See Your Attack Surface Before Adversaries Do.

Valid Accounts: Cloud Accounts

[UNC-9921] Adversaries are increasingly leveraging compromised cloud identity tokens to bypass MFA and maintain persistence in enterprise environments.

Phishing: Spearphishing Attachment

[APT-42] Threat actors continue to utilize weaponized documents to deliver modular malware payloads targeting government and critical infrastructure sectors.

OS Credential Dumping: LSASS Memory

[UNC-4402] Observed activity shows the use of custom memory-scraping tools to extract plaintext credentials from LSASS on domain controllers.

Command and Scripting Interpreter: PowerShell

[APT-19] Adversaries are employing obfuscated PowerShell scripts to execute fileless payloads directly in memory to evade EDR detection.

Account Discovery: Domain Account

[UNC-8832] Threat actors are performing extensive LDAP queries against domain controllers to map network architecture and identify high-value accounts.

Impair Defenses: Disable or Modify Tools

[APT-33] Recent campaigns involve the deployment of kernel-mode drivers specifically designed to terminate EDR processes and disable security logging.

Application Layer Protocol: Web Protocols

[UNC-7710] Adversaries are utilizing legitimate cloud storage services as C2 infrastructure to blend malicious traffic with normal business operations.

Steal or Forge Kerberos Tickets: Kerberoasting

[APT-29] Observed actors are requesting service tickets for accounts with weak SPNs to perform offline brute-force attacks against service account passwords.

Scheduled Task/Job: Scheduled Task

[UNC-5501] Threat actors are creating persistence via scheduled tasks that trigger malicious scripts upon system reboot or user login.

Data Encrypted for Impact

[UNC-2294] Ransomware operators are increasingly prioritizing the encryption of cloud-based backups before deploying final payloads to maximize extortion leverage.

Valid Accounts: Cloud Accounts

[UNC-9921] Adversaries are increasingly leveraging compromised cloud identity tokens to bypass MFA and maintain persistence in enterprise environments.

Phishing: Spearphishing Attachment

[APT-42] Threat actors continue to utilize weaponized documents to deliver modular malware payloads targeting government and critical infrastructure sectors.

OS Credential Dumping: LSASS Memory

[UNC-4402] Observed activity shows the use of custom memory-scraping tools to extract plaintext credentials from LSASS on domain controllers.

Command and Scripting Interpreter: PowerShell

[APT-19] Adversaries are employing obfuscated PowerShell scripts to execute fileless payloads directly in memory to evade EDR detection.

Account Discovery: Domain Account

[UNC-8832] Threat actors are performing extensive LDAP queries against domain controllers to map network architecture and identify high-value accounts.

Impair Defenses: Disable or Modify Tools

[APT-33] Recent campaigns involve the deployment of kernel-mode drivers specifically designed to terminate EDR processes and disable security logging.

Application Layer Protocol: Web Protocols

[UNC-7710] Adversaries are utilizing legitimate cloud storage services as C2 infrastructure to blend malicious traffic with normal business operations.

Steal or Forge Kerberos Tickets: Kerberoasting

[APT-29] Observed actors are requesting service tickets for accounts with weak SPNs to perform offline brute-force attacks against service account passwords.

Scheduled Task/Job: Scheduled Task

[UNC-5501] Threat actors are creating persistence via scheduled tasks that trigger malicious scripts upon system reboot or user login.

Data Encrypted for Impact

[UNC-2294] Ransomware operators are increasingly prioritizing the encryption of cloud-based backups before deploying final payloads to maximize extortion leverage.