ATT&CK 战术技术矩阵

Scanning IP Blocks

Vulnerability Scanning

Wordlist Scanning

Hardware

Software

Firmware

Client Configurations

Credentials

Email Addresses

Employee Names

Domain Properties

DNS

Network Trust Dependencies

Network Topology

IP Addresses

Network Security Appliances

Determine Physical Locations

Business Relationships

Identify Business Tempo

Identify Roles

Spearphishing Service

Spearphishing Attachment

Spearphishing Link

Spearphishing Voice

Threat Intel Vendors

Purchase Technical Data

DNS/Passive DNS

WHOIS

Digital Certificates

CDNs

Scan Databases

Social Media

Search Engines

Code Repositories

Domains

DNS Server

Virtual Private Server

Server

Botnet

Web Services

Serverless

Malvertising

Social Media Accounts

Email Accounts

Cloud Accounts

Domains

DNS Server

Virtual Private Server

Server

Botnet

Web Services

Serverless

Network Devices

Malware

Code Signing Certificates

Digital Certificates

Exploits

Social Media Accounts

Email Accounts

Cloud Accounts

Written Content

Audio-Visual Content

Malware

Tool

Code Signing Certificates

Digital Certificates

Exploits

Vulnerabilities

Artificial Intelligence

Upload Malware

Upload Tool

Install Digital Certificate

Drive-by Target

Link Target

SEO Poisoning

Spearphishing Attachment

Spearphishing Link

Spearphishing via Service

Spearphishing Voice

Compromise Software Dependencies and Development Tools

Compromise Software Supply Chain

Compromise Hardware Supply Chain

Default Accounts

Domain Accounts

Local Accounts

Cloud Accounts

PowerShell

AppleScript

Windows Command Shell

Unix Shell

Visual Basic

Python

JavaScript

Network Device CLI

Cloud API

AutoHotKey & AutoIT

Lua

Hypervisor CLI

Container CLI/API

DLL

Dylib Hijacking

Executable Installer File Permissions Weakness

Dynamic Linker Hijacking

Path Interception by PATH Environment Variable

Path Interception by Search Order Hijacking

Path Interception by Unquoted Path

Services File Permissions Weakness

Services Registry Permissions Weakness

COR_PROFILER

KernelCallbackTable

AppDomainManager

Component Object Model

Dynamic Data Exchange

XPC Services

At

Cron

Launchd

Scheduled Task

Systemd Timers

Container Orchestration Job

Launchctl

Service Execution

Systemctl

MSBuild

ClickOnce

JamPlus

Malicious Link

Malicious File

Malicious Image

Malicious Copy and Paste

Malicious Library

Additional Cloud Credentials

Additional Email Delegate Permissions

Additional Cloud Roles

SSH Authorized Keys

Device Registration

Additional Container Cluster Roles

Additional Local or Domain Groups

Registry Run Keys / Startup Folder

Authentication Package

Time Providers

Winlogon Helper DLL

Security Support Provider

Kernel Modules and Extensions

Re-opened Applications

LSASS Driver

Shortcut Modification

Port Monitors

Print Processors

XDG Autostart Entries

Active Setup

Login Items

Logon Script (Windows)

