Cyber Wiki Learning Path
MITRE ATT&CK® Mitigations and Defensive Design
Connect relevant adversary behaviors to layered architecture, identity, configuration, monitoring, containment, and recovery controls.
Recommended Sequence
70 connected entries
Abuse Elevation Control Mechanism (T1548)
An adversary misuses an operating-system mechanism intended to govern privilege elevation so activity runs with higher permissions.
ATT&CK technique profile · IntermediateAccess Token Manipulation (T1134)
An adversary duplicates, creates, replaces, or impersonates Windows access tokens to act in another security context.
ATT&CK technique profile · IntermediateAccount Discovery (T1087)
An adversary enumerates local, domain, cloud, service, or application accounts and groups to identify useful identities and privileges.
ATT&CK technique profile · IntermediateAcquire Infrastructure (T1583)
An operator obtains domains, servers, cloud resources, virtual private servers, certificates, or other infrastructure used to stage or conduct malicious activity.
Identity architecture concept · IntermediateActive Directory Domains, Trees, Forests, and Trusts
Active Directory organizes identities and resources into domains; related domains form trees, one or more trees form a forest, and trusts define which security principals may be recognized across boundaries.
Systems security concept · IntermediateActive Directory Fundamentals
Active Directory Fundamentals concerns the secure design, configuration, operation, monitoring, or recovery of computing platforms and connected devices.
ATT&CK technique profile · IntermediateActive Scanning (T1595)
An operator actively probes addresses, domains, services, applications, or network ranges to learn what is reachable and how it may be exposed.
Execution control · IntermediateApplication Allowlisting
Application allowlisting permits only approved executables, scripts, libraries, installers, or other code to run under defined rules.
ATT&CK technique profile · IntermediateApplication Layer Protocol (T1071)
An adversary uses common application protocols such as web, DNS, mail, or file transfer to carry command-and-control traffic.
Exposure management · IntermediateAttack Surface Management
Attack surface management identifies and tracks the systems, services, identities, data paths, and external dependencies that an attacker could reach or influence.
Resilience practice · BeginnerBackup and Recovery Strategies
Backup and recovery strategies preserve usable copies of data and system state so services can be restored after failure, error, corruption, or attack.
ATT&CK technique profile · IntermediateBoot or Logon Autostart Execution (T1547)
An adversary changes startup or sign-in mechanisms so code runs automatically during system boot or user logon.
ATT&CK technique profile · IntermediateBrute Force (T1110)
An adversary repeatedly attempts passwords, keys, or authentication combinations, including guessing, spraying, cracking, and credential stuffing.
ATT&CK technique profile · IntermediateClipboard Data (T1115)
An adversary reads clipboard contents to collect copied credentials, commands, documents, or other data exchanged through the user interface.
ATT&CK technique profile · IntermediateCommand and Scripting Interpreter (T1059)
An adversary uses a shell, command interpreter, scripting language, or administrative console to execute instructions and automate activity.
ATT&CK technique profile · IntermediateCreate Account (T1136)
An adversary creates a local, domain, cloud, service, or application account that can be used for continued access.
ATT&CK technique profile · IntermediateCredentials from Password Stores (T1555)
An adversary extracts credentials, keys, cookies, or tokens from browsers, password managers, operating-system stores, or application repositories.
ATT&CK technique profile · IntermediateData Encrypted for Impact (T1486)
An adversary encrypts files, databases, virtual machines, or other information to disrupt availability and pressure the victim.
ATT&CK technique profile · IntermediateData from Local System (T1005)
An adversary searches for and reads files, databases, application data, or other information stored on a compromised local system.
ATT&CK technique profile · IntermediateDevelop Capabilities (T1587)
An operator creates malware, exploits, certificates, tools, or other capabilities tailored to the intended operation.
ATT&CK legacy profile · IntermediateDisable or Modify System Firewall (Legacy T1562.004)
Disable or Modify System Firewall (T1562.004) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.
ATT&CK legacy profile · IntermediateDisable or Modify Tools (Legacy T1562.001)
Disable or Modify Tools (T1562.001) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.
ATT&CK technique profile · IntermediateDomain or Tenant Policy Modification (T1484)
An adversary changes domain, federation, identity-provider, tenant, or cloud policy to weaken controls, grant access, or alter trusted behavior.
