ATT＆CK中文矩阵列表-🔰0xShe网络安全导航ℒ🔰

=	Gather Victim Network Information ₍₆₎
	Domain Properties DNS Network Trust Dependencies Network Topology IP Addresses Network Security Appliances

=	Gather Victim Org Information ₍₄₎
	Business Relationships Determine Physical Locations Identify Business Tempo Identify Roles

=	Phishing for Information ₍₃₎
	Spearphishing Service Spearphishing Attachment Spearphishing Link

=	Search Closed Sources ₍₂₎
	Threat Intel Vendors Purchase Technical Data

=	Search Open Technical Databases ₍₅₎
	WHOIS DNS/Passive DNS Digital Certificates CDNs Scan Databases

=	Search Open Websites/Domains ₍₂₎
	Social Media Search Engines

Search Victim-Owned Websites

=	Acquire Infrastructure ₍₆₎
	Domains DNS Server Virtual Private Server Server Botnet Web Services

=	Compromise Accounts ₍₂₎
	Social Media Accounts Email Accounts

=	Compromise Infrastructure ₍₆₎
	Domains DNS Server Virtual Private Server Server Botnet Web Services

=	Develop Capabilities ₍₄₎
	Malware Code Signing Certificates Digital Certificates Exploits

=	Establish Accounts ₍₂₎
	Social Media Accounts Email Accounts

=	Obtain Capabilities ₍₆₎
	Malware Tool Code Signing Certificates Digital Certificates Exploits Vulnerabilities

=	Stage Capabilities ₍₅₎
	Upload Malware Upload Tool Install Digital Certificate Drive-by Target Link Target

Drive-by Compromise

Exploit Public-Facing Application

External Remote Services

Hardware Additions

=	Phishing ₍₃₎
	Spearphishing Attachment Spearphishing Link Spearphishing via Service

Replication Through Removable Media

=	Supply Chain Compromise ₍₃₎
	Compromise Software Dependencies and Development Tools Compromise Software Supply Chain Compromise Hardware Supply Chain

Trusted Relationship

=	Valid Accounts ₍₄₎
	Default Accounts Domain Accounts Local Accounts Cloud Accounts

=	Command and Scripting Interpreter ₍₈₎
	PowerShell AppleScript Windows Command Shell Unix Shell Visual Basic Python JavaScript Network Device CLI

Container Administration Command

Deploy Container

Exploitation for Client Execution

=	Inter-Process Communication ₍₂₎
	Component Object Model Dynamic Data Exchange

Native API

=	Scheduled Task/Job ₍₇₎
	At (Windows) Scheduled Task At (Linux) Launchd Cron Systemd Timers Container Orchestration Job

Shared Modules

Software Deployment Tools

=	System Services ₍₂₎
	Launchctl Service Execution

=	User Execution ₍₃₎
	Malicious Link Malicious File Malicious Image

Windows Management Instrumentation

=	Account Manipulation ₍₄₎
	Additional Cloud Credentials Exchange Email Delegate Permissions Add Office 365 Global Administrator Role SSH Authorized Keys

BITS Jobs

=	Boot or Logon Autostart Execution ₍₁₄₎
	Registry Run Keys / Startup Folder Authentication Package Time Providers Winlogon Helper DLL Security Support Provider Kernel Modules and Extensions Re-opened Applications LSASS Driver Shortcut Modification Port Monitors Plist Modification Print Processors XDG Autostart Entries Active Setup

=	Boot or Logon Initialization Scripts ₍₅₎
	Logon Script (Windows) Logon Script (Mac) Network Logon Script RC Scripts Startup Items

Browser Extensions

Compromise Client Software Binary

=	Create Account ₍₃₎
	Local Account Domain Account Cloud Account

=	Create or Modify System Process ₍₄₎
	Launch Agent Systemd Service Windows Service Launch Daemon

=	Event Triggered Execution ₍₁₅₎
	Change Default File Association Screensaver Windows Management Instrumentation Event Subscription Unix Shell Configuration Modification Trap LC_LOAD_DYLIB Addition Netsh Helper DLL Accessibility Features AppCert DLLs AppInit DLLs Application Shimming Image File Execution Options Injection PowerShell Profile Emond Component Object Model Hijacking

External Remote Services

=	Hijack Execution Flow ₍₁₁₎
	Services File Permissions Weakness Executable Installer File Permissions Weakness Services Registry Permissions Weakness Path Interception by Unquoted Path Path Interception by PATH Environment Variable Path Interception by Search Order Hijacking DLL Search Order Hijacking DLL Side-Loading Dynamic Linker Hijacking Dylib Hijacking COR_PROFILER

