This page is experimental and may change significantly in future
releases.
Digital Artifact
Access Control Configuration
Access Control Group
Access Control List
Access Token
Activity Dependency
Address Space
Administrative Network Traffic
Alias
Allocate Memory
Application
Application Configuration
Application Configuration Database
Application Configuration Database Record
Application Configuration File
Application Installer
Application Inventory Sensor
Application Layer Firewall
Application Layer Link
Application Process
Application Process Configuration
Application Rule
Application Shim
Archive File
Artifact Server
Asymmetric Key
Audio Input Device
Authenticate User
Authentication
Authentication Function
Authentication Log
Authentication Server
Authentication Service
Authorization
Authorization Log
Authorization Service
Barcode Scanner Input Device
Binary Large Object
Binary Segment
Blob
Block Device
Boot Loader
Boot Record
Boot Sector
Browser
Browser Extension
Build Tool
Business Communication Platform Client
CA Certificate File
Processor Cache Memory
Call Stack
Central Processing Unit
Certificate
Certificate File
Certificate Trust Store
Chatroom Client
Child Process
Client Application
Client Computer
Clipboard
Cloud Configuration
Cloud Instance Metadata
Cloud Service Authentication
Cloud Service Authorization
Cloud Service Sensor
Cloud Storage
Cloud User Account
Code Analyzer
Code Repository
Collaborative Software
Network Agent
Command
Command History Log
Command History Log File
Command Line Interface
Compiler
Compiler Configuration File
Computing Server
Configuration Database
Configuration Database Record
Configuration File
Configuration Management Database
Configuration Resource
Connect Socket
Console Output Function
Container Build Tool
Container Image
Container Orchestration Software
Container Process
Container Runtime
Copy Memory Function
Copy Token
Create File
Create Process
Create Socket
Create Thread
Credential
Credential Management System
Cryptographic Key
Custom Archive File
DHCP Network Traffic
DHCP Server
DNS Lookup
DNS Network Traffic
DNS Record
DNS Server
Data Artifact Server
Data Dependency
Data Link Link
Database
Database File
Database Query
Database Server
Decoy Artifact
Default User Account
Delete File
Dependency
Deserialization Function
Desktop Computer
Developer Application
Dial Up Modem
Digital Artifact
Digital Fingerprint
Digital System
Directory
Directory Service
Display Adapter
Display Device Driver
Display Server
Document File
Domain Name
Domain Registration
Domain User Account
Dynamic Analysis Tool
Email
Email Attachment
Email Rule
Embedded Computer
Enclave
Encrypted Credential
Encrypted Password
Endpoint Sensor
Eval Function
Event Log
Exception Handler
Exec
Executable Binary
Executable File
Executable Script
External Content Inclusion Function
Fast Symbolic Link
File
File Hash
File Path Open Function
File Section
File Server
File Share Service
File System
File System Link
File System Metadata
File System Sensor
File Transfer Network Traffic
Finger Print Scanner Input Device
Firewall
Firmware
Firmware Sensor
First-stage Boot Loader
Flash Memory
Forward Proxy Server
Free Memory
Get Open Sockets
Get Open Windows
Get Running Processes
Get Screen Capture
Get System Config Value
Get System Network Config Value
Get System Time
Global User Account
Graphical User Interface
Graphics Card Firmware
Graphics Processing Unit
Group Policy
HTML File
Hard Disk Firmware
Hard Link
Hardware Device
Hardware Driver
Heap Segment
Host
Host-based Firewall
Host Configuration Sensor
Host Group
Hostname
Human Input Device Firmware
IP Address
IPC Network Traffic
IP Phone
Identifier
Image Code Segment
Image Data Segment
Image Scanner Input Device
Image Segment
Impersonate User
Import Library Function
In-memory Password Store
Inbound Internet DNS Response Traffic
Inbound Internet Mail Traffic
Inbound Internet Network Traffic
Inbound Network Traffic
Init Script
Input Device
Input Function
Instant Messaging Client
Integration Test Execution Tool
Internet DNS Lookup
Internet File Transfer Traffic
Internet Network
Internet Network Traffic
Interprocess Communication
Intranet Administrative Network Traffic
Intranet DNS Lookup
Intranet File Transfer Traffic
Intranet IPC Network Traffic
Intranet Multicast Network Traffic
Intranet Network
Intranet Network Traffic
Intranet RPC Network Traffic
Intranet Web Network Traffic
Intrusion Detection System
Intrusion Prevention System
Java Archive
JavaScript Blob
Job Schedule
Job Scheduler Software
Kerberos Ticket
Kerberos Ticket Granting Service Ticket
Kerberos Ticket Granting Ticket
Kernel
Kernel API Sensor
Kernel Module
Kernel Process Table
Keyboard Input Device
Kiosk Computer
Laptop Computer
Legacy System
Link
Linux Clone
Linux Clone3
Linux Clone3 Argument CLONE_THREAD
Linux Clone Argument CLONE_THREAD
Linux Connect
Linux Creat
Linux Execve
Linux Execveat
Linux Fork
Linux Kill Argument SIGKILL
Linux Mmap
Linux Mmap2
Linux Munmap
Linux Open Argument O_CREAT
Linux Open Argument O_RDONLY, O_WRONLY, O_RDWR
Linux OpenAt2 Argument O_CREAT
Linux OpenAt2 Argument O_RDONLY, O_WRONLY, O_RDWR
Linux OpenAt Argument O_CREAT
Linux OpenAt Argument O_RDONLY, O_WRONLY, O_RDWR
Linux Pause Process
Linux Pause Thread
Linux Ptrace Argument PTRACE_INTERRUPT
Linux Ptrace Argument PTRACE_TRACEME
Linux Read
Linux Readv
Linux Rename
Linux Renameat
Linux Renameat2
Linux Socket
Linux Socketcall Argument SYS_CONNECT
Linux Socketcall Argument SYS_SOCKET
Linux Time
Linux Unlink
Linux Unlinkat
Linux Vfork
Linux Write
Linux Writev
Linux _Exit
Local Area Network
Local Area Network Traffic
Local Authentication Service
Local Authorization Service
Local Resource
Local Resource Access
Local User Account
Log
Log File
Log Message Function
Logical Link
Login Session
Logon User
MacOS Keychain
Mail Network Traffic
Mail Server
Mail Service
Mathematical Function
Media Server
Memory Address
Memory Address Space
Memory Allocation Function
Memory Block
Memory Extent
Memory Free Function
Memory Management Unit
Memory Management Unit Component
Memory Pool
Memory Protection Unit
Memory Word
Message Transfer Agent
Metadata
Microcode
Microsoft HTML Application
Mobile Phone
Modem
Mouse Input Device
Move File
Multimedia Document File
NTFS Hard Link
NTFS Junction Point
NTFS Link
NTFS Symbolic Link
Network
Network Card Firmware
Network Directory Resource
Network File Resource
Network File Share Resource
Network Flow
Network Flow Sensor
Network Init Script File Resource
Network Link
Network Node
Network Packet
Network Printer
Network Protocol Analyzer
Network Resource
Network Resource Access
Network Sensor
Network Service
Network Session
Network Time Server
Network Traffic
Network Traffic Analysis Software
OS API Allocate Memory
OS API Connect Socket
OS API Copy Token
OS API Create File
OS API Create Process
OS API Create Socket
OS API Create Thread
OS API Delete File
OS API Exec
OS API Free Memory
OS API Function
OS API Get System Time
OS API Move File
OS API Open File
OS API Private Function
OS API Read File
OS API Suspend Process
OS API Suspend Thread
OS API Terminate Process
OS API Trace Process
OS API Write File
Object File
Office Application
Office Application File
Open File
Operating System
Operating System Configuration
Operating System Configuration Component
Operating System Configuration File
Operating System Executable File
Operating System File
Operating System Log File
Operating System Packaging Tool
Operating System Process
Operating System Shared Library File
Operations Center Computer
Optical Modem
Orchestration Controller
Orchestration Server
Orchestration Worker
Outbound Internet DNS Lookup Traffic
Outbound Internet Encrypted Remote Terminal Traffic
Outbound Internet Encrypted Traffic
Outbound Internet Encrypted Web Traffic
Outbound Internet File Transfer Traffic
Outbound Internet Mail Traffic
Outbound Internet Network Traffic
Outbound Internet RPC Traffic
Outbound Internet Web Traffic
Outbound Network Traffic
Output Device
POSIX Symbolic Link
Packet Log
Page
Page Frame
Page Table
Parent Process
Partition
Partition Table
Password
Password Database
Password File
Password Manager
Password Store
Peripheral Firmware
Peripheral Hub Firmware
Personal Computer
Physical Address
Physical Link
Physical Location
Pipe
Platform
Pointer
Pointer Dereferencing Function
PowerShell Profile Script
Primary Storage
Print Server
Private Key
Privileged User Account
Process
Process Code Segment
Process Data Segment
Process Environment Variable
Process Image
Process Segment
Process Start Function
Process Tree
Processor
Processor Component
Processor Register
Property List File
Proxy Server
Public Key
Python Package
Python Script File
RAM
RDP Session
RF Node
RF Receiver
RF Transceiver
RF Transmitter
ROM
RPC Network Traffic
Radio Modem
Raw Memory Access Function
Read File
Record
Remote Authentication Service
Remote Authorization Service
Remote Command
Remote Database Query
Remote Procedure Call
Remote Resource
Remote Session
Remote Terminal Session
Removable Media Device
Resource
Resource Access
Resource Fork
Reverse Proxy Server
Router
SSH Session
Saved Instruction Pointer
Scheduled Job
Script Application Process
Second-stage Boot Loader
Secondary Storage
Security Token
Sensor
Serialization Function
Server
Service Application
Service Application Process
Service Dependency
Session
Session Cookie
Set System Config Value
Shadow Stack
Shared Computer
Shared Library File
Shared Resource Access Function
Shim
Shim Database
Shortcut File
Slow Symbolic Link
Software
Software Artifact Server
Software Deployment Tool
Software Library
Software Library File
Software Package
Software Packaging Tool
Software Patch
Source Code Analyzer Tool
Stack Component
Stack Frame
Stack Frame Canary
Stack Segment
Startup Directory
Static Analysis Tool
Storage
Stored Procedure
String Format Function
Subroutine
Suspend Process
Suspend Thread
Switch
Symbolic Link
Symmetric Key
System Call
System Config System Call
System Configuration Database
System Configuration Database Record
System Configuration Init Database Record
System Configuration Init Resource
System Dependency
System Firewall Configuration
System Firmware
System Init Configuration
System Init Process
System Init Script
System Password Database
System Service Software
System Software
System Startup Directory
System Time Application
System Utilization Record
TFTP Network Traffic
TFTP Server
Tablet Computer
Terminate Process
Tertiary Storage
Test Execution Tool
Thin Client Computer
Thread
Thread Start Function
Ticket Granting Ticket
Trace Process
Translation Lookaside Buffer
Transport Link
Trust Store
URL
Unit Test Execution Tool
Unix Hard Link
Unix Link
User
User Account
User Action
User Application
User Behavior
User Group
User Init Configuration File
User Init Script
User Input Function
User Interface
User Logon Init Resource
User Process
User Startup Directory
User Startup Script File
User to User Message
Utility Software
VPN Server
Version Control Tool
Video Input Device
Virtual Address
Virtual Memory Space
Virtualization Software
Volume
Volume Boot Record
Web API Resource
Web Application Firewall
Web Application Server
Web Authentication
Web File Resource
Web Network Traffic
Web Resource
Web Resource Access
Web Script File
Web Server
Web Server Application
Wide Area Network
Windows NtAllocateVirtualMemory
Windows NtAllocateVirtualMemoryEx
Windows NtCreateFile
Windows NtCreateMailslotFile
Windows NtCreateNamedPipeFile
Windows NtCreatePagingFile
Windows NtCreateProcess
Windows NtCreateProcessEx
Windows NtCreateThread
Windows NtCreateThreadEx
Windows NtDeleteFile
Windows NtDuplicateToken
Windows NtFreeVirtualMemory
Windows NtOpenFile
Windows NtOpenProcess
Windows NtQuerySystemTime
Windows NtReadFile
Windows NtReadFileScatter
Windows NtSetInformationFile Argument FileDispositionInformation
Windows NtSuspendProcess
Windows NtSuspendThread
Windows NtTerminateProcess
Windows NtWriteFile
Windows NtWriteFileGather
Windows Registry
Windows Registry Key
Windows Registry Value
Windows Shortcut File
Wireless Access Point
Wireless Router
Write File
Zero Client Computer
Properties
- name
- Digital Artifact
- definition
- An information-bearing artifact (object) that is, or is encoded to be used with, a digital computer system. This concept is broad to include the literal instances of an artifact, or an implicit summarization of changes to or properties of other artifacts.
- see also
- https://www.iso.org/obp/ui/#iso:std:iso-iec:19770:-1:ed-3:v1:en
- see also
- http://dbpedia.org/resource/Digital_artifactual_value
- see also
- http://dbpedia.org/resource/Virtual_artifact
Neighbors
graph LR;
d3f:DecoyArtifact["Decoy Artifact"] --> | may-contain | d3f:DigitalArtifact["Digital Artifact"];
class d3f:DecoyArtifact inbound_node;
style d3f:DecoyArtifact fill:#fff4dd;
class d3f:DigitalArtifact RootArtifactNode;
style d3f:DigitalArtifact fill:#fff4dd;
click d3f:DecoyArtifact href "/dao/artifact/d3f:DecoyArtifact";
click d3f:DigitalArtifact href "/dao/artifact/d3f:DigitalArtifact";
Inferred Relationships
Hierarchy
(filtered)
Related Countermeasure Techniques
graph LR;
DecoySessionToken["Decoy Session Token"] -->
| spoofs | AccessToken["Access Token"]; class DecoySessionToken DefensiveTechniqueNode; class AccessToken ArtifactNode; click DecoySessionToken href "/technique/d3f:DecoySessionToken"; click AccessToken href "/dao/artifact/d3f:AccessToken";ApplicationConfigurationHardening["Application Configuration Hardening"] -->
| hardens | ApplicationConfiguration["Application Configuration"]; class ApplicationConfigurationHardening DefensiveTechniqueNode; class ApplicationConfiguration ArtifactNode; click ApplicationConfigurationHardening href "/technique/d3f:ApplicationConfigurationHardening"; click ApplicationConfiguration href "/dao/artifact/d3f:ApplicationConfiguration";AuthenticationEventThresholding["Authentication Event Thresholding"] -->
| analyzes | Authentication["Authentication"]; class AuthenticationEventThresholding DefensiveTechniqueNode; class Authentication ArtifactNode; click AuthenticationEventThresholding href "/technique/d3f:AuthenticationEventThresholding"; click Authentication href "/dao/artifact/d3f:Authentication";ResourceAccessPatternAnalysis["Resource Access Pattern Analysis"] -->
| analyzes | Authentication["Authentication"]; class ResourceAccessPatternAnalysis DefensiveTechniqueNode; class Authentication ArtifactNode; click ResourceAccessPatternAnalysis href "/technique/d3f:ResourceAccessPatternAnalysis"; click Authentication href "/dao/artifact/d3f:Authentication";SessionDurationAnalysis["Session Duration Analysis"] -->
| analyzes | Authentication["Authentication"]; class SessionDurationAnalysis DefensiveTechniqueNode; class Authentication ArtifactNode; click SessionDurationAnalysis href "/technique/d3f:SessionDurationAnalysis"; click Authentication href "/dao/artifact/d3f:Authentication";AuthorizationEventThresholding["Authorization Event Thresholding"] -->
| analyzes | Authorization["Authorization"]; class AuthorizationEventThresholding DefensiveTechniqueNode; class Authorization ArtifactNode; click AuthorizationEventThresholding href "/technique/d3f:AuthorizationEventThresholding"; click Authorization href "/dao/artifact/d3f:Authorization";JobFunctionAccessPatternAnalysis["Job Function Access Pattern Analysis"] -->
| analyzes | Authorization["Authorization"]; class JobFunctionAccessPatternAnalysis DefensiveTechniqueNode; class Authorization ArtifactNode; click JobFunctionAccessPatternAnalysis href "/technique/d3f:JobFunctionAccessPatternAnalysis"; click Authorization href "/dao/artifact/d3f:Authorization";ResourceAccessPatternAnalysis["Resource Access Pattern Analysis"] -->
| analyzes | Authorization["Authorization"]; class ResourceAccessPatternAnalysis DefensiveTechniqueNode; class Authorization ArtifactNode; click ResourceAccessPatternAnalysis href "/technique/d3f:ResourceAccessPatternAnalysis"; click Authorization href "/dao/artifact/d3f:Authorization";SessionDurationAnalysis["Session Duration Analysis"] -->
| analyzes | Authorization["Authorization"]; class SessionDurationAnalysis DefensiveTechniqueNode; class Authorization ArtifactNode; click SessionDurationAnalysis href "/technique/d3f:SessionDurationAnalysis"; click Authorization href "/dao/artifact/d3f:Authorization";BootloaderAuthentication["Bootloader Authentication"] -->
| authenticates | BootLoader["Boot Loader"]; class BootloaderAuthentication DefensiveTechniqueNode; class BootLoader ArtifactNode; click BootloaderAuthentication href "/technique/d3f:BootloaderAuthentication"; click BootLoader href "/dao/artifact/d3f:BootLoader";CertificateAnalysis["Certificate Analysis"] -->
| analyzes | CertificateFile["Certificate File"]; class CertificateAnalysis DefensiveTechniqueNode; class CertificateFile ArtifactNode; click CertificateAnalysis href "/technique/d3f:CertificateAnalysis"; click CertificateFile href "/dao/artifact/d3f:CertificateFile";RestoreConfiguration["Restore Configuration"] -->
| restores | ConfigurationResource["Configuration Resource"]; class RestoreConfiguration DefensiveTechniqueNode; class ConfigurationResource ArtifactNode; click RestoreConfiguration href "/technique/d3f:RestoreConfiguration"; click ConfigurationResource href "/dao/artifact/d3f:ConfigurationResource";FileCreationAnalysis["File Creation Analysis"] -->
| analyzes | CreateFile["Create File"]; class FileCreationAnalysis DefensiveTechniqueNode; class CreateFile ArtifactNode; click FileCreationAnalysis href "/technique/d3f:FileCreationAnalysis"; click CreateFile href "/dao/artifact/d3f:CreateFile";ProcessSpawnAnalysis["Process Spawn Analysis"] -->
| analyzes | CreateProcess["Create Process"]; class ProcessSpawnAnalysis DefensiveTechniqueNode; class CreateProcess ArtifactNode; click ProcessSpawnAnalysis href "/technique/d3f:ProcessSpawnAnalysis"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";ExecutableAllowlisting["Executable Allowlisting"] -->
| restricts | CreateProcess["Create Process"]; class ExecutableAllowlisting DefensiveTechniqueNode; class CreateProcess ArtifactNode; click ExecutableAllowlisting href "/technique/d3f:ExecutableAllowlisting"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";ExecutableDenylisting["Executable Denylisting"] -->
| restricts | CreateProcess["Create Process"]; class ExecutableDenylisting DefensiveTechniqueNode; class CreateProcess ArtifactNode; click ExecutableDenylisting href "/technique/d3f:ExecutableDenylisting"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";Hardware-basedProcessIsolation["Hardware-based Process Isolation"] -->
| restricts | CreateProcess["Create Process"]; class Hardware-basedProcessIsolation DefensiveTechniqueNode; class CreateProcess ArtifactNode; click Hardware-basedProcessIsolation href "/technique/d3f:Hardware-basedProcessIsolation"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";MandatoryAccessControl["Mandatory Access Control"] -->
| restricts | CreateProcess["Create Process"]; class MandatoryAccessControl DefensiveTechniqueNode; class CreateProcess ArtifactNode; click MandatoryAccessControl href "/technique/d3f:MandatoryAccessControl"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";AuthenticationCacheInvalidation["Authentication Cache Invalidation"] -->
| deletes | Credential["Credential"]; class AuthenticationCacheInvalidation DefensiveTechniqueNode; class Credential ArtifactNode; click AuthenticationCacheInvalidation href "/technique/d3f:AuthenticationCacheInvalidation"; click Credential href "/dao/artifact/d3f:Credential";CredentialRevoking["Credential Revoking"] -->
| deletes | Credential["Credential"]; class CredentialRevoking DefensiveTechniqueNode; class Credential ArtifactNode; click CredentialRevoking href "/technique/d3f:CredentialRevoking"; click Credential href "/dao/artifact/d3f:Credential";CredentialTransmissionScoping["Credential Transmission Scoping"] -->
| restricts | Credential["Credential"]; class CredentialTransmissionScoping DefensiveTechniqueNode; class Credential ArtifactNode; click CredentialTransmissionScoping href "/technique/d3f:CredentialTransmissionScoping"; click Credential href "/dao/artifact/d3f:Credential";CredentialRotation["Credential Rotation"] -->
| regenerates | Credential["Credential"]; class CredentialRotation DefensiveTechniqueNode; class Credential ArtifactNode; click CredentialRotation href "/technique/d3f:CredentialRotation"; click Credential href "/dao/artifact/d3f:Credential";DecoyUserCredential["Decoy User Credential"] -->
| spoofs | Credential["Credential"]; class DecoyUserCredential DefensiveTechniqueNode; class Credential ArtifactNode; click DecoyUserCredential href "/technique/d3f:DecoyUserCredential"; click Credential href "/dao/artifact/d3f:Credential";CredentialCompromiseScopeAnalysis["Credential Compromise Scope Analysis"] -->
| analyzes | Credential["Credential"]; class CredentialCompromiseScopeAnalysis DefensiveTechniqueNode; class Credential ArtifactNode; click CredentialCompromiseScopeAnalysis href "/technique/d3f:CredentialCompromiseScopeAnalysis"; click Credential href "/dao/artifact/d3f:Credential";ReissueCredential["Reissue Credential"] -->
| restores | Credential["Credential"]; class ReissueCredential DefensiveTechniqueNode; class Credential ArtifactNode; click ReissueCredential href "/technique/d3f:ReissueCredential"; click Credential href "/dao/artifact/d3f:Credential";DNSTrafficAnalysis["DNS Traffic Analysis"] -->
| may-contain | DNSLookup["DNS Lookup"]; class DNSTrafficAnalysis DefensiveTechniqueNode; class DNSLookup ArtifactNode; click DNSTrafficAnalysis href "/technique/d3f:DNSTrafficAnalysis"; click DNSLookup href "/dao/artifact/d3f:DNSLookup";DNSDenylisting["DNS Denylisting"] -->
| blocks | DNSNetworkTraffic["DNS Network Traffic"]; class DNSDenylisting DefensiveTechniqueNode; class DNSNetworkTraffic ArtifactNode; click DNSDenylisting href "/technique/d3f:DNSDenylisting"; click DNSNetworkTraffic href "/dao/artifact/d3f:DNSNetworkTraffic";RestoreDatabase["Restore Database"] -->
| restores | Database["Database"]; class RestoreDatabase DefensiveTechniqueNode; class Database ArtifactNode; click RestoreDatabase href "/technique/d3f:RestoreDatabase"; click Database href "/dao/artifact/d3f:Database";DatabaseQueryStringAnalysis["Database Query String Analysis"] -->
| analyzes | DatabaseQuery["Database Query"]; class DatabaseQueryStringAnalysis DefensiveTechniqueNode; class DatabaseQuery ArtifactNode; click DatabaseQueryStringAnalysis href "/technique/d3f:DatabaseQueryStringAnalysis"; click DatabaseQuery href "/dao/artifact/d3f:DatabaseQuery";DecoyEnvironment["Decoy Environment"] -->
| manages | DecoyArtifact["Decoy Artifact"]; class DecoyEnvironment DefensiveTechniqueNode; class DecoyArtifact ArtifactNode; click DecoyEnvironment href "/technique/d3f:DecoyEnvironment"; click DecoyArtifact href "/dao/artifact/d3f:DecoyArtifact";LocalFilePermissions["Local File Permissions"] -->
| restricts | Directory["Directory"]; class LocalFilePermissions DefensiveTechniqueNode; class Directory ArtifactNode; click LocalFilePermissions href "/technique/d3f:LocalFilePermissions"; click Directory href "/dao/artifact/d3f:Directory";DomainTrustPolicy["Domain Trust Policy"] -->
| restricts | DirectoryService["Directory Service"]; class DomainTrustPolicy DefensiveTechniqueNode; class DirectoryService ArtifactNode; click DomainTrustPolicy href "/technique/d3f:DomainTrustPolicy"; click DirectoryService href "/dao/artifact/d3f:DirectoryService";DynamicAnalysis["Dynamic Analysis"] -->
| analyzes | DocumentFile["Document File"]; class DynamicAnalysis DefensiveTechniqueNode; class DocumentFile ArtifactNode; click DynamicAnalysis href "/technique/d3f:DynamicAnalysis"; click DocumentFile href "/dao/artifact/d3f:DocumentFile";EmulatedFileAnalysis["Emulated File Analysis"] -->
| analyzes | DocumentFile["Document File"]; class EmulatedFileAnalysis DefensiveTechniqueNode; class DocumentFile ArtifactNode; click EmulatedFileAnalysis href "/technique/d3f:EmulatedFileAnalysis"; click DocumentFile href "/dao/artifact/d3f:DocumentFile";DomainNameReputationAnalysis["Domain Name Reputation Analysis"] -->
| analyzes | DomainName["Domain Name"]; class DomainNameReputationAnalysis DefensiveTechniqueNode; class DomainName ArtifactNode; click DomainNameReputationAnalysis href "/technique/d3f:DomainNameReputationAnalysis"; click DomainName href "/dao/artifact/d3f:DomainName";DomainAccountMonitoring["Domain Account Monitoring"] -->
| monitors | DomainUserAccount["Domain User Account"]; class DomainAccountMonitoring DefensiveTechniqueNode; class DomainUserAccount ArtifactNode; click DomainAccountMonitoring href "/technique/d3f:DomainAccountMonitoring"; click DomainUserAccount href "/dao/artifact/d3f:DomainUserAccount";EmailFiltering["Email Filtering"] -->
| filters | Email["Email"]; class EmailFiltering DefensiveTechniqueNode; class Email ArtifactNode; click EmailFiltering href "/technique/d3f:EmailFiltering"; click Email href "/dao/artifact/d3f:Email";EmailRemoval["Email Removal"] -->
| deletes | Email["Email"]; class EmailRemoval DefensiveTechniqueNode; class Email ArtifactNode; click EmailRemoval href "/technique/d3f:EmailRemoval"; click Email href "/dao/artifact/d3f:Email";HomoglyphDetection["Homoglyph Detection"] -->
| analyzes | Email["Email"]; class HomoglyphDetection DefensiveTechniqueNode; class Email ArtifactNode; click HomoglyphDetection href "/technique/d3f:HomoglyphDetection"; click Email href "/dao/artifact/d3f:Email";SenderMTAReputationAnalysis["Sender MTA Reputation Analysis"] -->
| analyzes | Email["Email"]; class SenderMTAReputationAnalysis DefensiveTechniqueNode; class Email ArtifactNode; click SenderMTAReputationAnalysis href "/technique/d3f:SenderMTAReputationAnalysis"; click Email href "/dao/artifact/d3f:Email";SenderReputationAnalysis["Sender Reputation Analysis"] -->
| analyzes | Email["Email"]; class SenderReputationAnalysis DefensiveTechniqueNode; class Email ArtifactNode; click SenderReputationAnalysis href "/technique/d3f:SenderReputationAnalysis"; click Email href "/dao/artifact/d3f:Email";RestoreEmail["Restore Email"] -->
| restores | Email["Email"]; class RestoreEmail DefensiveTechniqueNode; class Email ArtifactNode; click RestoreEmail href "/technique/d3f:RestoreEmail"; click Email href "/dao/artifact/d3f:Email";ExecutableAllowlisting["Executable Allowlisting"] -->
| blocks | ExecutableFile["Executable File"]; class ExecutableAllowlisting DefensiveTechniqueNode; class ExecutableFile ArtifactNode; click ExecutableAllowlisting href "/technique/d3f:ExecutableAllowlisting"; click ExecutableFile href "/dao/artifact/d3f:ExecutableFile";ExecutableDenylisting["Executable Denylisting"] -->
| blocks | ExecutableFile["Executable File"]; class ExecutableDenylisting DefensiveTechniqueNode; class ExecutableFile ArtifactNode; click ExecutableDenylisting href "/technique/d3f:ExecutableDenylisting"; click ExecutableFile href "/dao/artifact/d3f:ExecutableFile";DynamicAnalysis["Dynamic Analysis"] -->