ATT&CK technique profile · IntermediateDrive-by Compromise (T1189)
A user is exposed to malicious web content that exploits a browser or convinces the user to retrieve and run harmful content, creating an entry path through normal browsing.
ATT&CK technique profile · IntermediateEncrypted Channel (T1573)
An adversary protects command traffic with encryption or an encrypted protocol to conceal content and complicate inspection.
ATT&CK technique profile · IntermediateExfiltration Over C2 Channel (T1041)
An adversary sends collected data through the same command-and-control channel used to manage compromised systems.
ATT&CK technique profile · IntermediateExfiltration Over Web Service (T1567)
An adversary uploads information through a web service, cloud-storage provider, code-sharing service, or other internet platform that may resemble normal use.
ATT&CK technique profile · IntermediateExploit Public-Facing Application (T1190)
An adversary exploits a weakness in an internet-accessible application, service, appliance, management interface, or workload to gain access.
ATT&CK technique profile · IntermediateExploitation for Privilege Escalation (T1068)
An adversary exploits a software or configuration weakness to cross a local or workload privilege boundary.
ATT&CK technique profile · IntermediateExploitation of Remote Services (T1210)
An adversary exploits a weakness in an internal remote service to gain access to another system without relying solely on valid credentials.
ATT&CK technique profile · IntermediateExternal Remote Services (T1133)
An adversary uses externally reachable VPN, remote desktop, SSH, virtual application, management, or other remote-access services to enter or return to an environment.
ATT&CK technique profile · IntermediateGather Victim Identity Information (T1589)
An operator collects names, usernames, email addresses, roles, relationships, or other identity details that can support targeting, credential attacks, and believable pretexts.
ATT&CK technique profile · IntermediateHide Artifacts (T1564)
An adversary conceals files, directories, processes, windows, accounts, services, or cloud resources from ordinary inspection.
Network security · IntermediateHost Firewall Policy
Host firewall policy limits inbound, outbound, and forwarded traffic at the workload boundary using explicit service intent, stateful rules, controlled administration, and verified persistence.
ATT&CK legacy profile · IntermediateImpair Defenses (Legacy T1562)
Impair Defenses (T1562) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.
ATT&CK technique profile · IntermediateIndicator Removal (T1070)
An adversary deletes or alters logs, files, timestamps, command history, accounts, or other evidence to reduce the visible record of activity.
ATT&CK technique profile · IntermediateIngress Tool Transfer (T1105)
An adversary transfers tools or files from an external location into a compromised environment, often through an existing command channel.
ATT&CK technique profile · IntermediateInhibit System Recovery (T1490)
An adversary deletes, disables, corrupts, or reconfigures backups, snapshots, recovery partitions, services, or boot options to make restoration harder.
Authentication protocol concept · AdvancedKerberos in Active Directory
Kerberos in Active Directory is a ticket-based authentication system in which domain controllers acting as key distribution centers issue time-limited tickets that let users and services prove identity without repeatedly transmitting passwords.
Windows credential-protection concept · AdvancedLSASS and Credential Protection
The Local Security Authority Subsystem Service enforces local security policy, validates certain logons, creates access tokens, and handles credential material; protecting LSASS is central to limiting credential theft from Windows endpoints.
ATT&CK technique profile · IntermediateLateral Tool Transfer (T1570)
An adversary copies tools or files between systems inside the target environment to support continued movement and execution.
Framework learning hub · All levelsMITRE ATT&CK® Educational Learning Center
A structured, versioned learning center that connects Enterprise ATT&CK adversary behavior to architecture, telemetry, detection, mitigation, investigation, recovery, and Bare Metal Cyber coursework.
Defensive architecture method · IntermediateMITRE ATT&CK® Mitigations and Defensive Design
How ATT&CK mitigation objects can inform layered control design while avoiding the false assumption that one mitigation universally stops a technique.
ATT&CK technique profile · IntermediateMasquerading (T1036)
An adversary makes an artifact, process, account, service, or task appear legitimate by using misleading names, locations, metadata, or presentation.
ATT&CK technique profile · IntermediateNative API (T1106)
An adversary calls operating-system or runtime application programming interfaces directly to perform actions that might otherwise require ordinary utilities.
ATT&CK technique profile · IntermediateOS Credential Dumping (T1003)
An adversary reads operating-system memory, databases, caches, registry material, or directory replication data to obtain credential artifacts.
