{"@context":{"rdfs":"http://www.w3.org/2000/01/rdf-schema#","owl":"http://www.w3.org/2002/07/owl#","d3f":"http://d3fend.mitre.org/ontologies/d3fend.owl#","skos":"http://www.w3.org/2004/02/skos/core#"},"@graph":[{"@id":"d3f:T1001","d3f:attack-id":"T1001","d3f:definition":"Adversaries may obfuscate command and control traffic to make it more difficult to detect.(Citation: Bitdefender FunnyDream Campaign November 2020) Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.","rdfs:label":"Data Obfuscation"},{"@id":"d3f:T1001.001","d3f:attack-id":"T1001.001","d3f:definition":"Adversaries may add junk data to protocols used for command and control to make detection more difficult.(Citation: FireEye SUNBURST Backdoor December 2020) By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic. Examples may include appending/prepending data with junk characters or writing junk characters between significant characters.","rdfs:label":"Junk Data"},{"@id":"d3f:T1001.002","d3f:attack-id":"T1001.002","d3f:definition":"Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.","rdfs:label":"Steganography"},{"@id":"d3f:T1001.003","d3f:attack-id":"T1001.003","d3f:definition":"Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic.","rdfs:label":"Protocol or Service Impersonation"},{"@id":"d3f:T1002","d3f:attack-id":"T1002","d3f:definition":"An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. The compression is done separately from the exfiltration channel and is performed using a custom program or algorithm, or a more common compression library or utility such as 7zip, RAR, ZIP, or zlib.","rdfs:label":"Data Compressed","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1003","d3f:attack-id":"T1003","d3f:definition":"Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures.(Citation: Brining MimiKatz to Unix) Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information.","rdfs:label":"OS Credential Dumping"},{"@id":"d3f:T1003.001","d3f:attack-id":"T1003.001","d3f:definition":"Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct [Lateral Movement](https://attack.mitre.org/tactics/TA0008) using [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550).","rdfs:label":"LSASS Memory"},{"@id":"d3f:T1003.002","d3f:attack-id":"T1003.002","d3f:definition":"Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access.","rdfs:label":"Security Account Manager"},{"@id":"d3f:T1003.003","d3f:attack-id":"T1003.003","d3f:definition":"Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in %SystemRoot%\\NTDS\\Ntds.dit of a domain controller.(Citation: Wikipedia Active Directory)","rdfs:label":"NTDS"},{"@id":"d3f:T1003.004","d3f:attack-id":"T1003.004","d3f:definition":"Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.(Citation: Passcape LSA Secrets)(Citation: Microsoft AD Admin Tier Model)(Citation: Tilbury Windows Credentials) LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\\SECURITY\\Policy\\Secrets. LSA secrets can also be dumped from memory.(Citation: ired Dumping LSA Secrets)","rdfs:label":"LSA Secrets"},{"@id":"d3f:T1003.005","d3f:attack-id":"T1003.005","d3f:definition":"Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.(Citation: Microsoft - Cached Creds)","rdfs:label":"Cached Domain Credentials"},{"@id":"d3f:T1003.006","d3f:attack-id":"T1003.006","d3f:definition":"Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) (Citation: Wine API samlib.dll) to simulate the replication process from a remote domain controller using a technique called DCSync.","rdfs:label":"DCSync"},{"@id":"d3f:T1003.007","d3f:attack-id":"T1003.007","d3f:definition":"Adversaries may gather credentials from the proc filesystem or `/proc`. The proc filesystem is a pseudo-filesystem used as an interface to kernel data structures for Linux based systems managing virtual memory. For each process, the `/proc//maps` file shows how memory is mapped within the process’s virtual address space. And `/proc//mem`, exposed for debugging purposes, provides access to the process’s virtual address space.(Citation: Picus Labs Proc cump 2022)(Citation: baeldung Linux proc map 2022)","rdfs:label":"Proc Filesystem"},{"@id":"d3f:T1003.008","d3f:attack-id":"T1003.008","d3f:definition":"Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking. Most modern Linux operating systems use a combination of /etc/passwd and /etc/shadow to store user account information including password hashes in /etc/shadow. By default, /etc/shadow is only readable by the root user.(Citation: Linux Password and Shadow File Formats)","rdfs:label":"/etc/passwd and /etc/shadow"},{"@id":"d3f:T1004","d3f:attack-id":"T1004","d3f:definition":"Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\\Software\\[Wow6432Node\\]Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\ and HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\ are used to manage additional helper programs and functionalities that support Winlogon. (Citation: Cylance Reg Persistence Sept 2013)","rdfs:label":"Winlogon Helper DLL","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1005","d3f:attack-id":"T1005","d3f:definition":"Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.","rdfs:label":"Data from Local System"},{"@id":"d3f:T1006","d3f:attack-id":"T1006","d3f:definition":"Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique