{ "schema_version": "1.0", "updated": "2026-08-20", "boundary": "Candidate mappings are analytical prompts, not automatic findings. Confirm a technique from preserved evidence and procedure-level context before using it in reporting, detection coverage or attribution.", "readiness_states": [ { "id": "not-assessed", "label": "Not assessed", "meaning": "No capability decision has been recorded." }, { "id": "no-telemetry", "label": "No telemetry", "meaning": "The required events or fields are not collected." }, { "id": "telemetry", "label": "Telemetry available", "meaning": "Relevant data exists, but no production analytic has been demonstrated." }, { "id": "analytic", "label": "Analytic implemented", "meaning": "An analytic exists but has not been validated against representative behaviour." }, { "id": "validated", "label": "Validated", "meaning": "The analytic and telemetry were tested against a documented procedure." }, { "id": "operational", "label": "Operational", "meaning": "Alert ownership, triage guidance and a response path are established." }, { "id": "not-applicable", "label": "Not applicable", "meaning": "The technique is outside the documented environment or threat scope." } ], "guides": [ { "technique_id": "T1003.001", "triggers": [ "lsass", "lsass memory", "mimikatz", "credential dump", "procdump lsass", "sekurlsa", "dump credentials" ], "analyst_summary": "Use when a process accesses or dumps LSASS memory to obtain credentials. Process access alone may be ambiguous; access rights, signer, lineage, dump creation and subsequent credential use matter.", "minimum_evidence": [ "Source process and target LSASS process", "Requested access rights or memory-read evidence", "Process signer, hash, path and lineage", "Dump-file creation or credential-use evidence" ], "telemetry": [ "EDR process-access telemetry", "Sysmon process access and file creation", "Windows security and authentication events", "Credential-protection control events" ], "benign_overlap": [ "Security and diagnostic products", "Crash dump and support tooling", "Approved credential-protection testing" ], "pivots": [ "Validate signer and expected product behaviour", "Search for dump files and archive creation", "Trace subsequent logons from affected accounts", "Inspect privilege escalation before LSASS access" ], "response": [ "Isolate the host when malicious access is supported", "Reset or protect credentials exposed on the system", "Preserve volatile and authentication evidence" ] }, { "technique_id": "T1027", "triggers": [ "obfuscated", "packed", "encoded", "compressed", "encrypted payload", "high entropy" ], "analyst_summary": "Use when content is intentionally transformed to hinder inspection or detection. Encoding or compression alone is common; document the transformation, execution context and adversary-relevant purpose.", "minimum_evidence": [ "Original bytes or content and cryptographic hash", "Observed encoding, packing or transformation", "Process or script responsible for handling the content", "Recovered or partially recovered content where safe" ], "telemetry": [ "Static file and script analysis metadata", "Endpoint process, module and memory telemetry", "Mail, proxy or sandbox content inspection" ], "benign_overlap": [ "Signed software packing and installers", "Minified web content", "Normal archive, encryption and data-protection workflows" ], "pivots": [ "Cluster on packer, decoder and stable code features", "Compare entropy and section metadata with benign software", "Search decoded configuration and infrastructure", "Track the process that writes or executes recovered content" ], "response": [ "Preserve original and decoded artefacts separately", "Do not upload sensitive samples to public services without approval", "Feed stable recovered features into hunting and validation" ] }, { "technique_id": "T1053.005", "triggers": [ "scheduled task", "schtasks", "task scheduler", "at job", "task created", "scheduled persistence" ], "analyst_summary": "Use when Windows Task Scheduler is used to execute a program at a configured time or condition. The same mechanism is heavily used by operating-system and enterprise software.", "minimum_evidence": [ "Task name, definition and creation/change time", "Author, account and execution principal", "Action, arguments, trigger and working directory", "Process or audit event that created the task" ], "telemetry": [ "Task Scheduler operational log", "Windows security task events", "EDR registry, file and process events", "Task XML from the affected host" ], "benign_overlap": [ "Operating-system