Implant Internal Image

=	Modify Authentication Process ₍₄₎
	Domain Controller Authentication Password Filter DLL Pluggable Authentication Modules Network Device Authentication

=	Office Application Startup ₍₆₎
	Add-ins Office Template Macros Outlook Forms Outlook Rules Outlook Home Page Office Test

=	Pre-OS Boot ₍₅₎
	System Firmware Component Firmware Bootkit ROMMONkit TFTP Boot

=	Scheduled Task/Job ₍₇₎
	At (Windows) Scheduled Task At (Linux) Launchd Cron Systemd Timers Container Orchestration Job

=	Server Software Component ₍₃₎
	SQL Stored Procedures Transport Agent Web Shell

=	Traffic Signaling ₍₁₎
	Port Knocking

=	Valid Accounts ₍₄₎
	Default Accounts Domain Accounts Local Accounts Cloud Accounts

=	Abuse Elevation Control Mechanism ₍₄₎
	Setuid and Setgid Bypass User Account Control Sudo and Sudo Caching Elevated Execution with Prompt

=	Access Token Manipulation ₍₅₎
	Token Impersonation/Theft Create Process with Token Make and Impersonate Token Parent PID Spoofing SID-History Injection

=	Boot or Logon Autostart Execution ₍₁₄₎
	Registry Run Keys / Startup Folder Authentication Package Time Providers Winlogon Helper DLL Security Support Provider Kernel Modules and Extensions Re-opened Applications LSASS Driver Shortcut Modification Port Monitors Plist Modification Print Processors XDG Autostart Entries Active Setup

=	Boot or Logon Initialization Scripts ₍₅₎
	Logon Script (Windows) Logon Script (Mac) Network Logon Script RC Scripts Startup Items

=	Create or Modify System Process ₍₄₎
	Launch Agent Systemd Service Windows Service Launch Daemon

=	Domain Policy Modification ₍₂₎
	Group Policy Modification Domain Trust Modification

Escape to Host

=	Event Triggered Execution ₍₁₅₎
	Change Default File Association Screensaver Windows Management Instrumentation Event Subscription Unix Shell Configuration Modification Trap LC_LOAD_DYLIB Addition Netsh Helper DLL Accessibility Features AppCert DLLs AppInit DLLs Application Shimming Image File Execution Options Injection PowerShell Profile Emond Component Object Model Hijacking

Exploitation for Privilege Escalation

=	Hijack Execution Flow ₍₁₁₎
	Services File Permissions Weakness Executable Installer File Permissions Weakness Services Registry Permissions Weakness Path Interception by Unquoted Path Path Interception by PATH Environment Variable Path Interception by Search Order Hijacking DLL Search Order Hijacking DLL Side-Loading Dynamic Linker Hijacking Dylib Hijacking COR_PROFILER

=	Process Injection ₍₁₁₎
	动态链接库注入便携式可执行注入线程执行劫持异步过程调用线程本地存储 Ptrace系统调用处理内存额外Window内存注入工艺流程工艺空洞 VDSO劫持

=	Scheduled Task/Job ₍₇₎
	At (Windows) Scheduled Task At (Linux) Launchd Cron Systemd Timers Container Orchestration Job

=	Valid Accounts ₍₄₎
	Default Accounts Domain Accounts Local Accounts Cloud Accounts

=	Abuse Elevation Control Mechanism ₍₄₎
	Setuid and Setgid Bypass User Account Control Sudo and Sudo Caching Elevated Execution with Prompt

=	Access Token Manipulation ₍₅₎
	Token Impersonation/Theft Create Process with Token Make and Impersonate Token Parent PID Spoofing SID-History Injection

BITS Jobs

Build Image on Host

Deobfuscate/Decode Files or Information

Deploy Container

Direct Volume Access

=	Domain Policy Modification ₍₂₎
	Group Policy Modification Domain Trust Modification

=	Execution Guardrails ₍₁₎
	Environmental Keying

Exploitation for Defense Evasion

=	File and Directory Permissions Modification ₍₂₎
	Windows File and Directory Permissions Modification Linux and Mac File and Directory Permissions Modification

=	Hide Artifacts ₍₇₎
	Hidden Files and Directories Hidden Users Hidden Window NTFS File Attributes Hidden File System Run Virtual Instance VBA Stomping

=	Hijack Execution Flow ₍₁₁₎
	Services File Permissions Weakness Executable Installer File Permissions Weakness Services Registry Permissions Weakness Path Interception by Unquoted Path Path Interception by PATH Environment Variable Path Interception by Search Order Hijacking DLL Search Order Hijacking DLL Side-Loading Dynamic Linker Hijacking Dylib Hijacking COR_PROFILER

