72b74d71-8169-42aa-92e0-e7b04b9f5a08) |
Attack Pattern |
Local Account - T1087.001 (25659dd6-ea12-45c4-97e6-381e3e4b593e) |
Attack Pattern |
2 |
| Input Capture - T1056 (bb5a00de-e086-4859-a231-fa793f6797e2) |
Attack Pattern |
Keylogging - T1056.001 (09a60ea3-a8d1-4ae5-976e-5783248b72a4) |
Attack Pattern |
2 |
| Adversary-in-the-Middle - T1557 (035bb001-ab69-4a0b-9f6c-2de8b09e1b9d) |
Attack Pattern |
LLMNR/NBT-NS Poisoning and SMB Relay - T1557.001 (650c784b-7504-4df7-ab2c-4ea882384d1e) |
Attack Pattern |
2 |
| Access Token Manipulation - T1134 (dcaa092b-7de9-4a21-977f-7fcb77e89c48) |
Attack Pattern |
Create Process with Token - T1134.002 (677569f9-a8b0-459e-ab24-7f18091fa7bf) |
Attack Pattern |
2 |
| Event Triggered Execution - T1546 (b6301b64-ef57-4cce-bb0b-77026f14a8db) |
Attack Pattern |
Windows Management Instrumentation Event Subscription - T1546.003 (910906dd-8c0a-475a-9cc1-5e029e2fad58) |
Attack Pattern |
2 |
| Domain Account - T1087.002 (21875073-b0ee-49e3-9077-1e2a885359af) |
Attack Pattern |
Account Discovery - T1087 (72b74d71-8169-42aa-92e0-e7b04b9f5a08) |
Attack Pattern |
2 |
| LSASS Memory - T1003.001 (65f2d882-3f41-4d48-8a06-29af77ec9f90) |
Attack Pattern |
OS Credential Dumping - T1003 (0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22) |
Attack Pattern |
2 |
| System Services - T1569 (d157f9d2-d09a-4efa-bb2a-64963f94e253) |
Attack Pattern |
Service Execution - T1569.002 (f1951e8a-500e-4a26-8803-76d95c4554b4) |
Attack Pattern |
2 |
| Archive Collected Data - T1560 (53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a) |
Attack Pattern |
Archive via Utility - T1560.001 (00f90846-cbd1-4fc5-9233-df5c2bf2a662) |
Attack Pattern |
2 |
| Bypass User Account Control - T1548.002 (120d5519-3098-4e1c-9191-2aa61232f073) |
Attack Pattern |
Abuse Elevation Control Mechanism - T1548 (67720091-eee3-4d2d-ae16-8264567f6f5b) |
Attack Pattern |
2 |
| Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161) |
Attack Pattern |
Application Layer Protocol - T1071 (355be19c-ffc9-46d5-8d50-d6a036c675b6) |
Attack Pattern |
2 |
| Use Alternate Authentication Material - T1550 (51a14c76-dd3b-440b-9c20-2bf91d25a814) |
Attack Pattern |
Pass the Hash - T1550.002 (e624264c-033a-424d-9fd7-fc9c3bbdb03e) |
Attack Pattern |
2 |
| Unsecured Credentials - T1552 (435dfb86-2697-4867-85b5-2fef496c0517) |
Attack Pattern |
Credentials In Files - T1552.001 (837f9164-50af-4ac0-8219-379d8a74cefc) |
Attack Pattern |
2 |
| Permission Groups Discovery - T1069 (15dbf668-795c-41e6-8219-f0447c0e64ce) |
Attack Pattern |
Local Groups - T1069.001 (a01bf75f-00b2-4568-a58f-565ff9bf202b) |
Attack Pattern |
2 |