may bypass Windows file access controls as well as file system monitoring tools. (Citation: Hakobyan 2009)","rdfs:label":"Direct Volume Access"},{"@id":"d3f:T1007","d3f:attack-id":"T1007","d3f:definition":"Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query, tasklist /svc, systemctl --type=service, and net start.","rdfs:label":"System Service Discovery"},{"@id":"d3f:T1008","d3f:attack-id":"T1008","d3f:definition":"Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.","rdfs:label":"Fallback Channels"},{"@id":"d3f:T1009","d3f:attack-id":"T1009","d3f:definition":"Adversaries can use binary padding to add junk data and change the on-disk representation of malware without affecting the functionality or behavior of the binary. This will often increase the size of the binary beyond what some security tools are capable of handling due to file size limitations.","rdfs:label":"Binary Padding","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1010","d3f:attack-id":"T1010","d3f:definition":"Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.(Citation: Prevailion DarkWatchman 2021) For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ([Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) to evade.(Citation: ESET Grandoreiro April 2020)","rdfs:label":"Application Window Discovery"},{"@id":"d3f:T1011","d3f:attack-id":"T1011","d3f:definition":"Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel.","rdfs:label":"Exfiltration Over Other Network Medium"},{"@id":"d3f:T1011.001","d3f:attack-id":"T1011.001","d3f:definition":"Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel.","rdfs:label":"Exfiltration Over Bluetooth"},{"@id":"d3f:T1012","d3f:attack-id":"T1012","d3f:definition":"Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.","rdfs:label":"Query Registry"},{"@id":"d3f:T1013","d3f:attack-id":"T1013","d3f:definition":"A port monitor can be set through the (Citation: AddMonitor) API call to set a DLL to be loaded at startup. (Citation: AddMonitor) This DLL can be located in C:\\Windows\\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. The spoolsv.exe process also runs under SYSTEM level permissions. (Citation: Bloxham) Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print\\Monitors.","rdfs:label":"Port Monitors","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1014","d3f:attack-id":"T1014","d3f:definition":"Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits)","rdfs:label":"Rootkit"},{"@id":"d3f:T1015","d3f:attack-id":"T1015","d3f:definition":"Windows contains accessibility features that may be launched with a key combination before a user has logged in (for example, when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.","rdfs:label":"Accessibility Features","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1016","d3f:attack-id":"T1016","d3f:definition":"Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](https://attack.mitre.org/software/S0100)/[ifconfig](https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103).","rdfs:label":"System Network Configuration Discovery"},{"@id":"d3f:T1016.001","d3f:attack-id":"T1016.001","d3f:definition":"Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using [Ping](https://attack.mitre.org/software/S0097), tracert, and GET requests to websites.","rdfs:label":"Internet Connection Discovery"},{"@id":"d3f:T1016.002","d3f:attack-id":"T1016.002","d3f:definition":"Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. Adversaries may use Wi-Fi information as part of [Account Discovery](https://attack.mitre.org/techniques/T1087), [Remote System Discovery](https://attack.mitre.org/techniques/T1018), and other discovery or [Credential Access](https://attack.mitre.org/tactics/TA0006) activity to support both ongoing and future campaigns.","rdfs:label":"Wi-Fi Discovery"},{"@id":"d3f:T1017","d3f:attack-id":"T1017","d3f:definition":"Adversaries may deploy malicious software to systems within a network using application deployment systems employed by enterprise administrators. The permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the deployment server, or specific domain credentials may be required. However, the system may require an administrative account to log in or to perform software deployment.","rdfs:label":"Application Deployment Software","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1018","d3f:attack-id":"T1018","d3f:definition":"Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as [Ping](https://attack.mitre.org/software/S0097) or net view using [Net](https://attack.mitre.org/software/S0039).","rdfs:label":"Remote System Discovery"},{"@id":"d3f:T1019","d3f:attack-id":"T1019","d3f:definition":"The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer. (Citation: Wikipedia BIOS) (Citation: Wikipedia UEFI) (Citation: About UEFI)","rdfs:label":"System Firmware","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1020","d3f:attack-id":"T1020","d3f:definition":"Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.