Cyber Wiki Learning Path
MITRE ATT&CK® Detection Strategies
Move from behavior hypotheses to data requirements, analytics, testing, tuning, investigation, and measurable operational coverage.
Recommended Sequence
68 connected entries
Abuse Elevation Control Mechanism (T1548)
An adversary misuses an operating-system mechanism intended to govern privilege elevation so activity runs with higher permissions.
ATT&CK technique profile · IntermediateAccess Token Manipulation (T1134)
An adversary duplicates, creates, replaces, or impersonates Windows access tokens to act in another security context.
ATT&CK technique profile · IntermediateAccount Discovery (T1087)
An adversary enumerates local, domain, cloud, service, or application accounts and groups to identify useful identities and privileges.
ATT&CK technique profile · IntermediateAcquire Infrastructure (T1583)
An operator obtains domains, servers, cloud resources, virtual private servers, certificates, or other infrastructure used to stage or conduct malicious activity.
ATT&CK technique profile · IntermediateActive Scanning (T1595)
An operator actively probes addresses, domains, services, applications, or network ranges to learn what is reachable and how it may be exposed.
ATT&CK technique profile · IntermediateApplication Layer Protocol (T1071)
An adversary uses common application protocols such as web, DNS, mail, or file transfer to carry command-and-control traffic.
ATT&CK technique profile · IntermediateBoot or Logon Autostart Execution (T1547)
An adversary changes startup or sign-in mechanisms so code runs automatically during system boot or user logon.
ATT&CK technique profile · IntermediateBrute Force (T1110)
An adversary repeatedly attempts passwords, keys, or authentication combinations, including guessing, spraying, cracking, and credential stuffing.
ATT&CK technique profile · IntermediateClipboard Data (T1115)
An adversary reads clipboard contents to collect copied credentials, commands, documents, or other data exchanged through the user interface.
Cloud detection practice · AdvancedCloud Storage Exfiltration Detection
Cloud storage exfiltration detection looks for unusual reads, downloads, copies, sharing changes, presigned access, cross-account movement, and data-transfer patterns.
Detection practice · IntermediateCommand and Control Detection
Command and control detection identifies the channels, timing patterns, protocol misuse, infrastructure, and host behavior used to direct compromised systems.
ATT&CK technique profile · IntermediateCommand and Scripting Interpreter (T1059)
An adversary uses a shell, command interpreter, scripting language, or administrative console to execute instructions and automate activity.
ATT&CK technique profile · IntermediateCreate Account (T1136)
An adversary creates a local, domain, cloud, service, or application account that can be used for continued access.
ATT&CK technique profile · IntermediateCredentials from Password Stores (T1555)
An adversary extracts credentials, keys, cookies, or tokens from browsers, password managers, operating-system stores, or application repositories.
ATT&CK technique profile · IntermediateData Encrypted for Impact (T1486)
An adversary encrypts files, databases, virtual machines, or other information to disrupt availability and pressure the victim.
Detection practice · IntermediateData Exfiltration Detection
Data exfiltration detection looks for unauthorized movement of information through network, cloud, endpoint, application, and removable-media paths.
ATT&CK technique profile · IntermediateData from Local System (T1005)
An adversary searches for and reads files, databases, application data, or other information stored on a compromised local system.
Detection engineering practice · AdvancedDetection as Code
Detection as code manages analytic rules, queries, parsers, tests, documentation, and deployment through version-controlled engineering practices so detection changes are reviewable, reproducible, testable, and safely promoted.
ATT&CK technique profile · IntermediateDevelop Capabilities (T1587)
An operator creates malware, exploits, certificates, tools, or other capabilities tailored to the intended operation.
ATT&CK legacy profile · IntermediateDisable or Modify System Firewall (Legacy T1562.004)
Disable or Modify System Firewall (T1562.004) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.
ATT&CK legacy profile · IntermediateDisable or Modify Tools (Legacy T1562.001)
Disable or Modify Tools (T1562.001) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.
ATT&CK technique profile · IntermediateDomain or Tenant Policy Modification (T1484)
An adversary changes domain, federation, identity-provider, tenant, or cloud policy to weaken controls, grant access, or alter trusted behavior.
