APT 组织技战术 · 机器可读聚合

基于 MITRE ATT&CK，但不局限于 MITRE ATT&CK，紧跟最新的 APT 组织、TTP 和 IOC。

193 组织 · 855 技术 · 4,815 TTP 记录 · 30 合成 IOC 已标注 · ATT&CK 20.1 · seq 10305

最近情报

按写入序读取；卡片链到组织档案

ToddyCat 使用 Archive via Utility

2024– verified ATT&CK

tech_t1560.001 · year · MITRE ATT&CK

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more sec…

Earth Lusca 使用 Malicious Link

2022– verified ATT&CK

tech_t1204.001 · year · MITRE ATT&CK

An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will…

menuPass 使用 DLL

2017– verified ATT&CK

tech_t1574.001 · year · MITRE ATT&CK

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by mult…

Rocke 使用 Security Software Discovery

2020– verified ATT&CK

tech_t1518.001 · year · MITRE ATT&CK

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agen…

APT41 使用 DLL

2019– verified ATT&CK

tech_t1574.001 · year · MITRE ATT&CK

LazyScripter 使用 Web Services

2021– verified ATT&CK

tech_t1583.006 · year · MITRE ATT&CK

Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversar…

BlackTech 使用 Digital Certificates

2020– verified ATT&CK

tech_t1588.004 · year · MITRE ATT&CK

Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity…

Ember Bear 使用 Network Service Discovery

2022– verified ATT&CK

tech_t1046 · year · MITRE ATT&CK

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire th…

BRONZE BUTLER 使用 Right-to-Left Override

2018– verified ATT&CK

tech_t1036.002 · year · MITRE ATT&CK

Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. RTLO is a non-printing Unicode character that causes the text that follow…