=	Impair Defenses ₍₇₎
	Disable or Modify Tools Disable Windows Event Logging Impair Command History Logging Disable or Modify System Firewall Indicator Blocking Disable or Modify Cloud Firewall Disable Cloud Logs

=	Indicator Removal on Host ₍₆₎
	Clear Windows Event Logs Clear Linux or Mac System Logs Clear Command History File Deletion Network Share Connection Removal Timestomp

Indirect Command Execution

=	Masquerading ₍₆₎
	Invalid Code Signature Right-to-Left Override Rename System Utilities Masquerade Task or Service Match Legitimate Name or Location Space after Filename

=	Modify Authentication Process ₍₄₎
	Domain Controller Authentication Password Filter DLL Pluggable Authentication Modules Network Device Authentication

=	Modify Cloud Compute Infrastructure ₍₄₎
	Create Snapshot Create Cloud Instance Delete Cloud Instance Revert Cloud Instance

Modify Registry

=	Modify System Image ₍₂₎
	Patch System Image Downgrade System Image

=	Network Boundary Bridging ₍₁₎
	Network Address Translation Traversal

=	Obfuscated Files or Information ₍₅₎
	Binary Padding Software Packing Steganography Compile After Delivery Indicator Removal from Tools

=	Pre-OS Boot ₍₅₎
	System Firmware Component Firmware Bootkit ROMMONkit TFTP Boot

=	Process Injection ₍₁₁₎
	动态链接库注入便携式可执行注入线程执行劫持异步过程调用线程本地存储 Ptrace系统调用处理内存额外Window内存注入工艺流程工艺空洞 VDSO劫持

Rogue Domain Controller

Rootkit

=	Signed Binary Proxy Execution ₍₁₁₎
	Rundll32 Compiled HTML File Control Panel CMSTP InstallUtil Mshta Regsvcs/Regasm Regsvr32 Msiexec Odbcconf Verclsid

=	Signed Script Proxy Execution ₍₁₎
	PubPrn

=	Subvert Trust Controls ₍₆₎
	Gatekeeper Bypass Code Signing SIP and Trust Provider Hijacking Install Root Certificate Mark-of-the-Web Bypass Code Signing Policy Modification

Template Injection

=	Traffic Signaling ₍₁₎
	Port Knocking

=	Trusted Developer Utilities Proxy Execution ₍₁₎
	MSBuild

Unused/Unsupported Cloud Regions

=	Use Alternate Authentication Material ₍₄₎
	Pass the Hash Pass the Ticket Application Access Token Web Session Cookie

=	Valid Accounts ₍₄₎
	Default Accounts Domain Accounts Local Accounts Cloud Accounts

=	Virtualization/Sandbox Evasion ₍₃₎
	System Checks User Activity Based Checks Time Based Evasion

=	Weaken Encryption ₍₂₎
	Reduce Key Space Disable Crypto Hardware

XSL Script Processing

=	Brute Force ₍₄₎
	Password Guessing Password Cracking Password Spraying Credential Stuffing

=	Credentials from Password Stores ₍₅₎
	Keychain Securityd Memory Credentials from Web Browsers Windows Credential Manager Password Managers

Exploitation for Credential Access

Forced Authentication

=	Forge Web Credentials ₍₂₎
	Web Cookies SAML Tokens

=	Input Capture ₍₄₎
	Keylogging GUI Input Capture Web Portal Capture Credential API Hooking

=	Man-in-the-Middle ₍₂₎
	LLMNR/NBT-NS Poisoning and SMB Relay ARP Cache Poisoning

=	Modify Authentication Process ₍₄₎
	Domain Controller Authentication Password Filter DLL Pluggable Authentication Modules Network Device Authentication

Network Sniffing

=	OS Credential Dumping ₍₈₎
	LSASS Memory Security Account Manager NTDS DCSync Proc Filesystem /etc/passwd and /etc/shadow Cached Domain Credentials LSA Secrets

Steal Application Access Token

=	Steal or Forge Kerberos Tickets ₍₄₎
	Golden Ticket Silver Ticket Kerberoasting AS-REP Roasting

Steal Web Session Cookie

Two-Factor Authentication Interception

=	Unsecured Credentials ₍₇₎
	Credentials In Files Credentials in Registry Bash History Private Keys Cloud Instance Metadata API Group Policy Preferences Container API

=	Account Discovery ₍₄₎
	Local Account Domain Account Email Account Cloud Account