(Citation: ESET Gamaredon June 2020)","rdfs:label":"Automated Exfiltration"},{"@id":"d3f:T1020.001","d3f:attack-id":"T1020.001","d3f:definition":"Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis. For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device. (Citation: Cisco Traffic Mirroring)(Citation: Juniper Traffic Mirroring)","rdfs:label":"Traffic Duplication"},{"@id":"d3f:T1021","d3f:attack-id":"T1021","d3f:definition":"Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.","rdfs:label":"Remote Services"},{"@id":"d3f:T1021.001","d3f:attack-id":"T1021.001","d3f:definition":"Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.","rdfs:label":"Remote Desktop Protocol"},{"@id":"d3f:T1021.002","d3f:attack-id":"T1021.002","d3f:definition":"Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.","rdfs:label":"SMB/Windows Admin Shares"},{"@id":"d3f:T1021.003","d3f:attack-id":"T1021.003","d3f:definition":"Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). The adversary may then perform actions as the logged-on user.","rdfs:label":"Distributed Component Object Model"},{"@id":"d3f:T1021.004","d3f:attack-id":"T1021.004","d3f:definition":"Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.","rdfs:label":"SSH"},{"@id":"d3f:T1021.005","d3f:attack-id":"T1021.005","d3f:definition":"Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely control machines using Virtual Network Computing (VNC). VNC is a platform-independent desktop sharing system that uses the RFB (“remote framebuffer”) protocol to enable users to remotely control another computer’s display by relaying the screen, mouse, and keyboard inputs over the network.(Citation: The Remote Framebuffer Protocol)","rdfs:label":"VNC"},{"@id":"d3f:T1021.006","d3f:attack-id":"T1021.006","d3f:definition":"Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.","rdfs:label":"Windows Remote Management"},{"@id":"d3f:T1021.007","d3f:attack-id":"T1021.007","d3f:definition":"Adversaries may log into accessible cloud services within a compromised environment using [Valid Accounts](https://attack.mitre.org/techniques/T1078) that are synchronized with or federated to on-premises user identities. The adversary may then perform management actions or access cloud-hosted resources as the logged-on user.","rdfs:label":"Cloud Services"},{"@id":"d3f:T1021.008","d3f:attack-id":"T1021.008","d3f:definition":"Adversaries may leverage [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log directly into accessible cloud hosted compute infrastructure through cloud native methods. Many cloud providers offer interactive connections to virtual infrastructure that can be accessed through the [Cloud API](https://attack.mitre.org/techniques/T1059/009), such as Azure Serial Console(Citation: Azure Serial Console), AWS EC2 Instance Connect(Citation: EC2 Instance Connect)(Citation: lucr-3: Getting SaaS-y in the cloud), and AWS System Manager.(Citation: AWS System Manager).","rdfs:label":"Direct Cloud VM Connections"},{"@id":"d3f:T1022","d3f:attack-id":"T1022","d3f:definition":"Data is encrypted before being exfiltrated in order to hide the information that is being exfiltrated from detection or to make the exfiltration less conspicuous upon inspection by a defender. The encryption is performed by a utility, programming library, or custom algorithm on the data itself and is considered separate from any encryption performed by the command and control or file transfer protocol. Common file archive formats that can encrypt files are RAR and zip.","rdfs:label":"Data Encrypted","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1023","d3f:attack-id":"T1023","d3f:definition":"Shortcuts or symbolic links are ways of referencing other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process. Adversaries could use shortcuts to execute their tools for persistence. They may create a new shortcut as a means of indirection that may use [Masquerading](https://attack.mitre.org/techniques/T1036) to look like a legitimate program. Adversaries could also edit the target path or entirely replace an existing shortcut so their tools will be executed instead of the intended legitimate program.","rdfs:label":"Shortcut Modification","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1024","d3f:attack-id":"T1024","d3f:definition":"Adversaries may use a custom cryptographic protocol or algorithm to hide command and control traffic. A simple scheme, such as XOR-ing the plaintext with a fixed key, will produce a very weak ciphertext.","rdfs:label":"Custom Cryptographic Protocol","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1025","d3f:attack-id":"T1025","d3f:definition":"Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.","rdfs:label":"Data from Removable Media"},{"@id":"d3f:T1026","d3f:attack-id":"T1026","d3f:definition":"**This technique has been deprecated and should no longer be used.