| analyzes | ExecutableFile["Executable File"]; class DynamicAnalysis DefensiveTechniqueNode; class ExecutableFile ArtifactNode; click DynamicAnalysis href "/technique/d3f:DynamicAnalysis"; click ExecutableFile href "/dao/artifact/d3f:ExecutableFile";EmulatedFileAnalysis["Emulated File Analysis"] -->
| analyzes | ExecutableFile["Executable File"]; class EmulatedFileAnalysis DefensiveTechniqueNode; class ExecutableFile ArtifactNode; click EmulatedFileAnalysis href "/technique/d3f:EmulatedFileAnalysis"; click ExecutableFile href "/dao/artifact/d3f:ExecutableFile";FileEncryption["File Encryption"] -->
| encrypts | File["File"]; class FileEncryption DefensiveTechniqueNode; class File ArtifactNode; click FileEncryption href "/technique/d3f:FileEncryption"; click File href "/dao/artifact/d3f:File";LocalFilePermissions["Local File Permissions"] -->
| restricts | File["File"]; class LocalFilePermissions DefensiveTechniqueNode; class File ArtifactNode; click LocalFilePermissions href "/technique/d3f:LocalFilePermissions"; click File href "/dao/artifact/d3f:File";DecoyFile["Decoy File"] -->
| spoofs | File["File"]; class DecoyFile DefensiveTechniqueNode; class File ArtifactNode; click DecoyFile href "/technique/d3f:DecoyFile"; click File href "/dao/artifact/d3f:File";FileRemoval["File Removal"] -->
| deletes | File["File"]; class FileRemoval DefensiveTechniqueNode; class File ArtifactNode; click FileRemoval href "/technique/d3f:FileRemoval"; click File href "/dao/artifact/d3f:File";FileIntegrityMonitoring["File Integrity Monitoring"] -->
| analyzes | File["File"]; class FileIntegrityMonitoring DefensiveTechniqueNode; class File ArtifactNode; click FileIntegrityMonitoring href "/technique/d3f:FileIntegrityMonitoring"; click File href "/dao/artifact/d3f:File";FileAnalysis["File Analysis"] -->
| analyzes | File["File"]; class FileAnalysis DefensiveTechniqueNode; class File ArtifactNode; click FileAnalysis href "/technique/d3f:FileAnalysis"; click File href "/dao/artifact/d3f:File";RestoreFile["Restore File"] -->
| restores | File["File"]; class RestoreFile DefensiveTechniqueNode; class File ArtifactNode; click RestoreFile href "/technique/d3f:RestoreFile"; click File href "/dao/artifact/d3f:File";FileHashReputationAnalysis["File Hash Reputation Analysis"] -->
| analyzes | FileHash["File Hash"]; class FileHashReputationAnalysis DefensiveTechniqueNode; class FileHash ArtifactNode; click FileHashReputationAnalysis href "/technique/d3f:FileHashReputationAnalysis"; click FileHash href "/dao/artifact/d3f:FileHash";FileRemoval["File Removal"] -->
| may-access | FileServer["File Server"]; class FileRemoval DefensiveTechniqueNode; class FileServer ArtifactNode; click FileRemoval href "/technique/d3f:FileRemoval"; click FileServer href "/dao/artifact/d3f:FileServer";FileCarving["File Carving"] -->
| analyzes | FileTransferNetworkTraffic["File Transfer Network Traffic"]; class FileCarving DefensiveTechniqueNode; class FileTransferNetworkTraffic ArtifactNode; click FileCarving href "/technique/d3f:FileCarving"; click FileTransferNetworkTraffic href "/dao/artifact/d3f:FileTransferNetworkTraffic";FirmwareBehaviorAnalysis["Firmware Behavior Analysis"] -->
| analyzes | Firmware["Firmware"]; class FirmwareBehaviorAnalysis DefensiveTechniqueNode; class Firmware ArtifactNode; click FirmwareBehaviorAnalysis href "/technique/d3f:FirmwareBehaviorAnalysis"; click Firmware href "/dao/artifact/d3f:Firmware";FirmwareEmbeddedMonitoringCode["Firmware Embedded Monitoring Code"] -->
| analyzes | Firmware["Firmware"]; class FirmwareEmbeddedMonitoringCode DefensiveTechniqueNode; class Firmware ArtifactNode; click FirmwareEmbeddedMonitoringCode href "/technique/d3f:FirmwareEmbeddedMonitoringCode"; click Firmware href "/dao/artifact/d3f:Firmware";FirmwareVerification["Firmware Verification"] -->
| verifies | Firmware["Firmware"]; class FirmwareVerification DefensiveTechniqueNode; class Firmware ArtifactNode; click FirmwareVerification href "/technique/d3f:FirmwareVerification"; click Firmware href "/dao/artifact/d3f:Firmware";DriverLoadIntegrityChecking["Driver Load Integrity Checking"] -->
| authenticates | HardwareDriver["Hardware Driver"]; class DriverLoadIntegrityChecking DefensiveTechniqueNode; class HardwareDriver ArtifactNode; click DriverLoadIntegrityChecking href "/technique/d3f:DriverLoadIntegrityChecking"; click HardwareDriver href "/dao/artifact/d3f:HardwareDriver";RestoreNetworkAccess["Restore Network Access"] -->
| restores | Host["Host"]; class RestoreNetworkAccess DefensiveTechniqueNode; class Host ArtifactNode; click RestoreNetworkAccess href "/technique/d3f:RestoreNetworkAccess"; click Host href "/dao/artifact/d3f:Host";IPReputationAnalysis["IP Reputation Analysis"] -->
| analyzes | IPAddress["IP Address"]; class IPReputationAnalysis DefensiveTechniqueNode; class IPAddress ArtifactNode; click IPReputationAnalysis href "/technique/d3f:IPReputationAnalysis"; click IPAddress href "/dao/artifact/d3f:IPAddress";IdentifierAnalysis["Identifier Analysis"] -->
| analyzes | Identifier["Identifier"]; class IdentifierAnalysis DefensiveTechniqueNode; class Identifier ArtifactNode; click IdentifierAnalysis href "/technique/d3f:IdentifierAnalysis"; click Identifier href "/dao/artifact/d3f:Identifier";ForwardResolutionIPDenylisting["Forward Resolution IP Denylisting"] -->
| blocks | InboundInternetDNSResponseTraffic["Inbound Internet DNS Response Traffic"]; class ForwardResolutionIPDenylisting DefensiveTechniqueNode; class InboundInternetDNSResponseTraffic ArtifactNode; click ForwardResolutionIPDenylisting href "/technique/d3f:ForwardResolutionIPDenylisting"; click InboundInternetDNSResponseTraffic href "/dao/artifact/d3f:InboundInternetDNSResponseTraffic";ReverseResolutionDomainDenylisting["Reverse Resolution Domain Denylisting"] -->
| blocks | InboundInternetDNSResponseTraffic["Inbound Internet DNS Response Traffic"]; class ReverseResolutionDomainDenylisting DefensiveTechniqueNode; class InboundInternetDNSResponseTraffic ArtifactNode; click ReverseResolutionDomainDenylisting href "/technique/d3f:ReverseResolutionDomainDenylisting"; click InboundInternetDNSResponseTraffic href "/dao/artifact/d3f:InboundInternetDNSResponseTraffic";InboundSessionVolumeAnalysis["Inbound Session Volume Analysis"] -->
| analyzes | InboundInternetNetworkTraffic["Inbound Internet Network Traffic"]; class InboundSessionVolumeAnalysis DefensiveTechniqueNode; class InboundInternetNetworkTraffic ArtifactNode; click InboundSessionVolumeAnalysis href "/technique/d3f:InboundSessionVolumeAnalysis"; click InboundInternetNetworkTraffic href "/dao/artifact/d3f:InboundInternetNetworkTraffic";InboundTrafficFiltering["Inbound Traffic Filtering"] -->
| filters | InboundNetworkTraffic["Inbound Network Traffic"]; class InboundTrafficFiltering DefensiveTechniqueNode; class InboundNetworkTraffic ArtifactNode; click InboundTrafficFiltering href "/technique/d3f:InboundTrafficFiltering"; click InboundNetworkTraffic href "/dao/artifact/d3f:InboundNetworkTraffic";IOPortRestriction["IO Port Restriction"] -->
| filters | InputDevice["Input Device"]; class IOPortRestriction DefensiveTechniqueNode; class InputDevice ArtifactNode; click IOPortRestriction href "/technique/d3f:IOPortRestriction"; click InputDevice href "/dao/artifact/d3f:InputDevice";InputDeviceAnalysis["Input Device Analysis"] -->
| analyzes | InputDevice["Input Device"]; class InputDeviceAnalysis DefensiveTechniqueNode; class InputDevice ArtifactNode; click InputDeviceAnalysis href "/technique/d3f:InputDeviceAnalysis"; click InputDevice href "/dao/artifact/d3f:InputDevice";AdministrativeNetworkActivityAnalysis["Administrative Network Activity Analysis"] -->
| analyzes | IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class AdministrativeNetworkActivityAnalysis DefensiveTechniqueNode; class IntranetAdministrativeNetworkTraffic ArtifactNode; click AdministrativeNetworkActivityAnalysis href "/technique/d3f:AdministrativeNetworkActivityAnalysis"; click IntranetAdministrativeNetworkTraffic href "/dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";IPCTrafficAnalysis["IPC Traffic Analysis"] -->
| analyzes | IntranetIPCNetworkTraffic["Intranet IPC Network Traffic"]; class IPCTrafficAnalysis DefensiveTechniqueNode; class IntranetIPCNetworkTraffic ArtifactNode; click IPCTrafficAnalysis href "/technique/d3f:IPCTrafficAnalysis"; click IntranetIPCNetworkTraffic href "/dao/artifact/d3f:IntranetIPCNetworkTraffic";EncryptedTunnels["Encrypted Tunnels"] -->
| isolates | IntranetNetwork["Intranet Network"]; class EncryptedTunnels DefensiveTechniqueNode; class IntranetNetwork ArtifactNode; click EncryptedTunnels href "/technique/d3f:EncryptedTunnels"; click IntranetNetwork href "/dao/artifact/d3f:IntranetNetwork";IntegratedHoneynet["Integrated Honeynet"] -->
| spoofs | IntranetNetwork["Intranet Network"]; class IntegratedHoneynet DefensiveTechniqueNode; class IntranetNetwork ArtifactNode; click IntegratedHoneynet href "/technique/d3f:IntegratedHoneynet"; click IntranetNetwork href "/dao/artifact/d3f:IntranetNetwork";StandaloneHoneynet["Standalone Honeynet"] -->
| spoofs | IntranetNetwork["Intranet Network"]; class StandaloneHoneynet DefensiveTechniqueNode; class IntranetNetwork ArtifactNode; click StandaloneHoneynet href "/technique/d3f:StandaloneHoneynet"; click IntranetNetwork href "/dao/artifact/d3f:IntranetNetwork";ConnectionAttemptAnalysis["Connection Attempt Analysis"] -->
| analyzes | IntranetNetworkTraffic["Intranet Network Traffic"]; class ConnectionAttemptAnalysis DefensiveTechniqueNode; class IntranetNetworkTraffic ArtifactNode; click ConnectionAttemptAnalysis href "/technique/d3f:ConnectionAttemptAnalysis"; click IntranetNetworkTraffic href "/dao/artifact/d3f:IntranetNetworkTraffic";ScheduledJobAnalysis["Scheduled Job Analysis"] -->
| analyzes | JobSchedule["Job Schedule"]; class ScheduledJobAnalysis DefensiveTechniqueNode; class JobSchedule ArtifactNode; click ScheduledJobAnalysis href "/technique/d3f:ScheduledJobAnalysis"; click JobSchedule href "/dao/artifact/d3f:JobSchedule";ConnectedHoneynet["Connected Honeynet"] -->
| spoofs | LocalAreaNetwork["Local Area Network"]; class ConnectedHoneynet DefensiveTechniqueNode; class LocalAreaNetwork ArtifactNode; click ConnectedHoneynet href "/technique/d3f:ConnectedHoneynet"; click LocalAreaNetwork href "/dao/artifact/d3f:LocalAreaNetwork";BroadcastDomainIsolation["Broadcast Domain Isolation"] -->
| filters | LocalAreaNetworkTraffic["Local Area Network Traffic"]; class BroadcastDomainIsolation DefensiveTechniqueNode; class LocalAreaNetworkTraffic ArtifactNode; click BroadcastDomainIsolation href "/technique/d3f:BroadcastDomainIsolation"; click LocalAreaNetworkTraffic href "/dao/artifact/d3f:LocalAreaNetworkTraffic";FileAccessPatternAnalysis["File Access Pattern Analysis"] -->
| analyzes | LocalResourceAccess["Local Resource Access"]; class FileAccessPatternAnalysis DefensiveTechniqueNode; class LocalResourceAccess ArtifactNode; click FileAccessPatternAnalysis href "/technique/d3f:FileAccessPatternAnalysis"; click LocalResourceAccess href "/dao/artifact/d3f:LocalResourceAccess";LocalAccountMonitoring["Local Account Monitoring"] -->
| analyzes | LocalUserAccount["Local User Account"]; class LocalAccountMonitoring DefensiveTechniqueNode; class LocalUserAccount ArtifactNode; click LocalAccountMonitoring href "/technique/d3f:LocalAccountMonitoring"; click LocalUserAccount href "/dao/artifact/d3f:LocalUserAccount";EmailRemoval["Email Removal"] -->
| may-access | MailServer["Mail Server"]; class EmailRemoval DefensiveTechniqueNode; class MailServer ArtifactNode; click EmailRemoval href "/technique/d3f:EmailRemoval"; click MailServer href "/dao/artifact/d3f:MailServer";EndpointHealthBeacon["Endpoint Health Beacon"] -->
| monitors | NetworkNode["Network Node"]; class EndpointHealthBeacon DefensiveTechniqueNode; class NetworkNode ArtifactNode; click EndpointHealthBeacon href "/technique/d3f:EndpointHealthBeacon"; click NetworkNode href "/dao/artifact/d3f:NetworkNode";DecoyNetworkResource["Decoy Network Resource"] -->
| spoofs | NetworkResource["Network Resource"]; class DecoyNetworkResource DefensiveTechniqueNode; class NetworkResource ArtifactNode; click DecoyNetworkResource href "/technique/d3f:DecoyNetworkResource"; click NetworkResource href "/dao/artifact/d3f:NetworkResource";NetworkTrafficFiltering["Network Traffic Filtering"] -->
| filters | NetworkTraffic["Network Traffic"]; class NetworkTrafficFiltering DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click NetworkTrafficFiltering href "/technique/d3f:NetworkTrafficFiltering"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -->
| analyzes | NetworkTraffic["Network Traffic"]; class UserGeolocationLogonPatternAnalysis DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click UserGeolocationLogonPatternAnalysis href "/technique/d3f:UserGeolocationLogonPatternAnalysis"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -->
| analyzes | NetworkTraffic["Network Traffic"]; class ProtocolMetadataAnomalyDetection DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click ProtocolMetadataAnomalyDetection href "/technique/d3f:ProtocolMetadataAnomalyDetection"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -->
| analyzes | NetworkTraffic["Network Traffic"]; class RemoteTerminalSessionDetection DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click RemoteTerminalSessionDetection href "/technique/d3f:RemoteTerminalSessionDetection"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -->
| analyzes | NetworkTraffic["Network Traffic"]; class NetworkTrafficCommunityDeviation DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click NetworkTrafficCommunityDeviation href "/technique/d3f:NetworkTrafficCommunityDeviation"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -->
| analyzes | NetworkTraffic["Network Traffic"]; class PerHostDownload-UploadRatioAnalysis DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click PerHostDownload-UploadRatioAnalysis href "/technique/d3f:PerHostDownload-UploadRatioAnalysis"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";Client-serverPayloadProfiling["Client-server Payload Profiling"] -->
| analyzes | NetworkTraffic["Network Traffic"]; class Client-serverPayloadProfiling DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click Client-serverPayloadProfiling href "/technique/d3f:Client-serverPayloadProfiling"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";SystemFileAnalysis["System File Analysis"] -->
| analyzes | OperatingSystemFile["Operating System File"]; class SystemFileAnalysis DefensiveTechniqueNode; class OperatingSystemFile ArtifactNode; click SystemFileAnalysis href "/technique/d3f:SystemFileAnalysis"; click OperatingSystemFile href "/dao/artifact/d3f:OperatingSystemFile";SystemDaemonMonitoring["System Daemon Monitoring"] -->
| monitors | OperatingSystemProcess["Operating System Process"]; class SystemDaemonMonitoring DefensiveTechniqueNode; class OperatingSystemProcess ArtifactNode; click SystemDaemonMonitoring href "/technique/d3f:SystemDaemonMonitoring"; click OperatingSystemProcess href "/dao/artifact/d3f:OperatingSystemProcess";DNSAllowlisting["DNS Allowlisting"] -->
| blocks | OutboundInternetDNSLookupTraffic["Outbound Internet DNS Lookup Traffic"]; class DNSAllowlisting DefensiveTechniqueNode; class OutboundInternetDNSLookupTraffic ArtifactNode; click DNSAllowlisting href "/technique/d3f:DNSAllowlisting"; click OutboundInternetDNSLookupTraffic href "/dao/artifact/d3f:OutboundInternetDNSLookupTraffic";ForwardResolutionDomainDenylisting["Forward Resolution Domain Denylisting"] -->
| blocks | OutboundInternetDNSLookupTraffic["Outbound Internet DNS Lookup Traffic"]; class ForwardResolutionDomainDenylisting DefensiveTechniqueNode; class OutboundInternetDNSLookupTraffic ArtifactNode; click ForwardResolutionDomainDenylisting href "/technique/d3f:ForwardResolutionDomainDenylisting"; click OutboundInternetDNSLookupTraffic href "/dao/artifact/d3f:OutboundInternetDNSLookupTraffic";ReverseResolutionIPDenylisting["Reverse Resolution IP Denylisting"] -->
| blocks | OutboundInternetDNSLookupTraffic["Outbound Internet DNS Lookup Traffic"]; class ReverseResolutionIPDenylisting DefensiveTechniqueNode; class OutboundInternetDNSLookupTraffic ArtifactNode; click ReverseResolutionIPDenylisting href "/technique/d3f:ReverseResolutionIPDenylisting"; click OutboundInternetDNSLookupTraffic href "/dao/artifact/d3f:OutboundInternetDNSLookupTraffic";DNSTrafficAnalysis["DNS Traffic Analysis"] -->
| analyzes | OutboundInternetDNSLookupTraffic["Outbound Internet DNS Lookup Traffic"]; class DNSTrafficAnalysis DefensiveTechniqueNode; class OutboundInternetDNSLookupTraffic ArtifactNode; click DNSTrafficAnalysis href "/technique/d3f:DNSTrafficAnalysis"; click OutboundInternetDNSLookupTraffic href "/dao/artifact/d3f:OutboundInternetDNSLookupTraffic";RelayPatternAnalysis["Relay Pattern Analysis"] -->
| analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class RelayPatternAnalysis DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click RelayPatternAnalysis href "/technique/d3f:RelayPatternAnalysis"; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic";OutboundTrafficFiltering["Outbound Traffic Filtering"] -->
| filters | OutboundNetworkTraffic["Outbound Network Traffic"]; class OutboundTrafficFiltering DefensiveTechniqueNode; class OutboundNetworkTraffic ArtifactNode; click OutboundTrafficFiltering href "/technique/d3f:OutboundTrafficFiltering"; click OutboundNetworkTraffic href "/dao/artifact/d3f:OutboundNetworkTraffic";StrongPasswordPolicy["Strong Password Policy"] -->
| strengthens | Password["Password"]; class StrongPasswordPolicy DefensiveTechniqueNode; class Password ArtifactNode; click StrongPasswordPolicy href "/technique/d3f:StrongPasswordPolicy"; click Password href "/dao/artifact/d3f:Password";One-timePassword["One-time Password"] -->
| use-limits | Password["Password"]; class One-timePassword DefensiveTechniqueNode; class Password ArtifactNode; click One-timePassword href "/technique/d3f:One-timePassword"; click Password href "/dao/artifact/d3f:Password";PeripheralFirmwareVerification["Peripheral Firmware Verification"] -->
| verifies | PeripheralFirmware["Peripheral Firmware"]; class PeripheralFirmwareVerification DefensiveTechniqueNode; class PeripheralFirmware ArtifactNode; click PeripheralFirmwareVerification href "/technique/d3f:PeripheralFirmwareVerification"; click PeripheralFirmware href "/dao/artifact/d3f:PeripheralFirmware";PointerAuthentication["Pointer Authentication"] -->
| authenticates | Pointer["Pointer"]; class PointerAuthentication DefensiveTechniqueNode; class Pointer ArtifactNode; click PointerAuthentication href "/technique/d3f:PointerAuthentication"; click Pointer href "/dao/artifact/d3f:Pointer";ExceptionHandlerPointerValidation["Exception Handler Pointer Validation"] -->
| validates | Pointer["Pointer"]; class ExceptionHandlerPointerValidation DefensiveTechniqueNode; class Pointer ArtifactNode; click ExceptionHandlerPointerValidation href "/technique/d3f:ExceptionHandlerPointerValidation"; click Pointer href "/dao/artifact/d3f:Pointer";ProcessTermination["Process Termination"] -->
| terminates | Process["Process"]; class ProcessTermination DefensiveTechniqueNode; class Process ArtifactNode; click ProcessTermination href "/technique/d3f:ProcessTermination"; click Process href "/dao/artifact/d3f:Process";ProcessSuspension["Process Suspension"] -->
| suspends | Process["Process"]; class ProcessSuspension DefensiveTechniqueNode; class Process ArtifactNode; click ProcessSuspension href "/technique/d3f:ProcessSuspension"; click Process href "/dao/artifact/d3f:Process";ProcessSelf-ModificationDetection["Process Self-Modification Detection"] -->
| analyzes | Process["Process"]; class ProcessSelf-ModificationDetection DefensiveTechniqueNode; class Process ArtifactNode; click ProcessSelf-ModificationDetection href "/technique/d3f:ProcessSelf-ModificationDetection"; click Process href "/dao/artifact/d3f:Process";ProcessSpawnAnalysis["Process Spawn Analysis"] -->
| analyzes | Process["Process"]; class ProcessSpawnAnalysis DefensiveTechniqueNode; class Process ArtifactNode; click ProcessSpawnAnalysis href "/technique/d3f:ProcessSpawnAnalysis"; click Process href "/dao/artifact/d3f:Process";ProcessLineageAnalysis["Process Lineage Analysis"] -->
| analyzes | Process["Process"]; class ProcessLineageAnalysis DefensiveTechniqueNode; class Process ArtifactNode; click ProcessLineageAnalysis href "/technique/d3f:ProcessLineageAnalysis"; click Process href "/dao/artifact/d3f:Process";Hardware-basedProcessIsolation["Hardware-based Process Isolation"] -->
| isolates | Process["Process"]; class Hardware-basedProcessIsolation DefensiveTechniqueNode; class Process ArtifactNode; click Hardware-basedProcessIsolation href "/technique/d3f:Hardware-basedProcessIsolation"; click Process href "/dao/artifact/d3f:Process";MandatoryAccessControl["Mandatory Access Control"] -->
| isolates | Process["Process"]; class MandatoryAccessControl DefensiveTechniqueNode; class Process ArtifactNode; click MandatoryAccessControl href "/technique/d3f:MandatoryAccessControl"; click Process href "/dao/artifact/d3f:Process";ProcessCodeSegmentVerification["Process Code Segment Verification"] -->
| verifies | ProcessCodeSegment["Process Code Segment"]; class ProcessCodeSegmentVerification DefensiveTechniqueNode; class ProcessCodeSegment ArtifactNode; click ProcessCodeSegmentVerification href "/technique/d3f:ProcessCodeSegmentVerification"; click ProcessCodeSegment href "/dao/artifact/d3f:ProcessCodeSegment";MemoryBoundaryTracking["Memory Boundary Tracking"] -->
| analyzes | ProcessCodeSegment["Process Code Segment"]; class MemoryBoundaryTracking DefensiveTechniqueNode; class ProcessCodeSegment ArtifactNode; click MemoryBoundaryTracking href "/technique/d3f:MemoryBoundaryTracking"; click ProcessCodeSegment href "/dao/artifact/d3f:ProcessCodeSegment";ProcessSegmentExecutionPrevention["Process Segment Execution Prevention"] -->
| neutralizes | ProcessSegment["Process Segment"]; class ProcessSegmentExecutionPrevention DefensiveTechniqueNode; class ProcessSegment ArtifactNode; click ProcessSegmentExecutionPrevention href "/technique/d3f:ProcessSegmentExecutionPrevention"; click ProcessSegment href "/dao/artifact/d3f:ProcessSegment";SegmentAddressOffsetRandomization["Segment Address Offset Randomization"] -->
| obfuscates | ProcessSegment["Process Segment"]; class SegmentAddressOffsetRandomization DefensiveTechniqueNode; class ProcessSegment ArtifactNode; click SegmentAddressOffsetRandomization href "/technique/d3f:SegmentAddressOffsetRandomization"; click ProcessSegment href "/dao/artifact/d3f:ProcessSegment";ProcessLineageAnalysis["Process Lineage Analysis"] -->
| analyzes | ProcessTree["Process Tree"]; class ProcessLineageAnalysis DefensiveTechniqueNode; class ProcessTree ArtifactNode; click ProcessLineageAnalysis href "/technique/d3f:ProcessLineageAnalysis"; click ProcessTree href "/dao/artifact/d3f:ProcessTree";CertificatePinning["Certificate Pinning"] -->
| authenticates | PublicKey["Public Key"]; class CertificatePinning DefensiveTechniqueNode; class PublicKey ArtifactNode; click CertificatePinning href "/technique/d3f:CertificatePinning"; click PublicKey href "/dao/artifact/d3f:PublicKey";RPCTrafficAnalysis["RPC Traffic Analysis"] -->
| analyzes | RPCNetworkTraffic["RPC Network Traffic"]; class RPCTrafficAnalysis DefensiveTechniqueNode; class RPCNetworkTraffic ArtifactNode; click RPCTrafficAnalysis href "/technique/d3f:RPCTrafficAnalysis"; click RPCNetworkTraffic href "/dao/artifact/d3f:RPCNetworkTraffic";IOPortRestriction["IO Port Restriction"] -->
| filters | RemovableMediaDevice["Removable Media Device"]; class IOPortRestriction DefensiveTechniqueNode; class RemovableMediaDevice ArtifactNode; click IOPortRestriction href "/technique/d3f:IOPortRestriction"; click RemovableMediaDevice href "/dao/artifact/d3f:RemovableMediaDevice";UserDataTransferAnalysis["User Data Transfer Analysis"] -->
| analyzes | ResourceAccess["Resource Access"]; class UserDataTransferAnalysis DefensiveTechniqueNode; class ResourceAccess ArtifactNode; click UserDataTransferAnalysis href "/technique/d3f:UserDataTransferAnalysis"; click ResourceAccess href "/dao/artifact/d3f:ResourceAccess";ScriptExecutionAnalysis["Script Execution Analysis"] -->
| analyzes | ScriptApplicationProcess["Script Application Process"]; class ScriptExecutionAnalysis DefensiveTechniqueNode; class ScriptApplicationProcess ArtifactNode; click ScriptExecutionAnalysis href "/technique/d3f:ScriptExecutionAnalysis"; click ScriptApplicationProcess href "/dao/artifact/d3f:ScriptApplicationProcess";ServiceBinaryVerification["Service Binary Verification"] -->
| verifies | ServiceApplication["Service Application"]; class ServiceBinaryVerification DefensiveTechniqueNode; class ServiceApplication ArtifactNode; click ServiceBinaryVerification href "/technique/d3f:ServiceBinaryVerification"; click ServiceApplication href "/dao/artifact/d3f:ServiceApplication";SoftwareUpdate["Software Update"] -->
| updates | Software["Software"]; class SoftwareUpdate DefensiveTechniqueNode; class Software ArtifactNode; click SoftwareUpdate href "/technique/d3f:SoftwareUpdate"; click Software href "/dao/artifact/d3f:Software";RestoreSoftware["Restore Software"] -->
| restores | Software["Software"]; class RestoreSoftware DefensiveTechniqueNode; class Software ArtifactNode; click RestoreSoftware href "/technique/d3f:RestoreSoftware"; click Software href "/dao/artifact/d3f:Software";ShadowStackComparisons["Shadow Stack Comparisons"] -->
| analyzes | StackFrame["Stack Frame"]; class ShadowStackComparisons DefensiveTechniqueNode; class StackFrame ArtifactNode; click ShadowStackComparisons href "/technique/d3f:ShadowStackComparisons"; click StackFrame href "/dao/artifact/d3f:StackFrame";StackFrameCanaryValidation["Stack Frame Canary Validation"] -->
| validates | StackFrame["Stack Frame"]; class StackFrameCanaryValidation DefensiveTechniqueNode; class StackFrame ArtifactNode; click StackFrameCanaryValidation href "/technique/d3f:StackFrameCanaryValidation"; click StackFrame href "/dao/artifact/d3f:StackFrame";DiskEncryption["Disk Encryption"] -->
| encrypts | Storage["Storage"]; class DiskEncryption DefensiveTechniqueNode; class Storage ArtifactNode; click DiskEncryption href "/technique/d3f:DiskEncryption"; click Storage href "/dao/artifact/d3f:Storage";SystemCallAnalysis["System Call Analysis"] -->
| analyzes | SystemCall["System Call"]; class SystemCallAnalysis DefensiveTechniqueNode; class SystemCall ArtifactNode; click SystemCallAnalysis href "/technique/d3f:SystemCallAnalysis"; click SystemCall href "/dao/artifact/d3f:SystemCall";SystemCallFiltering["System Call Filtering"] -->
| filters | SystemCall["System Call"]; class SystemCallFiltering DefensiveTechniqueNode; class SystemCall ArtifactNode; click SystemCallFiltering href "/technique/d3f:SystemCallFiltering"; click SystemCall href "/dao/artifact/d3f:SystemCall";SystemConfigurationPermissions["System Configuration Permissions"] -->