Login Hook

Network Logon Script

RC Scripts

Startup Items

Local Account

Domain Account

Cloud Account

Launch Agent

Systemd Service

Windows Service

Launch Daemon

Container Service

Change Default File Association

Screensaver

Windows Management Instrumentation Event Subscription

Unix Shell Configuration Modification

Trap

LC_LOAD_DYLIB Addition

Netsh Helper DLL

Accessibility Features

AppCert DLLs

AppInit DLLs

Application Shimming

Image File Execution Options Injection

PowerShell Profile

Emond

Component Object Model Hijacking

Installer Packages

Udev Rules

Python Startup Hooks

Domain Controller Authentication

Password Filter DLL

Pluggable Authentication Modules

Network Device Authentication

Reversible Encryption

Multi-Factor Authentication

Hybrid Identity

Network Provider DLL

Conditional Access Policies

Office Template Macros

Office Test

Outlook Forms

Outlook Home Page

Outlook Rules

Add-ins

System Firmware

Component Firmware

Bootkit

ROMMONkit

TFTP Boot

At

Cron

Launchd

Scheduled Task

Systemd Timers

Container Orchestration Job

SQL Stored Procedures

Transport Agent

Web Shell

IIS Components

Terminal Services DLL

vSphere Installation Bundles

Browser Extensions

IDE Extensions

Port Knocking

Socket Filters

Default Accounts

Domain Accounts

Local Accounts

Cloud Accounts

Setuid and Setgid

Bypass User Account Control

Sudo and Sudo Caching

Elevated Execution with Prompt

Temporary Elevated Cloud Access

TCC Manipulation

Token Impersonation/Theft

Create Process with Token

Make and Impersonate Token

Parent PID Spoofing

SID-History Injection

Additional Cloud Credentials

Additional Email Delegate Permissions

Additional Cloud Roles

SSH Authorized Keys

Device Registration

Additional Container Cluster Roles

Additional Local or Domain Groups

Registry Run Keys / Startup Folder

Authentication Package

Time Providers

Winlogon Helper DLL

Security Support Provider

Kernel Modules and Extensions

Re-opened Applications

LSASS Driver

Shortcut Modification

Port Monitors

Print Processors

XDG Autostart Entries

Active Setup

Login Items

Logon Script (Windows)

