hunters

T1106Native API

The threat actor utilizes the application programming interface to execute malicious behaviors.

T1129Shared Modules

The threat actor executes payloads by loading shared modules.

T1547Boot or Logon Autostart Execution

The threat actor may set system configurations to automatically execute malware during system startup or login.

T1027Obfuscated Files or Information

The threat actor utilizes obfuscation on files used for their attack, encrypting, encoding, or obfuscating their content.

T1562Impair Defenses

The actor may maliciously modify victim environment components to hinder or disable defense mechanisms.

T1057Process Discovery

The threat actor may attempt to gather information about running processes on a system.

T1082System Information Discovery

The actor may try to obtain detailed information about the operating system and hardware, including version, patches, hotfixes, and other details.

T1083File and Directory Discovery

The threat actor may enumerate files and directories or search specific locations on a host or network share for certain information within a file system.

T1071Application Layer Protocol

The threat actor can communicate using OSI application layer protocols to avoid network detection/filtering, blending in with existing traffic.

T1071.001Application Layer Protocol: Web Protocols

The threat actor can communicate using web traffic associated application layer protocols to avoid detection.

T1486Data Encrypted for Impact

The threat actor can encrypt data on the target system or on a large number of systems to disrupt system availability.