maintenance", "Software updates and management agents", "Enterprise automation" ], "pivots": [ "Compare task definition with known-good systems", "Trace the creating process and account", "Inspect referenced binaries and scripts", "Search for the same task across endpoints" ], "response": [ "Preserve the task XML before removal", "Disable malicious tasks and isolate referenced payloads", "Investigate the account and creation path" ] }, { "technique_id": "T1056.003", "triggers": [ "fake login", "credential portal", "cloned login", "password form", "credential harvesting", "web portal capture", "phishing page" ], "analyst_summary": "Use when a web portal is designed to capture information entered by a victim. Visual similarity alone is insufficient; preserve form behaviour or collection endpoints when safely possible.", "minimum_evidence": [ "Page capture and timestamp", "Form action, script handler or network destination", "Brand impersonated and fields requested", "Evidence of user interaction, if available" ], "telemetry": [ "Browser developer/network capture from an isolated environment", "Web proxy and DNS events", "Identity sign-in and risk events", "Reported message and URL artefacts" ], "benign_overlap": [ "Legitimate federated login pages", "Reverse proxies and SSO portals", "Security-training replicas" ], "pivots": [ "Compare form endpoints and JavaScript across related hosts", "Search reused favicons, page titles and kits", "Correlate entered account with subsequent sign-ins and session creation", "Inspect registrar, hosting and certificate relationships" ], "response": [ "Treat submitted credentials and active sessions as exposed", "Preserve the portal and network evidence without contaminating operator data", "Report and block infrastructure using evidence-backed indicators" ] }, { "technique_id": "T1059.001", "triggers": [ "powershell", "pwsh", "encodedcommand", "-enc", "invoke-expression", "iex", "downloadstring", "script block" ], "analyst_summary": "Use when PowerShell executes adversary-relevant commands. PowerShell is common administration infrastructure; intent depends on command content, lineage, user, host, destination and surrounding activity.", "minimum_evidence": [ "Process creation with complete command line", "Parent and child process lineage", "User, host and execution timestamp", "Script content or script-block evidence when available" ], "telemetry": [ "EDR process and network events", "PowerShell Script Block and Module logging", "AMSI or security-product content telemetry", "DNS, proxy and file-creation events" ], "benign_overlap": [ "Administration and configuration management", "Software deployment and support tooling", "Security-product automation" ], "pivots": [ "Decode content while preserving the original", "Inspect parent process and interactive/logon context", "Extract URLs, paths, registry keys and follow-on processes", "Find the same command or script hash across hosts" ], "response": [ "Preserve command, script and process lineage", "Contain based on the wider execution chain, not the binary name alone", "Scope credentials and remote systems touched by the command" ] }, { "technique_id": "T1059.003", "triggers": [ "cmd.exe", "command shell", "batch file", "cmd /c", "shell execution" ], "analyst_summary": "Use when the Windows command shell executes adversary-relevant commands. cmd.exe is common infrastructure; parentage, command content, identity and consequences determine significance.", "minimum_evidence": [ "Complete command line", "Parent and child process identifiers", "User, host and logon context", "Correlated file, service, registry or network consequences" ], "telemetry": [ "EDR, Sysmon or Security process creation with command lines", "Script, file, registry and service modification events", "DNS, proxy and endpoint network connections" ], "benign_overlap": [ "Logon scripts and software installers", "IT administration and troubleshooting", "Build agents and scheduled maintenance" ], "pivots": [ "Decode quoting, environment variables and chained commands", "Trace the complete ancestry and child tree", "Scope rare commands and parent combinations", "Correlate the same user and logon session across hosts" ], "response": [ "Preserve complete process lineage", "Contain when command intent and consequences support malicious execution", "Turn validated benign chains into narrow regression cases" ] }, { "technique_id": "T1078", "triggers": [ "valid account", "stolen account", "compromised account", "impossible travel", "suspicious login", "account takeover", "valid