| restricts | SystemConfigurationDatabase["System Configuration Database"]; class SystemConfigurationPermissions DefensiveTechniqueNode; class SystemConfigurationDatabase ArtifactNode; click SystemConfigurationPermissions href "/technique/d3f:SystemConfigurationPermissions"; click SystemConfigurationDatabase href "/dao/artifact/d3f:SystemConfigurationDatabase";SystemFirmwareVerification["System Firmware Verification"] -->
| verifies | SystemFirmware["System Firmware"]; class SystemFirmwareVerification DefensiveTechniqueNode; class SystemFirmware ArtifactNode; click SystemFirmwareVerification href "/technique/d3f:SystemFirmwareVerification"; click SystemFirmware href "/dao/artifact/d3f:SystemFirmware";SystemInitConfigAnalysis["System Init Config Analysis"] -->
| analyzes | SystemInitConfiguration["System Init Configuration"]; class SystemInitConfigAnalysis DefensiveTechniqueNode; class SystemInitConfiguration ArtifactNode; click SystemInitConfigAnalysis href "/technique/d3f:SystemInitConfigAnalysis"; click SystemInitConfiguration href "/dao/artifact/d3f:SystemInitConfiguration";URLAnalysis["URL Analysis"] -->
| analyzes | URL["URL"]; class URLAnalysis DefensiveTechniqueNode; class URL ArtifactNode; click URLAnalysis href "/technique/d3f:URLAnalysis"; click URL href "/dao/artifact/d3f:URL";HomoglyphDetection["Homoglyph Detection"] -->
| analyzes | URL["URL"]; class HomoglyphDetection DefensiveTechniqueNode; class URL ArtifactNode; click HomoglyphDetection href "/technique/d3f:HomoglyphDetection"; click URL href "/dao/artifact/d3f:URL";URLReputationAnalysis["URL Reputation Analysis"] -->
| analyzes | URL["URL"]; class URLReputationAnalysis DefensiveTechniqueNode; class URL ArtifactNode; click URLReputationAnalysis href "/technique/d3f:URLReputationAnalysis"; click URL href "/dao/artifact/d3f:URL";DecoyPersona["Decoy Persona"] -->
| spoofs | User["User"]; class DecoyPersona DefensiveTechniqueNode; class User ArtifactNode; click DecoyPersona href "/technique/d3f:DecoyPersona"; click User href "/dao/artifact/d3f:User";AccountLocking["Account Locking"] -->
| disables | UserAccount["User Account"]; class AccountLocking DefensiveTechniqueNode; class UserAccount ArtifactNode; click AccountLocking href "/technique/d3f:AccountLocking"; click UserAccount href "/dao/artifact/d3f:UserAccount";Multi-factorAuthentication["Multi-factor Authentication"] -->
| authenticates | UserAccount["User Account"]; class Multi-factorAuthentication DefensiveTechniqueNode; class UserAccount ArtifactNode; click Multi-factorAuthentication href "/technique/d3f:Multi-factorAuthentication"; click UserAccount href "/dao/artifact/d3f:UserAccount";One-timePassword["One-time Password"] -->
| authenticates | UserAccount["User Account"]; class One-timePassword DefensiveTechniqueNode; class UserAccount ArtifactNode; click One-timePassword href "/technique/d3f:One-timePassword"; click UserAccount href "/dao/artifact/d3f:UserAccount";BiometricAuthentication["Biometric Authentication"] -->
| authenticates | UserAccount["User Account"]; class BiometricAuthentication DefensiveTechniqueNode; class UserAccount ArtifactNode; click BiometricAuthentication href "/technique/d3f:BiometricAuthentication"; click UserAccount href "/dao/artifact/d3f:UserAccount";UserAccountPermissions["User Account Permissions"] -->
| restricts | UserAccount["User Account"]; class UserAccountPermissions DefensiveTechniqueNode; class UserAccount ArtifactNode; click UserAccountPermissions href "/technique/d3f:UserAccountPermissions"; click UserAccount href "/dao/artifact/d3f:UserAccount";StrongPasswordPolicy["Strong Password Policy"] -->
| strengthens | UserAccount["User Account"]; class StrongPasswordPolicy DefensiveTechniqueNode; class UserAccount ArtifactNode; click StrongPasswordPolicy href "/technique/d3f:StrongPasswordPolicy"; click UserAccount href "/dao/artifact/d3f:UserAccount";RestoreUserAccountAccess["Restore User Account Access"] -->
| restores | UserAccount["User Account"]; class RestoreUserAccountAccess DefensiveTechniqueNode; class UserAccount ArtifactNode; click RestoreUserAccountAccess href "/technique/d3f:RestoreUserAccountAccess"; click UserAccount href "/dao/artifact/d3f:UserAccount";UnlockAccount["Unlock Account"] -->
| restores | UserAccount["User Account"]; class UnlockAccount DefensiveTechniqueNode; class UserAccount ArtifactNode; click UnlockAccount href "/technique/d3f:UnlockAccount"; click UserAccount href "/dao/artifact/d3f:UserAccount";UserSessionInitConfigAnalysis["User Session Init Config Analysis"] -->
| analyzes | UserInitConfigurationFile["User Init Configuration File"]; class UserSessionInitConfigAnalysis DefensiveTechniqueNode; class UserInitConfigurationFile ArtifactNode; click UserSessionInitConfigAnalysis href "/technique/d3f:UserSessionInitConfigAnalysis"; click UserInitConfigurationFile href "/dao/artifact/d3f:UserInitConfigurationFile";MessageAuthentication["Message Authentication"] -->
| authenticates | UserToUserMessage["User to User Message"]; class MessageAuthentication DefensiveTechniqueNode; class UserToUserMessage ArtifactNode; click MessageAuthentication href "/technique/d3f:MessageAuthentication"; click UserToUserMessage href "/dao/artifact/d3f:UserToUserMessage";MessageEncryption["Message Encryption"] -->
| encrypts | UserToUserMessage["User to User Message"]; class MessageEncryption DefensiveTechniqueNode; class UserToUserMessage ArtifactNode; click MessageEncryption href "/technique/d3f:MessageEncryption"; click UserToUserMessage href "/dao/artifact/d3f:UserToUserMessage";WebSessionActivityAnalysis["Web Session Activity Analysis"] -->
| analyzes | WebResourceAccess["Web Resource Access"]; class WebSessionActivityAnalysis DefensiveTechniqueNode; class WebResourceAccess ArtifactNode; click WebSessionActivityAnalysis href "/technique/d3f:WebSessionActivityAnalysis"; click WebResourceAccess href "/dao/artifact/d3f:WebResourceAccess";
Related Weaknesses
graph LR;
d3f:CWE-119["Improper Restriction of Operations within the Bounds of a Memory Buffer"] --> | weakness-of | d3f:RawMemoryAccessFunction["Raw Memory Access Function"];
class d3f:CWE-119 inbound_node;
style d3f:CWE-119 fill:#f9d999;
class d3f:RawMemoryAccessFunction RootArtifactNode;
style d3f:RawMemoryAccessFunction fill:#fff4dd;
click d3f:CWE-119 href "/weakness/cwe/CWE-119";
click d3f:RawMemoryAccessFunction href "/dao/artifact/d3f:RawMemoryAccessFunction";d3f:CWE-125["Out-of-bounds Read"] --> | weakness-of | d3f:RawMemoryAccessFunction["Raw Memory Access Function"];
class d3f:CWE-125 inbound_node;
style d3f:CWE-125 fill:#f9d999;
class d3f:RawMemoryAccessFunction RootArtifactNode;
style d3f:RawMemoryAccessFunction fill:#fff4dd;
click d3f:CWE-125 href "/weakness/cwe/CWE-125";
click d3f:RawMemoryAccessFunction href "/dao/artifact/d3f:RawMemoryAccessFunction";d3f:CWE-190["Integer Overflow or Wraparound"] --> | weakness-of | d3f:MathematicalFunction["Mathematical Function"];
class d3f:CWE-190 inbound_node;
style d3f:CWE-190 fill:#f9d999;
class d3f:MathematicalFunction RootArtifactNode;
style d3f:MathematicalFunction fill:#fff4dd;
click d3f:CWE-190 href "/weakness/cwe/CWE-190";
click d3f:MathematicalFunction href "/dao/artifact/d3f:MathematicalFunction";d3f:CWE-20["Improper Input Validation"] --> | weakness-of | d3f:UserInputFunction["User Input Function"];
class d3f:CWE-20 inbound_node;
style d3f:CWE-20 fill:#f9d999;
class d3f:UserInputFunction RootArtifactNode;
style d3f:UserInputFunction fill:#fff4dd;
click d3f:CWE-20 href "/weakness/cwe/CWE-20";
click d3f:UserInputFunction href "/dao/artifact/d3f:UserInputFunction";d3f:CWE-22["Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"] --> | weakness-of | d3f:UserInputFunction["User Input Function"];
class d3f:CWE-22 inbound_node;
style d3f:CWE-22 fill:#f9d999;
class d3f:UserInputFunction RootArtifactNode;
style d3f:UserInputFunction fill:#fff4dd;
click d3f:CWE-22 href "/weakness/cwe/CWE-22";
click d3f:UserInputFunction href "/dao/artifact/d3f:UserInputFunction";d3f:CWE-276["Incorrect Default Permissions"] --> | weakness-of | d3f:ApplicationInstaller["Application Installer"];
class d3f:CWE-276 inbound_node;
style d3f:CWE-276 fill:#f9d999;
class d3f:ApplicationInstaller RootArtifactNode;
style d3f:ApplicationInstaller fill:#fff4dd;
click d3f:CWE-276 href "/weakness/cwe/CWE-276";
click d3f:ApplicationInstaller href "/dao/artifact/d3f:ApplicationInstaller";d3f:CWE-287["Improper Authentication"] --> | weakness-of | d3f:AuthenticationFunction["Authentication Function"];
class d3f:CWE-287 inbound_node;
style d3f:CWE-287 fill:#f9d999;
class d3f:AuthenticationFunction RootArtifactNode;
style d3f:AuthenticationFunction fill:#fff4dd;
click d3f:CWE-287 href "/weakness/cwe/CWE-287";
click d3f:AuthenticationFunction href "/dao/artifact/d3f:AuthenticationFunction";d3f:CWE-352["Cross-Site Request Forgery (CSRF)"] --> | weakness-of | d3f:UserInputFunction["User Input Function"];
class d3f:CWE-352 inbound_node;
style d3f:CWE-352 fill:#f9d999;
class d3f:UserInputFunction RootArtifactNode;
style d3f:UserInputFunction fill:#fff4dd;
click d3f:CWE-352 href "/weakness/cwe/CWE-352";
click d3f:UserInputFunction href "/dao/artifact/d3f:UserInputFunction";d3f:CWE-362["Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"] --> | weakness-of | d3f:SharedResourceAccessFunction["Shared Resource Access Function"];
class d3f:CWE-362 inbound_node;
style d3f:CWE-362 fill:#f9d999;
class d3f:SharedResourceAccessFunction RootArtifactNode;
style d3f:SharedResourceAccessFunction fill:#fff4dd;
click d3f:CWE-362 href "/weakness/cwe/CWE-362";
click d3f:SharedResourceAccessFunction href "/dao/artifact/d3f:SharedResourceAccessFunction";d3f:CWE-434["Unrestricted Upload of File with Dangerous Type"] --> | weakness-of | d3f:UserInputFunction["User Input Function"];
class d3f:CWE-434 inbound_node;
style d3f:CWE-434 fill:#f9d999;
class d3f:UserInputFunction RootArtifactNode;
style d3f:UserInputFunction fill:#fff4dd;
click d3f:CWE-434 href "/weakness/cwe/CWE-434";
click d3f:UserInputFunction href "/dao/artifact/d3f:UserInputFunction";d3f:CWE-476["NULL Pointer Dereference"] --> | weakness-of | d3f:PointerDereferencingFunction["Pointer Dereferencing Function"];
class d3f:CWE-476 inbound_node;
style d3f:CWE-476 fill:#f9d999;
class d3f:PointerDereferencingFunction RootArtifactNode;
style d3f:PointerDereferencingFunction fill:#fff4dd;
click d3f:CWE-476 href "/weakness/cwe/CWE-476";
click d3f:PointerDereferencingFunction href "/dao/artifact/d3f:PointerDereferencingFunction";d3f:CWE-502["Deserialization of Untrusted Data"] --> | weakness-of | d3f:DeserializationFunction["Deserialization Function"];
class d3f:CWE-502 inbound_node;
style d3f:CWE-502 fill:#f9d999;
class d3f:DeserializationFunction RootArtifactNode;
style d3f:DeserializationFunction fill:#fff4dd;
click d3f:CWE-502 href "/weakness/cwe/CWE-502";
click d3f:DeserializationFunction href "/dao/artifact/d3f:DeserializationFunction";d3f:CWE-502["Deserialization of Untrusted Data"] --> | may-be-weakness-of | d3f:UserInputFunction["User Input Function"];
class d3f:CWE-502 inbound_node;
style d3f:CWE-502 fill:#f9d999;
class d3f:UserInputFunction RootArtifactNode;
style d3f:UserInputFunction fill:#fff4dd;
click d3f:CWE-502 href "/weakness/cwe/CWE-502";
click d3f:UserInputFunction href "/dao/artifact/d3f:UserInputFunction";d3f:CWE-611["Improper Restriction of XML External Entity Reference"] --> | weakness-of | d3f:ExternalContentInclusionFunction["External Content Inclusion Function"];
class d3f:CWE-611 inbound_node;
style d3f:CWE-611 fill:#f9d999;
class d3f:ExternalContentInclusionFunction RootArtifactNode;
style d3f:ExternalContentInclusionFunction fill:#fff4dd;
click d3f:CWE-611 href "/weakness/cwe/CWE-611";
click d3f:ExternalContentInclusionFunction href "/dao/artifact/d3f:ExternalContentInclusionFunction";d3f:CWE-77["Improper Neutralization of Special Elements used in a Command ('Command Injection')"] --> | weakness-of | d3f:UserInputFunction["User Input Function"];
class d3f:CWE-77 inbound_node;
style d3f:CWE-77 fill:#f9d999;
class d3f:UserInputFunction RootArtifactNode;
style d3f:UserInputFunction fill:#fff4dd;
click d3f:CWE-77 href "/weakness/cwe/CWE-77";
click d3f:UserInputFunction href "/dao/artifact/d3f:UserInputFunction";d3f:CWE-78["Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"] --> | may-be-weakness-of | d3f:EvalFunction["Eval Function"];
class d3f:CWE-78 inbound_node;
style d3f:CWE-78 fill:#f9d999;
class d3f:EvalFunction RootArtifactNode;
style d3f:EvalFunction fill:#fff4dd;
click d3f:CWE-78 href "/weakness/cwe/CWE-78";
click d3f:EvalFunction href "/dao/artifact/d3f:EvalFunction";d3f:CWE-78["Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"] --> | may-be-weakness-of | d3f:ProcessStartFunction["Process Start Function"];
class d3f:CWE-78 inbound_node;
style d3f:CWE-78 fill:#f9d999;
class d3f:ProcessStartFunction RootArtifactNode;
style d3f:ProcessStartFunction fill:#fff4dd;
click d3f:CWE-78 href "/weakness/cwe/CWE-78";
click d3f:ProcessStartFunction href "/dao/artifact/d3f:ProcessStartFunction";d3f:CWE-78["Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"] --> | may-be-weakness-of | d3f:UserInputFunction["User Input Function"];
class d3f:CWE-78 inbound_node;
style d3f:CWE-78 fill:#f9d999;
class d3f:UserInputFunction RootArtifactNode;
style d3f:UserInputFunction fill:#fff4dd;
click d3f:CWE-78 href "/weakness/cwe/CWE-78";
click d3f:UserInputFunction href "/dao/artifact/d3f:UserInputFunction";d3f:CWE-787["Out-of-bounds Write"] --> | weakness-of | d3f:RawMemoryAccessFunction["Raw Memory Access Function"];
class d3f:CWE-787 inbound_node;
style d3f:CWE-787 fill:#f9d999;
class d3f:RawMemoryAccessFunction RootArtifactNode;
style d3f:RawMemoryAccessFunction fill:#fff4dd;
click d3f:CWE-787 href "/weakness/cwe/CWE-787";
click d3f:RawMemoryAccessFunction href "/dao/artifact/d3f:RawMemoryAccessFunction";d3f:CWE-79["Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"] --> | weakness-of | d3f:UserInputFunction["User Input Function"];
class d3f:CWE-79 inbound_node;
style d3f:CWE-79 fill:#f9d999;
class d3f:UserInputFunction RootArtifactNode;
style d3f:UserInputFunction fill:#fff4dd;
click d3f:CWE-79 href "/weakness/cwe/CWE-79";
click d3f:UserInputFunction href "/dao/artifact/d3f:UserInputFunction";d3f:CWE-798["Use of Hard-coded Credentials"] --> | weakness-of | d3f:AuthenticationFunction["Authentication Function"];
class d3f:CWE-798 inbound_node;
style d3f:CWE-798 fill:#f9d999;
class d3f:AuthenticationFunction RootArtifactNode;
style d3f:AuthenticationFunction fill:#fff4dd;
click d3f:CWE-798 href "/weakness/cwe/CWE-798";
click d3f:AuthenticationFunction href "/dao/artifact/d3f:AuthenticationFunction";d3f:CWE-89["Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"] --> | weakness-of | d3f:UserInputFunction["User Input Function"];
class d3f:CWE-89 inbound_node;
style d3f:CWE-89 fill:#f9d999;
class d3f:UserInputFunction RootArtifactNode;
style d3f:UserInputFunction fill:#fff4dd;
click d3f:CWE-89 href "/weakness/cwe/CWE-89";
click d3f:UserInputFunction href "/dao/artifact/d3f:UserInputFunction";d3f:CWE-918["Server-Side Request Forgery (SSRF)"] --> | weakness-of | d3f:UserInputFunction["User Input Function"];
class d3f:CWE-918 inbound_node;
style d3f:CWE-918 fill:#f9d999;
class d3f:UserInputFunction RootArtifactNode;
style d3f:UserInputFunction fill:#fff4dd;
click d3f:CWE-918 href "/weakness/cwe/CWE-918";
click d3f:UserInputFunction href "/dao/artifact/d3f:UserInputFunction";d3f:CWE-94["Improper Control of Generation of Code ('Code Injection')"] --> | may-be-weakness-of | d3f:EvalFunction["Eval Function"];
class d3f:CWE-94 inbound_node;
style d3f:CWE-94 fill:#f9d999;
class d3f:EvalFunction RootArtifactNode;
style d3f:EvalFunction fill:#fff4dd;
click d3f:CWE-94 href "/weakness/cwe/CWE-94";
click d3f:EvalFunction href "/dao/artifact/d3f:EvalFunction";d3f:CWE-94["Improper Control of Generation of Code ('Code Injection')"] --> | may-be-weakness-of | d3f:UserInputFunction["User Input Function"];
class d3f:CWE-94 inbound_node;
style d3f:CWE-94 fill:#f9d999;
class d3f:UserInputFunction RootArtifactNode;
style d3f:UserInputFunction fill:#fff4dd;
click d3f:CWE-94 href "/weakness/cwe/CWE-94";
click d3f:UserInputFunction href "/dao/artifact/d3f:UserInputFunction";
Related Offensive Techniques
graph LR;
T1222["File and Directory Permissions Modification"] --> |modifies| AccessControlConfiguration["Access Control Configuration"]; class T1222 OffensiveTechniqueNode;
class AccessControlConfiguration ArtifactNode; click T1222 href "/offensive-technique/attack/T1222/"; click AccessControlConfiguration href "/dao/artifact/d3f:AccessControlConfiguration";T1134005["SID-History Injection"] --> |modifies| AccessControlConfiguration["Access Control Configuration"]; class T1134005 OffensiveTechniqueNode;
class AccessControlConfiguration ArtifactNode; click T1134005 href "/offensive-technique/attack/T1134.005/"; click AccessControlConfiguration href "/dao/artifact/d3f:AccessControlConfiguration";T1548001["Setuid and Setgid"] --> |modifies| AccessControlConfiguration["Access Control Configuration"]; class T1548001 OffensiveTechniqueNode;
class AccessControlConfiguration ArtifactNode; click T1548001 href "/offensive-technique/attack/T1548.001/"; click AccessControlConfiguration href "/dao/artifact/d3f:AccessControlConfiguration";T1528["Steal Application Access Token"] --> |accesses| AccessToken["Access Token"]; class T1528 OffensiveTechniqueNode;
class AccessToken ArtifactNode; click T1528 href "/offensive-technique/attack/T1528/"; click AccessToken href "/dao/artifact/d3f:AccessToken";T1134001["Token Impersonation/Theft"] --> |copies| AccessToken["Access Token"]; class T1134001 OffensiveTechniqueNode;
class AccessToken ArtifactNode; click T1134001 href "/offensive-technique/attack/T1134.001/"; click AccessToken href "/dao/artifact/d3f:AccessToken";T1134002["Create Process with Token"] --> |copies| AccessToken["Access Token"]; class T1134002 OffensiveTechniqueNode;
class AccessToken ArtifactNode; click T1134002 href "/offensive-technique/attack/T1134.002/"; click AccessToken href "/dao/artifact/d3f:AccessToken";T1134003["Make and Impersonate Token"] --> |copies| AccessToken["Access Token"]; class T1134003 OffensiveTechniqueNode;
class AccessToken ArtifactNode; click T1134003 href "/offensive-technique/attack/T1134.003/"; click AccessToken href "/dao/artifact/d3f:AccessToken";T1550001["Application Access Token"] --> |uses| AccessToken["Access Token"]; class T1550001 OffensiveTechniqueNode;
class AccessToken ArtifactNode; click T1550001 href "/offensive-technique/attack/T1550.001/"; click AccessToken href "/dao/artifact/d3f:AccessToken";T1563["Remote Service Session Hijacking"] --> |produces| AdministrativeNetworkTraffic["Administrative Network Traffic"]; class T1563 OffensiveTechniqueNode;
class AdministrativeNetworkTraffic ArtifactNode; click T1563 href "/offensive-technique/attack/T1563/"; click AdministrativeNetworkTraffic href "/dao/artifact/d3f:AdministrativeNetworkTraffic";T1021001["Remote Desktop Protocol"] --> |produces| AdministrativeNetworkTraffic["Administrative Network Traffic"]; class T1021001 OffensiveTechniqueNode;
class AdministrativeNetworkTraffic ArtifactNode; click T1021001 href "/offensive-technique/attack/T1021.001/"; click AdministrativeNetworkTraffic href "/dao/artifact/d3f:AdministrativeNetworkTraffic";T1021004["SSH"] --> |produces| AdministrativeNetworkTraffic["Administrative Network Traffic"]; class T1021004 OffensiveTechniqueNode;
class AdministrativeNetworkTraffic ArtifactNode; click T1021004 href "/offensive-technique/attack/T1021.004/"; click AdministrativeNetworkTraffic href "/dao/artifact/d3f:AdministrativeNetworkTraffic";T1562002["Disable Windows Event Logging"] --> |may-modify| ApplicationConfiguration["Application Configuration"]; class T1562002 OffensiveTechniqueNode;
class ApplicationConfiguration ArtifactNode; click T1562002 href "/offensive-technique/attack/T1562.002/"; click ApplicationConfiguration href "/dao/artifact/d3f:ApplicationConfiguration";T1114003["Email Forwarding Rule"] --> |modifies| ApplicationConfiguration["Application Configuration"]; class T1114003 OffensiveTechniqueNode;
class ApplicationConfiguration ArtifactNode; click T1114003 href "/offensive-technique/attack/T1114.003/"; click ApplicationConfiguration href "/dao/artifact/d3f:ApplicationConfiguration";T1564008["Email Hiding Rules"] --> |modifies| ApplicationConfiguration["Application Configuration"]; class T1564008 OffensiveTechniqueNode;
class ApplicationConfiguration ArtifactNode; click T1564008 href "/offensive-technique/attack/T1564.008/"; click ApplicationConfiguration href "/dao/artifact/d3f:ApplicationConfiguration";T1137004["Outlook Home Page"] --> |modifies| ApplicationConfigurationDatabase["Application Configuration Database"]; class T1137004 OffensiveTechniqueNode;
class ApplicationConfigurationDatabase ArtifactNode; click T1137004 href "/offensive-technique/attack/T1137.004/"; click ApplicationConfigurationDatabase href "/dao/artifact/d3f:ApplicationConfigurationDatabase";T1137005["Outlook Rules"] --> |modifies| ApplicationConfigurationDatabase["Application Configuration Database"]; class T1137005 OffensiveTechniqueNode;
class ApplicationConfigurationDatabase ArtifactNode; click T1137005 href "/offensive-technique/attack/T1137.005/"; click ApplicationConfigurationDatabase href "/dao/artifact/d3f:ApplicationConfigurationDatabase";T1547007["Re-opened Applications"] --> |modifies| ApplicationConfigurationFile["Application Configuration File"]; class T1547007 OffensiveTechniqueNode;
class ApplicationConfigurationFile ArtifactNode; click T1547007 href "/offensive-technique/attack/T1547.007/"; click ApplicationConfigurationFile href "/dao/artifact/d3f:ApplicationConfigurationFile";T1547011["Plist Modification"] --> |modifies| ApplicationConfigurationFile["Application Configuration File"]; class T1547011 OffensiveTechniqueNode;
class ApplicationConfigurationFile ArtifactNode; click T1547011 href "/offensive-technique/attack/T1547.011/"; click ApplicationConfigurationFile href "/dao/artifact/d3f:ApplicationConfigurationFile";T1560["Archive Collected Data"] --> |creates| ArchiveFile["Archive File"]; class T1560 OffensiveTechniqueNode;
class ArchiveFile ArtifactNode; click T1560 href "/offensive-technique/attack/T1560/"; click ArchiveFile href "/dao/artifact/d3f:ArchiveFile";T1560001["Archive via Utility"] --> |creates| ArchiveFile["Archive File"]; class T1560001 OffensiveTechniqueNode;
class ArchiveFile ArtifactNode; click T1560001 href "/offensive-technique/attack/T1560.001/"; click ArchiveFile href "/dao/artifact/d3f:ArchiveFile";T1560002["Archive via Library"] --> |creates| ArchiveFile["Archive File"]; class T1560002 OffensiveTechniqueNode;
class ArchiveFile ArtifactNode; click T1560002 href "/offensive-technique/attack/T1560.002/"; click ArchiveFile href "/dao/artifact/d3f:ArchiveFile";T1123["Audio Capture"] --> |accesses| AudioInputDevice["Audio Input Device"]; class T1123 OffensiveTechniqueNode;
class AudioInputDevice ArtifactNode; click T1123 href "/offensive-technique/attack/T1123/"; click AudioInputDevice href "/dao/artifact/d3f:AudioInputDevice";T1550002["Pass The Hash"] --> |creates| Authentication["Authentication"]; class T1550002 OffensiveTechniqueNode;
class Authentication ArtifactNode; click T1550002 href "/offensive-technique/attack/T1550.002/"; click Authentication href "/dao/artifact/d3f:Authentication";T1550003["Pass The Ticket"] --> |creates| Authentication["Authentication"]; class T1550003 OffensiveTechniqueNode;
class Authentication ArtifactNode; click T1550003 href "/offensive-technique/attack/T1550.003/"; click Authentication href "/dao/artifact/d3f:Authentication";T1078["Valid Accounts"] --> |produces| Authentication["Authentication"]; class T1078 OffensiveTechniqueNode;
class Authentication ArtifactNode; click T1078 href "/offensive-technique/attack/T1078/"; click Authentication href "/dao/artifact/d3f:Authentication";T1133["External Remote Services"] --> |produces| Authentication["Authentication"]; class T1133 OffensiveTechniqueNode;
class Authentication ArtifactNode; click T1133 href "/offensive-technique/attack/T1133/"; click Authentication href "/dao/artifact/d3f:Authentication";T1187["Forced Authentication"] --> |produces| Authentication["Authentication"]; class T1187 OffensiveTechniqueNode;
class Authentication ArtifactNode; click T1187 href "/offensive-technique/attack/T1187/"; click Authentication href "/dao/artifact/d3f:Authentication";T1110001["Password Guessing"] --> |produces| Authentication["Authentication"]; class T1110001 OffensiveTechniqueNode;
class Authentication ArtifactNode; click T1110001 href "/offensive-technique/attack/T1110.001/"; click Authentication href "/dao/artifact/d3f:Authentication";T1110003["Password Spraying"] --> |produces| Authentication["Authentication"]; class T1110003 OffensiveTechniqueNode;
class Authentication ArtifactNode; click T1110003 href "/offensive-technique/attack/T1110.003/"; click Authentication href "/dao/artifact/d3f:Authentication";T1110004["Credential Stuffing"] --> |produces| Authentication["Authentication"]; class T1110004 OffensiveTechniqueNode;
class Authentication ArtifactNode; click T1110004 href "/offensive-technique/attack/T1110.004/"; click Authentication href "/dao/artifact/d3f:Authentication";T1187["Forced Authentication"] --> |modifies| AuthenticationLog["Authentication Log"]; class T1187 OffensiveTechniqueNode;
class AuthenticationLog ArtifactNode; click T1187 href "/offensive-technique/attack/T1187/"; click AuthenticationLog href "/dao/artifact/d3f:AuthenticationLog";T1110001["Password Guessing"] --> |modifies| AuthenticationLog["Authentication Log"]; class T1110001 OffensiveTechniqueNode;
class AuthenticationLog ArtifactNode; click T1110001 href "/offensive-technique/attack/T1110.001/"; click AuthenticationLog href "/dao/artifact/d3f:AuthenticationLog";T1110003["Password Spraying"] --> |modifies| AuthenticationLog["Authentication Log"]; class T1110003 OffensiveTechniqueNode;
class AuthenticationLog ArtifactNode; click T1110003 href "/offensive-technique/attack/T1110.003/"; click AuthenticationLog href "/dao/artifact/d3f:AuthenticationLog";T1110004["Credential Stuffing"] --> |modifies| AuthenticationLog["Authentication Log"]; class T1110004 OffensiveTechniqueNode;
class AuthenticationLog ArtifactNode; click T1110004 href "/offensive-technique/attack/T1110.004/"; click AuthenticationLog href "/dao/artifact/d3f:AuthenticationLog";T1550["Use Alternate Authentication Material"] --> |accesses| AuthenticationService["Authentication Service"]; class T1550 OffensiveTechniqueNode;
class AuthenticationService ArtifactNode; click T1550 href "/offensive-technique/attack/T1550/"; click AuthenticationService href "/dao/artifact/d3f:AuthenticationService";T1003001["LSASS Memory"] --> |accesses| AuthenticationService["Authentication Service"]; class T1003001 OffensiveTechniqueNode;