ATT&CK technique profile · IntermediateDrive-by Compromise (T1189)
A user is exposed to malicious web content that exploits a browser or convinces the user to retrieve and run harmful content, creating an entry path through normal browsing.
ATT&CK technique profile · IntermediateEncrypted Channel (T1573)
An adversary protects command traffic with encryption or an encrypted protocol to conceal content and complicate inspection.
ATT&CK technique profile · IntermediateExfiltration Over C2 Channel (T1041)
An adversary sends collected data through the same command-and-control channel used to manage compromised systems.
ATT&CK technique profile · IntermediateExfiltration Over Web Service (T1567)
An adversary uploads information through a web service, cloud-storage provider, code-sharing service, or other internet platform that may resemble normal use.
ATT&CK technique profile · IntermediateExploit Public-Facing Application (T1190)
An adversary exploits a weakness in an internet-accessible application, service, appliance, management interface, or workload to gain access.
ATT&CK technique profile · IntermediateExploitation for Privilege Escalation (T1068)
An adversary exploits a software or configuration weakness to cross a local or workload privilege boundary.
ATT&CK technique profile · IntermediateExploitation of Remote Services (T1210)
An adversary exploits a weakness in an internal remote service to gain access to another system without relying solely on valid credentials.
ATT&CK technique profile · IntermediateExternal Remote Services (T1133)
An adversary uses externally reachable VPN, remote desktop, SSH, virtual application, management, or other remote-access services to enter or return to an environment.
ATT&CK technique profile · IntermediateGather Victim Identity Information (T1589)
An operator collects names, usernames, email addresses, roles, relationships, or other identity details that can support targeting, credential attacks, and believable pretexts.
ATT&CK technique profile · IntermediateHide Artifacts (T1564)
An adversary conceals files, directories, processes, windows, accounts, services, or cloud resources from ordinary inspection.
ATT&CK legacy profile · IntermediateImpair Defenses (Legacy T1562)
Impair Defenses (T1562) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.
ATT&CK technique profile · IntermediateIndicator Removal (T1070)
An adversary deletes or alters logs, files, timestamps, command history, accounts, or other evidence to reduce the visible record of activity.
ATT&CK technique profile · IntermediateIngress Tool Transfer (T1105)
An adversary transfers tools or files from an external location into a compromised environment, often through an existing command channel.
ATT&CK technique profile · IntermediateInhibit System Recovery (T1490)
An adversary deletes, disables, corrupts, or reconfigures backups, snapshots, recovery partitions, services, or boot options to make restoration harder.
ATT&CK technique profile · IntermediateLateral Tool Transfer (T1570)
An adversary copies tools or files between systems inside the target environment to support continued movement and execution.
Security operations process · IntermediateLog Source Onboarding
Log source onboarding is the controlled process of bringing a new event source into security monitoring with validated collection, parsing, timestamps, identifiers, access controls, retention, health checks, and documented analytic value.
Assurance method · IntermediateMITRE ATT&CK® Coverage and Gap Analysis
How to measure coverage without equating a colored matrix cell with a validated detection or effective control.
Detection engineering method · IntermediateMITRE ATT&CK® Detection Strategies, Analytics, and Data Components
How defenders move from required observations to analytic logic, testing, tuning, ownership, and response-ready evidence.
Framework learning hub · All levelsMITRE ATT&CK® Educational Learning Center
A structured, versioned learning center that connects Enterprise ATT&CK adversary behavior to architecture, telemetry, detection, mitigation, investigation, recovery, and Bare Metal Cyber coursework.
ATT&CK technique profile · IntermediateMasquerading (T1036)
An adversary makes an artifact, process, account, service, or task appear legitimate by using misleading names, locations, metadata, or presentation.
ATT&CK technique profile · IntermediateNative API (T1106)
An adversary calls operating-system or runtime application programming interfaces directly to perform actions that might otherwise require ordinary utilities.
Network monitoring concept · AdvancedNetwork Traffic Analysis
Network traffic analysis examines packet, flow, DNS, proxy, TLS, routing, and session metadata to understand communication patterns, identify suspicious behavior, and reconstruct activity across network trust boundaries.
