Cyber Wiki Learning Path
MITRE ATT&CK® for Network Devices
Focus ATT&CK study on Network Devices behavior, defensive context, telemetry, investigation, and architecture.
Recommended Sequence
52 connected entries
Account Discovery (T1087)
An adversary enumerates local, domain, cloud, service, or application accounts and groups to identify useful identities and privileges.
Execution control · IntermediateApplication Allowlisting
Application allowlisting permits only approved executables, scripts, libraries, installers, or other code to run under defined rules.
ATT&CK technique profile · IntermediateApplication Layer Protocol (T1071)
An adversary uses common application protocols such as web, DNS, mail, or file transfer to carry command-and-control traffic.
Resilience practice · BeginnerBackup and Recovery Strategies
Backup and recovery strategies preserve usable copies of data and system state so services can be restored after failure, error, corruption, or attack.
ATT&CK technique profile · IntermediateBrute Force (T1110)
An adversary repeatedly attempts passwords, keys, or authentication combinations, including guessing, spraying, cracking, and credential stuffing.
Threat and attack concept · IntermediateCommand and Control Channels
Command and Control Channels is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Detection practice · IntermediateCommand and Control Detection
Command and control detection identifies the channels, timing patterns, protocol misuse, infrastructure, and host behavior used to direct compromised systems.
ATT&CK technique profile · IntermediateCommand and Scripting Interpreter (T1059)
An adversary uses a shell, command interpreter, scripting language, or administrative console to execute instructions and automate activity.
ATT&CK technique profile · IntermediateCreate Account (T1136)
An adversary creates a local, domain, cloud, service, or application account that can be used for continued access.
ATT&CK technique profile · IntermediateData Encrypted for Impact (T1486)
An adversary encrypts files, databases, virtual machines, or other information to disrupt availability and pressure the victim.
Detection practice · IntermediateData Exfiltration Detection
Data exfiltration detection looks for unauthorized movement of information through network, cloud, endpoint, application, and removable-media paths.
Threat and attack concept · IntermediateData Staging and Exfiltration
Data Staging and Exfiltration describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.
Detection engineering practice · AdvancedDetection as Code
Detection as code manages analytic rules, queries, parsers, tests, documentation, and deployment through version-controlled engineering practices so detection changes are reviewable, reproducible, testable, and safely promoted.
ATT&CK legacy profile · IntermediateDisable or Modify System Firewall (Legacy T1562.004)
Disable or Modify System Firewall (T1562.004) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.
ATT&CK technique profile · IntermediateEncrypted Channel (T1573)
An adversary protects command traffic with encryption or an encrypted protocol to conceal content and complicate inspection.
ATT&CK technique profile · IntermediateExfiltration Over C2 Channel (T1041)
An adversary sends collected data through the same command-and-control channel used to manage compromised systems.
ATT&CK technique profile · IntermediateExploit Public-Facing Application (T1190)
An adversary exploits a weakness in an internet-accessible application, service, appliance, management interface, or workload to gain access.
ATT&CK technique profile · IntermediateExploitation of Remote Services (T1210)
An adversary exploits a weakness in an internal remote service to gain access to another system without relying solely on valid credentials.
ATT&CK technique profile · IntermediateExternal Remote Services (T1133)
An adversary uses externally reachable VPN, remote desktop, SSH, virtual application, management, or other remote-access services to enter or return to an environment.
Application security concept · IntermediateFile Upload Security
File Upload Security is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.
ATT&CK technique profile · IntermediateHide Artifacts (T1564)
An adversary conceals files, directories, processes, windows, accounts, services, or cloud resources from ordinary inspection.
Network security · IntermediateHost Firewall Policy
Host firewall policy limits inbound, outbound, and forwarded traffic at the workload boundary using explicit service intent, stateful rules, controlled administration, and verified persistence.
ATT&CK legacy profile · IntermediateImpair Defenses (Legacy T1562)
Impair Defenses (T1562) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.
Recovery assurance practice · AdvancedIncident Recovery Validation
Incident recovery validation confirms that services are restored, attacker access is removed, controls are effective, data is trustworthy, and monitoring can detect recurrence.
ATT&CK technique profile · IntermediateIndicator Removal (T1070)
An adversary deletes or alters logs, files, timestamps, command history, accounts, or other evidence to reduce the visible record of activity.
ATT&CK technique profile · IntermediateIngress Tool Transfer (T1105)
An adversary transfers tools or files from an external location into a compromised environment, often through an existing command channel.