class AuthenticationService ArtifactNode; click T1003001 href "/offensive-technique/attack/T1003.001/"; click AuthenticationService href "/dao/artifact/d3f:AuthenticationService";T1212["Exploitation for Credential Access"] --> |may-access| AuthenticationService["Authentication Service"]; class T1212 OffensiveTechniqueNode;
class AuthenticationService ArtifactNode; click T1212 href "/offensive-technique/attack/T1212/"; click AuthenticationService href "/dao/artifact/d3f:AuthenticationService";T1003002["Security Account Manager"] --> |may-access| AuthenticationService["Authentication Service"]; class T1003002 OffensiveTechniqueNode;
class AuthenticationService ArtifactNode; click T1003002 href "/offensive-technique/attack/T1003.002/"; click AuthenticationService href "/dao/artifact/d3f:AuthenticationService";T1556["Modify Authentication Process"] --> |modifies| AuthenticationService["Authentication Service"]; class T1556 OffensiveTechniqueNode;
class AuthenticationService ArtifactNode; click T1556 href "/offensive-technique/attack/T1556/"; click AuthenticationService href "/dao/artifact/d3f:AuthenticationService";T1078["Valid Accounts"] --> |produces| Authorization["Authorization"]; class T1078 OffensiveTechniqueNode;
class Authorization ArtifactNode; click T1078 href "/offensive-technique/attack/T1078/"; click Authorization href "/dao/artifact/d3f:Authorization";T1133["External Remote Services"] --> |produces| Authorization["Authorization"]; class T1133 OffensiveTechniqueNode;
class Authorization ArtifactNode; click T1133 href "/offensive-technique/attack/T1133/"; click Authorization href "/dao/artifact/d3f:Authorization";T1561001["Disk Content Wipe"] --> |modifies| BlockDevice["Block Device"]; class T1561001 OffensiveTechniqueNode;
class BlockDevice ArtifactNode; click T1561001 href "/offensive-technique/attack/T1561.001/"; click BlockDevice href "/dao/artifact/d3f:BlockDevice";T1542003["Bootkit"] --> |may-modify| BootLoader["Boot Loader"]; class T1542003 OffensiveTechniqueNode;
class BootLoader ArtifactNode; click T1542003 href "/offensive-technique/attack/T1542.003/"; click BootLoader href "/dao/artifact/d3f:BootLoader";T1014["Rootkit"] --> |may-modify| BootSector["Boot Sector"]; class T1014 OffensiveTechniqueNode;
class BootSector ArtifactNode; click T1014 href "/offensive-technique/attack/T1014/"; click BootSector href "/dao/artifact/d3f:BootSector";T1542003["Bootkit"] --> |may-modify| BootSector["Boot Sector"]; class T1542003 OffensiveTechniqueNode;
class BootSector ArtifactNode; click T1542003 href "/offensive-technique/attack/T1542.003/"; click BootSector href "/dao/artifact/d3f:BootSector";T1561001["Disk Content Wipe"] --> |may-modify| BootSector["Boot Sector"]; class T1561001 OffensiveTechniqueNode;
class BootSector ArtifactNode; click T1561001 href "/offensive-technique/attack/T1561.001/"; click BootSector href "/dao/artifact/d3f:BootSector";T1561002["Disk Structure Wipe"] --> |may-modify| BootSector["Boot Sector"]; class T1561002 OffensiveTechniqueNode;
class BootSector ArtifactNode; click T1561002 href "/offensive-technique/attack/T1561.002/"; click BootSector href "/dao/artifact/d3f:BootSector";T1176["Browser Extensions"] --> |modifies| BrowserExtension["Browser Extension"]; class T1176 OffensiveTechniqueNode;
class BrowserExtension ArtifactNode; click T1176 href "/offensive-technique/attack/T1176/"; click BrowserExtension href "/dao/artifact/d3f:BrowserExtension";T1041["Exfiltration Over C2 Channel"] --> |may-transfer| CertificateFile["Certificate File"]; class T1041 OffensiveTechniqueNode;
class CertificateFile ArtifactNode; click T1041 href "/offensive-technique/attack/T1041/"; click CertificateFile href "/dao/artifact/d3f:CertificateFile";T1071["Application Layer Protocol"] --> |may-transfer| CertificateFile["Certificate File"]; class T1071 OffensiveTechniqueNode;
class CertificateFile ArtifactNode; click T1071 href "/offensive-technique/attack/T1071/"; click CertificateFile href "/dao/artifact/d3f:CertificateFile";T1071001["Web Protocols"] --> |may-transfer| CertificateFile["Certificate File"]; class T1071001 OffensiveTechniqueNode;
class CertificateFile ArtifactNode; click T1071001 href "/offensive-technique/attack/T1071.001/"; click CertificateFile href "/dao/artifact/d3f:CertificateFile";T1048002["Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"] --> |may-transfer| CertificateFile["Certificate File"]; class T1048002 OffensiveTechniqueNode;
class CertificateFile ArtifactNode; click T1048002 href "/offensive-technique/attack/T1048.002/"; click CertificateFile href "/dao/artifact/d3f:CertificateFile";T1573002["Asymmetric Cryptography"] --> |may-transfer| CertificateFile["Certificate File"]; class T1573002 OffensiveTechniqueNode;
class CertificateFile ArtifactNode; click T1573002 href "/offensive-technique/attack/T1573.002/"; click CertificateFile href "/dao/artifact/d3f:CertificateFile";T1553004["Install Root Certificate"] --> |modifies| CertificateTrustStore["Certificate Trust Store"]; class T1553004 OffensiveTechniqueNode;
class CertificateTrustStore ArtifactNode; click T1553004 href "/offensive-technique/attack/T1553.004/"; click CertificateTrustStore href "/dao/artifact/d3f:CertificateTrustStore";T1554["Compromise Client Software Binary"] --> |modifies| ClientApplication["Client Application"]; class T1554 OffensiveTechniqueNode;
class ClientApplication ArtifactNode; click T1554 href "/offensive-technique/attack/T1554/"; click ClientApplication href "/dao/artifact/d3f:ClientApplication";T1115["Clipboard Data"] --> |reads| Clipboard["Clipboard"]; class T1115 OffensiveTechniqueNode;
class Clipboard ArtifactNode; click T1115 href "/offensive-technique/attack/T1115/"; click Clipboard href "/dao/artifact/d3f:Clipboard";T1538["Cloud Service Dashboard"] --> |accesses| CloudConfiguration["Cloud Configuration"]; class T1538 OffensiveTechniqueNode;
class CloudConfiguration ArtifactNode; click T1538 href "/offensive-technique/attack/T1538/"; click CloudConfiguration href "/dao/artifact/d3f:CloudConfiguration";T1526["Cloud Service Discovery"] --> |reads| CloudConfiguration["Cloud Configuration"]; class T1526 OffensiveTechniqueNode;
class CloudConfiguration ArtifactNode; click T1526 href "/offensive-technique/attack/T1526/"; click CloudConfiguration href "/dao/artifact/d3f:CloudConfiguration";T1552005["Cloud Instance Metadata API"] --> |accesses| CloudInstanceMetadata["Cloud Instance Metadata"]; class T1552005 OffensiveTechniqueNode;
class CloudInstanceMetadata ArtifactNode; click T1552005 href "/offensive-technique/attack/T1552.005/"; click CloudInstanceMetadata href "/dao/artifact/d3f:CloudInstanceMetadata";T1619["Cloud Storage Object Discovery"] --> |accesses| CloudStorage["Cloud Storage"]; class T1619 OffensiveTechniqueNode;
class CloudStorage ArtifactNode; click T1619 href "/offensive-technique/attack/T1619/"; click CloudStorage href "/dao/artifact/d3f:CloudStorage";T1087004["Cloud Account"] --> |creates| CloudUserAccount["Cloud User Account"]; class T1087004 OffensiveTechniqueNode;
class CloudUserAccount ArtifactNode; click T1087004 href "/offensive-technique/attack/T1087.004/"; click CloudUserAccount href "/dao/artifact/d3f:CloudUserAccount";T1078004["Cloud Accounts"] --> |uses| CloudUserAccount["Cloud User Account"]; class T1078004 OffensiveTechniqueNode;
class CloudUserAccount ArtifactNode; click T1078004 href "/offensive-technique/attack/T1078.004/"; click CloudUserAccount href "/dao/artifact/d3f:CloudUserAccount";T1213003["Code Repositories"] --> |reads| CodeRepository["Code Repository"]; class T1213003 OffensiveTechniqueNode;
class CodeRepository ArtifactNode; click T1213003 href "/offensive-technique/attack/T1213.003/"; click CodeRepository href "/dao/artifact/d3f:CodeRepository";T1546005["Trap"] --> |executes| Command["Command"]; class T1546005 OffensiveTechniqueNode;
class Command ArtifactNode; click T1546005 href "/offensive-technique/attack/T1546.005/"; click Command href "/dao/artifact/d3f:Command";T1218014["MMC"] --> |executes| Command["Command"]; class T1218014 OffensiveTechniqueNode;
class Command ArtifactNode; click T1218014 href "/offensive-technique/attack/T1218.014/"; click Command href "/dao/artifact/d3f:Command";T1070003["Clear Command History"] --> |modifies| CommandHistoryLog["Command History Log"]; class T1070003 OffensiveTechniqueNode;
class CommandHistoryLog ArtifactNode; click T1070003 href "/offensive-technique/attack/T1070.003/"; click CommandHistoryLog href "/dao/artifact/d3f:CommandHistoryLog";T1552003["Bash History"] --> |accesses| CommandHistoryLogFile["Command History Log File"]; class T1552003 OffensiveTechniqueNode;
class CommandHistoryLogFile ArtifactNode; click T1552003 href "/offensive-technique/attack/T1552.003/"; click CommandHistoryLogFile href "/dao/artifact/d3f:CommandHistoryLogFile";T1127001["MSBuild"] --> |runs| Compiler["Compiler"]; class T1127001 OffensiveTechniqueNode;
class Compiler ArtifactNode; click T1127001 href "/offensive-technique/attack/T1127.001/"; click Compiler href "/dao/artifact/d3f:Compiler";T1127001["MSBuild"] --> |modifies| CompilerConfigurationFile["Compiler Configuration File"]; class T1127001 OffensiveTechniqueNode;
class CompilerConfigurationFile ArtifactNode; click T1127001 href "/offensive-technique/attack/T1127.001/"; click CompilerConfigurationFile href "/dao/artifact/d3f:CompilerConfigurationFile";T1614["System Location Discovery"] --> |accesses| ConfigurationResource["Configuration Resource"]; class T1614 OffensiveTechniqueNode;
class ConfigurationResource ArtifactNode; click T1614 href "/offensive-technique/attack/T1614/"; click ConfigurationResource href "/dao/artifact/d3f:ConfigurationResource";T1546014["Emond"] --> |modifies| ConfigurationResource["Configuration Resource"]; class T1546014 OffensiveTechniqueNode;
class ConfigurationResource ArtifactNode; click T1546014 href "/offensive-technique/attack/T1546.014/"; click ConfigurationResource href "/dao/artifact/d3f:ConfigurationResource";T1525["Implant Container Image"] --> |adds| ContainerImage["Container Image"]; class T1525 OffensiveTechniqueNode;
class ContainerImage ArtifactNode; click T1525 href "/offensive-technique/attack/T1525/"; click ContainerImage href "/dao/artifact/d3f:ContainerImage";T1033["System Owner/User Discovery"] --> |may-invoke| CopyToken["Copy Token"]; class T1033 OffensiveTechniqueNode;
class CopyToken ArtifactNode; click T1033 href "/offensive-technique/attack/T1033/"; click CopyToken href "/dao/artifact/d3f:CopyToken";T1218001["Compiled HTML File"] --> |invokes| CreateFile["Create File"]; class T1218001 OffensiveTechniqueNode;
class CreateFile ArtifactNode; click T1218001 href "/offensive-technique/attack/T1218.001/"; click CreateFile href "/dao/artifact/d3f:CreateFile";T1074001["Local Data Staging"] --> |may-invoke| CreateFile["Create File"]; class T1074001 OffensiveTechniqueNode;
class CreateFile ArtifactNode; click T1074001 href "/offensive-technique/attack/T1074.001/"; click CreateFile href "/dao/artifact/d3f:CreateFile";T1053["Scheduled Task/Job Execution"] --> |invokes| CreateProcess["Create Process"]; class T1053 OffensiveTechniqueNode;
class CreateProcess ArtifactNode; click T1053 href "/offensive-technique/attack/T1053/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";T1047["Windows Management Instrumentation Execution"] --> |may-invoke| CreateProcess["Create Process"]; class T1047 OffensiveTechniqueNode;
class CreateProcess ArtifactNode; click T1047 href "/offensive-technique/attack/T1047/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";T1007["System Service Discovery"] --> |may-invoke| CreateProcess["Create Process"]; class T1007 OffensiveTechniqueNode;
class CreateProcess ArtifactNode; click T1007 href "/offensive-technique/attack/T1007/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";T1010["Application Window Discovery"] --> |may-invoke| CreateProcess["Create Process"]; class T1010 OffensiveTechniqueNode;
class CreateProcess ArtifactNode; click T1010 href "/offensive-technique/attack/T1010/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";T1016["System Network Configuration Discovery"] --> |may-invoke| CreateProcess["Create Process"]; class T1016 OffensiveTechniqueNode;
class CreateProcess ArtifactNode; click T1016 href "/offensive-technique/attack/T1016/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";T1018["Remote System Discovery"] --> |may-invoke| CreateProcess["Create Process"]; class T1018 OffensiveTechniqueNode;
class CreateProcess ArtifactNode; click T1018 href "/offensive-technique/attack/T1018/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";T1033["System Owner/User Discovery"] --> |may-invoke| CreateProcess["Create Process"]; class T1033 OffensiveTechniqueNode;
class CreateProcess ArtifactNode; click T1033 href "/offensive-technique/attack/T1033/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";T1220["XSL Script Processing"] --> |invokes| CreateProcess["Create Process"]; class T1220 OffensiveTechniqueNode;
class CreateProcess ArtifactNode; click T1220 href "/offensive-technique/attack/T1220/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";T1140["Deobfuscate/Decode Files or Information"] --> |invokes| CreateProcess["Create Process"]; class T1140 OffensiveTechniqueNode;
class CreateProcess ArtifactNode; click T1140 href "/offensive-technique/attack/T1140/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";T1055013["Process Doppelgänging"] --> |invokes| CreateProcess["Create Process"]; class T1055013 OffensiveTechniqueNode;
class CreateProcess ArtifactNode; click T1055013 href "/offensive-technique/attack/T1055.013/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";T1218001["Compiled HTML File"] --> |invokes| CreateProcess["Create Process"]; class T1218001 OffensiveTechniqueNode;
class CreateProcess ArtifactNode; click T1218001 href "/offensive-technique/attack/T1218.001/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";T1218002["Control Panel Execution"] --> |invokes| CreateProcess["Create Process"]; class T1218002 OffensiveTechniqueNode;
class CreateProcess ArtifactNode; click T1218002 href "/offensive-technique/attack/T1218.002/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";T1218003["CMSTP"] --> |invokes| CreateProcess["Create Process"]; class T1218003 OffensiveTechniqueNode;
class CreateProcess ArtifactNode; click T1218003 href "/offensive-technique/attack/T1218.003/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";T1546009["AppCert DLLs"] --> |invokes| CreateProcess["Create Process"]; class T1546009 OffensiveTechniqueNode;
class CreateProcess ArtifactNode; click T1546009 href "/offensive-technique/attack/T1546.009/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";T1546010["AppInit DLLs"] --> |invokes| CreateProcess["Create Process"]; class T1546010 OffensiveTechniqueNode;
class CreateProcess ArtifactNode; click T1546010 href "/offensive-technique/attack/T1546.010/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";T1218005["Mshta Execution"] --> |invokes| CreateProcess["Create Process"]; class T1218005 OffensiveTechniqueNode;
class CreateProcess ArtifactNode; click T1218005 href "/offensive-technique/attack/T1218.005/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";T1218011["Rundll32 Execution"] --> |invokes| CreateProcess["Create Process"]; class T1218011 OffensiveTechniqueNode;
class CreateProcess ArtifactNode; click T1218011 href "/offensive-technique/attack/T1218.011/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";T1134004["Parent PID Spoofing"] --> |invokes| CreateProcess["Create Process"]; class T1134004 OffensiveTechniqueNode;
class CreateProcess ArtifactNode; click T1134004 href "/offensive-technique/attack/T1134.004/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";T1548002["Bypass User Access Control"] --> |invokes| CreateProcess["Create Process"]; class T1548002 OffensiveTechniqueNode;
class CreateProcess ArtifactNode; click T1548002 href "/offensive-technique/attack/T1548.002/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";T1505001["SQL Stored Procedures"] --> |invokes| CreateProcess["Create Process"]; class T1505001 OffensiveTechniqueNode;
class CreateProcess ArtifactNode; click T1505001 href "/offensive-technique/attack/T1505.001/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";T1057["Process Discovery"] --> |may-invoke| CreateProcess["Create Process"]; class T1057 OffensiveTechniqueNode;
class CreateProcess ArtifactNode; click T1057 href "/offensive-technique/attack/T1057/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";T1082["System Information Discovery"] --> |may-invoke| CreateProcess["Create Process"]; class T1082 OffensiveTechniqueNode;
class CreateProcess ArtifactNode; click T1082 href "/offensive-technique/attack/T1082/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";T1124["System Time Discovery"] --> |may-invoke| CreateProcess["Create Process"]; class T1124 OffensiveTechniqueNode;
class CreateProcess ArtifactNode; click T1124 href "/offensive-technique/attack/T1124/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";T1055004["Asynchronous Procedure Call"] --> |may-invoke| CreateProcess["Create Process"]; class T1055004 OffensiveTechniqueNode;
class CreateProcess ArtifactNode; click T1055004 href "/offensive-technique/attack/T1055.004/"; click CreateProcess href "/dao/artifact/d3f:CreateProcess";T1018["Remote System Discovery"] --> |may-invoke| CreateSocket["Create Socket"]; class T1018 OffensiveTechniqueNode;
class CreateSocket ArtifactNode; click T1018 href "/offensive-technique/attack/T1018/"; click CreateSocket href "/dao/artifact/d3f:CreateSocket";T1218013["Mavinject"] --> |invokes| CreateThread["Create Thread"]; class T1218013 OffensiveTechniqueNode;
class CreateThread ArtifactNode; click T1218013 href "/offensive-technique/attack/T1218.013/"; click CreateThread href "/dao/artifact/d3f:CreateThread";T1552["Unsecured Credentials"] --> |accesses| Credential["Credential"]; class T1552 OffensiveTechniqueNode;
class Credential ArtifactNode; click T1552 href "/offensive-technique/attack/T1552/"; click Credential href "/dao/artifact/d3f:Credential";T1098001["Additional Azure Service Principal Credentials"] --> |creates| Credential["Credential"]; class T1098001 OffensiveTechniqueNode;
class Credential ArtifactNode; click T1098001 href "/offensive-technique/attack/T1098.001/"; click Credential href "/dao/artifact/d3f:Credential";T1212["Exploitation for Credential Access"] --> |may-access| CredentialManagementSystem["Credential Management System"]; class T1212 OffensiveTechniqueNode;
class CredentialManagementSystem ArtifactNode; click T1212 href "/offensive-technique/attack/T1212/"; click CredentialManagementSystem href "/dao/artifact/d3f:CredentialManagementSystem";T1560003["Archive via Custom Method"] --> |creates| CustomArchiveFile["Custom Archive File"]; class T1560003 OffensiveTechniqueNode;
class CustomArchiveFile ArtifactNode; click T1560003 href "/offensive-technique/attack/T1560.003/"; click CustomArchiveFile href "/dao/artifact/d3f:CustomArchiveFile";T1557003["DHCP Spoofing"] --> |creates| DHCPNetworkTraffic["DHCP Network Traffic"]; class T1557003 OffensiveTechniqueNode;
class DHCPNetworkTraffic ArtifactNode; click T1557003 href "/offensive-technique/attack/T1557.003/"; click DHCPNetworkTraffic href "/dao/artifact/d3f:DHCPNetworkTraffic";T1040["Network Sniffing"] --> |may-produce| DNSLookup["DNS Lookup"]; class T1040 OffensiveTechniqueNode;
class DNSLookup ArtifactNode; click T1040 href "/offensive-technique/attack/T1040/"; click DNSLookup href "/dao/artifact/d3f:DNSLookup";T1555003["Credentials from Web Browsers"] --> |accesses| DatabaseFile["Database File"]; class T1555003 OffensiveTechniqueNode;
class DatabaseFile ArtifactNode; click T1555003 href "/offensive-technique/attack/T1555.003/"; click DatabaseFile href "/dao/artifact/d3f:DatabaseFile";T1555["Credentials from Password Stores"] --> |may-access| DatabaseFile["Database File"]; class T1555 OffensiveTechniqueNode;
class DatabaseFile ArtifactNode; click T1555 href "/offensive-technique/attack/T1555/"; click DatabaseFile href "/dao/artifact/d3f:DatabaseFile";T1190["Exploit Public-Facing Application"] --> |injects| DatabaseQuery["Database Query"]; class T1190 OffensiveTechniqueNode;
class DatabaseQuery ArtifactNode; click T1190 href "/offensive-technique/attack/T1190/"; click DatabaseQuery href "/dao/artifact/d3f:DatabaseQuery";T1082["System Information Discovery"] --> |may-access| DecoyArtifact["Decoy Artifact"]; class T1082 OffensiveTechniqueNode;
class DecoyArtifact ArtifactNode; click T1082 href "/offensive-technique/attack/T1082/"; click DecoyArtifact href "/dao/artifact/d3f:DecoyArtifact";T1078001["Default Accounts"] --> |uses| DefaultUserAccount["Default User Account"]; class T1078001 OffensiveTechniqueNode;
class DefaultUserAccount ArtifactNode; click T1078001 href "/offensive-technique/attack/T1078.001/"; click DefaultUserAccount href "/dao/artifact/d3f:DefaultUserAccount";T1027006["HTML Smuggling"] --> |hides| DigitalArtifact["Digital Artifact"]; class T1027006 OffensiveTechniqueNode;
class DigitalArtifact ArtifactNode; click T1027006 href "/offensive-technique/attack/T1027.006/"; click DigitalArtifact href "/dao/artifact/d3f:DigitalArtifact";T1195["Supply Chain Compromise"] --> |modifies| DigitalArtifact["Digital Artifact"]; class T1195 OffensiveTechniqueNode;
class DigitalArtifact ArtifactNode; click T1195 href "/offensive-technique/attack/T1195/"; click DigitalArtifact href "/dao/artifact/d3f:DigitalArtifact";T1083["File and Directory Discovery"] --> |accesses| Directory["Directory"]; class T1083 OffensiveTechniqueNode;
class Directory ArtifactNode; click T1083 href "/offensive-technique/attack/T1083/"; click Directory href "/dao/artifact/d3f:Directory";T1564006["Run Virtual Instance"] --> |may-create| Directory["Directory"]; class T1564006 OffensiveTechniqueNode;
class Directory ArtifactNode; click T1564006 href "/offensive-technique/attack/T1564.006/"; click Directory href "/dao/artifact/d3f:Directory";T1033["System Owner/User Discovery"] --> |may-access| DirectoryService["Directory Service"]; class T1033 OffensiveTechniqueNode;
class DirectoryService ArtifactNode; click T1033 href "/offensive-technique/attack/T1033/"; click DirectoryService href "/dao/artifact/d3f:DirectoryService";T1113["Screen Capture"] --> |may-access| DisplayServer["Display Server"]; class T1113 OffensiveTechniqueNode;
class DisplayServer ArtifactNode; click T1113 href "/offensive-technique/attack/T1113/"; click DisplayServer href "/dao/artifact/d3f:DisplayServer";T1087002["Domain Account"] --> |creates| DomainUserAccount["Domain User Account"]; class T1087002 OffensiveTechniqueNode;
class DomainUserAccount ArtifactNode; click T1087002 href "/offensive-technique/attack/T1087.002/"; click DomainUserAccount href "/dao/artifact/d3f:DomainUserAccount";T1098002["Exchange Email Delegate Permissions"] --> |modifies| DomainUserAccount["Domain User Account"]; class T1098002 OffensiveTechniqueNode;
class DomainUserAccount ArtifactNode; click T1098002 href "/offensive-technique/attack/T1098.002/"; click DomainUserAccount href "/dao/artifact/d3f:DomainUserAccount";T1078002["Domain Accounts"] --> |uses| DomainUserAccount["Domain User Account"]; class T1078002 OffensiveTechniqueNode;
class DomainUserAccount ArtifactNode; click T1078002 href "/offensive-technique/attack/T1078.002/"; click DomainUserAccount href "/dao/artifact/d3f:DomainUserAccount";T1534["Internal Spearphishing"] --> |produces| Email["Email"]; class T1534 OffensiveTechniqueNode;
class Email ArtifactNode; click T1534 href "/offensive-technique/attack/T1534/"; click Email href "/dao/artifact/d3f:Email";T1566001["Spearphishing Attachment"] --> |produces| Email["Email"]; class T1566001 OffensiveTechniqueNode;
class Email ArtifactNode; click T1566001 href "/offensive-technique/attack/T1566.001/"; click Email href "/dao/artifact/d3f:Email";T1566002["Spearphishing Link"] --> |produces| Email["Email"]; class T1566002 OffensiveTechniqueNode;
class Email ArtifactNode; click T1566002 href "/offensive-technique/attack/T1566.002/"; click Email href "/dao/artifact/d3f:Email";T1114001["Local Email Collection"] --> |reads| Email["Email"]; class T1114001 OffensiveTechniqueNode;
class Email ArtifactNode; click T1114001 href "/offensive-technique/attack/T1114.001/"; click Email href "/dao/artifact/d3f:Email";T1564008["Email Hiding Rules"] --> |may-create| EmailRule["Email Rule"]; class T1564008 OffensiveTechniqueNode;
class EmailRule ArtifactNode; click T1564008 href "/offensive-technique/attack/T1564.008/"; click EmailRule href "/dao/artifact/d3f:EmailRule";T1564008["Email Hiding Rules"] --> |may-modify| EmailRule["Email Rule"]; class T1564008 OffensiveTechniqueNode;
class EmailRule ArtifactNode; click T1564008 href "/offensive-technique/attack/T1564.008/"; click EmailRule href "/dao/artifact/d3f:EmailRule";T1003003["NTDS"] --> |accesses| EncryptedCredential["Encrypted Credential"]; class T1003003 OffensiveTechniqueNode;
class EncryptedCredential ArtifactNode; click T1003003 href "/offensive-technique/attack/T1003.003/"; click EncryptedCredential href "/dao/artifact/d3f:EncryptedCredential";T1003005["Cached Domain Credentials"] --> |accesses| EncryptedCredential["Encrypted Credential"]; class T1003005 OffensiveTechniqueNode;
class EncryptedCredential ArtifactNode; click T1003005 href "/offensive-technique/attack/T1003.005/"; click EncryptedCredential href "/dao/artifact/d3f:EncryptedCredential";T1003008["/etc/passwd and /etc/shadow"] --> |accesses| EncryptedCredential["Encrypted Credential"]; class T1003008 OffensiveTechniqueNode;
class EncryptedCredential ArtifactNode; click T1003008 href "/offensive-technique/attack/T1003.008/"; click EncryptedCredential href "/dao/artifact/d3f:EncryptedCredential";T1142["Keychain"] --> |accesses| EncryptedCredential["Encrypted Credential"]; class T1142 OffensiveTechniqueNode;
class EncryptedCredential ArtifactNode; click T1142 href "/offensive-technique/attack/T1142/"; click EncryptedCredential href "/dao/artifact/d3f:EncryptedCredential";T1562009["Safe Mode Boot"] --> |disables| EndpointSensor["Endpoint Sensor"]; class T1562009 OffensiveTechniqueNode;
class EndpointSensor ArtifactNode; click T1562009 href "/offensive-technique/attack/T1562.009/"; click EndpointSensor href "/dao/artifact/d3f:EndpointSensor";T1140["Deobfuscate/Decode Files or Information"] --> |may-modify| EventLog["Event Log"]; class T1140 OffensiveTechniqueNode;
class EventLog ArtifactNode; click T1140 href "/offensive-technique/attack/T1140/"; click EventLog href "/dao/artifact/d3f:EventLog";T1003006["DCSync"] --> |may-modify| EventLog["Event Log"]; class T1003006 OffensiveTechniqueNode;
class EventLog ArtifactNode; click T1003006 href "/offensive-technique/attack/T1003.006/"; click EventLog href "/dao/artifact/d3f:EventLog";T1134002["Create Process with Token"] --> |may-modify| EventLog["Event Log"]; class T1134002 OffensiveTechniqueNode;