credentials" ], "analyst_summary": "Use when an adversary authenticates with legitimate credentials or an existing account. A successful login is not enough; establish why the use is inconsistent with the account owner or authorised automation.", "minimum_evidence": [ "Account and authentication result", "Source, device, application and timestamp", "Authentication method and session/token context", "Behaviour inconsistent with the legitimate user or workload" ], "telemetry": [ "Identity-provider and application sign-ins", "VPN, remote access and endpoint logons", "Device compliance and risk telemetry", "Post-authentication resource access" ], "benign_overlap": [ "Travel and VPN egress changes", "Shared or service accounts", "New managed devices and automation" ], "pivots": [ "Build an account timeline before and after access", "Compare device, source and authentication method", "Trace mailbox, file, directory and administrative activity", "Find other accounts from the same source or device" ], "response": [ "Revoke sessions and protect the account when compromise is supported", "Preserve identity and resource-access logs", "Investigate persistence such as added credentials, roles or inbox rules" ] }, { "technique_id": "T1098", "triggers": [ "account manipulation", "added mfa", "new credential", "added role", "new ssh key", "password reset", "additional cloud role", "mailbox delegation" ], "analyst_summary": "Use when an adversary modifies an account to maintain access, extend privileges or establish an alternate authentication path. Record the specific sub-technique when evidence supports it.", "minimum_evidence": [ "Account and changed property", "Before/after value and timestamp", "Actor or session performing the change", "Authorisation context and subsequent use" ], "telemetry": [ "Identity and directory audit logs", "Cloud IAM and role-assignment events", "MFA and credential registration events", "Mailbox permission and delegation logs" ], "benign_overlap": [ "Help-desk recovery", "Role changes and onboarding", "Key rotation and legitimate automation" ], "pivots": [ "Identify the initiating session and authentication method", "Find parallel changes to other accounts", "Trace use of the added credential or role", "Review approvals and change records" ], "response": [ "Remove unauthorised credentials, roles or delegates", "Revoke initiating sessions and protect affected accounts", "Preserve audit events and investigate downstream access" ] }, { "technique_id": "T1105", "triggers": [ "download payload", "ingress transfer", "downloaded tool", "curl payload", "certutil download", "bitsadmin download", "payload retrieval" ], "analyst_summary": "Use when files or tools are transferred from an external system into a compromised environment. Ordinary downloads are common; preserve the initiating process, destination and resulting use.", "minimum_evidence": [ "Source and destination of transfer", "Initiating process, account and command", "Resulting file, hash and path", "Execution or operational use, if any" ], "telemetry": [ "Endpoint process, file and network telemetry", "Proxy, DNS and firewall records", "Script and command-line logging", "File reputation and static-analysis results" ], "benign_overlap": [ "Software installation and updates", "Administrative file transfer", "Browser and user downloads" ], "pivots": [ "Trace the parent process and preceding access", "Cluster source infrastructure and filenames", "Search the hash and path across endpoints", "Inspect execution, persistence and outbound connections" ], "response": [ "Preserve the transferred file and network evidence", "Block confirmed malicious sources and hashes", "Scope execution and related access before cleanup" ] }, { "technique_id": "T1110.003", "triggers": [ "password spray", "many accounts", "single password", "authentication failures", "distributed login attempts" ], "analyst_summary": "Use when one or a small set of passwords is attempted across many accounts. Separate failures, successful authentication and post-authentication activity; source IP alone is not an actor identity.", "minimum_evidence": [ "Target account and authentication result", "Source address, client and application", "Accurate timestamp and tenant or domain", "Population-level pattern across identities" ], "telemetry": [ "Identity-provider and directory authentication logs", "VPN, SaaS and externally accessible application logs", "Risk, device, session and conditional-access context" ], "benign_overlap": [ "Misconfigured applications using stale credentials", "Password-manager