Tácticas, Técnicas y Procedimientos (TTPs)

Compara las técnicas asociadas a distintos adversarios en esta matriz introductoria, sin entrar en procedimientos específicos. Los mapas de calor te ayudarán a identificar solapamientos de comportamiento y priorizar los esfuerzos del equipo de ciberseguridad.

—

ReconnaissanceTA004312 técnicas

T1589Gather Victim Identity Information

T1590Gather Victim Network Information

T1591Gather Victim Org Information

T1592Gather Victim Host Information

T1593Search Open Websites/Domains

T1594Search Victim-Owned Websites

T1595Active Scanning

T1596Search Open Technical Databases

T1597Search Closed Sources

T1598Phishing for Information

T1681Search Threat Vendor Data

T1682Query Public AI Services

Resource DevelopmentTA00429 técnicas

T1583Acquire Infrastructure

T1584Compromise Infrastructure

T1585Establish Accounts

T1586Compromise Accounts

T1587Develop Capabilities

T1588Obtain Capabilities

T1608Stage Capabilities

T1650Acquire Access

T1683Generate Content

Initial AccessTA000111 técnicas

T1078Valid Accounts

T1091Replication Through Removable Media

T1133External Remote Services

T1189Drive-by Compromise

T1190Exploit Public-Facing Application

T1195Supply Chain Compromise

T1199Trusted Relationship

T1200Hardware Additions

T1566Phishing

T1659Content Injection

T1669Wi-Fi Networks

ExecutionTA000220 técnicas

T1047Windows Management Instrumentation

T1053Scheduled Task/Job

T1059Command and Scripting Interpreter

T1072Software Deployment Tools

T1106Native API

T1127Trusted Developer Utilities Proxy Execution

T1129Shared Modules

T1197BITS Jobs

T1203Exploitation for Client Execution

T1204User Execution

T1559Inter-Process Communication

T1569System Services

T1574Hijack Execution Flow

T1609Container Administration Command

T1610Deploy Container

T1648Serverless Execution

T1651Cloud Administration Command

T1674Input Injection

T1675ESXi Administration Command

T1677Poisoned Pipeline Execution

PersistenceTA000322 técnicas

T1037Boot or Logon Initialization Scripts

T1053Scheduled Task/Job

T1078Valid Accounts

T1098Account Manipulation

T1112Modify Registry

T1133External Remote Services

T1136Create Account

T1137Office Application Startup

T1176Software Extensions

T1197BITS Jobs

T1205Traffic Signaling

T1505Server Software Component

T1525Implant Internal Image

T1542Pre-OS Boot

T1543Create or Modify System Process

T1546Event Triggered Execution

T1547Boot or Logon Autostart Execution

T1554Compromise Host Software Binary

T1556Modify Authentication Process

T1653Power Settings

T1668Exclusive Control

T1671Cloud Application Integration

Privilege EscalationTA000413 técnicas

T1037Boot or Logon Initialization Scripts

T1053Scheduled Task/Job

T1055Process Injection

T1068Exploitation for Privilege Escalation

T1078Valid Accounts

T1098Account Manipulation

T1134Access Token Manipulation

T1484Domain or Tenant Policy Modification

T1543Create or Modify System Process

T1546Event Triggered Execution

T1547Boot or Logon Autostart Execution

T1548Abuse Elevation Control Mechanism

T1611Escape to Host

StealthTA000530 técnicas

T1006Direct Volume Access

T1014Rootkit

T1027Obfuscated Files or Information

T1036Masquerading

T1055Process Injection

T1070Indicator Removal

T1078Valid Accounts

T1127Trusted Developer Utilities Proxy Execution

T1134Access Token Manipulation

T1140Deobfuscate/Decode Files or Information

T1197BITS Jobs

T1202Indirect Command Execution

T1205Traffic Signaling

T1211Exploitation for Stealth

T1216System Script Proxy Execution

T1218System Binary Proxy Execution

T1220XSL Script Processing

T1221Template Injection

T1480Execution Guardrails

T1497Virtualization/Sandbox Evasion

T1535Unused/Unsupported Cloud Regions

T1542Pre-OS Boot

T1564Hide Artifacts

T1574Hijack Execution Flow

T1612Build Image on Host

T1620Reflective Code Loading

T1622Debugger Evasion

T1678Delay Execution

T1679Selective Exclusion

T1684Social Engineering

Defense ImpairmentTA005018 técnicas

T1112Modify Registry

T1207Rogue Domain Controller

T1222File and Directory Permissions Modification

T1484Domain or Tenant Policy Modification

T1553Subvert Trust Controls