class EventLog ArtifactNode; click T1134002 href "/offensive-technique/attack/T1134.002/"; click EventLog href "/dao/artifact/d3f:EventLog";T1134003["Make and Impersonate Token"] --> |may-modify| EventLog["Event Log"]; class T1134003 OffensiveTechniqueNode;
class EventLog ArtifactNode; click T1134003 href "/offensive-technique/attack/T1134.003/"; click EventLog href "/dao/artifact/d3f:EventLog";T1548003["Sudo and Sudo Caching"] --> |may-modify| EventLog["Event Log"]; class T1548003 OffensiveTechniqueNode;
class EventLog ArtifactNode; click T1548003 href "/offensive-technique/attack/T1548.003/"; click EventLog href "/dao/artifact/d3f:EventLog";T1070001["Clear Windows Event Logs"] --> |modifies| EventLog["Event Log"]; class T1070001 OffensiveTechniqueNode;
class EventLog ArtifactNode; click T1070001 href "/offensive-technique/attack/T1070.001/"; click EventLog href "/dao/artifact/d3f:EventLog";T1546005["Trap"] --> |modifies| EventLog["Event Log"]; class T1546005 OffensiveTechniqueNode;
class EventLog ArtifactNode; click T1546005 href "/offensive-technique/attack/T1546.005/"; click EventLog href "/dao/artifact/d3f:EventLog";T1546003["Windows Management Instrumentation Event Subscription"] --> |modifies| EventLog["Event Log"]; class T1546003 OffensiveTechniqueNode;
class EventLog ArtifactNode; click T1546003 href "/offensive-technique/attack/T1546.003/"; click EventLog href "/dao/artifact/d3f:EventLog";T1036001["Invalid Code Signature"] --> |creates| ExecutableBinary["Executable Binary"]; class T1036001 OffensiveTechniqueNode;
class ExecutableBinary ArtifactNode; click T1036001 href "/offensive-technique/attack/T1036.001/"; click ExecutableBinary href "/dao/artifact/d3f:ExecutableBinary";T1546015["Component Object Model Hijacking"] --> |loads| ExecutableBinary["Executable Binary"]; class T1546015 OffensiveTechniqueNode;
class ExecutableBinary ArtifactNode; click T1546015 href "/offensive-technique/attack/T1546.015/"; click ExecutableBinary href "/dao/artifact/d3f:ExecutableBinary";T1055003["Thread Execution Hijacking"] --> |may-add| ExecutableBinary["Executable Binary"]; class T1055003 OffensiveTechniqueNode;
class ExecutableBinary ArtifactNode; click T1055003 href "/offensive-technique/attack/T1055.003/"; click ExecutableBinary href "/dao/artifact/d3f:ExecutableBinary";T1546008["Accessibility Features"] --> |may-modify| ExecutableBinary["Executable Binary"]; class T1546008 OffensiveTechniqueNode;
class ExecutableBinary ArtifactNode; click T1546008 href "/offensive-technique/attack/T1546.008/"; click ExecutableBinary href "/dao/artifact/d3f:ExecutableBinary";T1027001["Binary Padding"] --> |modifies| ExecutableBinary["Executable Binary"]; class T1027001 OffensiveTechniqueNode;
class ExecutableBinary ArtifactNode; click T1027001 href "/offensive-technique/attack/T1027.001/"; click ExecutableBinary href "/dao/artifact/d3f:ExecutableBinary";T1546006["LC_LOAD_DYLIB Addition"] --> |modifies| ExecutableBinary["Executable Binary"]; class T1546006 OffensiveTechniqueNode;
class ExecutableBinary ArtifactNode; click T1546006 href "/offensive-technique/attack/T1546.006/"; click ExecutableBinary href "/dao/artifact/d3f:ExecutableBinary";T1574008["Path Interception by Search Order Hijacking"] --> |creates| ExecutableFile["Executable File"]; class T1574008 OffensiveTechniqueNode;
class ExecutableFile ArtifactNode; click T1574008 href "/offensive-technique/attack/T1574.008/"; click ExecutableFile href "/dao/artifact/d3f:ExecutableFile";T1574009["Path Interception by Unquoted Path"] --> |creates| ExecutableFile["Executable File"]; class T1574009 OffensiveTechniqueNode;
class ExecutableFile ArtifactNode; click T1574009 href "/offensive-technique/attack/T1574.009/"; click ExecutableFile href "/dao/artifact/d3f:ExecutableFile";T1027004["Compile After Delivery"] --> |creates| ExecutableFile["Executable File"]; class T1027004 OffensiveTechniqueNode;
class ExecutableFile ArtifactNode; click T1027004 href "/offensive-technique/attack/T1027.004/"; click ExecutableFile href "/dao/artifact/d3f:ExecutableFile";T1546002["Screensaver"] --> |creates| ExecutableFile["Executable File"]; class T1546002 OffensiveTechniqueNode;
class ExecutableFile ArtifactNode; click T1546002 href "/offensive-technique/attack/T1546.002/"; click ExecutableFile href "/dao/artifact/d3f:ExecutableFile";T1574007["Path Interception by PATH Environment Variable"] --> |creates| ExecutableFile["Executable File"]; class T1574007 OffensiveTechniqueNode;
class ExecutableFile ArtifactNode; click T1574007 href "/offensive-technique/attack/T1574.007/"; click ExecutableFile href "/dao/artifact/d3f:ExecutableFile";T1204002["Malicious File Execution"] --> |executes| ExecutableFile["Executable File"]; class T1204002 OffensiveTechniqueNode;
class ExecutableFile ArtifactNode; click T1204002 href "/offensive-technique/attack/T1204.002/"; click ExecutableFile href "/dao/artifact/d3f:ExecutableFile";T1548002["Bypass User Access Control"] --> |executes| ExecutableFile["Executable File"]; class T1548002 OffensiveTechniqueNode;
class ExecutableFile ArtifactNode; click T1548002 href "/offensive-technique/attack/T1548.002/"; click ExecutableFile href "/dao/artifact/d3f:ExecutableFile";T1140["Deobfuscate/Decode Files or Information"] --> |may-add| ExecutableFile["Executable File"]; class T1140 OffensiveTechniqueNode;
class ExecutableFile ArtifactNode; click T1140 href "/offensive-technique/attack/T1140/"; click ExecutableFile href "/dao/artifact/d3f:ExecutableFile";T1036003["Rename System Utilities"] --> |may-create| ExecutableFile["Executable File"]; class T1036003 OffensiveTechniqueNode;
class ExecutableFile ArtifactNode; click T1036003 href "/offensive-technique/attack/T1036.003/"; click ExecutableFile href "/dao/artifact/d3f:ExecutableFile";T1565003["Runtime Data Manipulation"] --> |may-modify| ExecutableFile["Executable File"]; class T1565003 OffensiveTechniqueNode;
class ExecutableFile ArtifactNode; click T1565003 href "/offensive-technique/attack/T1565.003/"; click ExecutableFile href "/dao/artifact/d3f:ExecutableFile";T1027002["Software Packing"] --> |obfuscates| ExecutableFile["Executable File"]; class T1027002 OffensiveTechniqueNode;
class ExecutableFile ArtifactNode; click T1027002 href "/offensive-technique/attack/T1027.002/"; click ExecutableFile href "/dao/artifact/d3f:ExecutableFile";T1059["Command and Scripting Interpreter Execution"] --> |executes| ExecutableScript["Executable Script"]; class T1059 OffensiveTechniqueNode;
class ExecutableScript ArtifactNode; click T1059 href "/offensive-technique/attack/T1059/"; click ExecutableScript href "/dao/artifact/d3f:ExecutableScript";T1220["XSL Script Processing"] --> |interprets| ExecutableScript["Executable Script"]; class T1220 OffensiveTechniqueNode;
class ExecutableScript ArtifactNode; click T1220 href "/offensive-technique/attack/T1220/"; click ExecutableScript href "/dao/artifact/d3f:ExecutableScript";T1137001["Office Template Macros"] --> |may-add| ExecutableScript["Executable Script"]; class T1137001 OffensiveTechniqueNode;
class ExecutableScript ArtifactNode; click T1137001 href "/offensive-technique/attack/T1137.001/"; click ExecutableScript href "/dao/artifact/d3f:ExecutableScript";T1546005["Trap"] --> |may-create| ExecutableScript["Executable Script"]; class T1546005 OffensiveTechniqueNode;
class ExecutableScript ArtifactNode; click T1546005 href "/offensive-technique/attack/T1546.005/"; click ExecutableScript href "/dao/artifact/d3f:ExecutableScript";T1016["System Network Configuration Discovery"] --> |may-execute| ExecutableScript["Executable Script"]; class T1016 OffensiveTechniqueNode;
class ExecutableScript ArtifactNode; click T1016 href "/offensive-technique/attack/T1016/"; click ExecutableScript href "/dao/artifact/d3f:ExecutableScript";T1137001["Office Template Macros"] --> |may-modify| ExecutableScript["Executable Script"]; class T1137001 OffensiveTechniqueNode;
class ExecutableScript ArtifactNode; click T1137001 href "/offensive-technique/attack/T1137.001/"; click ExecutableScript href "/dao/artifact/d3f:ExecutableScript";T1546005["Trap"] --> |may-modify| ExecutableScript["Executable Script"]; class T1546005 OffensiveTechniqueNode;
class ExecutableScript ArtifactNode; click T1546005 href "/offensive-technique/attack/T1546.005/"; click ExecutableScript href "/dao/artifact/d3f:ExecutableScript";T1005["Data from Local System"] --> |accesses| File["File"]; class T1005 OffensiveTechniqueNode;
class File ArtifactNode; click T1005 href "/offensive-technique/attack/T1005/"; click File href "/dao/artifact/d3f:File";T1083["File and Directory Discovery"] --> |accesses| File["File"]; class T1083 OffensiveTechniqueNode;
class File ArtifactNode; click T1083 href "/offensive-technique/attack/T1083/"; click File href "/dao/artifact/d3f:File";T1119["Automated Collection"] --> |accesses| File["File"]; class T1119 OffensiveTechniqueNode;
class File ArtifactNode; click T1119 href "/offensive-technique/attack/T1119/"; click File href "/dao/artifact/d3f:File";T1552001["Credentials in Files"] --> |accesses| File["File"]; class T1552001 OffensiveTechniqueNode;
class File ArtifactNode; click T1552001 href "/offensive-technique/attack/T1552.001/"; click File href "/dao/artifact/d3f:File";T1072["Software Deployment Tools Execution"] --> |adds| File["File"]; class T1072 OffensiveTechniqueNode;
class File ArtifactNode; click T1072 href "/offensive-technique/attack/T1072/"; click File href "/dao/artifact/d3f:File";T1220["XSL Script Processing"] --> |adds| File["File"]; class T1220 OffensiveTechniqueNode;
class File ArtifactNode; click T1220 href "/offensive-technique/attack/T1220/"; click File href "/dao/artifact/d3f:File";T1036006["Space after Filename"] --> |creates| File["File"]; class T1036006 OffensiveTechniqueNode;
class File ArtifactNode; click T1036006 href "/offensive-technique/attack/T1036.006/"; click File href "/dao/artifact/d3f:File";T1564006["Run Virtual Instance"] --> |creates| File["File"]; class T1564006 OffensiveTechniqueNode;
class File ArtifactNode; click T1564006 href "/offensive-technique/attack/T1564.006/"; click File href "/dao/artifact/d3f:File";T1070004["File Deletion"] --> |deletes| File["File"]; class T1070004 OffensiveTechniqueNode;
class File ArtifactNode; click T1070004 href "/offensive-technique/attack/T1070.004/"; click File href "/dao/artifact/d3f:File";T1036005["Match Legitimate Name or Location"] --> |may-create| File["File"]; class T1036005 OffensiveTechniqueNode;
class File ArtifactNode; click T1036005 href "/offensive-technique/attack/T1036.005/"; click File href "/dao/artifact/d3f:File";T1074001["Local Data Staging"] --> |may-create| File["File"]; class T1074001 OffensiveTechniqueNode;
class File ArtifactNode; click T1074001 href "/offensive-technique/attack/T1074.001/"; click File href "/dao/artifact/d3f:File";T1070004["File Deletion"] --> |may-modify| File["File"]; class T1070004 OffensiveTechniqueNode;
class File ArtifactNode; click T1070004 href "/offensive-technique/attack/T1070.004/"; click File href "/dao/artifact/d3f:File";T1565001["Stored Data Manipulation"] --> |modifies| File["File"]; class T1565001 OffensiveTechniqueNode;
class File ArtifactNode; click T1565001 href "/offensive-technique/attack/T1565.001/"; click File href "/dao/artifact/d3f:File";T1566003["Spearphishing Via Service"] --> |produces| File["File"]; class T1566003 OffensiveTechniqueNode;
class File ArtifactNode; click T1566003 href "/offensive-technique/attack/T1566.003/"; click File href "/dao/artifact/d3f:File";T1070006["Timestomp"] --> |forges| FileSystemMetadata["File System Metadata"]; class T1070006 OffensiveTechniqueNode;
class FileSystemMetadata ArtifactNode; click T1070006 href "/offensive-technique/attack/T1070.006/"; click FileSystemMetadata href "/dao/artifact/d3f:FileSystemMetadata";T1518001["Security Software Discovery"] --> |may-access| FileSystemMetadata["File System Metadata"]; class T1518001 OffensiveTechniqueNode;
class FileSystemMetadata ArtifactNode; click T1518001 href "/offensive-technique/attack/T1518.001/"; click FileSystemMetadata href "/dao/artifact/d3f:FileSystemMetadata";T1036002["Right-to-Left Override"] --> |modifies| FileSystemMetadata["File System Metadata"]; class T1036002 OffensiveTechniqueNode;
class FileSystemMetadata ArtifactNode; click T1036002 href "/offensive-technique/attack/T1036.002/"; click FileSystemMetadata href "/dao/artifact/d3f:FileSystemMetadata";T1036007["Double File Extension"] --> |modifies| FileSystemMetadata["File System Metadata"]; class T1036007 OffensiveTechniqueNode;
class FileSystemMetadata ArtifactNode; click T1036007 href "/offensive-technique/attack/T1036.007/"; click FileSystemMetadata href "/dao/artifact/d3f:FileSystemMetadata";T1553001["Gatekeeper Bypass"] --> |modifies| FileSystemMetadata["File System Metadata"]; class T1553001 OffensiveTechniqueNode;
class FileSystemMetadata ArtifactNode; click T1553001 href "/offensive-technique/attack/T1553.001/"; click FileSystemMetadata href "/dao/artifact/d3f:FileSystemMetadata";T1564001["Hidden Files and Directories"] --> |modifies| FileSystemMetadata["File System Metadata"]; class T1564001 OffensiveTechniqueNode;
class FileSystemMetadata ArtifactNode; click T1564001 href "/offensive-technique/attack/T1564.001/"; click FileSystemMetadata href "/dao/artifact/d3f:FileSystemMetadata";T1564004["NTFS File Attributes"] --> |modifies| FileSystemMetadata["File System Metadata"]; class T1564004 OffensiveTechniqueNode;
class FileSystemMetadata ArtifactNode; click T1564004 href "/offensive-technique/attack/T1564.004/"; click FileSystemMetadata href "/dao/artifact/d3f:FileSystemMetadata";T1014["Rootkit"] --> |may-modify| Firmware["Firmware"]; class T1014 OffensiveTechniqueNode;
class Firmware ArtifactNode; click T1014 href "/offensive-technique/attack/T1014/"; click Firmware href "/dao/artifact/d3f:Firmware";T1542002["Component Firmware"] --> |modifies| Firmware["Firmware"]; class T1542002 OffensiveTechniqueNode;
class Firmware ArtifactNode; click T1542002 href "/offensive-technique/attack/T1542.002/"; click Firmware href "/dao/artifact/d3f:Firmware";T1049["System Network Connections Discovery"] --> |may-invoke| GetOpenSockets["Get Open Sockets"]; class T1049 OffensiveTechniqueNode;
class GetOpenSockets ArtifactNode; click T1049 href "/offensive-technique/attack/T1049/"; click GetOpenSockets href "/dao/artifact/d3f:GetOpenSockets";T1010["Application Window Discovery"] --> |may-invoke| GetOpenWindows["Get Open Windows"]; class T1010 OffensiveTechniqueNode;
class GetOpenWindows ArtifactNode; click T1010 href "/offensive-technique/attack/T1010/"; click GetOpenWindows href "/dao/artifact/d3f:GetOpenWindows";T1007["System Service Discovery"] --> |may-invoke| GetRunningProcesses["Get Running Processes"]; class T1007 OffensiveTechniqueNode;
class GetRunningProcesses ArtifactNode; click T1007 href "/offensive-technique/attack/T1007/"; click GetRunningProcesses href "/dao/artifact/d3f:GetRunningProcesses";T1057["Process Discovery"] --> |may-invoke| GetRunningProcesses["Get Running Processes"]; class T1057 OffensiveTechniqueNode;
class GetRunningProcesses ArtifactNode; click T1057 href "/offensive-technique/attack/T1057/"; click GetRunningProcesses href "/dao/artifact/d3f:GetRunningProcesses";T1518001["Security Software Discovery"] --> |may-invoke| GetRunningProcesses["Get Running Processes"]; class T1518001 OffensiveTechniqueNode;
class GetRunningProcesses ArtifactNode; click T1518001 href "/offensive-technique/attack/T1518.001/"; click GetRunningProcesses href "/dao/artifact/d3f:GetRunningProcesses";T1113["Screen Capture"] --> |may-invoke| GetScreenCapture["Get Screen Capture"]; class T1113 OffensiveTechniqueNode;
class GetScreenCapture ArtifactNode; click T1113 href "/offensive-technique/attack/T1113/"; click GetScreenCapture href "/dao/artifact/d3f:GetScreenCapture";T1033["System Owner/User Discovery"] --> |may-access| GetSystemConfigValue["Get System Config Value"]; class T1033 OffensiveTechniqueNode;
class GetSystemConfigValue ArtifactNode; click T1033 href "/offensive-technique/attack/T1033/"; click GetSystemConfigValue href "/dao/artifact/d3f:GetSystemConfigValue";T1012["Query Registry"] --> |may-invoke| GetSystemConfigValue["Get System Config Value"]; class T1012 OffensiveTechniqueNode;
class GetSystemConfigValue ArtifactNode; click T1012 href "/offensive-technique/attack/T1012/"; click GetSystemConfigValue href "/dao/artifact/d3f:GetSystemConfigValue";T1016["System Network Configuration Discovery"] --> |may-invoke| GetSystemNetworkConfigValue["Get System Network Config Value"]; class T1016 OffensiveTechniqueNode;
class GetSystemNetworkConfigValue ArtifactNode; click T1016 href "/offensive-technique/attack/T1016/"; click GetSystemNetworkConfigValue href "/dao/artifact/d3f:GetSystemNetworkConfigValue";T1124["System Time Discovery"] --> |may-invoke| GetSystemTime["Get System Time"]; class T1124 OffensiveTechniqueNode;
class GetSystemTime ArtifactNode; click T1124 href "/offensive-technique/attack/T1124/"; click GetSystemTime href "/dao/artifact/d3f:GetSystemTime";T1497003["Time Based Evasion"] --> |may-invoke| GetSystemTime["Get System Time"]; class T1497003 OffensiveTechniqueNode;
class GetSystemTime ArtifactNode; click T1497003 href "/offensive-technique/attack/T1497.003/"; click GetSystemTime href "/dao/artifact/d3f:GetSystemTime";T1098003["Add Office 365 Global Administrator Role"] --> |modifies| GlobalUserAccount["Global User Account"]; class T1098003 OffensiveTechniqueNode;
class GlobalUserAccount ArtifactNode; click T1098003 href "/offensive-technique/attack/T1098.003/"; click GlobalUserAccount href "/dao/artifact/d3f:GlobalUserAccount";T1056002["GUI Input Capture"] --> |accesses| GraphicalUserInterface["Graphical User Interface"]; class T1056002 OffensiveTechniqueNode;
class GraphicalUserInterface ArtifactNode; click T1056002 href "/offensive-technique/attack/T1056.002/"; click GraphicalUserInterface href "/dao/artifact/d3f:GraphicalUserInterface";T1552006["Group Policy Preferences"] --> |accesses| GroupPolicy["Group Policy"]; class T1552006 OffensiveTechniqueNode;
class GroupPolicy ArtifactNode; click T1552006 href "/offensive-technique/attack/T1552.006/"; click GroupPolicy href "/dao/artifact/d3f:GroupPolicy";T1484["Group Policy Modification"] --> |modifies| GroupPolicy["Group Policy"]; class T1484 OffensiveTechniqueNode;
class GroupPolicy ArtifactNode; click T1484 href "/offensive-technique/attack/T1484/"; click GroupPolicy href "/dao/artifact/d3f:GroupPolicy";T1615["Group Policy Discovery"] --> |reads| GroupPolicy["Group Policy"]; class T1615 OffensiveTechniqueNode;
class GroupPolicy ArtifactNode; click T1615 href "/offensive-technique/attack/T1615/"; click GroupPolicy href "/dao/artifact/d3f:GroupPolicy";T1200["Hardware Additions"] --> |connects| HardwareDevice["Hardware Device"]; class T1200 OffensiveTechniqueNode;
class HardwareDevice ArtifactNode; click T1200 href "/offensive-technique/attack/T1200/"; click HardwareDevice href "/dao/artifact/d3f:HardwareDevice";T1195003["Compromise Hardware Supply Chain"] --> |modifies| HardwareDevice["Hardware Device"]; class T1195003 OffensiveTechniqueNode;
class HardwareDevice ArtifactNode; click T1195003 href "/offensive-technique/attack/T1195.003/"; click HardwareDevice href "/dao/artifact/d3f:HardwareDevice";T1555002["Securityd Memory"] --> |accesses| In-memoryPasswordStore["In-memory Password Store"]; class T1555002 OffensiveTechniqueNode;
class In-memoryPasswordStore ArtifactNode; click T1555002 href "/offensive-technique/attack/T1555.002/"; click In-memoryPasswordStore href "/dao/artifact/d3f:In-memoryPasswordStore";T1555003["Credentials from Web Browsers"] --> |may-access| In-memoryPasswordStore["In-memory Password Store"]; class T1555003 OffensiveTechniqueNode;
class In-memoryPasswordStore ArtifactNode; click T1555003 href "/offensive-technique/attack/T1555.003/"; click In-memoryPasswordStore href "/dao/artifact/d3f:In-memoryPasswordStore";T1566001["Spearphishing Attachment"] --> |produces| InboundInternetMailTraffic["Inbound Internet Mail Traffic"]; class T1566001 OffensiveTechniqueNode;
class InboundInternetMailTraffic ArtifactNode; click T1566001 href "/offensive-technique/attack/T1566.001/"; click InboundInternetMailTraffic href "/dao/artifact/d3f:InboundInternetMailTraffic";T1566002["Spearphishing Link"] --> |produces| InboundInternetMailTraffic["Inbound Internet Mail Traffic"]; class T1566002 OffensiveTechniqueNode;
class InboundInternetMailTraffic ArtifactNode; click T1566002 href "/offensive-technique/attack/T1566.002/"; click InboundInternetMailTraffic href "/dao/artifact/d3f:InboundInternetMailTraffic";T1498001["Direct Network Flood"] --> |creates| InboundInternetNetworkTraffic["Inbound Internet Network Traffic"]; class T1498001 OffensiveTechniqueNode;
class InboundInternetNetworkTraffic ArtifactNode; click T1498001 href "/offensive-technique/attack/T1498.001/"; click InboundInternetNetworkTraffic href "/dao/artifact/d3f:InboundInternetNetworkTraffic";T1190["Exploit Public-Facing Application"] --> |produces| InboundInternetNetworkTraffic["Inbound Internet Network Traffic"]; class T1190 OffensiveTechniqueNode;
class InboundInternetNetworkTraffic ArtifactNode; click T1190 href "/offensive-technique/attack/T1190/"; click InboundInternetNetworkTraffic href "/dao/artifact/d3f:InboundInternetNetworkTraffic";T1498002["Reflection Amplification"] --> |produces| InboundInternetNetworkTraffic["Inbound Internet Network Traffic"]; class T1498002 OffensiveTechniqueNode;
class InboundInternetNetworkTraffic ArtifactNode; click T1498002 href "/offensive-technique/attack/T1498.002/"; click InboundInternetNetworkTraffic href "/dao/artifact/d3f:InboundInternetNetworkTraffic";T1499002["Service Exhaustion Flood"] --> |produces| InboundInternetNetworkTraffic["Inbound Internet Network Traffic"]; class T1499002 OffensiveTechniqueNode;
class InboundInternetNetworkTraffic ArtifactNode; click T1499002 href "/offensive-technique/attack/T1499.002/"; click InboundInternetNetworkTraffic href "/dao/artifact/d3f:InboundInternetNetworkTraffic";T1011["Exfiltration Over Other Network Medium"] --> |produces| InternetNetworkTraffic["Internet Network Traffic"]; class T1011 OffensiveTechniqueNode;
class InternetNetworkTraffic ArtifactNode; click T1011 href "/offensive-technique/attack/T1011/"; click InternetNetworkTraffic href "/dao/artifact/d3f:InternetNetworkTraffic";T1020["Automated Exfiltration"] --> |produces| InternetNetworkTraffic["Internet Network Traffic"]; class T1020 OffensiveTechniqueNode;
class InternetNetworkTraffic ArtifactNode; click T1020 href "/offensive-technique/attack/T1020/"; click InternetNetworkTraffic href "/dao/artifact/d3f:InternetNetworkTraffic";T1029["Scheduled Transfer"] --> |produces| InternetNetworkTraffic["Internet Network Traffic"]; class T1029 OffensiveTechniqueNode;
class InternetNetworkTraffic ArtifactNode; click T1029 href "/offensive-technique/attack/T1029/"; click InternetNetworkTraffic href "/dao/artifact/d3f:InternetNetworkTraffic";T1030["Data Transfer Size Limits"] --> |produces| InternetNetworkTraffic["Internet Network Traffic"]; class T1030 OffensiveTechniqueNode;
class InternetNetworkTraffic ArtifactNode; click T1030 href "/offensive-technique/attack/T1030/"; click InternetNetworkTraffic href "/dao/artifact/d3f:InternetNetworkTraffic";T1041["Exfiltration Over C2 Channel"] --> |produces| InternetNetworkTraffic["Internet Network Traffic"]; class T1041 OffensiveTechniqueNode;
class InternetNetworkTraffic ArtifactNode; click T1041 href "/offensive-technique/attack/T1041/"; click InternetNetworkTraffic href "/dao/artifact/d3f:InternetNetworkTraffic";T1048["Exfiltration Over Alternative Protocol"] --> |produces| InternetNetworkTraffic["Internet Network Traffic"]; class T1048 OffensiveTechniqueNode;
class InternetNetworkTraffic ArtifactNode; click T1048 href "/offensive-technique/attack/T1048/"; click InternetNetworkTraffic href "/dao/artifact/d3f:InternetNetworkTraffic";T1559["Inter-Process Communication Execution"] --> |injects| InterprocessCommunication["Interprocess Communication"]; class T1559 OffensiveTechniqueNode;
class InterprocessCommunication ArtifactNode; click T1559 href "/offensive-technique/attack/T1559/"; click InterprocessCommunication href "/dao/artifact/d3f:InterprocessCommunication";T1047["Windows Management Instrumentation Execution"] --> |may-create| IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class T1047 OffensiveTechniqueNode;
class IntranetAdministrativeNetworkTraffic ArtifactNode; click T1047 href "/offensive-technique/attack/T1047/"; click IntranetAdministrativeNetworkTraffic href "/dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";T1110003["Password Spraying"] --> |may-create| IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class T1110003 OffensiveTechniqueNode;
class IntranetAdministrativeNetworkTraffic ArtifactNode; click T1110003 href "/offensive-technique/attack/T1110.003/"; click IntranetAdministrativeNetworkTraffic href "/dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";T1110004["Credential Stuffing"] --> |may-create| IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class T1110004 OffensiveTechniqueNode;
class IntranetAdministrativeNetworkTraffic ArtifactNode; click T1110004 href "/offensive-technique/attack/T1110.004/"; click IntranetAdministrativeNetworkTraffic href "/dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";T1546008["Accessibility Features"] --> |may-create| IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class T1546008 OffensiveTechniqueNode;
class IntranetAdministrativeNetworkTraffic ArtifactNode; click T1546008 href "/offensive-technique/attack/T1546.008/"; click IntranetAdministrativeNetworkTraffic href "/dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";T1207["Rogue Domain Controller"] --> |produces| IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class T1207 OffensiveTechniqueNode;
class IntranetAdministrativeNetworkTraffic ArtifactNode; click T1207 href "/offensive-technique/attack/T1207/"; click IntranetAdministrativeNetworkTraffic href "/dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";T1003006["DCSync"] --> |produces| IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class T1003006 OffensiveTechniqueNode;
class IntranetAdministrativeNetworkTraffic ArtifactNode; click T1003006 href "/offensive-technique/attack/T1003.006/"; click IntranetAdministrativeNetworkTraffic href "/dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";T1098001["Additional Azure Service Principal Credentials"] --> |produces| IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class T1098001 OffensiveTechniqueNode;
class IntranetAdministrativeNetworkTraffic ArtifactNode; click T1098001 href "/offensive-technique/attack/T1098.001/"; click IntranetAdministrativeNetworkTraffic href "/dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";T1546003["Windows Management Instrumentation Event Subscription"] --> |produces| IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class T1546003 OffensiveTechniqueNode;