ATT&CK technique profile · IntermediateInhibit System Recovery (T1490)
An adversary deletes, disables, corrupts, or reconfigures backups, snapshots, recovery partitions, services, or boot options to make restoration harder.
Adversary behavior · IntermediateLateral Movement
Lateral movement is the use of credentials, remote services, trust relationships, and administrative tools to move from one system or account to another.
Security operations process · IntermediateLog Source Onboarding
Log source onboarding is the controlled process of bringing a new event source into security monitoring with validated collection, parsing, timestamps, identifiers, access controls, retention, health checks, and documented analytic value.
Framework learning hub · All levelsMITRE ATT&CK® Educational Learning Center
A structured, versioned learning center that connects Enterprise ATT&CK adversary behavior to architecture, telemetry, detection, mitigation, investigation, recovery, and Bare Metal Cyber coursework.
Framework scope · IntermediateMITRE ATT&CK® Platforms and Technology Scope
How ATT&CK platform metadata helps analysts distinguish Windows, Linux, macOS, cloud, identity, SaaS, containers, network devices, ESXi, and pre-compromise activity.
ATT&CK technique profile · IntermediateMasquerading (T1036)
An adversary makes an artifact, process, account, service, or task appear legitimate by using misleading names, locations, metadata, or presentation.
Network monitoring concept · AdvancedNetwork Traffic Analysis
Network traffic analysis examines packet, flow, DNS, proxy, TLS, routing, and session metadata to understand communication patterns, identify suspicious behavior, and reconstruct activity across network trust boundaries.
ATT&CK technique profile · IntermediateObfuscated Files or Information (T1027)
An adversary encodes, encrypts, packs, fragments, or otherwise transforms files and information to make discovery or analysis more difficult.
Threat and attack concept · IntermediateOn-Path Attacks
On-Path Attacks describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.
Security operations practice · IntermediatePacket Capture and PCAP Analysis
Packet Capture and PCAP Analysis is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.
Threat and attack concept · IntermediatePassword Attacks
Password Attacks describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.
Attack pattern · BeginnerRansomware
Ransomware operations disrupt access to systems or data and may combine encryption with theft, extortion, public pressure, and attacks on recovery systems.
Recovery assurance practice · IntermediateRecovery Testing and Restore Assurance
Recovery testing and restore assurance verify that protected data, systems, dependencies, procedures, and personnel can meet defined recovery needs.
ATT&CK technique profile · IntermediateRemote Services (T1021)
An adversary uses authenticated remote services such as RDP, SMB, WinRM, SSH, VNC, or management protocols to access another system.
ATT&CK technique profile · IntermediateServer Software Component (T1505)
An adversary adds or modifies a component within server software—such as a web shell, plug-in, module, or management extension—to preserve access or execute code.
Application security concept · IntermediateServer-Side Request Forgery
Server-Side Request Forgery is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.
Security operations practice · IntermediateSigma Rules
Sigma Rules is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.
Network security concept · BeginnerStateful and Stateless Firewalls
Stateful and Stateless Firewalls is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Security operations practice · IntermediateSysmon
Sysmon is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
ATT&CK technique profile · IntermediateSystem Information Discovery (T1082)
An adversary queries operating-system, architecture, hardware, version, patch, hostname, or instance information to guide later actions.
ATT&CK technique profile · IntermediateSystem Network Configuration Discovery (T1016)
An adversary queries addresses, interfaces, routes, DNS settings, proxies, adapters, and other network configuration to understand connectivity.
Proactive analysis · AdvancedThreat Hunting
Threat hunting is a structured search for adversary behavior or hidden compromise that has not been fully identified by existing alerts.
ATT&CK technique profile · IntermediateUnsecured Credentials (T1552)
An adversary searches files, repositories, scripts, logs, environment variables, instance metadata, or configuration for exposed authentication material.
Application security concept · IntermediateWeb Application Attack Classes
Web application attack classes include injection, broken access control, authentication failures, insecure design, misconfiguration, component risk, request forgery, and unsafe handling of data and sessions.
Host firewall control · IntermediateWindows Defender Firewall
Windows Defender Firewall is a stateful host firewall that applies profile-aware inbound and outbound rules to programs, services, ports, protocols, interfaces, users, and network conditions.
Malware detection concept · AdvancedYARA Rules
YARA is a pattern-matching language used to classify files, memory, and other byte or text content by combining strings, metadata, modules, and Boolean conditions into reusable detection rules.