bianlian

T1059Command and Scripting Interpreter

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

T1204User Execution

An adversary may rely upon specific actions by a user in order to gain execution.

T1027.002Software Packing

Adversaries may perform software packing or virtual machine software protection to conceal their code.

T1036Masquerading

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

T1497Virtualization/Sandbox Evasion

Adversaries may employ various means to detect and avoid virtualization and analysis environments.

T1082System Information Discovery

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

T1083File and Directory Discovery

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

T1120Peripheral Device Discovery

Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.

T1518.001Security Software Discovery

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

T1091Replication Through Removable Media

Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes.

T1486Data Encrypted for Impact

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.