class IntranetAdministrativeNetworkTraffic ArtifactNode; click T1546003 href "/offensive-technique/attack/T1546.003/"; click IntranetAdministrativeNetworkTraffic href "/dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";T1570["Lateral Tool Transfer"] --> |produces| IntranetFileTransferTraffic["Intranet File Transfer Traffic"]; class T1570 OffensiveTechniqueNode;
class IntranetFileTransferTraffic ArtifactNode; click T1570 href "/offensive-technique/attack/T1570/"; click IntranetFileTransferTraffic href "/dao/artifact/d3f:IntranetFileTransferTraffic";T1197["BITS Jobs"] --> |may-produce| IntranetIPCNetworkTraffic["Intranet IPC Network Traffic"]; class T1197 OffensiveTechniqueNode;
class IntranetIPCNetworkTraffic ArtifactNode; click T1197 href "/offensive-technique/attack/T1197/"; click IntranetIPCNetworkTraffic href "/dao/artifact/d3f:IntranetIPCNetworkTraffic";T1557001["LLMNR/NBT-NS Poisoning and SMB Relay"] --> |produces| IntranetMulticastNetworkTraffic["Intranet Multicast Network Traffic"]; class T1557001 OffensiveTechniqueNode;
class IntranetMulticastNetworkTraffic ArtifactNode; click T1557001 href "/offensive-technique/attack/T1557.001/"; click IntranetMulticastNetworkTraffic href "/dao/artifact/d3f:IntranetMulticastNetworkTraffic";T1021["Remote Services"] --> |produces| IntranetNetworkTraffic["Intranet Network Traffic"]; class T1021 OffensiveTechniqueNode;
class IntranetNetworkTraffic ArtifactNode; click T1021 href "/offensive-technique/attack/T1021/"; click IntranetNetworkTraffic href "/dao/artifact/d3f:IntranetNetworkTraffic";T1199["Trusted Relationship"] --> |produces| IntranetNetworkTraffic["Intranet Network Traffic"]; class T1199 OffensiveTechniqueNode;
class IntranetNetworkTraffic ArtifactNode; click T1199 href "/offensive-technique/attack/T1199/"; click IntranetNetworkTraffic href "/dao/artifact/d3f:IntranetNetworkTraffic";T1210["Exploitation of Remote Services"] --> |produces| IntranetNetworkTraffic["Intranet Network Traffic"]; class T1210 OffensiveTechniqueNode;
class IntranetNetworkTraffic ArtifactNode; click T1210 href "/offensive-technique/attack/T1210/"; click IntranetNetworkTraffic href "/dao/artifact/d3f:IntranetNetworkTraffic";T1090001["Internal Proxy"] --> |produces| IntranetNetworkTraffic["Intranet Network Traffic"]; class T1090001 OffensiveTechniqueNode;
class IntranetNetworkTraffic ArtifactNode; click T1090001 href "/offensive-technique/attack/T1090.001/"; click IntranetNetworkTraffic href "/dao/artifact/d3f:IntranetNetworkTraffic";T1197["BITS Jobs"] --> |may-produce| IntranetWebNetworkTraffic["Intranet Web Network Traffic"]; class T1197 OffensiveTechniqueNode;
class IntranetWebNetworkTraffic ArtifactNode; click T1197 href "/offensive-technique/attack/T1197/"; click IntranetWebNetworkTraffic href "/dao/artifact/d3f:IntranetWebNetworkTraffic";T1027006["HTML Smuggling"] --> |creates| JavaScriptBlob["JavaScript Blob"]; class T1027006 OffensiveTechniqueNode;
class JavaScriptBlob ArtifactNode; click T1027006 href "/offensive-technique/attack/T1027.006/"; click JavaScriptBlob href "/dao/artifact/d3f:JavaScriptBlob";T1053["Scheduled Task/Job Execution"] --> |modifies| JobSchedule["Job Schedule"]; class T1053 OffensiveTechniqueNode;
class JobSchedule ArtifactNode; click T1053 href "/offensive-technique/attack/T1053/"; click JobSchedule href "/dao/artifact/d3f:JobSchedule";T1036004["Masquerade Task or Service"] --> |modifies| JobSchedule["Job Schedule"]; class T1036004 OffensiveTechniqueNode;
class JobSchedule ArtifactNode; click T1036004 href "/offensive-technique/attack/T1036.004/"; click JobSchedule href "/dao/artifact/d3f:JobSchedule";T1558["Steal or Forge Kerberos Tickets"] --> |may-access| KerberosTicket["Kerberos Ticket"]; class T1558 OffensiveTechniqueNode;
class KerberosTicket ArtifactNode; click T1558 href "/offensive-technique/attack/T1558/"; click KerberosTicket href "/dao/artifact/d3f:KerberosTicket";T1558["Steal or Forge Kerberos Tickets"] --> |may-create| KerberosTicket["Kerberos Ticket"]; class T1558 OffensiveTechniqueNode;
class KerberosTicket ArtifactNode; click T1558 href "/offensive-technique/attack/T1558/"; click KerberosTicket href "/dao/artifact/d3f:KerberosTicket";T1558001["Golden Ticket"] --> |forges| KerberosTicketGrantingTicket["Kerberos Ticket Granting Ticket"]; class T1558001 OffensiveTechniqueNode;
class KerberosTicketGrantingTicket ArtifactNode; click T1558001 href "/offensive-technique/attack/T1558.001/"; click KerberosTicketGrantingTicket href "/dao/artifact/d3f:KerberosTicketGrantingTicket";T1014["Rootkit"] --> |may-modify| Kernel["Kernel"]; class T1014 OffensiveTechniqueNode;
class Kernel ArtifactNode; click T1014 href "/offensive-technique/attack/T1014/"; click Kernel href "/dao/artifact/d3f:Kernel";T1014["Rootkit"] --> |may-modify| KernelModule["Kernel Module"]; class T1014 OffensiveTechniqueNode;
class KernelModule ArtifactNode; click T1014 href "/offensive-technique/attack/T1014/"; click KernelModule href "/dao/artifact/d3f:KernelModule";T1547006["Kernel Modules and Extensions"] --> |modifies| KernelModule["Kernel Module"]; class T1547006 OffensiveTechniqueNode;
class KernelModule ArtifactNode; click T1547006 href "/offensive-technique/attack/T1547.006/"; click KernelModule href "/dao/artifact/d3f:KernelModule";T1518001["Security Software Discovery"] --> |may-access| KernelProcessTable["Kernel Process Table"]; class T1518001 OffensiveTechniqueNode;
class KernelProcessTable ArtifactNode; click T1518001 href "/offensive-technique/attack/T1518.001/"; click KernelProcessTable href "/dao/artifact/d3f:KernelProcessTable";T1056001["Keylogging"] --> |accesses| KeyboardInputDevice["Keyboard Input Device"]; class T1056001 OffensiveTechniqueNode;
class KeyboardInputDevice ArtifactNode; click T1056001 href "/offensive-technique/attack/T1056.001/"; click KeyboardInputDevice href "/dao/artifact/d3f:KeyboardInputDevice";T1562010["Downgrade Attack"] --> |accesses| LegacySystem["Legacy System"]; class T1562010 OffensiveTechniqueNode;
class LegacySystem ArtifactNode; click T1562010 href "/offensive-technique/attack/T1562.010/"; click LegacySystem href "/dao/artifact/d3f:LegacySystem";T1005["Data from Local System"] --> |accesses| LocalResource["Local Resource"]; class T1005 OffensiveTechniqueNode;
class LocalResource ArtifactNode; click T1005 href "/offensive-technique/attack/T1005/"; click LocalResource href "/dao/artifact/d3f:LocalResource";T1087001["Local Account"] --> |creates| LocalUserAccount["Local User Account"]; class T1087001 OffensiveTechniqueNode;
class LocalUserAccount ArtifactNode; click T1087001 href "/offensive-technique/attack/T1087.001/"; click LocalUserAccount href "/dao/artifact/d3f:LocalUserAccount";T1078003["Local Accounts"] --> |uses| LocalUserAccount["Local User Account"]; class T1078003 OffensiveTechniqueNode;
class LocalUserAccount ArtifactNode; click T1078003 href "/offensive-technique/attack/T1078.003/"; click LocalUserAccount href "/dao/artifact/d3f:LocalUserAccount";T1003005["Cached Domain Credentials"] --> |may-modify| Log["Log"]; class T1003005 OffensiveTechniqueNode;
class Log ArtifactNode; click T1003005 href "/offensive-technique/attack/T1003.005/"; click Log href "/dao/artifact/d3f:Log";T1199["Trusted Relationship"] --> |creates| LoginSession["Login Session"]; class T1199 OffensiveTechniqueNode;
class LoginSession ArtifactNode; click T1199 href "/offensive-technique/attack/T1199/"; click LoginSession href "/dao/artifact/d3f:LoginSession";T1134003["Make and Impersonate Token"] --> |creates| LoginSession["Login Session"]; class T1134003 OffensiveTechniqueNode;
class LoginSession ArtifactNode; click T1134003 href "/offensive-technique/attack/T1134.003/"; click LoginSession href "/dao/artifact/d3f:LoginSession";T1555001["Keychain"] --> |accesses| MacOSKeychain["MacOS Keychain"]; class T1555001 OffensiveTechniqueNode;
class MacOSKeychain ArtifactNode; click T1555001 href "/offensive-technique/attack/T1555.001/"; click MacOSKeychain href "/dao/artifact/d3f:MacOSKeychain";T1114002["Remote Email Collection"] --> |accesses| MailServer["Mail Server"]; class T1114002 OffensiveTechniqueNode;
class MailServer ArtifactNode; click T1114002 href "/offensive-technique/attack/T1114.002/"; click MailServer href "/dao/artifact/d3f:MailServer";T1505002["Transport Agent"] --> |modifies| MailServer["Mail Server"]; class T1505002 OffensiveTechniqueNode;
class MailServer ArtifactNode; click T1505002 href "/offensive-technique/attack/T1505.002/"; click MailServer href "/dao/artifact/d3f:MailServer";T1505002["Transport Agent"] --> |adds| MessageTransferAgent["Message Transfer Agent"]; class T1505002 OffensiveTechniqueNode;
class MessageTransferAgent ArtifactNode; click T1505002 href "/offensive-technique/attack/T1505.002/"; click MessageTransferAgent href "/dao/artifact/d3f:MessageTransferAgent";T1218005["Mshta Execution"] --> |interprets| MicrosoftHTMLApplication["Microsoft HTML Application"]; class T1218005 OffensiveTechniqueNode;
class MicrosoftHTMLApplication ArtifactNode; click T1218005 href "/offensive-technique/attack/T1218.005/"; click MicrosoftHTMLApplication href "/dao/artifact/d3f:MicrosoftHTMLApplication";T1036005["Match Legitimate Name or Location"] --> |invokes| MoveFile["Move File"]; class T1036005 OffensiveTechniqueNode;
class MoveFile ArtifactNode; click T1036005 href "/offensive-technique/attack/T1036.005/"; click MoveFile href "/dao/artifact/d3f:MoveFile";T1039["Data from Network Shared Drive"] --> |accesses| NetworkFileShareResource["Network File Share Resource"]; class T1039 OffensiveTechniqueNode;
class NetworkFileShareResource ArtifactNode; click T1039 href "/offensive-technique/attack/T1039/"; click NetworkFileShareResource href "/dao/artifact/d3f:NetworkFileShareResource";T1070005["Network Share Connection Removal"] --> |unmounts| NetworkFileShareResource["Network File Share Resource"]; class T1070005 OffensiveTechniqueNode;
class NetworkFileShareResource ArtifactNode; click T1070005 href "/offensive-technique/attack/T1070.005/"; click NetworkFileShareResource href "/dao/artifact/d3f:NetworkFileShareResource";T1037003["Network Logon Script"] --> |modifies| NetworkInitScriptFileResource["Network Init Script File Resource"]; class T1037003 OffensiveTechniqueNode;
class NetworkInitScriptFileResource ArtifactNode; click T1037003 href "/offensive-technique/attack/T1037.003/"; click NetworkInitScriptFileResource href "/dao/artifact/d3f:NetworkInitScriptFileResource";T1080["Taint Shared Content"] --> |modifies| NetworkResource["Network Resource"]; class T1080 OffensiveTechniqueNode;
class NetworkResource ArtifactNode; click T1080 href "/offensive-technique/attack/T1080/"; click NetworkResource href "/dao/artifact/d3f:NetworkResource";T1074002["Remote Data Staging"] --> |modifies| NetworkResource["Network Resource"]; class T1074002 OffensiveTechniqueNode;
class NetworkResource ArtifactNode; click T1074002 href "/offensive-technique/attack/T1074.002/"; click NetworkResource href "/dao/artifact/d3f:NetworkResource";T1491002["External Defacement"] --> |modifies| NetworkResource["Network Resource"]; class T1491002 OffensiveTechniqueNode;
class NetworkResource ArtifactNode; click T1491002 href "/offensive-technique/attack/T1491.002/"; click NetworkResource href "/dao/artifact/d3f:NetworkResource";T1133["External Remote Services"] --> |produces| NetworkSession["Network Session"]; class T1133 OffensiveTechniqueNode;
class NetworkSession ArtifactNode; click T1133 href "/offensive-technique/attack/T1133/"; click NetworkSession href "/dao/artifact/d3f:NetworkSession";T1565002["Transmitted Data Manipulation"] --> |may-modify| NetworkTraffic["Network Traffic"]; class T1565002 OffensiveTechniqueNode;
class NetworkTraffic ArtifactNode; click T1565002 href "/offensive-technique/attack/T1565.002/"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";T1218003["CMSTP"] --> |may-produce| NetworkTraffic["Network Traffic"]; class T1218003 OffensiveTechniqueNode;
class NetworkTraffic ArtifactNode; click T1218003 href "/offensive-technique/attack/T1218.003/"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";T1550001["Application Access Token"] --> |may-produce| NetworkTraffic["Network Traffic"]; class T1550001 OffensiveTechniqueNode;
class NetworkTraffic ArtifactNode; click T1550001 href "/offensive-technique/attack/T1550.001/"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";T1018["Remote System Discovery"] --> |produces| NetworkTraffic["Network Traffic"]; class T1018 OffensiveTechniqueNode;
class NetworkTraffic ArtifactNode; click T1018 href "/offensive-technique/attack/T1018/"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";T1205["Traffic Signaling"] --> |produces| NetworkTraffic["Network Traffic"]; class T1205 OffensiveTechniqueNode;
class NetworkTraffic ArtifactNode; click T1205 href "/offensive-technique/attack/T1205/"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";T1557["Man-in-the-Middle"] --> |produces| NetworkTraffic["Network Traffic"]; class T1557 OffensiveTechniqueNode;
class NetworkTraffic ArtifactNode; click T1557 href "/offensive-technique/attack/T1557/"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";T1205001["Port Knocking"] --> |produces| NetworkTraffic["Network Traffic"]; class T1205001 OffensiveTechniqueNode;
class NetworkTraffic ArtifactNode; click T1205001 href "/offensive-technique/attack/T1205.001/"; click NetworkTraffic href "/dao/artifact/d3f:NetworkTraffic";T1055002["Portable Executable Injection"] --> |may-add| ObjectFile["Object File"]; class T1055002 OffensiveTechniqueNode;
class ObjectFile ArtifactNode; click T1055002 href "/offensive-technique/attack/T1055.002/"; click ObjectFile href "/dao/artifact/d3f:ObjectFile";T1137006["Add-ins"] --> |modifies| OfficeApplication["Office Application"]; class T1137006 OffensiveTechniqueNode;
class OfficeApplication ArtifactNode; click T1137006 href "/offensive-technique/attack/T1137.006/"; click OfficeApplication href "/dao/artifact/d3f:OfficeApplication";T1137003["Outlook Forms"] --> |adds| OfficeApplicationFile["Office Application File"]; class T1137003 OffensiveTechniqueNode;
class OfficeApplicationFile ArtifactNode; click T1137003 href "/offensive-technique/attack/T1137.003/"; click OfficeApplicationFile href "/dao/artifact/d3f:OfficeApplicationFile";T1564007["VBA Stomping"] --> |modifies| OfficeApplicationFile["Office Application File"]; class T1564007 OffensiveTechniqueNode;
class OfficeApplicationFile ArtifactNode; click T1564007 href "/offensive-technique/attack/T1564.007/"; click OfficeApplicationFile href "/dao/artifact/d3f:OfficeApplicationFile";T1562002["Disable Windows Event Logging"] --> |may-modify| OperatingSystemConfigurationComponent["Operating System Configuration Component"]; class T1562002 OffensiveTechniqueNode;
class OperatingSystemConfigurationComponent ArtifactNode; click T1562002 href "/offensive-technique/attack/T1562.002/"; click OperatingSystemConfigurationComponent href "/dao/artifact/d3f:OperatingSystemConfigurationComponent";T1018["Remote System Discovery"] --> |may-access| OperatingSystemConfigurationFile["Operating System Configuration File"]; class T1018 OffensiveTechniqueNode;
class OperatingSystemConfigurationFile ArtifactNode; click T1018 href "/offensive-technique/attack/T1018/"; click OperatingSystemConfigurationFile href "/dao/artifact/d3f:OperatingSystemConfigurationFile";T1543002["Systemd Service"] --> |may-create| OperatingSystemConfigurationFile["Operating System Configuration File"]; class T1543002 OffensiveTechniqueNode;
class OperatingSystemConfigurationFile ArtifactNode; click T1543002 href "/offensive-technique/attack/T1543.002/"; click OperatingSystemConfigurationFile href "/dao/artifact/d3f:OperatingSystemConfigurationFile";T1543002["Systemd Service"] --> |may-modify| OperatingSystemConfigurationFile["Operating System Configuration File"]; class T1543002 OffensiveTechniqueNode;
class OperatingSystemConfigurationFile ArtifactNode; click T1543002 href "/offensive-technique/attack/T1543.002/"; click OperatingSystemConfigurationFile href "/dao/artifact/d3f:OperatingSystemConfigurationFile";T1556003["Pluggable Authentication Modules"] --> |may-modify| OperatingSystemConfigurationFile["Operating System Configuration File"]; class T1556003 OffensiveTechniqueNode;
class OperatingSystemConfigurationFile ArtifactNode; click T1556003 href "/offensive-technique/attack/T1556.003/"; click OperatingSystemConfigurationFile href "/dao/artifact/d3f:OperatingSystemConfigurationFile";T1548003["Sudo and Sudo Caching"] --> |modifies| OperatingSystemConfigurationFile["Operating System Configuration File"]; class T1548003 OffensiveTechniqueNode;
class OperatingSystemConfigurationFile ArtifactNode; click T1548003 href "/offensive-technique/attack/T1548.003/"; click OperatingSystemConfigurationFile href "/dao/artifact/d3f:OperatingSystemConfigurationFile";T1574006["LD_PRELOAD"] --> |modifies| OperatingSystemConfigurationFile["Operating System Configuration File"]; class T1574006 OffensiveTechniqueNode;
class OperatingSystemConfigurationFile ArtifactNode; click T1574006 href "/offensive-technique/attack/T1574.006/"; click OperatingSystemConfigurationFile href "/dao/artifact/d3f:OperatingSystemConfigurationFile";T1036003["Rename System Utilities"] --> |may-modify| OperatingSystemExecutableFile["Operating System Executable File"]; class T1036003 OffensiveTechniqueNode;
class OperatingSystemExecutableFile ArtifactNode; click T1036003 href "/offensive-technique/attack/T1036.003/"; click OperatingSystemExecutableFile href "/dao/artifact/d3f:OperatingSystemExecutableFile";T1003007["Proc Filesystem"] --> |accesses| OperatingSystemFile["Operating System File"]; class T1003007 OffensiveTechniqueNode;
class OperatingSystemFile ArtifactNode; click T1003007 href "/offensive-technique/attack/T1003.007/"; click OperatingSystemFile href "/dao/artifact/d3f:OperatingSystemFile";T1055009["Proc Memory"] --> |accesses| OperatingSystemFile["Operating System File"]; class T1055009 OffensiveTechniqueNode;
class OperatingSystemFile ArtifactNode; click T1055009 href "/offensive-technique/attack/T1055.009/"; click OperatingSystemFile href "/dao/artifact/d3f:OperatingSystemFile";T1055009["Proc Memory"] --> |may-modify| OperatingSystemFile["Operating System File"]; class T1055009 OffensiveTechniqueNode;
class OperatingSystemFile ArtifactNode; click T1055009 href "/offensive-technique/attack/T1055.009/"; click OperatingSystemFile href "/dao/artifact/d3f:OperatingSystemFile";T1070002["Clear Linux or Mac System Logs"] --> |modifies| OperatingSystemLogFile["Operating System Log File"]; class T1070002 OffensiveTechniqueNode;
class OperatingSystemLogFile ArtifactNode; click T1070002 href "/offensive-technique/attack/T1070.002/"; click OperatingSystemLogFile href "/dao/artifact/d3f:OperatingSystemLogFile";T1562001["Disable or Modify Tools"] --> |disables| OperatingSystemProcess["Operating System Process"]; class T1562001 OffensiveTechniqueNode;
class OperatingSystemProcess ArtifactNode; click T1562001 href "/offensive-technique/attack/T1562.001/"; click OperatingSystemProcess href "/dao/artifact/d3f:OperatingSystemProcess";T1556003["Pluggable Authentication Modules"] --> |may-modify| OperatingSystemSharedLibraryFile["Operating System Shared Library File"]; class T1556003 OffensiveTechniqueNode;
class OperatingSystemSharedLibraryFile ArtifactNode; click T1556003 href "/offensive-technique/attack/T1556.003/"; click OperatingSystemSharedLibraryFile href "/dao/artifact/d3f:OperatingSystemSharedLibraryFile";T1568["Dynamic Resolution"] --> |produces| OutboundInternetDNSLookupTraffic["Outbound Internet DNS Lookup Traffic"]; class T1568 OffensiveTechniqueNode;
class OutboundInternetDNSLookupTraffic ArtifactNode; click T1568 href "/offensive-technique/attack/T1568/"; click OutboundInternetDNSLookupTraffic href "/dao/artifact/d3f:OutboundInternetDNSLookupTraffic";T1071004["DNS"] --> |produces| OutboundInternetDNSLookupTraffic["Outbound Internet DNS Lookup Traffic"]; class T1071004 OffensiveTechniqueNode;
class OutboundInternetDNSLookupTraffic ArtifactNode; click T1071004 href "/offensive-technique/attack/T1071.004/"; click OutboundInternetDNSLookupTraffic href "/dao/artifact/d3f:OutboundInternetDNSLookupTraffic";T1567001["Exfiltration to Code Repository"] --> |may-produce| OutboundInternetEncryptedRemoteTerminalTraffic["Outbound Internet Encrypted Remote Terminal Traffic"]; class T1567001 OffensiveTechniqueNode;
class OutboundInternetEncryptedRemoteTerminalTraffic ArtifactNode; click T1567001 href "/offensive-technique/attack/T1567.001/"; click OutboundInternetEncryptedRemoteTerminalTraffic href "/dao/artifact/d3f:OutboundInternetEncryptedRemoteTerminalTraffic";T1573001["Symmetric Cryptography"] --> |creates| OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"]; class T1573001 OffensiveTechniqueNode;
class OutboundInternetEncryptedTraffic ArtifactNode; click T1573001 href "/offensive-technique/attack/T1573.001/"; click OutboundInternetEncryptedTraffic href "/dao/artifact/d3f:OutboundInternetEncryptedTraffic";T1573002["Asymmetric Cryptography"] --> |creates| OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"]; class T1573002 OffensiveTechniqueNode;
class OutboundInternetEncryptedTraffic ArtifactNode; click T1573002 href "/offensive-technique/attack/T1573.002/"; click OutboundInternetEncryptedTraffic href "/dao/artifact/d3f:OutboundInternetEncryptedTraffic";T1573["Encrypted Channel"] --> |produces| OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"]; class T1573 OffensiveTechniqueNode;
class OutboundInternetEncryptedTraffic ArtifactNode; click T1573 href "/offensive-technique/attack/T1573/"; click OutboundInternetEncryptedTraffic href "/dao/artifact/d3f:OutboundInternetEncryptedTraffic";T1048001["Exfiltration Over Symmetric Encrypted Non-C2 Protocol"] --> |produces| OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"]; class T1048001 OffensiveTechniqueNode;
class OutboundInternetEncryptedTraffic ArtifactNode; click T1048001 href "/offensive-technique/attack/T1048.001/"; click OutboundInternetEncryptedTraffic href "/dao/artifact/d3f:OutboundInternetEncryptedTraffic";T1048002["Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"] --> |produces| OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"]; class T1048002 OffensiveTechniqueNode;
class OutboundInternetEncryptedTraffic ArtifactNode; click T1048002 href "/offensive-technique/attack/T1048.002/"; click OutboundInternetEncryptedTraffic href "/dao/artifact/d3f:OutboundInternetEncryptedTraffic";T1567001["Exfiltration to Code Repository"] --> |may-produce| OutboundInternetEncryptedWebTraffic["Outbound Internet Encrypted Web Traffic"]; class T1567001 OffensiveTechniqueNode;
class OutboundInternetEncryptedWebTraffic ArtifactNode; click T1567001 href "/offensive-technique/attack/T1567.001/"; click OutboundInternetEncryptedWebTraffic href "/dao/artifact/d3f:OutboundInternetEncryptedWebTraffic";T1090004["Domain Fronting"] --> |produces| OutboundInternetEncryptedWebTraffic["Outbound Internet Encrypted Web Traffic"]; class T1090004 OffensiveTechniqueNode;
class OutboundInternetEncryptedWebTraffic ArtifactNode; click T1090004 href "/offensive-technique/attack/T1090.004/"; click OutboundInternetEncryptedWebTraffic href "/dao/artifact/d3f:OutboundInternetEncryptedWebTraffic";T1567002["Exfiltration to Cloud Storage"] --> |produces| OutboundInternetEncryptedWebTraffic["Outbound Internet Encrypted Web Traffic"]; class T1567002 OffensiveTechniqueNode;
class OutboundInternetEncryptedWebTraffic ArtifactNode; click T1567002 href "/offensive-technique/attack/T1567.002/"; click OutboundInternetEncryptedWebTraffic href "/dao/artifact/d3f:OutboundInternetEncryptedWebTraffic";T1071002["File Transfer Protocols"] --> |produces| OutboundInternetFileTransferTraffic["Outbound Internet File Transfer Traffic"]; class T1071002 OffensiveTechniqueNode;
class OutboundInternetFileTransferTraffic ArtifactNode; click T1071002 href "/offensive-technique/attack/T1071.002/"; click OutboundInternetFileTransferTraffic href "/dao/artifact/d3f:OutboundInternetFileTransferTraffic";T1071003["Mail Protocols"] --> |produces| OutboundInternetMailTraffic["Outbound Internet Mail Traffic"]; class T1071003 OffensiveTechniqueNode;
class OutboundInternetMailTraffic ArtifactNode; click T1071003 href "/offensive-technique/attack/T1071.003/"; click OutboundInternetMailTraffic href "/dao/artifact/d3f:OutboundInternetMailTraffic";T1001["Data Obfuscation"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1001 OffensiveTechniqueNode;
class OutboundInternetNetworkTraffic ArtifactNode; click T1001 href "/offensive-technique/attack/T1001/"; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic";T1008["Fallback Channels"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1008 OffensiveTechniqueNode;
class OutboundInternetNetworkTraffic ArtifactNode; click T1008 href "/offensive-technique/attack/T1008/"; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic";T1189["Drive-by Compromise"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1189 OffensiveTechniqueNode;
class OutboundInternetNetworkTraffic ArtifactNode; click T1189 href "/offensive-technique/attack/T1189/"; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic";T1071["Application Layer Protocol"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1071 OffensiveTechniqueNode;
class OutboundInternetNetworkTraffic ArtifactNode; click T1071 href "/offensive-technique/attack/T1071/"; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic";T1095["Non-Application Layer Protocol"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1095 OffensiveTechniqueNode;
class OutboundInternetNetworkTraffic ArtifactNode; click T1095 href "/offensive-technique/attack/T1095/"; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic";T1104["Multi-Stage Channels"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1104 OffensiveTechniqueNode;
class OutboundInternetNetworkTraffic ArtifactNode; click T1104 href "/offensive-technique/attack/T1104/"; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic";T1105["Ingress Tool Transfer"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1105 OffensiveTechniqueNode;
class OutboundInternetNetworkTraffic ArtifactNode; click T1105 href "/offensive-technique/attack/T1105/"; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic";T1132["Data Encoding"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1132 OffensiveTechniqueNode;
class OutboundInternetNetworkTraffic ArtifactNode; click T1132 href "/offensive-technique/attack/T1132/"; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic";T1219["Remote Access Software"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1219 OffensiveTechniqueNode;
class OutboundInternetNetworkTraffic ArtifactNode; click T1219 href "/offensive-technique/attack/T1219/"; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic";T1571["Non-Standard Port"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1571 OffensiveTechniqueNode;