ATT&CK technique profile · IntermediateObfuscated Files or Information (T1027)
An adversary encodes, encrypts, packs, fragments, or otherwise transforms files and information to make discovery or analysis more difficult.
ATT&CK technique profile · IntermediateObtain Capabilities (T1588)
An operator purchases, steals, downloads, or otherwise acquires exploits, malware, credentials, information, or tools rather than developing them independently.
Security operations practice · IntermediatePowerShell Security and Logging
PowerShell Security and Logging is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.
ATT&CK technique profile · IntermediateProcess Discovery (T1057)
An adversary lists running processes, services, containers, or workloads to identify security tools, applications, users, and possible targets.
Attack pattern · BeginnerRansomware
Ransomware operations disrupt access to systems or data and may combine encryption with theft, extortion, public pressure, and attacks on recovery systems.
Recovery assurance practice · IntermediateRecovery Testing and Restore Assurance
Recovery testing and restore assurance verify that protected data, systems, dependencies, procedures, and personnel can meet defined recovery needs.
Remote administration security concept · AdvancedRemote Desktop Security
Remote Desktop security protects Windows interactive administrative sessions by controlling who can connect, how endpoints authenticate, where credentials are exposed, which channels are redirected, and how activity is monitored and contained.
ATT&CK technique profile · IntermediateRemote Services (T1021)
An adversary uses authenticated remote services such as RDP, SMB, WinRM, SSH, VNC, or management protocols to access another system.
ATT&CK technique profile · IntermediateScheduled Task/Job (T1053)
An adversary creates or modifies a scheduled task, cron job, cloud schedule, or similar mechanism to run code at a chosen time or event.
ATT&CK technique profile · IntermediateScreen Capture (T1113)
An adversary captures screenshots or display content to collect information visible in applications, sessions, and user workflows.
ATT&CK technique profile · IntermediateSearch Open Websites/Domains (T1593)
An operator searches public websites, social platforms, code repositories, technical forums, and organizational domains for information useful to an operation.
ATT&CK technique profile · IntermediateServer Software Component (T1505)
An adversary adds or modifies a component within server software—such as a web shell, plug-in, module, or management extension—to preserve access or execute code.
Network security concept · BeginnerStateful and Stateless Firewalls
Stateful and Stateless Firewalls is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
ATT&CK technique profile · IntermediateSystem Information Discovery (T1082)
An adversary queries operating-system, architecture, hardware, version, patch, hostname, or instance information to guide later actions.
ATT&CK technique profile · IntermediateSystem Network Configuration Discovery (T1016)
An adversary queries addresses, interfaces, routes, DNS settings, proxies, adapters, and other network configuration to understand connectivity.
Risk program · IntermediateThird-Party Cyber Risk Management
Third-party risk management identifies, evaluates, treats, monitors, and responds to cyber risk introduced by vendors, cloud services, software, partners, and other external dependencies.
ATT&CK technique profile · IntermediateTrusted Relationship (T1199)
An adversary abuses a supplier, partner, managed service, federation, software, or other trusted relationship to reach the target environment.
ATT&CK technique profile · IntermediateUnsecured Credentials (T1552)
An adversary searches files, repositories, scripts, logs, environment variables, instance metadata, or configuration for exposed authentication material.
ATT&CK technique profile · IntermediateUser Execution (T1204)
An adversary depends on a user to open, launch, approve, install, or otherwise trigger malicious content or code.
Assessment method · IntermediateUsing MITRE ATT&CK® for Security Assessments
How to evaluate whether people, processes, architecture, controls, and telemetry can prevent, observe, investigate, and recover from relevant behaviors.
Threat modeling method · IntermediateUsing MITRE ATT&CK® for Threat Modeling
How architecture teams can use relevant adversary behaviors to test trust boundaries, abuse cases, telemetry, and resilience decisions.
Windows platform-security control · AdvancedWindows Credential Guard
Windows Credential Guard uses virtualization-based security to isolate selected domain credentials from the normal operating system so that compromise of the host is less likely to expose reusable NTLM hashes and Kerberos ticket-granting tickets.
Host firewall control · IntermediateWindows Defender Firewall
Windows Defender Firewall is a stateful host firewall that applies profile-aware inbound and outbound rules to programs, services, ports, protocols, interfaces, users, and network conditions.
ATT&CK technique profile · IntermediateWindows Management Instrumentation (T1047)
An adversary uses Windows Management Instrumentation to query, execute, configure, or remotely manage Windows systems.