See Your Attack Surface Before Adversaries Do.

Modify Authentication Process: Multi-Factor Authentication

[UNC-4992] Adversaries have been observed modifying MFA tokens to bypass security controls and gain unauthorized network access.

Valid Accounts

[UNC-4992] Threat actors are actively abusing and controlling legitimate user accounts to maintain persistence within targeted commercial networks.

Command and Scripting Interpreter: PowerShell

[APT-38] Recent campaigns utilize obfuscated PowerShell scripts to execute secondary payloads and evade signature-based detection.

Phishing: Spearphishing Attachment

[UNC-2104] Actors are distributing malicious macro-enabled documents via spearphishing to facilitate initial entry into corporate environments.

Process Injection: Dynamic-link Library Injection

[APT-29] Adversaries are injecting malicious DLLs into trusted system processes to hide activity and maintain stealthy execution.

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

[UNC-8821] Malware samples have been identified modifying Windows Registry run keys to ensure automatic execution upon system reboot.

OS Credential Dumping: LSASS Memory

[APT-41] Threat actors are leveraging custom tools to dump credentials from the Local Security Authority Subsystem Service memory.

User Execution: Malicious File

[UNC-5502] Campaigns are relying on social engineering to trick users into executing malicious binaries disguised as legitimate software updates.

Application Layer Protocol: Web Protocols

[APT-10] Adversaries are using standard HTTP/HTTPS traffic to communicate with command-and-control servers to blend in with normal network activity.

Data Encrypted for Impact

[UNC-3310] Ransomware operators are increasingly deploying encryption routines against critical infrastructure to disrupt business operations.

Modify Authentication Process: Multi-Factor Authentication

[UNC-4992] Adversaries have been observed modifying MFA tokens to bypass security controls and gain unauthorized network access.

Valid Accounts

[UNC-4992] Threat actors are actively abusing and controlling legitimate user accounts to maintain persistence within targeted commercial networks.

Command and Scripting Interpreter: PowerShell

[APT-38] Recent campaigns utilize obfuscated PowerShell scripts to execute secondary payloads and evade signature-based detection.

Phishing: Spearphishing Attachment

[UNC-2104] Actors are distributing malicious macro-enabled documents via spearphishing to facilitate initial entry into corporate environments.

Process Injection: Dynamic-link Library Injection

[APT-29] Adversaries are injecting malicious DLLs into trusted system processes to hide activity and maintain stealthy execution.

Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

[UNC-8821] Malware samples have been identified modifying Windows Registry run keys to ensure automatic execution upon system reboot.

OS Credential Dumping: LSASS Memory

[APT-41] Threat actors are leveraging custom tools to dump credentials from the Local Security Authority Subsystem Service memory.

User Execution: Malicious File

[UNC-5502] Campaigns are relying on social engineering to trick users into executing malicious binaries disguised as legitimate software updates.

Application Layer Protocol: Web Protocols

[APT-10] Adversaries are using standard HTTP/HTTPS traffic to communicate with command-and-control servers to blend in with normal network activity.

Data Encrypted for Impact

[UNC-3310] Ransomware operators are increasingly deploying encryption routines against critical infrastructure to disrupt business operations.