class OutboundInternetNetworkTraffic ArtifactNode; click T1571 href "/offensive-technique/attack/T1571/"; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic";T1572["Protocol Tunneling"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1572 OffensiveTechniqueNode;
class OutboundInternetNetworkTraffic ArtifactNode; click T1572 href "/offensive-technique/attack/T1572/"; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic";T1048003["Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1048003 OffensiveTechniqueNode;
class OutboundInternetNetworkTraffic ArtifactNode; click T1048003 href "/offensive-technique/attack/T1048.003/"; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic";T1090002["External Proxy"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1090002 OffensiveTechniqueNode;
class OutboundInternetNetworkTraffic ArtifactNode; click T1090002 href "/offensive-technique/attack/T1090.002/"; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic";T1090003["Multi-hop Proxy"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1090003 OffensiveTechniqueNode;
class OutboundInternetNetworkTraffic ArtifactNode; click T1090003 href "/offensive-technique/attack/T1090.003/"; click OutboundInternetNetworkTraffic href "/dao/artifact/d3f:OutboundInternetNetworkTraffic";T1197["BITS Jobs"] --> |may-produce| OutboundInternetWebTraffic["Outbound Internet Web Traffic"]; class T1197 OffensiveTechniqueNode;
class OutboundInternetWebTraffic ArtifactNode; click T1197 href "/offensive-technique/attack/T1197/"; click OutboundInternetWebTraffic href "/dao/artifact/d3f:OutboundInternetWebTraffic";T1102["Web Service"] --> |produces| OutboundInternetWebTraffic["Outbound Internet Web Traffic"]; class T1102 OffensiveTechniqueNode;
class OutboundInternetWebTraffic ArtifactNode; click T1102 href "/offensive-technique/attack/T1102/"; click OutboundInternetWebTraffic href "/dao/artifact/d3f:OutboundInternetWebTraffic";T1567["Exfiltration Over Web Service"] --> |produces| OutboundInternetWebTraffic["Outbound Internet Web Traffic"]; class T1567 OffensiveTechniqueNode;
class OutboundInternetWebTraffic ArtifactNode; click T1567 href "/offensive-technique/attack/T1567/"; click OutboundInternetWebTraffic href "/dao/artifact/d3f:OutboundInternetWebTraffic";T1071001["Web Protocols"] --> |produces| OutboundInternetWebTraffic["Outbound Internet Web Traffic"]; class T1071001 OffensiveTechniqueNode;
class OutboundInternetWebTraffic ArtifactNode; click T1071001 href "/offensive-technique/attack/T1071.001/"; click OutboundInternetWebTraffic href "/dao/artifact/d3f:OutboundInternetWebTraffic";T1204001["Malicious Link Execution"] --> |produces| OutboundInternetWebTraffic["Outbound Internet Web Traffic"]; class T1204001 OffensiveTechniqueNode;
class OutboundInternetWebTraffic ArtifactNode; click T1204001 href "/offensive-technique/attack/T1204.001/"; click OutboundInternetWebTraffic href "/dao/artifact/d3f:OutboundInternetWebTraffic";T1561001["Disk Content Wipe"] --> |may-modify| Partition["Partition"]; class T1561001 OffensiveTechniqueNode;
class Partition ArtifactNode; click T1561001 href "/offensive-technique/attack/T1561.001/"; click Partition href "/dao/artifact/d3f:Partition";T1561001["Disk Content Wipe"] --> |may-modify| PartitionTable["Partition Table"]; class T1561001 OffensiveTechniqueNode;
class PartitionTable ArtifactNode; click T1561001 href "/offensive-technique/attack/T1561.001/"; click PartitionTable href "/dao/artifact/d3f:PartitionTable";T1561002["Disk Structure Wipe"] --> |may-modify| PartitionTable["Partition Table"]; class T1561002 OffensiveTechniqueNode;
class PartitionTable ArtifactNode; click T1561002 href "/offensive-technique/attack/T1561.002/"; click PartitionTable href "/dao/artifact/d3f:PartitionTable";T1110001["Password Guessing"] --> |accesses| Password["Password"]; class T1110001 OffensiveTechniqueNode;
class Password ArtifactNode; click T1110001 href "/offensive-technique/attack/T1110.001/"; click Password href "/dao/artifact/d3f:Password";T1110002["Password Cracking"] --> |accesses| Password["Password"]; class T1110002 OffensiveTechniqueNode;
class Password ArtifactNode; click T1110002 href "/offensive-technique/attack/T1110.002/"; click Password href "/dao/artifact/d3f:Password";T1110003["Password Spraying"] --> |accesses| Password["Password"]; class T1110003 OffensiveTechniqueNode;
class Password ArtifactNode; click T1110003 href "/offensive-technique/attack/T1110.003/"; click Password href "/dao/artifact/d3f:Password";T1003008["/etc/passwd and /etc/shadow"] --> |accesses| PasswordFile["Password File"]; class T1003008 OffensiveTechniqueNode;
class PasswordFile ArtifactNode; click T1003008 href "/offensive-technique/attack/T1003.008/"; click PasswordFile href "/dao/artifact/d3f:PasswordFile";T1033["System Owner/User Discovery"] --> |may-access| PasswordFile["Password File"]; class T1033 OffensiveTechniqueNode;
class PasswordFile ArtifactNode; click T1033 href "/offensive-technique/attack/T1033/"; click PasswordFile href "/dao/artifact/d3f:PasswordFile";T1555["Credentials from Password Stores"] --> |accesses| PasswordStore["Password Store"]; class T1555 OffensiveTechniqueNode;
class PasswordStore ArtifactNode; click T1555 href "/offensive-technique/attack/T1555/"; click PasswordStore href "/dao/artifact/d3f:PasswordStore";T1546013["PowerShell Profile"] --> |modifies| PowerShellProfileScript["PowerShell Profile Script"]; class T1546013 OffensiveTechniqueNode;
class PowerShellProfileScript ArtifactNode; click T1546013 href "/offensive-technique/attack/T1546.013/"; click PowerShellProfileScript href "/dao/artifact/d3f:PowerShellProfileScript";T1552004["Private Keys"] --> |accesses| PrivateKey["Private Key"]; class T1552004 OffensiveTechniqueNode;
class PrivateKey ArtifactNode; click T1552004 href "/offensive-technique/attack/T1552.004/"; click PrivateKey href "/dao/artifact/d3f:PrivateKey";T1003001["LSASS Memory"] --> |accesses| Process["Process"]; class T1003001 OffensiveTechniqueNode;
class Process ArtifactNode; click T1003001 href "/offensive-technique/attack/T1003.001/"; click Process href "/dao/artifact/d3f:Process";T1003002["Security Account Manager"] --> |may-access| Process["Process"]; class T1003002 OffensiveTechniqueNode;
class Process ArtifactNode; click T1003002 href "/offensive-technique/attack/T1003.002/"; click Process href "/dao/artifact/d3f:Process";T1003004["LSA Secrets"] --> |may-access| Process["Process"]; class T1003004 OffensiveTechniqueNode;
class Process ArtifactNode; click T1003004 href "/offensive-technique/attack/T1003.004/"; click Process href "/dao/artifact/d3f:Process";T1546007["Netsh Helper DLL"] --> |produces| Process["Process"]; class T1546007 OffensiveTechniqueNode;
class Process ArtifactNode; click T1546007 href "/offensive-technique/attack/T1546.007/"; click Process href "/dao/artifact/d3f:Process";T1505003["Web Shell"] --> |produces| Process["Process"]; class T1505003 OffensiveTechniqueNode;
class Process ArtifactNode; click T1505003 href "/offensive-technique/attack/T1505.003/"; click Process href "/dao/artifact/d3f:Process";T1210["Exploitation of Remote Services"] --> |may-modify| ProcessCodeSegment["Process Code Segment"]; class T1210 OffensiveTechniqueNode;
class ProcessCodeSegment ArtifactNode; click T1210 href "/offensive-technique/attack/T1210/"; click ProcessCodeSegment href "/dao/artifact/d3f:ProcessCodeSegment";T1211["Exploitation for Defense Evasion"] --> |may-modify| ProcessCodeSegment["Process Code Segment"]; class T1211 OffensiveTechniqueNode;
class ProcessCodeSegment ArtifactNode; click T1211 href "/offensive-technique/attack/T1211/"; click ProcessCodeSegment href "/dao/artifact/d3f:ProcessCodeSegment";T1212["Exploitation for Credential Access"] --> |may-modify| ProcessCodeSegment["Process Code Segment"]; class T1212 OffensiveTechniqueNode;
class ProcessCodeSegment ArtifactNode; click T1212 href "/offensive-technique/attack/T1212/"; click ProcessCodeSegment href "/dao/artifact/d3f:ProcessCodeSegment";T1056004["Credential API Hooking"] --> |may-modify| ProcessCodeSegment["Process Code Segment"]; class T1056004 OffensiveTechniqueNode;
class ProcessCodeSegment ArtifactNode; click T1056004 href "/offensive-technique/attack/T1056.004/"; click ProcessCodeSegment href "/dao/artifact/d3f:ProcessCodeSegment";T1068["Exploitation for Privilege Escalation"] --> |modifies| ProcessCodeSegment["Process Code Segment"]; class T1068 OffensiveTechniqueNode;
class ProcessCodeSegment ArtifactNode; click T1068 href "/offensive-technique/attack/T1068/"; click ProcessCodeSegment href "/dao/artifact/d3f:ProcessCodeSegment";T1203["Exploitation for Client Execution"] --> |modifies| ProcessCodeSegment["Process Code Segment"]; class T1203 OffensiveTechniqueNode;
class ProcessCodeSegment ArtifactNode; click T1203 href "/offensive-technique/attack/T1203/"; click ProcessCodeSegment href "/dao/artifact/d3f:ProcessCodeSegment";T1055012["Process Hollowing"] --> |modifies| ProcessCodeSegment["Process Code Segment"]; class T1055012 OffensiveTechniqueNode;
class ProcessCodeSegment ArtifactNode; click T1055012 href "/offensive-technique/attack/T1055.012/"; click ProcessCodeSegment href "/dao/artifact/d3f:ProcessCodeSegment";T1562003["Impair Command History Logging"] --> |modifies| ProcessEnvironmentVariable["Process Environment Variable"]; class T1562003 OffensiveTechniqueNode;
class ProcessEnvironmentVariable ArtifactNode; click T1562003 href "/offensive-technique/attack/T1562.003/"; click ProcessEnvironmentVariable href "/dao/artifact/d3f:ProcessEnvironmentVariable";T1003007["Proc Filesystem"] --> |accesses| ProcessImage["Process Image"]; class T1003007 OffensiveTechniqueNode;
class ProcessImage ArtifactNode; click T1003007 href "/offensive-technique/attack/T1003.007/"; click ProcessImage href "/dao/artifact/d3f:ProcessImage";T1033["System Owner/User Discovery"] --> |may-access| ProcessSegment["Process Segment"]; class T1033 OffensiveTechniqueNode;
class ProcessSegment ArtifactNode; click T1033 href "/offensive-technique/attack/T1033/"; click ProcessSegment href "/dao/artifact/d3f:ProcessSegment";T1210["Exploitation of Remote Services"] --> |may-modify| ProcessSegment["Process Segment"]; class T1210 OffensiveTechniqueNode;
class ProcessSegment ArtifactNode; click T1210 href "/offensive-technique/attack/T1210/"; click ProcessSegment href "/dao/artifact/d3f:ProcessSegment";T1189["Drive-by Compromise"] --> |modifies| ProcessSegment["Process Segment"]; class T1189 OffensiveTechniqueNode;
class ProcessSegment ArtifactNode; click T1189 href "/offensive-technique/attack/T1189/"; click ProcessSegment href "/dao/artifact/d3f:ProcessSegment";T1190["Exploit Public-Facing Application"] --> |modifies| ProcessSegment["Process Segment"]; class T1190 OffensiveTechniqueNode;
class ProcessSegment ArtifactNode; click T1190 href "/offensive-technique/attack/T1190/"; click ProcessSegment href "/dao/artifact/d3f:ProcessSegment";T1620["Reflective Code Loading"] --> |modifies| ProcessSegment["Process Segment"]; class T1620 OffensiveTechniqueNode;
class ProcessSegment ArtifactNode; click T1620 href "/offensive-technique/attack/T1620/"; click ProcessSegment href "/dao/artifact/d3f:ProcessSegment";T1218013["Mavinject"] --> |modifies| ProcessSegment["Process Segment"]; class T1218013 OffensiveTechniqueNode;
class ProcessSegment ArtifactNode; click T1218013 href "/offensive-technique/attack/T1218.013/"; click ProcessSegment href "/dao/artifact/d3f:ProcessSegment";T1053004["Launchd"] --> |creates| PropertyListFile["Property List File"]; class T1053004 OffensiveTechniqueNode;
class PropertyListFile ArtifactNode; click T1053004 href "/offensive-technique/attack/T1053.004/"; click PropertyListFile href "/dao/artifact/d3f:PropertyListFile";T1543001["Launch Agent"] --> |creates| PropertyListFile["Property List File"]; class T1543001 OffensiveTechniqueNode;
class PropertyListFile ArtifactNode; click T1543001 href "/offensive-technique/attack/T1543.001/"; click PropertyListFile href "/dao/artifact/d3f:PropertyListFile";T1546014["Emond"] --> |may-create| PropertyListFile["Property List File"]; class T1546014 OffensiveTechniqueNode;
class PropertyListFile ArtifactNode; click T1546014 href "/offensive-technique/attack/T1546.014/"; click PropertyListFile href "/dao/artifact/d3f:PropertyListFile";T1546014["Emond"] --> |may-modify| PropertyListFile["Property List File"]; class T1546014 OffensiveTechniqueNode;
class PropertyListFile ArtifactNode; click T1546014 href "/offensive-technique/attack/T1546.014/"; click PropertyListFile href "/dao/artifact/d3f:PropertyListFile";T1564003["Hidden Window"] --> |may-modify| PropertyListFile["Property List File"]; class T1564003 OffensiveTechniqueNode;
class PropertyListFile ArtifactNode; click T1564003 href "/offensive-technique/attack/T1564.003/"; click PropertyListFile href "/dao/artifact/d3f:PropertyListFile";T1543004["Launch Daemon"] --> |modifies| PropertyListFile["Property List File"]; class T1543004 OffensiveTechniqueNode;
class PropertyListFile ArtifactNode; click T1543004 href "/offensive-technique/attack/T1543.004/"; click PropertyListFile href "/dao/artifact/d3f:PropertyListFile";T1563002["RDP Hijacking"] --> |accesses| RDPSession["RDP Session"]; class T1563002 OffensiveTechniqueNode;
class RDPSession ArtifactNode; click T1563002 href "/offensive-technique/attack/T1563.002/"; click RDPSession href "/dao/artifact/d3f:RDPSession";T1021001["Remote Desktop Protocol"] --> |creates| RDPSession["RDP Session"]; class T1021001 OffensiveTechniqueNode;
class RDPSession ArtifactNode; click T1021001 href "/offensive-technique/attack/T1021.001/"; click RDPSession href "/dao/artifact/d3f:RDPSession";T1558003["Kerberoasting"] --> |may-produce| RPCNetworkTraffic["RPC Network Traffic"]; class T1558003 OffensiveTechniqueNode;
class RPCNetworkTraffic ArtifactNode; click T1558003 href "/offensive-technique/attack/T1558.003/"; click RPCNetworkTraffic href "/dao/artifact/d3f:RPCNetworkTraffic";T1555003["Credentials from Web Browsers"] --> |may-invoke| ReadFile["Read File"]; class T1555003 OffensiveTechniqueNode;
class ReadFile ArtifactNode; click T1555003 href "/offensive-technique/attack/T1555.003/"; click ReadFile href "/dao/artifact/d3f:ReadFile";T1563["Remote Service Session Hijacking"] --> |accesses| RemoteSession["Remote Session"]; class T1563 OffensiveTechniqueNode;
class RemoteSession ArtifactNode; click T1563 href "/offensive-technique/attack/T1563/"; click RemoteSession href "/dao/artifact/d3f:RemoteSession";T1025["Data from Removable Media"] --> |accesses| RemovableMediaDevice["Removable Media Device"]; class T1025 OffensiveTechniqueNode;
class RemovableMediaDevice ArtifactNode; click T1025 href "/offensive-technique/attack/T1025/"; click RemovableMediaDevice href "/dao/artifact/d3f:RemovableMediaDevice";T1091["Replication Through Removable Media"] --> |executes| RemovableMediaDevice["Removable Media Device"]; class T1091 OffensiveTechniqueNode;
class RemovableMediaDevice ArtifactNode; click T1091 href "/offensive-technique/attack/T1091/"; click RemovableMediaDevice href "/dao/artifact/d3f:RemovableMediaDevice";T1092["Communication Through Removable Media"] --> |modifies| RemovableMediaDevice["Removable Media Device"]; class T1092 OffensiveTechniqueNode;
class RemovableMediaDevice ArtifactNode; click T1092 href "/offensive-technique/attack/T1092/"; click RemovableMediaDevice href "/dao/artifact/d3f:RemovableMediaDevice";T1052001["Exfiltration over USB"] --> |modifies| RemovableMediaDevice["Removable Media Device"]; class T1052001 OffensiveTechniqueNode;
class RemovableMediaDevice ArtifactNode; click T1052001 href "/offensive-technique/attack/T1052.001/"; click RemovableMediaDevice href "/dao/artifact/d3f:RemovableMediaDevice";T1213["Data from Information Repositories"] --> |accesses| Resource["Resource"]; class T1213 OffensiveTechniqueNode;
class Resource ArtifactNode; click T1213 href "/offensive-technique/attack/T1213/"; click Resource href "/dao/artifact/d3f:Resource";T1114["Email Collection"] --> |accesses| Resource["Resource"]; class T1114 OffensiveTechniqueNode;
class Resource ArtifactNode; click T1114 href "/offensive-technique/attack/T1114/"; click Resource href "/dao/artifact/d3f:Resource";T1491001["Internal Defacement"] --> |modifies| Resource["Resource"]; class T1491001 OffensiveTechniqueNode;
class Resource ArtifactNode; click T1491001 href "/offensive-technique/attack/T1491.001/"; click Resource href "/dao/artifact/d3f:Resource";T1074["Data Staged"] --> |reads| Resource["Resource"]; class T1074 OffensiveTechniqueNode;
class Resource ArtifactNode; click T1074 href "/offensive-technique/attack/T1074/"; click Resource href "/dao/artifact/d3f:Resource";T1564009["Resource Forking"] --> |may-create| ResourceFork["Resource Fork"]; class T1564009 OffensiveTechniqueNode;
class ResourceFork ArtifactNode; click T1564009 href "/offensive-technique/attack/T1564.009/"; click ResourceFork href "/dao/artifact/d3f:ResourceFork";T1564009["Resource Forking"] --> |may-modify| ResourceFork["Resource Fork"]; class T1564009 OffensiveTechniqueNode;
class ResourceFork ArtifactNode; click T1564009 href "/offensive-technique/attack/T1564.009/"; click ResourceFork href "/dao/artifact/d3f:ResourceFork";T1563001["SSH Hijacking"] --> |accesses| SSHSession["SSH Session"]; class T1563001 OffensiveTechniqueNode;
class SSHSession ArtifactNode; click T1563001 href "/offensive-technique/attack/T1563.001/"; click SSHSession href "/dao/artifact/d3f:SSHSession";T1021004["SSH"] --> |creates| SSHSession["SSH Session"]; class T1021004 OffensiveTechniqueNode;
class SSHSession ArtifactNode; click T1021004 href "/offensive-technique/attack/T1021.004/"; click SSHSession href "/dao/artifact/d3f:SSHSession";T1053["Scheduled Task/Job Execution"] --> |executes| ScheduledJob["Scheduled Job"]; class T1053 OffensiveTechniqueNode;
class ScheduledJob ArtifactNode; click T1053 href "/offensive-technique/attack/T1053/"; click ScheduledJob href "/dao/artifact/d3f:ScheduledJob";T1053005["Schtasks Execution"] --> |executes| ScheduledJob["Scheduled Job"]; class T1053005 OffensiveTechniqueNode;
class ScheduledJob ArtifactNode; click T1053005 href "/offensive-technique/attack/T1053.005/"; click ScheduledJob href "/dao/artifact/d3f:ScheduledJob";T1111["Two-Factor Authentication Interception"] --> |may-access| SecurityToken["Security Token"]; class T1111 OffensiveTechniqueNode;
class SecurityToken ArtifactNode; click T1111 href "/offensive-technique/attack/T1111/"; click SecurityToken href "/dao/artifact/d3f:SecurityToken";T1574005["Executable Installer File Permissions Weakness"] --> |modifies| ServiceApplication["Service Application"]; class T1574005 OffensiveTechniqueNode;
class ServiceApplication ArtifactNode; click T1574005 href "/offensive-technique/attack/T1574.005/"; click ServiceApplication href "/dao/artifact/d3f:ServiceApplication";T1574010["Services File Permissions Weakness"] --> |modifies| ServiceApplication["Service Application"]; class T1574010 OffensiveTechniqueNode;
class ServiceApplication ArtifactNode; click T1574010 href "/offensive-technique/attack/T1574.010/"; click ServiceApplication href "/dao/artifact/d3f:ServiceApplication";T1539["Steal Web Session Cookie"] --> |accesses| SessionCookie["Session Cookie"]; class T1539 OffensiveTechniqueNode;
class SessionCookie ArtifactNode; click T1539 href "/offensive-technique/attack/T1539/"; click SessionCookie href "/dao/artifact/d3f:SessionCookie";T1550004["Web Session Cookie"] --> |adds| SessionCookie["Session Cookie"]; class T1550004 OffensiveTechniqueNode;
class SessionCookie ArtifactNode; click T1550004 href "/offensive-technique/attack/T1550.004/"; click SessionCookie href "/dao/artifact/d3f:SessionCookie";T1055014["VDSO Hijacking"] --> |accesses| SharedLibraryFile["Shared Library File"]; class T1055014 OffensiveTechniqueNode;
class SharedLibraryFile ArtifactNode; click T1055014 href "/offensive-technique/attack/T1055.014/"; click SharedLibraryFile href "/dao/artifact/d3f:SharedLibraryFile";T1055001["Dynamic-link Library Injection"] --> |adds| SharedLibraryFile["Shared Library File"]; class T1055001 OffensiveTechniqueNode;
class SharedLibraryFile ArtifactNode; click T1055001 href "/offensive-technique/attack/T1055.001/"; click SharedLibraryFile href "/dao/artifact/d3f:SharedLibraryFile";T1556002["Password Filter DLL"] --> |creates| SharedLibraryFile["Shared Library File"]; class T1556002 OffensiveTechniqueNode;
class SharedLibraryFile ArtifactNode; click T1556002 href "/offensive-technique/attack/T1556.002/"; click SharedLibraryFile href "/dao/artifact/d3f:SharedLibraryFile";T1055001["Dynamic-link Library Injection"] --> |loads| SharedLibraryFile["Shared Library File"]; class T1055001 OffensiveTechniqueNode;
class SharedLibraryFile ArtifactNode; click T1055001 href "/offensive-technique/attack/T1055.001/"; click SharedLibraryFile href "/dao/artifact/d3f:SharedLibraryFile";T1546009["AppCert DLLs"] --> |loads| SharedLibraryFile["Shared Library File"]; class T1546009 OffensiveTechniqueNode;
class SharedLibraryFile ArtifactNode; click T1546009 href "/offensive-technique/attack/T1546.009/"; click SharedLibraryFile href "/dao/artifact/d3f:SharedLibraryFile";T1546010["AppInit DLLs"] --> |loads| SharedLibraryFile["Shared Library File"]; class T1546010 OffensiveTechniqueNode;
class SharedLibraryFile ArtifactNode; click T1546010 href "/offensive-technique/attack/T1546.010/"; click SharedLibraryFile href "/dao/artifact/d3f:SharedLibraryFile";T1218011["Rundll32 Execution"] --> |loads| SharedLibraryFile["Shared Library File"]; class T1218011 OffensiveTechniqueNode;
class SharedLibraryFile ArtifactNode; click T1218011 href "/offensive-technique/attack/T1218.011/"; click SharedLibraryFile href "/dao/artifact/d3f:SharedLibraryFile";T1547008["LSASS Driver"] --> |may-create| SharedLibraryFile["Shared Library File"]; class T1547008 OffensiveTechniqueNode;
class SharedLibraryFile ArtifactNode; click T1547008 href "/offensive-technique/attack/T1547.008/"; click SharedLibraryFile href "/dao/artifact/d3f:SharedLibraryFile";T1574001["DLL Search Order Hijacking"] --> |may-create| SharedLibraryFile["Shared Library File"]; class T1574001 OffensiveTechniqueNode;
class SharedLibraryFile ArtifactNode; click T1574001 href "/offensive-technique/attack/T1574.001/"; click SharedLibraryFile href "/dao/artifact/d3f:SharedLibraryFile";T1574002["DLL Side-Loading"] --> |may-create| SharedLibraryFile["Shared Library File"]; class T1574002 OffensiveTechniqueNode;
class SharedLibraryFile ArtifactNode; click T1574002 href "/offensive-technique/attack/T1574.002/"; click SharedLibraryFile href "/dao/artifact/d3f:SharedLibraryFile";T1574004["Dylib Hijacking"] --> |may-create| SharedLibraryFile["Shared Library File"]; class T1574004 OffensiveTechniqueNode;
class SharedLibraryFile ArtifactNode; click T1574004 href "/offensive-technique/attack/T1574.004/"; click SharedLibraryFile href "/dao/artifact/d3f:SharedLibraryFile";T1014["Rootkit"] --> |may-modify| SharedLibraryFile["Shared Library File"]; class T1014 OffensiveTechniqueNode;
class SharedLibraryFile ArtifactNode; click T1014 href "/offensive-technique/attack/T1014/"; click SharedLibraryFile href "/dao/artifact/d3f:SharedLibraryFile";T1574002["DLL Side-Loading"] --> |may-modify| SharedLibraryFile["Shared Library File"]; class T1574002 OffensiveTechniqueNode;
class SharedLibraryFile ArtifactNode; click T1574002 href "/offensive-technique/attack/T1574.002/"; click SharedLibraryFile href "/dao/artifact/d3f:SharedLibraryFile";T1574004["Dylib Hijacking"] --> |may-modify| SharedLibraryFile["Shared Library File"]; class T1574004 OffensiveTechniqueNode;
class SharedLibraryFile ArtifactNode; click T1574004 href "/offensive-technique/attack/T1574.004/"; click SharedLibraryFile href "/dao/artifact/d3f:SharedLibraryFile";T1574012["COR_PROFILER"] --> |adds| SharedLibraryFile["Shared Library File"]; class T1574012 OffensiveTechniqueNode;
class SharedLibraryFile ArtifactNode; click T1574012 href "/offensive-technique/attack/T1574.012/"; click SharedLibraryFile href "/dao/artifact/d3f:SharedLibraryFile";T1546011["Application Shimming"] --> |creates| Shim["Shim"]; class T1546011 OffensiveTechniqueNode;
class Shim ArtifactNode; click T1546011 href "/offensive-technique/attack/T1546.011/"; click Shim href "/dao/artifact/d3f:Shim";T1546011["Application Shimming"] --> |modifies| ShimDatabase["Shim Database"]; class T1546011 OffensiveTechniqueNode;
class ShimDatabase ArtifactNode; click T1546011 href "/offensive-technique/attack/T1546.011/"; click ShimDatabase href "/dao/artifact/d3f:ShimDatabase";T1137006["Add-ins"] --> |adds| Software["Software"]; class T1137006 OffensiveTechniqueNode;
class Software ArtifactNode; click T1137006 href "/offensive-technique/attack/T1137.006/"; click Software href "/dao/artifact/d3f:Software";T1505004["IIS Components"] --> |adds| Software["Software"]; class T1505004 OffensiveTechniqueNode;
class Software ArtifactNode; click T1505004 href "/offensive-technique/attack/T1505.004/"; click Software href "/dao/artifact/d3f:Software";T1072["Software Deployment Tools Execution"] --> |installs| Software["Software"]; class T1072 OffensiveTechniqueNode;
class Software ArtifactNode; click T1072 href "/offensive-technique/attack/T1072/"; click Software href "/dao/artifact/d3f:Software";T1218014["MMC"] --> |may-add| Software["Software"]; class T1218014 OffensiveTechniqueNode;
class Software ArtifactNode; click T1218014 href "/offensive-technique/attack/T1218.014/"; click Software href "/dao/artifact/d3f:Software";T1195001["Compromise Software Dependencies and Development Tools"] --> |modifies| Software["Software"]; class T1195001 OffensiveTechniqueNode;
class Software ArtifactNode; click T1195001 href "/offensive-technique/attack/T1195.001/"; click Software href "/dao/artifact/d3f:Software";T1195002["Compromise Software Supply Chain"] --> |modifies| Software["Software"]; class T1195002 OffensiveTechniqueNode;
class Software ArtifactNode; click T1195002 href "/offensive-technique/attack/T1195.002/"; click Software href "/dao/artifact/d3f:Software";T1072["Software Deployment Tools Execution"] --> |executes| SoftwareDeploymentTool["Software Deployment Tool"]; class T1072 OffensiveTechniqueNode;
class SoftwareDeploymentTool ArtifactNode; click T1072 href "/offensive-technique/attack/T1072/"; click SoftwareDeploymentTool href "/dao/artifact/d3f:SoftwareDeploymentTool";T1068["Exploitation for Privilege Escalation"] --> |may-modify| StackFrame["Stack Frame"]; class T1068 OffensiveTechniqueNode;
class StackFrame ArtifactNode; click T1068 href "/offensive-technique/attack/T1068/"; click StackFrame href "/dao/artifact/d3f:StackFrame";T1210["Exploitation of Remote Services"] --> |may-modify| StackFrame["Stack Frame"]; class T1210 OffensiveTechniqueNode;