Login Hook

Network Logon Script

RC Scripts

Startup Items

Launch Agent

Systemd Service

Windows Service

Launch Daemon

Container Service

Group Policy Modification

Trust Modification

Change Default File Association

Screensaver

Windows Management Instrumentation Event Subscription

Unix Shell Configuration Modification

Trap

LC_LOAD_DYLIB Addition

Netsh Helper DLL

Accessibility Features

AppCert DLLs

AppInit DLLs

Application Shimming

Image File Execution Options Injection

PowerShell Profile

Emond

Component Object Model Hijacking

Installer Packages

Udev Rules

Python Startup Hooks

Dynamic-link Library Injection

Portable Executable Injection

Thread Execution Hijacking

Asynchronous Procedure Call

Thread Local Storage

Ptrace System Calls

Proc Memory

Extra Window Memory Injection

Process Hollowing

Process Doppelgänging

VDSO Hijacking

ListPlanting

At

Cron

Launchd

Scheduled Task

Systemd Timers

Container Orchestration Job

Default Accounts

Domain Accounts

Local Accounts

Cloud Accounts

Token Impersonation/Theft

Create Process with Token

Make and Impersonate Token

Parent PID Spoofing

SID-History Injection

Environmental Keying

Mutual Exclusion

Hidden Files and Directories

Hidden Users

Hidden Window

NTFS File Attributes

Hidden File System

Run Virtual Instance

VBA Stomping

Email Hiding Rules

Resource Forking

Process Argument Spoofing

Ignore Process Interrupts

File/Path Exclusions

Bind Mounts

Extended Attributes

DLL

Dylib Hijacking

Executable Installer File Permissions Weakness

Dynamic Linker Hijacking

Path Interception by PATH Environment Variable

Path Interception by Search Order Hijacking

Path Interception by Unquoted Path

Services File Permissions Weakness

Services Registry Permissions Weakness

COR_PROFILER

KernelCallbackTable

AppDomainManager

Clear Command History

File Deletion

Network Share Connection Removal

Timestomp

Clear Network Connection History and Configurations

Clear Mailbox Data

Clear Persistence

Relocate Malware

Invalid Code Signature

Right-to-Left Override

Rename Legitimate Utilities

Masquerade Task or Service

Match Legitimate Resource Name or Location

Space after Filename

Double File Extension

Masquerade File Type

Break Process Trees

Masquerade Account Name

Overwrite Process Arguments

Browser Fingerprint

Binary Padding

Software Packing

Steganography

Compile After Delivery

Indicator Removal from Tools

HTML Smuggling

Dynamic API Resolution

Stripped Payloads

Embedded Payloads

Command Obfuscation

Fileless Storage

LNK Icon Smuggling

Encrypted/Encoded File

Polymorphic Code

Compression

Junk Code Insertion

SVG Smuggling

Invisible Unicode

System Firmware

Component Firmware

Bootkit

ROMMONkit

TFTP Boot

Dynamic-link Library Injection

Portable Executable Injection

Thread Execution Hijacking

Asynchronous Procedure Call

Thread Local Storage

Ptrace System Calls

Proc Memory

Extra Window Memory Injection

Process Hollowing

Process Doppelgänging

VDSO Hijacking

ListPlanting

Impersonation

Email Spoofing

Compiled HTML File

Control Panel

CMSTP

InstallUtil

Mshta

Msiexec

Odbcconf

Regsvcs/Regasm

Regsvr32

Rundll32

Verclsid

Mavinject

MMC

Electron Applications

PubPrn

SyncAppvPublishingServer

Port Knocking

Socket Filters

MSBuild

ClickOnce

JamPlus

Default Accounts

Domain Accounts

Local Accounts

Cloud Accounts

System Checks

User Activity Based Checks

Time Based Checks

Cloud Firewall

Network Device Firewall

Windows Host Firewall

Disable or Modify Windows Event Log

Disable or Modify Cloud Log

Modify or Spoof Tool UI

Disable or Modify Linux Audit System Log

Clear Windows Event Logs

Clear Linux or Mac System Logs

Group Policy Modification

Trust Modification

Windows Permissions

Linux and Mac Permissions

Domain Controller Authentication

Password Filter DLL

Pluggable Authentication Modules

Network Device Authentication

Reversible Encryption

Multi-Factor Authentication

Hybrid Identity

Network Provider DLL

Conditional Access Policies

Create Snapshot

Create Cloud Instance

Delete Cloud Instance

Revert Cloud Instance

Modify Cloud Compute Configurations

Patch System Image

Downgrade System Image

Network Address Translation Traversal

Gatekeeper Bypass

Code Signing

SIP and Trust Provider Hijacking

Install Root Certificate

Mark-of-the-Web Bypass

Code Signing Policy Modification

Reduce Key Space

Disable Crypto Hardware

Name Resolution Poisoning and SMB Relay

ARP Cache Poisoning

DHCP Spoofing

Evil Twin

Password Guessing

Password Cracking

Password Spraying

Credential Stuffing

Keychain

Securityd Memory

Credentials from Web Browsers

Windows Credential Manager

Password Managers

Cloud Secrets Management Stores

Web Cookies

SAML Tokens

Keylogging

GUI Input Capture

Web Portal Capture

Credential API Hooking

Domain Controller Authentication

Password Filter DLL

Pluggable Authentication Modules

Network Device Authentication

Reversible Encryption

Multi-Factor Authentication

Hybrid Identity

Network Provider DLL

Conditional Access Policies

LSASS Memory

Security Account Manager

NTDS

LSA Secrets

Cached Domain Credentials

DCSync

Proc Filesystem

/etc/passwd and /etc/shadow

Golden Ticket

Silver Ticket

Kerberoasting

AS-REP Roasting

Ccache Files

Credentials In Files

Credentials in Registry

Shell History

Private Keys

Cloud Instance Metadata API

Group Policy Preferences

Container API

Chat Messages

Local Account

Domain Account

Email Account

Cloud Account

Local Groups

Domain Groups

Cloud Groups

Security Software Discovery

Backup Software Discovery

System Language Discovery

Internet Connection Discovery

Wi-Fi Discovery

System Checks

User Activity Based Checks

Time Based Checks

SSH Hijacking

RDP Hijacking

Remote Desktop Protocol

SMB/Windows Admin Shares

Distributed Component Object Model

SSH

VNC

Windows Remote Management

Cloud Services

Direct Cloud VM Connections

Application Access Token

Pass the Hash

Pass the Ticket

Web Session Cookie

Name Resolution Poisoning and SMB Relay

ARP Cache Poisoning

DHCP Spoofing

Evil Twin

Archive via Utility

Archive via Library

Archive via Custom Method

SNMP (MIB Dump)

Network Device Configuration Dump

Confluence

Sharepoint

Code Repositories

Customer Relationship Management Software

Messaging Applications

Databases

Local Data Staging

Remote Data Staging

Local Email Collection

Remote Email Collection

Email Forwarding Rule

Keylogging

GUI Input Capture

Web Portal Capture

Credential API Hooking

Web Protocols

File Transfer Protocols

Mail Protocols

DNS

Publish/Subscribe Protocols

Standard Encoding

Non-Standard Encoding

Junk Data

Steganography

Protocol or Service Impersonation

Fast Flux DNS

Domain Generation Algorithms

DNS Calculation

Symmetric Cryptography

Asymmetric Cryptography

Internal Proxy

External Proxy

Multi-hop Proxy

Domain Fronting

IDE Tunneling

Remote Desktop Software

Remote Access Hardware

Port Knocking

Socket Filters

Dead Drop Resolver

Bidirectional Communication

One-Way Communication

Traffic Duplication

Exfiltration Over Symmetric Encrypted Non-C2 Protocol

Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Exfiltration Over Unencrypted Non-C2 Protocol

Exfiltration Over Bluetooth

Exfiltration over USB

Exfiltration to Code Repository

Exfiltration to Cloud Storage

Exfiltration to Text Storage Sites

Exfiltration Over Webhook

Lifecycle-Triggered Deletion

Stored Data Manipulation

Transmitted Data Manipulation

Runtime Data Manipulation

Internal Defacement

External Defacement

Disk Content Wipe

Disk Structure Wipe

OS Exhaustion Flood

Service Exhaustion Flood

Application Exhaustion Flood

Application or System Exploitation

Direct Network Flood

Reflection Amplification

Compute Hijacking

Bandwidth Hijacking

SMS Pumping

Cloud Service Hijacking