T1556Modify Authentication Process

T1578Modify Cloud Compute Infrastructure

T1599Network Boundary Bridging

T1600Weaken Encryption

T1601Modify System Image

T1647Plist File Modification

T1666Modify Cloud Resource Hierarchy

T1685Disable or Modify Tools

T1686Disable or Modify System Firewall

T1687Exploitation for Defense Impairment

T1688Safe Mode Boot

T1689Downgrade Attack

T1690Prevent Command History Logging

Credential AccessTA000617 técnicas

T1003OS Credential Dumping

T1040Network Sniffing

T1056Input Capture

T1110Brute Force

T1111Multi-Factor Authentication Interception

T1187Forced Authentication

T1212Exploitation for Credential Access

T1528Steal Application Access Token

T1539Steal Web Session Cookie

T1552Unsecured Credentials

T1555Credentials from Password Stores

T1556Modify Authentication Process

T1557Adversary-in-the-Middle

T1558Steal or Forge Kerberos Tickets

T1606Forge Web Credentials

T1621Multi-Factor Authentication Request Generation

T1649Steal or Forge Authentication Certificates

DiscoveryTA000734 técnicas

T1007System Service Discovery

T1010Application Window Discovery

T1012Query Registry

T1016System Network Configuration Discovery

T1018Remote System Discovery

T1033System Owner/User Discovery

T1040Network Sniffing

T1046Network Service Discovery

T1049System Network Connections Discovery

T1057Process Discovery

T1069Permission Groups Discovery

T1082System Information Discovery

T1083File and Directory Discovery

T1087Account Discovery

T1120Peripheral Device Discovery

T1124System Time Discovery

T1135Network Share Discovery

T1201Password Policy Discovery

T1217Browser Information Discovery

T1482Domain Trust Discovery

T1497Virtualization/Sandbox Evasion

T1518Software Discovery

T1526Cloud Service Discovery

T1538Cloud Service Dashboard

T1580Cloud Infrastructure Discovery

T1613Container and Resource Discovery

T1614System Location Discovery

T1615Group Policy Discovery

T1619Cloud Storage Object Discovery

T1622Debugger Evasion

T1652Device Driver Discovery

T1654Log Enumeration

T1673Virtual Machine Discovery

T1680Local Storage Discovery

Lateral MovementTA00089 técnicas

T1021Remote Services

T1072Software Deployment Tools

T1080Taint Shared Content

T1091Replication Through Removable Media

T1210Exploitation of Remote Services

T1534Internal Spearphishing

T1550Use Alternate Authentication Material

T1563Remote Service Session Hijacking

T1570Lateral Tool Transfer

CollectionTA000917 técnicas

T1005Data from Local System

T1025Data from Removable Media

T1039Data from Network Shared Drive

T1056Input Capture

T1074Data Staged

T1113Screen Capture

T1114Email Collection

T1115Clipboard Data

T1119Automated Collection

T1123Audio Capture

T1125Video Capture

T1185Browser Session Hijacking

T1213Data from Information Repositories

T1530Data from Cloud Storage

T1557Adversary-in-the-Middle

T1560Archive Collected Data

T1602Data from Configuration Repository

Command and ControlTA001118 técnicas

T1001Data Obfuscation

T1008Fallback Channels

T1071Application Layer Protocol

T1090Proxy

T1092Communication Through Removable Media

T1095Non-Application Layer Protocol

T1102Web Service

T1104Multi-Stage Channels

T1105Ingress Tool Transfer

T1132Data Encoding

T1205Traffic Signaling

T1219Remote Access Tools

T1568Dynamic Resolution

T1571Non-Standard Port

T1572Protocol Tunneling

T1573Encrypted Channel

T1659Content Injection

T1665Hide Infrastructure

ExfiltrationTA00109 técnicas

T1011Exfiltration Over Other Network Medium

T1020Automated Exfiltration

T1029Scheduled Transfer

T1030Data Transfer Size Limits

T1041Exfiltration Over C2 Channel

T1048Exfiltration Over Alternative Protocol

T1052Exfiltration Over Physical Medium

T1537Transfer Data to Cloud Account

T1567Exfiltration Over Web Service

ImpactTA004015 técnicas

T1485Data Destruction

T1486Data Encrypted for Impact

T1489Service Stop

T1490Inhibit System Recovery

T1491Defacement

T1495Firmware Corruption

T1496Resource Hijacking

T1498Network Denial of Service

T1499Endpoint Denial of Service

T1529System Shutdown/Reboot

T1531Account Access Removal

T1561Disk Wipe

T1565Data Manipulation

T1657Financial Theft

T1667Email Bombing