ATT&CK technique profile · IntermediateOS Credential Dumping (T1003)
An adversary reads operating-system memory, databases, caches, registry material, or directory replication data to obtain credential artifacts.
ATT&CK technique profile · IntermediateObfuscated Files or Information (T1027)
An adversary encodes, encrypts, packs, fragments, or otherwise transforms files and information to make discovery or analysis more difficult.
ATT&CK technique profile · IntermediateObtain Capabilities (T1588)
An operator purchases, steals, downloads, or otherwise acquires exploits, malware, credentials, information, or tools rather than developing them independently.
Security operations practice · IntermediatePacket Capture and PCAP Analysis
Packet Capture and PCAP Analysis is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.
Security operations practice · IntermediatePowerShell Security and Logging
PowerShell Security and Logging is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.
ATT&CK technique profile · IntermediateProcess Discovery (T1057)
An adversary lists running processes, services, containers, or workloads to identify security tools, applications, users, and possible targets.
Remote administration security concept · AdvancedRemote Desktop Security
Remote Desktop security protects Windows interactive administrative sessions by controlling who can connect, how endpoints authenticate, where credentials are exposed, which channels are redirected, and how activity is monitored and contained.
ATT&CK technique profile · IntermediateRemote Services (T1021)
An adversary uses authenticated remote services such as RDP, SMB, WinRM, SSH, VNC, or management protocols to access another system.
ATT&CK technique profile · IntermediateScheduled Task/Job (T1053)
An adversary creates or modifies a scheduled task, cron job, cloud schedule, or similar mechanism to run code at a chosen time or event.
ATT&CK technique profile · IntermediateScreen Capture (T1113)
An adversary captures screenshots or display content to collect information visible in applications, sessions, and user workflows.
ATT&CK technique profile · IntermediateSearch Open Websites/Domains (T1593)
An operator searches public websites, social platforms, code repositories, technical forums, and organizational domains for information useful to an operation.
ATT&CK technique profile · IntermediateServer Software Component (T1505)
An adversary adds or modifies a component within server software—such as a web shell, plug-in, module, or management extension—to preserve access or execute code.
Security operations practice · IntermediateSigma Rules
Sigma Rules is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.
Security operations practice · IntermediateSysmon
Sysmon is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
ATT&CK technique profile · IntermediateSystem Information Discovery (T1082)
An adversary queries operating-system, architecture, hardware, version, patch, hostname, or instance information to guide later actions.
ATT&CK technique profile · IntermediateSystem Network Configuration Discovery (T1016)
An adversary queries addresses, interfaces, routes, DNS settings, proxies, adapters, and other network configuration to understand connectivity.
Proactive analysis · AdvancedThreat Hunting
Threat hunting is a structured search for adversary behavior or hidden compromise that has not been fully identified by existing alerts.
ATT&CK technique profile · IntermediateTrusted Relationship (T1199)
An adversary abuses a supplier, partner, managed service, federation, software, or other trusted relationship to reach the target environment.
ATT&CK technique profile · IntermediateUnsecured Credentials (T1552)
An adversary searches files, repositories, scripts, logs, environment variables, instance metadata, or configuration for exposed authentication material.
ATT&CK technique profile · IntermediateUser Execution (T1204)
An adversary depends on a user to open, launch, approve, install, or otherwise trigger malicious content or code.
Detection engineering method · IntermediateUsing MITRE ATT&CK® for Detection Engineering
How to translate behaviors into hypotheses, data requirements, analytics, tests, tuning criteria, response actions, and measurable coverage.
Security operations practice · IntermediateWindows Event Logs
Windows Event Logs is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.
ATT&CK technique profile · IntermediateWindows Management Instrumentation (T1047)
An adversary uses Windows Management Instrumentation to query, execute, configure, or remotely manage Windows systems.
Malware detection concept · AdvancedYARA Rules
YARA is a pattern-matching language used to classify files, memory, and other byte or text content by combining strings, metadata, modules, and Boolean conditions into reusable detection rules.