or mobile-client retries", "Authorised identity testing" ], "pivots": [ "Count distinct targets per source and password-independent pattern", "Identify successes after failure clusters", "Correlate device, session and token issuance", "Scope the same targets across applications and addresses" ], "response": [ "Protect successfully accessed identities and sessions", "Apply risk-based controls without locking out the entire target set", "Preserve distributed-source and application context" ] }, { "technique_id": "T1140", "triggers": [ "decode", "decompress", "decrypt", "unpack", "base64 decode", "payload extraction" ], "analyst_summary": "Use when a process decodes or deobfuscates content for subsequent use. The operation is meaningful only when linked to the input, recovered output and follow-on behaviour.", "minimum_evidence": [ "Input content or identifier", "Decoder process, script or routine", "Recovered output or observable side effect", "Follow-on execution, loading or transfer evidence" ], "telemetry": [ "Script-content and command-line telemetry", "File creation, memory and module-load events", "Process ancestry and consequential network activity" ], "benign_overlap": [ "Installers and update clients", "Application resource extraction", "Administrative encoding and certificate workflows" ], "pivots": [ "Preserve both encoded and decoded hashes", "Identify repeated decoder logic across samples", "Trace output to execution or loading", "Search recovered strings, paths and configuration" ], "response": [ "Acquire original and transformed content", "Contain only when the wider chain supports harmful use", "Add decoder and output examples to regression tests" ] }, { "technique_id": "T1190", "triggers": [ "public facing exploit", "web exploit", "exploit application", "internet facing vulnerability", "rce server", "edge device exploit", "initial access vulnerability" ], "analyst_summary": "Use when exploitation of an internet-facing system produces adversary access or execution. Vulnerability presence, scanning and successful exploitation are separate facts.", "minimum_evidence": [ "Affected service, version and exposure", "Exploit request or equivalent technical evidence", "Application or system response indicating success", "Resulting process, file, account or session activity" ], "telemetry": [ "Reverse-proxy, WAF and application logs", "EDR process, file and network events", "Vulnerability and asset inventory", "Authentication and configuration-change logs" ], "benign_overlap": [ "Vulnerability scanning", "Failed exploit attempts", "Application errors and proof-of-concept testing" ], "pivots": [ "Separate scanning from successful exploitation", "Trace the first post-exploitation process or account", "Search the request pattern across exposed assets", "Identify persistence, credential access and outbound communication" ], "response": [ "Remove or restrict the affected service while preserving evidence", "Patch only after scoping compromise and persistence", "Rotate exposed secrets and investigate connected systems" ] }, { "technique_id": "T1204.001", "triggers": [ "malicious link", "user clicked", "browser opened", "email URL", "SMS URL", "chat link" ], "analyst_summary": "Use when a person follows an adversary-controlled link. Message delivery and URL presence are not user execution; preserve click, browser and downstream outcome as separate claims.", "minimum_evidence": [ "Original message or defensible delivery record", "Normalised URL and redirect chain", "Click or browser-navigation evidence tied to an identity", "Downstream authentication, download or execution outcome" ], "telemetry": [ "Mail, SMS or collaboration platform delivery and click records", "Secure web gateway, DNS and browser navigation history", "Identity, endpoint and proxy events after the navigation" ], "benign_overlap": [ "Legitimate marketing and tracking redirects", "Security-awareness simulations", "Normal external links shared through collaboration tools" ], "pivots": [ "Expand redirects and preserve every hostname", "Scope recipients and clickers separately", "Correlate browser activity with downloads, sign-ins and token events", "Search page templates, certificates and infrastructure reuse" ], "response": [ "Preserve the message and complete redirect chain", "Revoke affected sessions when credential capture is supported", "Block confirmed infrastructure with an expiry and review owner" ] }, { "technique_id": "T1204.002", "triggers": [ "malicious file", "user opened", "document execution", "archive opened", "payload