class StackFrame ArtifactNode; click T1210 href "/offensive-technique/attack/T1210/"; click StackFrame href "/dao/artifact/d3f:StackFrame";T1211["Exploitation for Defense Evasion"] --> |may-modify| StackFrame["Stack Frame"]; class T1211 OffensiveTechniqueNode;
class StackFrame ArtifactNode; click T1211 href "/offensive-technique/attack/T1211/"; click StackFrame href "/dao/artifact/d3f:StackFrame";T1212["Exploitation for Credential Access"] --> |may-modify| StackFrame["Stack Frame"]; class T1212 OffensiveTechniqueNode;
class StackFrame ArtifactNode; click T1212 href "/offensive-technique/attack/T1212/"; click StackFrame href "/dao/artifact/d3f:StackFrame";T1203["Exploitation for Client Execution"] --> |modifies| StackFrame["Stack Frame"]; class T1203 OffensiveTechniqueNode;
class StackFrame ArtifactNode; click T1203 href "/offensive-technique/attack/T1203/"; click StackFrame href "/dao/artifact/d3f:StackFrame";T1564005["Hidden File System"] --> |modifies| Storage["Storage"]; class T1564005 OffensiveTechniqueNode;
class Storage ArtifactNode; click T1564005 href "/offensive-technique/attack/T1564.005/"; click Storage href "/dao/artifact/d3f:Storage";T1505001["SQL Stored Procedures"] --> |creates| StoredProcedure["Stored Procedure"]; class T1505001 OffensiveTechniqueNode;
class StoredProcedure ArtifactNode; click T1505001 href "/offensive-technique/attack/T1505.001/"; click StoredProcedure href "/dao/artifact/d3f:StoredProcedure";T1547009["Shortcut Modification"] --> |may-modify| SymbolicLink["Symbolic Link"]; class T1547009 OffensiveTechniqueNode;
class SymbolicLink ArtifactNode; click T1547009 href "/offensive-technique/attack/T1547.009/"; click SymbolicLink href "/dao/artifact/d3f:SymbolicLink";T1106["Native API Execution"] --> |invokes| SystemCall["System Call"]; class T1106 OffensiveTechniqueNode;
class SystemCall ArtifactNode; click T1106 href "/offensive-technique/attack/T1106/"; click SystemCall href "/dao/artifact/d3f:SystemCall";T1055014["VDSO Hijacking"] --> |invokes| SystemCall["System Call"]; class T1055014 OffensiveTechniqueNode;
class SystemCall ArtifactNode; click T1055014 href "/offensive-technique/attack/T1055.014/"; click SystemCall href "/dao/artifact/d3f:SystemCall";T1055001["Dynamic-link Library Injection"] --> |invokes| SystemCall["System Call"]; class T1055001 OffensiveTechniqueNode;
class SystemCall ArtifactNode; click T1055001 href "/offensive-technique/attack/T1055.001/"; click SystemCall href "/dao/artifact/d3f:SystemCall";T1055003["Thread Execution Hijacking"] --> |invokes| SystemCall["System Call"]; class T1055003 OffensiveTechniqueNode;
class SystemCall ArtifactNode; click T1055003 href "/offensive-technique/attack/T1055.003/"; click SystemCall href "/dao/artifact/d3f:SystemCall";T1055005["Thread Local Storage"] --> |invokes| SystemCall["System Call"]; class T1055005 OffensiveTechniqueNode;
class SystemCall ArtifactNode; click T1055005 href "/offensive-technique/attack/T1055.005/"; click SystemCall href "/dao/artifact/d3f:SystemCall";T1055008["Ptrace System Calls"] --> |invokes| SystemCall["System Call"]; class T1055008 OffensiveTechniqueNode;
class SystemCall ArtifactNode; click T1055008 href "/offensive-technique/attack/T1055.008/"; click SystemCall href "/dao/artifact/d3f:SystemCall";T1548004["Elevated Execution with Prompt"] --> |invokes| SystemCall["System Call"]; class T1548004 OffensiveTechniqueNode;
class SystemCall ArtifactNode; click T1548004 href "/offensive-technique/attack/T1548.004/"; click SystemCall href "/dao/artifact/d3f:SystemCall";T1012["Query Registry"] --> |accesses| SystemConfigurationDatabase["System Configuration Database"]; class T1012 OffensiveTechniqueNode;
class SystemConfigurationDatabase ArtifactNode; click T1012 href "/offensive-technique/attack/T1012/"; click SystemConfigurationDatabase href "/dao/artifact/d3f:SystemConfigurationDatabase";T1552002["Credentials in Registry"] --> |accesses| SystemConfigurationDatabase["System Configuration Database"]; class T1552002 OffensiveTechniqueNode;
class SystemConfigurationDatabase ArtifactNode; click T1552002 href "/offensive-technique/attack/T1552.002/"; click SystemConfigurationDatabase href "/dao/artifact/d3f:SystemConfigurationDatabase";T1548004["Elevated Execution with Prompt"] --> |creates| SystemConfigurationDatabase["System Configuration Database"]; class T1548004 OffensiveTechniqueNode;
class SystemConfigurationDatabase ArtifactNode; click T1548004 href "/offensive-technique/attack/T1548.004/"; click SystemConfigurationDatabase href "/dao/artifact/d3f:SystemConfigurationDatabase";T1137006["Add-ins"] --> |may-modify| SystemConfigurationDatabase["System Configuration Database"]; class T1137006 OffensiveTechniqueNode;
class SystemConfigurationDatabase ArtifactNode; click T1137006 href "/offensive-technique/attack/T1137.006/"; click SystemConfigurationDatabase href "/dao/artifact/d3f:SystemConfigurationDatabase";T1218014["MMC"] --> |may-modify| SystemConfigurationDatabase["System Configuration Database"]; class T1218014 OffensiveTechniqueNode;
class SystemConfigurationDatabase ArtifactNode; click T1218014 href "/offensive-technique/attack/T1218.014/"; click SystemConfigurationDatabase href "/dao/artifact/d3f:SystemConfigurationDatabase";T1564003["Hidden Window"] --> |may-modify| SystemConfigurationDatabase["System Configuration Database"]; class T1564003 OffensiveTechniqueNode;
class SystemConfigurationDatabase ArtifactNode; click T1564003 href "/offensive-technique/attack/T1564.003/"; click SystemConfigurationDatabase href "/dao/artifact/d3f:SystemConfigurationDatabase";T1564005["Hidden File System"] --> |may-modify| SystemConfigurationDatabase["System Configuration Database"]; class T1564005 OffensiveTechniqueNode;
class SystemConfigurationDatabase ArtifactNode; click T1564005 href "/offensive-technique/attack/T1564.005/"; click SystemConfigurationDatabase href "/dao/artifact/d3f:SystemConfigurationDatabase";T1207["Rogue Domain Controller"] --> |modifies| SystemConfigurationDatabase["System Configuration Database"]; class T1207 OffensiveTechniqueNode;
class SystemConfigurationDatabase ArtifactNode; click T1207 href "/offensive-technique/attack/T1207/"; click SystemConfigurationDatabase href "/dao/artifact/d3f:SystemConfigurationDatabase";T1546012["Image File Execution Options Injection"] --> |modifies| SystemConfigurationDatabase["System Configuration Database"]; class T1546012 OffensiveTechniqueNode;
class SystemConfigurationDatabase ArtifactNode; click T1546012 href "/offensive-technique/attack/T1546.012/"; click SystemConfigurationDatabase href "/dao/artifact/d3f:SystemConfigurationDatabase";T1546015["Component Object Model Hijacking"] --> |modifies| SystemConfigurationDatabase["System Configuration Database"]; class T1546015 OffensiveTechniqueNode;
class SystemConfigurationDatabase ArtifactNode; click T1546015 href "/offensive-technique/attack/T1546.015/"; click SystemConfigurationDatabase href "/dao/artifact/d3f:SystemConfigurationDatabase";T1543003["Windows Service"] --> |modifies| SystemConfigurationDatabase["System Configuration Database"]; class T1543003 OffensiveTechniqueNode;
class SystemConfigurationDatabase ArtifactNode; click T1543003 href "/offensive-technique/attack/T1543.003/"; click SystemConfigurationDatabase href "/dao/artifact/d3f:SystemConfigurationDatabase";T1614001["System Language Discovery"] --> |queries| SystemConfigurationDatabase["System Configuration Database"]; class T1614001 OffensiveTechniqueNode;
class SystemConfigurationDatabase ArtifactNode; click T1614001 href "/offensive-technique/attack/T1614.001/"; click SystemConfigurationDatabase href "/dao/artifact/d3f:SystemConfigurationDatabase";T1518001["Security Software Discovery"] --> |may-access| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1518001 OffensiveTechniqueNode;
class SystemConfigurationDatabaseRecord ArtifactNode; click T1518001 href "/offensive-technique/attack/T1518.001/"; click SystemConfigurationDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1137001["Office Template Macros"] --> |may-modify| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1137001 OffensiveTechniqueNode;
class SystemConfigurationDatabaseRecord ArtifactNode; click T1137001 href "/offensive-technique/attack/T1137.001/"; click SystemConfigurationDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1218002["Control Panel Execution"] --> |may-modify| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1218002 OffensiveTechniqueNode;
class SystemConfigurationDatabaseRecord ArtifactNode; click T1218002 href "/offensive-technique/attack/T1218.002/"; click SystemConfigurationDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1546008["Accessibility Features"] --> |may-modify| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1546008 OffensiveTechniqueNode;
class SystemConfigurationDatabaseRecord ArtifactNode; click T1546008 href "/offensive-technique/attack/T1546.008/"; click SystemConfigurationDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1548002["Bypass User Access Control"] --> |may-modify| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1548002 OffensiveTechniqueNode;
class SystemConfigurationDatabaseRecord ArtifactNode; click T1548002 href "/offensive-technique/attack/T1548.002/"; click SystemConfigurationDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1137002["Office Test"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1137002 OffensiveTechniqueNode;
class SystemConfigurationDatabaseRecord ArtifactNode; click T1137002 href "/offensive-technique/attack/T1137.002/"; click SystemConfigurationDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1546007["Netsh Helper DLL"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1546007 OffensiveTechniqueNode;
class SystemConfigurationDatabaseRecord ArtifactNode; click T1546007 href "/offensive-technique/attack/T1546.007/"; click SystemConfigurationDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1546009["AppCert DLLs"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1546009 OffensiveTechniqueNode;
class SystemConfigurationDatabaseRecord ArtifactNode; click T1546009 href "/offensive-technique/attack/T1546.009/"; click SystemConfigurationDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1546010["AppInit DLLs"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1546010 OffensiveTechniqueNode;
class SystemConfigurationDatabaseRecord ArtifactNode; click T1546010 href "/offensive-technique/attack/T1546.010/"; click SystemConfigurationDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1547002["Authentication Package"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1547002 OffensiveTechniqueNode;
class SystemConfigurationDatabaseRecord ArtifactNode; click T1547002 href "/offensive-technique/attack/T1547.002/"; click SystemConfigurationDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1547003["Time Providers"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1547003 OffensiveTechniqueNode;
class SystemConfigurationDatabaseRecord ArtifactNode; click T1547003 href "/offensive-technique/attack/T1547.003/"; click SystemConfigurationDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1547004["Winlogon Helper DLL"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1547004 OffensiveTechniqueNode;
class SystemConfigurationDatabaseRecord ArtifactNode; click T1547004 href "/offensive-technique/attack/T1547.004/"; click SystemConfigurationDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1547005["Security Support Provider"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1547005 OffensiveTechniqueNode;
class SystemConfigurationDatabaseRecord ArtifactNode; click T1547005 href "/offensive-technique/attack/T1547.005/"; click SystemConfigurationDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1547010["Port Monitors"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1547010 OffensiveTechniqueNode;
class SystemConfigurationDatabaseRecord ArtifactNode; click T1547010 href "/offensive-technique/attack/T1547.010/"; click SystemConfigurationDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1546001["Change Default File Association"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1546001 OffensiveTechniqueNode;
class SystemConfigurationDatabaseRecord ArtifactNode; click T1546001 href "/offensive-technique/attack/T1546.001/"; click SystemConfigurationDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1546002["Screensaver"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1546002 OffensiveTechniqueNode;
class SystemConfigurationDatabaseRecord ArtifactNode; click T1546002 href "/offensive-technique/attack/T1546.002/"; click SystemConfigurationDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1553003["SIP and Trust Provider Hijacking"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1553003 OffensiveTechniqueNode;
class SystemConfigurationDatabaseRecord ArtifactNode; click T1553003 href "/offensive-technique/attack/T1553.003/"; click SystemConfigurationDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1556002["Password Filter DLL"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1556002 OffensiveTechniqueNode;
class SystemConfigurationDatabaseRecord ArtifactNode; click T1556002 href "/offensive-technique/attack/T1556.002/"; click SystemConfigurationDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1574012["COR_PROFILER"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1574012 OffensiveTechniqueNode;
class SystemConfigurationDatabaseRecord ArtifactNode; click T1574012 href "/offensive-technique/attack/T1574.012/"; click SystemConfigurationDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1562009["Safe Mode Boot"] --> |disables| SystemConfigurationInitDatabaseRecord["System Configuration Init Database Record"]; class T1562009 OffensiveTechniqueNode;
class SystemConfigurationInitDatabaseRecord ArtifactNode; click T1562009 href "/offensive-technique/attack/T1562.009/"; click SystemConfigurationInitDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationInitDatabaseRecord";T1547001["Registry Run Keys / Startup Folder"] --> |may-modify| SystemConfigurationInitDatabaseRecord["System Configuration Init Database Record"]; class T1547001 OffensiveTechniqueNode;
class SystemConfigurationInitDatabaseRecord ArtifactNode; click T1547001 href "/offensive-technique/attack/T1547.001/"; click SystemConfigurationInitDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationInitDatabaseRecord";T1574011["Services Registry Permissions Weakness"] --> |modifies| SystemConfigurationInitDatabaseRecord["System Configuration Init Database Record"]; class T1574011 OffensiveTechniqueNode;
class SystemConfigurationInitDatabaseRecord ArtifactNode; click T1574011 href "/offensive-technique/attack/T1574.011/"; click SystemConfigurationInitDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationInitDatabaseRecord";T1518001["Security Software Discovery"] --> |may-access| SystemFirewallConfiguration["System Firewall Configuration"]; class T1518001 OffensiveTechniqueNode;
class SystemFirewallConfiguration ArtifactNode; click T1518001 href "/offensive-technique/attack/T1518.001/"; click SystemFirewallConfiguration href "/dao/artifact/d3f:SystemFirewallConfiguration";T1562004["Disable or Modify System Firewall"] --> |modifies| SystemFirewallConfiguration["System Firewall Configuration"]; class T1562004 OffensiveTechniqueNode;
class SystemFirewallConfiguration ArtifactNode; click T1562004 href "/offensive-technique/attack/T1562.004/"; click SystemFirewallConfiguration href "/dao/artifact/d3f:SystemFirewallConfiguration";T1542001["System Firmware"] --> |modifies| SystemFirmware["System Firmware"]; class T1542001 OffensiveTechniqueNode;
class SystemFirmware ArtifactNode; click T1542001 href "/offensive-technique/attack/T1542.001/"; click SystemFirmware href "/dao/artifact/d3f:SystemFirmware";T1542004["ROMMONkit"] --> |modifies| SystemFirmware["System Firmware"]; class T1542004 OffensiveTechniqueNode;
class SystemFirmware ArtifactNode; click T1542004 href "/offensive-technique/attack/T1542.004/"; click SystemFirmware href "/dao/artifact/d3f:SystemFirmware";T1037004["Rc.common"] --> |modifies| SystemInitScript["System Init Script"]; class T1037004 OffensiveTechniqueNode;
class SystemInitScript ArtifactNode; click T1037004 href "/offensive-technique/attack/T1037.004/"; click SystemInitScript href "/dao/artifact/d3f:SystemInitScript";T1003002["Security Account Manager"] --> |may-access| SystemPasswordDatabase["System Password Database"]; class T1003002 OffensiveTechniqueNode;
class SystemPasswordDatabase ArtifactNode; click T1003002 href "/offensive-technique/attack/T1003.002/"; click SystemPasswordDatabase href "/dao/artifact/d3f:SystemPasswordDatabase";T1003004["LSA Secrets"] --> |may-access| SystemPasswordDatabase["System Password Database"]; class T1003004 OffensiveTechniqueNode;
class SystemPasswordDatabase ArtifactNode; click T1003004 href "/offensive-technique/attack/T1003.004/"; click SystemPasswordDatabase href "/dao/artifact/d3f:SystemPasswordDatabase";T1547008["LSASS Driver"] --> |modifies| SystemServiceSoftware["System Service Software"]; class T1547008 OffensiveTechniqueNode;
class SystemServiceSoftware ArtifactNode; click T1547008 href "/offensive-technique/attack/T1547.008/"; click SystemServiceSoftware href "/dao/artifact/d3f:SystemServiceSoftware";T1037005["Startup Items"] --> |modifies| SystemStartupDirectory["System Startup Directory"]; class T1037005 OffensiveTechniqueNode;
class SystemStartupDirectory ArtifactNode; click T1037005 href "/offensive-technique/attack/T1037.005/"; click SystemStartupDirectory href "/dao/artifact/d3f:SystemStartupDirectory";T1497003["Time Based Evasion"] --> |may-run| SystemTimeApplication["System Time Application"]; class T1497003 OffensiveTechniqueNode;
class SystemTimeApplication ArtifactNode; click T1497003 href "/offensive-technique/attack/T1497.003/"; click SystemTimeApplication href "/dao/artifact/d3f:SystemTimeApplication";T1542005["TFTP Boot"] --> |creates| TFTPNetworkTraffic["TFTP Network Traffic"]; class T1542005 OffensiveTechniqueNode;
class TFTPNetworkTraffic ArtifactNode; click T1542005 href "/offensive-technique/attack/T1542.005/"; click TFTPNetworkTraffic href "/dao/artifact/d3f:TFTPNetworkTraffic";T1204001["Malicious Link Execution"] --> |accesses| URL["URL"]; class T1204001 OffensiveTechniqueNode;
class URL ArtifactNode; click T1204001 href "/offensive-technique/attack/T1204.001/"; click URL href "/dao/artifact/d3f:URL";T1189["Drive-by Compromise"] --> |produces| URL["URL"]; class T1189 OffensiveTechniqueNode;
class URL ArtifactNode; click T1189 href "/offensive-technique/attack/T1189/"; click URL href "/dao/artifact/d3f:URL";T1566002["Spearphishing Link"] --> |produces| URL["URL"]; class T1566002 OffensiveTechniqueNode;
class URL ArtifactNode; click T1566002 href "/offensive-technique/attack/T1566.002/"; click URL href "/dao/artifact/d3f:URL";T1566003["Spearphishing Via Service"] --> |produces| URL["URL"]; class T1566003 OffensiveTechniqueNode;
class URL ArtifactNode; click T1566003 href "/offensive-technique/attack/T1566.003/"; click URL href "/dao/artifact/d3f:URL";T1136["Create Account"] --> |creates| UserAccount["User Account"]; class T1136 OffensiveTechniqueNode;
class UserAccount ArtifactNode; click T1136 href "/offensive-technique/attack/T1136/"; click UserAccount href "/dao/artifact/d3f:UserAccount";T1098["Account Manipulation"] --> |modifies| UserAccount["User Account"]; class T1098 OffensiveTechniqueNode;
class UserAccount ArtifactNode; click T1098 href "/offensive-technique/attack/T1098/"; click UserAccount href "/dao/artifact/d3f:UserAccount";T1531["Account Access Removal"] --> |modifies| UserAccount["User Account"]; class T1531 OffensiveTechniqueNode;
class UserAccount ArtifactNode; click T1531 href "/offensive-technique/attack/T1531/"; click UserAccount href "/dao/artifact/d3f:UserAccount";T1078["Valid Accounts"] --> |uses| UserAccount["User Account"]; class T1078 OffensiveTechniqueNode;
class UserAccount ArtifactNode; click T1078 href "/offensive-technique/attack/T1078/"; click UserAccount href "/dao/artifact/d3f:UserAccount";T1546004[".bash_profile and .bashrc"] --> |modifies| UserInitConfigurationFile["User Init Configuration File"]; class T1546004 OffensiveTechniqueNode;
class UserInitConfigurationFile ArtifactNode; click T1546004 href "/offensive-technique/attack/T1546.004/"; click UserInitConfigurationFile href "/dao/artifact/d3f:UserInitConfigurationFile";T1564002["Hidden Users"] --> |modifies| UserInitConfigurationFile["User Init Configuration File"]; class T1564002 OffensiveTechniqueNode;
class UserInitConfigurationFile ArtifactNode; click T1564002 href "/offensive-technique/attack/T1564.002/"; click UserInitConfigurationFile href "/dao/artifact/d3f:UserInitConfigurationFile";T1562003["Impair Command History Logging"] --> |may-modify| UserInitScript["User Init Script"]; class T1562003 OffensiveTechniqueNode;
class UserInitScript ArtifactNode; click T1562003 href "/offensive-technique/attack/T1562.003/"; click UserInitScript href "/dao/artifact/d3f:UserInitScript";T1037001["Logon Script (Windows)"] --> |modifies| UserInitScript["User Init Script"]; class T1037001 OffensiveTechniqueNode;
class UserInitScript ArtifactNode; click T1037001 href "/offensive-technique/attack/T1037.001/"; click UserInitScript href "/dao/artifact/d3f:UserInitScript";T1037002["Logon Script (Mac)"] --> |modifies| UserInitScript["User Init Script"]; class T1037002 OffensiveTechniqueNode;
class UserInitScript ArtifactNode; click T1037002 href "/offensive-technique/attack/T1037.002/"; click UserInitScript href "/dao/artifact/d3f:UserInitScript";T1547015["Login Items"] --> |modifies| UserLogonInitResource["User Logon Init Resource"]; class T1547015 OffensiveTechniqueNode;
class UserLogonInitResource ArtifactNode; click T1547015 href "/offensive-technique/attack/T1547.015/"; click UserLogonInitResource href "/dao/artifact/d3f:UserLogonInitResource";T1547001["Registry Run Keys / Startup Folder"] --> |may-modify| UserStartupScriptFile["User Startup Script File"]; class T1547001 OffensiveTechniqueNode;
class UserStartupScriptFile ArtifactNode; click T1547001 href "/offensive-technique/attack/T1547.001/"; click UserStartupScriptFile href "/dao/artifact/d3f:UserStartupScriptFile";T1547009["Shortcut Modification"] --> |may-modify| UserStartupScriptFile["User Startup Script File"]; class T1547009 OffensiveTechniqueNode;
class UserStartupScriptFile ArtifactNode; click T1547009 href "/offensive-technique/attack/T1547.009/"; click UserStartupScriptFile href "/dao/artifact/d3f:UserStartupScriptFile";T1125["Video Capture"] --> |accesses| VideoInputDevice["Video Input Device"]; class T1125 OffensiveTechniqueNode;
class VideoInputDevice ArtifactNode; click T1125 href "/offensive-technique/attack/T1125/"; click VideoInputDevice href "/dao/artifact/d3f:VideoInputDevice";T1564006["Run Virtual Instance"] --> |executes| VirtualizationSoftware["Virtualization Software"]; class T1564006 OffensiveTechniqueNode;
class VirtualizationSoftware ArtifactNode; click T1564006 href "/offensive-technique/attack/T1564.006/"; click VirtualizationSoftware href "/dao/artifact/d3f:VirtualizationSoftware";T1564006["Run Virtual Instance"] --> |may-add| VirtualizationSoftware["Virtualization Software"]; class T1564006 OffensiveTechniqueNode;
class VirtualizationSoftware ArtifactNode; click T1564006 href "/offensive-technique/attack/T1564.006/"; click VirtualizationSoftware href "/dao/artifact/d3f:VirtualizationSoftware";T1006["Direct Volume Access"] --> |accesses| Volume["Volume"]; class T1006 OffensiveTechniqueNode;
class Volume ArtifactNode; click T1006 href "/offensive-technique/attack/T1006/"; click Volume href "/dao/artifact/d3f:Volume";T1561001["Disk Content Wipe"] --> |may-modify| Volume["Volume"]; class T1561001 OffensiveTechniqueNode;
class Volume ArtifactNode; click T1561001 href "/offensive-technique/attack/T1561.001/"; click Volume href "/dao/artifact/d3f:Volume";T1542003["Bootkit"] --> |may-modify| VolumeBootRecord["Volume Boot Record"]; class T1542003 OffensiveTechniqueNode;
class VolumeBootRecord ArtifactNode; click T1542003 href "/offensive-technique/attack/T1542.003/"; click VolumeBootRecord href "/dao/artifact/d3f:VolumeBootRecord";T1213001["Confluence"] --> |accesses| WebFileResource["Web File Resource"]; class T1213001 OffensiveTechniqueNode;
class WebFileResource ArtifactNode; click T1213001 href "/offensive-technique/attack/T1213.001/"; click WebFileResource href "/dao/artifact/d3f:WebFileResource";T1213002["Sharepoint"] --> |accesses| WebFileResource["Web File Resource"]; class T1213002 OffensiveTechniqueNode;
class WebFileResource ArtifactNode; click T1213002 href "/offensive-technique/attack/T1213.002/"; click WebFileResource href "/dao/artifact/d3f:WebFileResource";T1185["Man in the Browser"] --> |produces| WebNetworkTraffic["Web Network Traffic"]; class T1185 OffensiveTechniqueNode;
class WebNetworkTraffic ArtifactNode; click T1185 href "/offensive-technique/attack/T1185/"; click WebNetworkTraffic href "/dao/artifact/d3f:WebNetworkTraffic";T1550004["Web Session Cookie"] --> |produces| WebNetworkTraffic["Web Network Traffic"]; class T1550004 OffensiveTechniqueNode;
class WebNetworkTraffic ArtifactNode; click T1550004 href "/offensive-technique/attack/T1550.004/"; click WebNetworkTraffic href "/dao/artifact/d3f:WebNetworkTraffic";T1505003["Web Shell"] --> |adds| WebScriptFile["Web Script File"]; class T1505003 OffensiveTechniqueNode;
class WebScriptFile ArtifactNode; click T1505003 href "/offensive-technique/attack/T1505.003/"; click WebScriptFile href "/dao/artifact/d3f:WebScriptFile";T1505003["Web Shell"] --> |modifies| WebServer["Web Server"]; class T1505003 OffensiveTechniqueNode;
class WebServer ArtifactNode; click T1505003 href "/offensive-technique/attack/T1505.003/"; click WebServer href "/dao/artifact/d3f:WebServer";T1056003["Web Portal Capture"] --> |modifies| WebServerApplication["Web Server Application"]; class T1056003 OffensiveTechniqueNode;
class WebServerApplication ArtifactNode; click T1056003 href "/offensive-technique/attack/T1056.003/"; click WebServerApplication href "/dao/artifact/d3f:WebServerApplication";T1112["Modify Registry"] --> |modifies| WindowsRegistry["Windows Registry"]; class T1112 OffensiveTechniqueNode;
class WindowsRegistry ArtifactNode; click T1112 href "/offensive-technique/attack/T1112/"; click WindowsRegistry href "/dao/artifact/d3f:WindowsRegistry";T1562003["Impair Command History Logging"] --> |may-modify| WindowsRegistryKey["Windows Registry Key"]; class T1562003 OffensiveTechniqueNode;
class WindowsRegistryKey ArtifactNode; click T1562003 href "/offensive-technique/attack/T1562.003/"; click WindowsRegistryKey href "/dao/artifact/d3f:WindowsRegistryKey";T1187["Forced Authentication"] --> |may-modify| WindowsShortcutFile["Windows Shortcut File"]; class T1187 OffensiveTechniqueNode;
class WindowsShortcutFile ArtifactNode; click T1187 href "/offensive-technique/attack/T1187/"; click WindowsShortcutFile href "/dao/artifact/d3f:WindowsShortcutFile";