Application Window Discovery

Browser Bookmark Discovery

Cloud Infrastructure Discovery

Cloud Service Dashboard

Cloud Service Discovery

Container and Resource Discovery

Domain Trust Discovery

File and Directory Discovery

Network Service Scanning

Network Share Discovery

Network Sniffing

Password Policy Discovery

Peripheral Device Discovery

=	Permission Groups Discovery ₍₃₎
	Domain Groups Cloud Groups Local Groups

Process Discovery

Query Registry

Remote System Discovery

=	Software Discovery ₍₁₎
	Security Software Discovery

System Information Discovery

System Location Discovery

=	System Network Configuration Discovery ₍₁₎
	Internet Connection Discovery

System Network Connections Discovery

System Owner/User Discovery

System Service Discovery

System Time Discovery

=	Virtualization/Sandbox Evasion ₍₃₎
	System Checks User Activity Based Checks Time Based Evasion

Exploitation of Remote Services

Internal Spearphishing

Lateral Tool Transfer

=	Remote Service Session Hijacking ₍₂₎
	SSH Hijacking RDP Hijacking

=	Remote Services ₍₆₎
	Remote Desktop Protocol SMB/Windows Admin Shares Distributed Component Object Model SSH VNC Windows Remote Management

Replication Through Removable Media

Software Deployment Tools

Taint Shared Content

=	Use Alternate Authentication Material ₍₄₎
	Pass the Hash Pass the Ticket Application Access Token Web Session Cookie

=	Archive Collected Data ₍₃₎
	Archive via Utility Archive via Library Archive via Custom Method

Audio Capture

Automated Collection

Clipboard Data

Data from Cloud Storage Object

=	Data from Configuration Repository ₍₂₎
	SNMP (MIB Dump) Network Device Configuration Dump

=	Data from Information Repositories ₍₂₎
	Confluence Sharepoint

Data from Local System

Data from Network Shared Drive

Data from Removable Media

=	Data Staged ₍₂₎
	Local Data Staging Remote Data Staging

=	Email Collection ₍₃₎
	Local Email Collection Remote Email Collection Email Forwarding Rule

=	Input Capture ₍₄₎
	Keylogging GUI Input Capture Web Portal Capture Credential API Hooking

Man in the Browser

=	Man-in-the-Middle ₍₂₎
	LLMNR/NBT-NS Poisoning and SMB Relay ARP Cache Poisoning

Screen Capture

Video Capture

=	Application Layer Protocol ₍₄₎
	网络协议文件传输协议邮件协议 DNS

Communication Through Removable Media

=	Data Encoding ₍₂₎
	Standard Encoding Non-Standard Encoding

=	Data Obfuscation ₍₃₎
	Junk Data Steganography Protocol Impersonation

=	Dynamic Resolution ₍₃₎
	Domain Generation Algorithms Fast Flux DNS DNS Calculation

=	Encrypted Channel ₍₂₎
	Symmetric Cryptography Asymmetric Cryptography

Fallback Channels

Ingress Tool Transfer

Multi-Stage Channels

Non-Application Layer Protocol

Non-Standard Port

Protocol Tunneling

=	Proxy ₍₄₎
	Internal Proxy External Proxy Multi-hop Proxy Domain Fronting

Remote Access Software

=	Traffic Signaling ₍₁₎
	Port Knocking

=	Web Service ₍₃₎
	Dead Drop Resolver Bidirectional Communication One-Way Communication

=	Automated Exfiltration ₍₁₎
	Traffic Duplication

Data Transfer Size Limits

=	Exfiltration Over Alternative Protocol ₍₃₎
	Exfiltration Over Symmetric Encrypted Non-C2 Protocol Exfiltration Over Asymmetric Encrypted Non-C2 Protocol Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol

Exfiltration Over C2 Channel

=	Exfiltration Over Other Network Medium ₍₁₎
	Exfiltration Over Bluetooth

=	Exfiltration Over Physical Medium ₍₁₎
	Exfiltration over USB

=	Exfiltration Over Web Service ₍₂₎
	Exfiltration to Code Repository Exfiltration to Cloud Storage

Scheduled Transfer

Transfer Data to Cloud Account

Account Access Removal

Data Destruction

Data Encrypted for Impact

=	Data Manipulation ₍₃₎
	Stored Data Manipulation Transmitted Data Manipulation Runtime Data Manipulation

=	Defacement ₍₂₎
	Internal Defacement External Defacement

=	Disk Wipe ₍₂₎
	Disk Content Wipe Disk Structure Wipe

=	Endpoint Denial of Service ₍₄₎
	OS Exhaustion Flood Service Exhaustion Flood Application Exhaustion Flood Application or System Exploitation

Firmware Corruption

Inhibit System Recovery

=	Network Denial of Service ₍₂₎
	Direct Network Flood Reflection Amplification

Resource Hijacking

Service Stop

System Shutdown/Reboot