launched" ], "analyst_summary": "Use when a person opens or executes a delivered file. File presence is not execution; require process, document-reader or operating-system evidence of the user-triggered action.", "minimum_evidence": [ "Original file, hash and collection context", "User and host associated with the file", "Open or execution timestamp", "Process lineage or application evidence showing the action" ], "telemetry": [ "Endpoint file creation and process telemetry", "Document-reader, archive utility and script-interpreter events", "Mail, browser or collaboration delivery metadata" ], "benign_overlap": [ "Expected business documents and installers", "Approved software deployment", "Sandbox or security-team detonation" ], "pivots": [ "Scope the hash, filename and signer across hosts", "Trace the parent process and delivery application", "Inspect child processes, network activity and persistence", "Compare execution with recipients who only received the file" ], "response": [ "Preserve the original file before quarantine", "Contain systems where harmful execution is supported", "Scope all recipients and execution outcomes" ] }, { "technique_id": "T1486", "triggers": [ "ransomware", "files encrypted", "encrypted extension", "mass file modification", "ransom note" ], "analyst_summary": "Use when data is encrypted to interrupt availability. A ransom note or extension is supporting context; require evidence of the process, affected objects and operational impact.", "minimum_evidence": [ "Initiating process or account", "Affected files, shares or storage objects", "Rate and timing of modifications", "Recovery, backup and business-impact context" ], "telemetry": [ "Endpoint file and process telemetry", "File-server, storage and cloud audit logs", "Backup, identity and remote-access activity" ], "benign_overlap": [ "Approved encryption and migration", "Backup, compression and archival jobs", "Large developer or media workflows" ], "pivots": [ "Identify the first affected host and account", "Trace lateral access to shares and hypervisors", "Search precursor discovery, credential and recovery-inhibition activity", "Measure unaffected recovery sources" ], "response": [ "Prioritise containment of active encryption and shared access", "Preserve evidence before rebuilding", "Validate recovery paths independently of attacker-controlled systems" ] }, { "technique_id": "T1505.003", "triggers": [ "web shell", "webshell", "aspx shell", "aspx file", "php shell", "jsp shell", "server script backdoor", "iis shell", "w3wp" ], "analyst_summary": "Use when a script placed on a web server provides persistent remote access or command execution. A suspicious server-side script should be tied to request and execution behaviour where possible.", "minimum_evidence": [ "Server-side file, hash, path and timestamps", "Web requests reaching the file", "Web-worker child process or command execution", "Initial write or exploitation evidence" ], "telemetry": [ "Web access and error logs", "File-integrity or EDR file events", "Web-worker process lineage", "Reverse-proxy, WAF and network telemetry" ], "benign_overlap": [ "Administrative web tools", "Application deployment artefacts", "Diagnostic scripts" ], "pivots": [ "Search URI, hash and code fragments across servers", "Trace web-worker child processes and outbound connections", "Identify the file-write origin and vulnerable application", "Inspect commands, accounts and lateral movement after access" ], "response": [ "Preserve file and web logs before removal", "Isolate or remove the exposed service from rotation", "Treat the server as compromised beyond deleting the shell" ] }, { "technique_id": "T1528", "triggers": [ "oauth token", "access token", "consent phishing", "device code", "oauth consent", "token theft", "application consent", "refresh token" ], "analyst_summary": "Use when an adversary obtains an application access token. Distinguish token issuance, token theft and later token use; an OAuth URL by itself proves none of them.", "minimum_evidence": [ "Identity-provider audit event for consent or token activity", "Application/client ID and requested scopes", "Account, source, timestamp and authentication context", "Evidence of token use or protected-resource access" ], "telemetry": [ "Identity-provider sign-in and audit logs", "OAuth consent, service-principal and application events", "Cloud application access logs", "Mailbox and file-access audit records" ], "benign_overlap": [ "Legitimate application consent", "Device-code authentication", "Administrative application onboarding" ], "pivots": [ "Review scopes, publisher verification and tenant consent", "Trace token use across IPs and applications", "Identify mailbox, file or directory access after issuance", "Hunt for other users authorising the same application" ], "response": [ "Revoke affected tokens and sessions", "Remove malicious consent and service-principal grants", "Preserve identity audit records and investigate accessed resources" ] }, { "technique_id": "T1566.001", "triggers": [ "attachment", "attached file", "rtf", "docm", "macro", "invoice document", "malicious document", "email attachment" ], "analyst_summary": "Use when a phishing message delivers a file intended to enable access or execution. Delivery alone does not prove that the recipient opened the file or that execution succeeded.", "minimum_evidence": [ "Original message or defensible mail-gateway record", "Attachment name, hash and MIME/file type", "Sender, recipient and delivery timestamp", "Evidence separating delivery from open or execution" ], "telemetry": [ "Mail gateway: message ID, sender, recipient, URLs, attachments and verdicts", "Endpoint: file creation, process lineage and document-reader child processes", "Sandbox or static analysis: document relationships, macros and embedded objects" ], "benign_overlap": [ "Legitimate business attachments", "Automated invoice and document workflows", "Security-test messages" ], "pivots": [ "Search the attachment hash and filename across recipients", "Correlate document-reader processes with script interpreters or LOLBins", "Resolve embedded URLs and template relationships safely", "Identify mailbox rules or follow-on messages" ], "response": [ "Preserve the original message and attachment", "Scope all recipients before deleting messages", "Contain endpoints only when execution or harmful follow-on activity is supported" ] }, { "technique_id": "T1566.002", "triggers": [ "phishing link", "suspicious link", "suspicious url", "email link", "smishing", "received an sms", "sms link", "parking payment link", "credential link", "clicked link", "short url" ], "analyst_summary": "Use when a phishing message contains a link intended to produce access, credential theft or execution. Keep message delivery, link traversal and downstream outcome as separate claims.", "minimum_evidence": [ "Message or provider record containing the URL", "Complete URL and redirect chain", "Recipient and delivery time", "Browser, proxy or identity evidence showing whether the URL was visited" ], "telemetry": [ "Mail/SMS provider metadata and message identifiers", "Secure web gateway, DNS and browser history", "Identity-provider sign-in, consent and token events", "Endpoint process/network lineage for downloaded payloads" ], "benign_overlap": [ "Marketing and tracking redirects", "Legitimate URL shorteners", "Security-awareness simulations" ], "pivots": [ "Expand redirects without submitting credentials", "Cluster domains, certificates, paths and page assets", "Correlate click time with sign-ins, downloads and process creation", "Search for other recipients and matching lure text" ], "response": [ "Block confirmed malicious destinations at appropriate controls", "Revoke sessions or reset credentials only when exposure is supported", "Preserve message, redirect and identity evidence before remediation" ] }, { "technique_id": "T1685", "triggers": [ "disable antivirus", "stop edr", "tamper protection", "security service stopped", "logging disabled" ], "analyst_summary": "Use when an adversary disables or modifies security tooling or its configuration. A sensor outage is not automatically tampering; distinguish administrative change, failure and adversary action.", "minimum_evidence": [ "Security control, service or configuration affected", "Initiating identity and process", "Before-and-after state with timestamp", "Related execution or privilege context" ], "telemetry": [ "Security-product health and tamper events", "Service, process, registry and policy changes", "Administrative audit and endpoint process telemetry" ], "benign_overlap": [ "Approved upgrades and troubleshooting", "Device decommissioning", "Temporary service failure or policy rollout" ], "pivots": [ "Scope the same change across hosts", "Correlate with privilege escalation and tool execution", "Compare against approved change records", "Measure missing telemetry during the impaired interval" ], "response": [ "Restore trustworthy collection before declaring containment", "Isolate systems when deliberate impairment is supported", "Record visibility gaps created by the event" ] } ], "phishing_flow": { "summary": "A decision-oriented model. Follow only branches supported by evidence; an unvisited node is unknown, not absent.", "nodes": [ { "id": "lure", "label": "Reported lure", "stage": "Intake", "techniques": [ "T1566.001", "T1566.002", "T1566.003" ], "question": "What was actually delivered and through which channel?", "collect": [ "Original message", "Provider message ID", "Sender and recipient", "Attachment and complete URLs" ], "next": [ "redirect", "attachment" ] }, { "id": "redirect", "label": "Link and redirect path", "stage": "Delivery", "techniques": [ "T1566.002", "T1204.001" ], "question": "Was the link visited, and where did every redirect lead?", "collect": [ "Redirect chain", "DNS and proxy events", "Browser history", "Landing-page capture" ], "next": [ "credential", "consent", "download" ] }, { "id": "attachment", "label": "Attachment path", "stage": "Delivery", "techniques": [ "T1566.001", "T1204.002", "T1203" ], "question": "Was the file opened and did it produce execution?", "collect": [ "File hash and type", "Document relationships", "Process lineage", "Child process and network events" ], "next": [ "execution", "download" ] }, { "id": "credential", "label": "Credential collection", "stage": "Identity outcome", "techniques": [ "T1056.003" ], "question": "Did the portal submit credentials to an operator-controlled endpoint?", "collect": [ "Form action or script handler", "Network request", "Affected identity", "Subsequent sign-ins" ], "next": [ "account-use" ] }, { "id": "consent", "label": "Token or consent path", "stage": "Identity outcome", "techniques": [ "T1528" ], "question": "Was consent granted or a token issued and used?", "collect": [ "Application ID and scopes", "Consent audit event", "Token/session records", "Resource access" ], "next": [ "account-use" ] }, { "id": "execution", "label": "Local execution", "stage": "Endpoint outcome", "techniques": [ "T1059.001", "T1059.005", "T1059.007" ], "question": "Which process or interpreter executed, and from what parent?", "collect": [ "Complete command line", "Script content", "Process ancestry", "User and host context" ], "next": [ "download" ] }, { "id": "download", "label": "Follow-on payload", "stage": "Endpoint outcome", "techniques": [ "T1105" ], "question": "Was an additional tool or payload transferred and used?", "collect": [ "Source URL or host", "File hash and path", "Initiating process", "Execution and network activity" ], "next": [ "post-access" ] }, { "id": "account-use", "label": "Account or session use", "stage": "Post-access", "techniques": [ "T1078", "T1098", "T1114.002" ], "question": "What did the identity access, and was persistence added?", "collect": [ "Sign-in timeline", "Session and token use", "Account changes", "Mailbox, file and directory access" ], "next": [] }, { "id": "post-access", "label": "Post-compromise activity", "stage": "Post-access", "techniques": [ "T1078", "T1053.005" ], "question": "What execution, persistence, discovery or lateral movement followed?", "collect": [ "Host timeline", "Authentication events", "Persistence artefacts", "Network connections" ], "next": [] } ], "edges": [ { "from": "lure", "to": "redirect", "label": "message contains a link" }, { "from": "lure", "to": "attachment", "label": "message contains a file" }, { "from": "redirect", "to": "credential", "label": "portal requests credentials" }, { "from": "redirect", "to": "consent", "label": "authorisation flow" }, { "from": "redirect", "to": "download", "label": "payload retrieved" }, { "from": "attachment", "to": "execution", "label": "file produces execution" }, { "from": "attachment", "to": "download", "label": "file retrieves content" }, { "from": "credential", "to": "account-use", "label": "credentials used" }, { "from": "consent", "to": "account-use", "label": "token used" }, { "from": "execution", "to": "download", "label": "next stage retrieved" }, { "from": "download", "to": "post-access", "label": "payload executes" } ] }, "sources": [ { "title": "Get Started with ATT&CK", "publisher": "MITRE ATT&CK", "url": "https://attack.mitre.org/resources/" }, { "title": "Best Practices for MITRE ATT&CK Mapping", "publisher": "CISA", "url": "https://www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping" }, { "title": "Sensor Mappings to ATT&CK", "publisher": "Center for Threat-Informed Defense", "url": "https://ctid.mitre.org/projects/sensor-mappings-to-attack/" }, { "title": "Ambiguous Techniques", "publisher": "Center for Threat-Informed Defense", "url": "https://ctid.mitre.org/projects/ambiguous-techniques/" } ] }