**","rdfs:label":"Multiband Communication","owl:deprecated":{"@type":"http://www.w3.org/2001/XMLSchema#boolean","@value":"true"}},{"@id":"d3f:T1027","d3f:attack-id":"T1027","d3f:definition":"Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.","rdfs:label":"Obfuscated Files or Information"},{"@id":"d3f:T1027.001","d3f:attack-id":"T1027.001","d3f:definition":"Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations.","rdfs:label":"Binary Padding"},{"@id":"d3f:T1027.002","d3f:attack-id":"T1027.002","d3f:definition":"Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018)","rdfs:label":"Software Packing"},{"@id":"d3f:T1027.003","d3f:attack-id":"T1027.003","d3f:definition":"Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files.","rdfs:label":"Steganography"},{"@id":"d3f:T1027.004","d3f:attack-id":"T1027.004","d3f:definition":"Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018)","rdfs:label":"Compile After Delivery"},{"@id":"d3f:T1027.005","d3f:attack-id":"T1027.005","d3f:definition":"Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems.","rdfs:label":"Indicator Removal from Tools"},{"@id":"d3f:T1027.006","d3f:attack-id":"T1027.006","d3f:definition":"Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. HTML documents can store large binary objects known as JavaScript Blobs (immutable data that represents raw bytes) that can later be constructed into file-like objects. Data may also be stored in Data URLs, which enable embedding media type or MIME files inline of HTML documents. HTML5 also introduced a download attribute that may be used to initiate file downloads.(Citation: HTML Smuggling Menlo Security 2020)(Citation: Outlflank HTML Smuggling 2018)","rdfs:label":"HTML Smuggling"},{"@id":"d3f:T1027.007","d3f:attack-id":"T1027.007","d3f:definition":"Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis. Malware commonly uses various [Native API](https://attack.mitre.org/techniques/T1106) functions provided by the OS to perform various tasks such as those involving processes, files, and other system artifacts.","rdfs:label":"Dynamic API Resolution"},{"@id":"d3f:T1027.008","d3f:attack-id":"T1027.008","d3f:definition":"Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information. Scripts and executables may contain variables names and other strings that help developers document code functionality. Symbols are often created by an operating system’s `linker` when executable payloads are compiled. Reverse engineers use these symbols and strings to analyze code and to identify functionality in payloads.(Citation: Mandiant golang stripped binaries explanation)(Citation: intezer stripped binaries elf files 2018)","rdfs:label":"Stripped Payloads"},{"@id":"d3f:T1027.009","d3f:attack-id":"T1027.009","d3f:definition":"Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherwise seemingly benign files (such as scripts and executables) may be abused to carry and obfuscate malicious payloads and content. In some cases, embedded payloads may also enable adversaries to [Subvert Trust Controls](https://attack.mitre.org/techniques/T1553) by not impacting execution controls such as digital signatures and notarization tickets.(Citation: Sentinel Labs)","rdfs:label":"Embedded Payloads"},{"@id":"d3f:T1027.010","d3f:attack-id":"T1027.010","d3f:definition":"Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., [Phishing](https://attack.mitre.org/techniques/T1566) and [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)) or interactively via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).(Citation: Akamai JS)(Citation: Malware Monday VBE)","rdfs:label":"Command Obfuscation"},{"@id":"d3f:T1027.011","d3f:attack-id":"T1027.011","d3f:definition":"Adversaries may store data in \"fileless\" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format other than a file. Common examples of non-volatile fileless storage include the Windows Registry, event logs, or WMI repository.(Citation: Microsoft Fileless)(Citation: SecureList Fileless)","rdfs:label":"Fileless Storage"},{"@id":"d3f:T1027.012","d3f:attack-id":"T1027.012","d3f:definition":"Adversaries may smuggle commands to download malicious payloads past content filters by hiding them within otherwise seemingly benign windows shortcut files. Windows shortcut files (.LNK) include many metadata fields, including an icon location field (also known as the `IconEnvironmentDataBlock`) designed to specify the path to an icon file that is to be displayed for the LNK file within a host directory.","rdfs:label":"LNK Icon Smuggling"},{"@id":"d3f:T1027.013","d3f:attack-id":"T1027.013","d3f:definition":"Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within a file used in an intrusion. Many other techniques, such as [Software Packing](https://attack.mitre.org/techniques/T1027/002), [Steganography](https://attack.mitre.org/techniques/T1027/003), and [Embedded Payloads](https://attack.mitre.org/techniques/T1027/009), share this same broad objective. Encrypting and/or encoding files could lead to a lapse in detection of static signatures, only for this malicious content to be revealed (i.e., [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140)) at the time of execution/use.","rdfs:label":"Encrypted/Encoded File"},{"@id":"d3f:T1027.014","d3f:attack-id":"T1027.014","d3f:definition":"Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection. Polymorphic code is a type of software capable of changing its runtime footprint during code execution.(Citation: polymorphic-blackberry) With each execution of the software, the code is mutated into a different version of itself that achieves the same purpose or objective as the original. This functionality enables the malware to evade traditional signature-based defenses, such as antivirus and antimalware tools.(Citation: polymorphic-sentinelone)","rdfs:label":"Polymorphic Code"},{"@id":"d3f:T1027.015","d3f:attack-id":"T1027.015","d3f:definition":"Adversaries may use compression to obfuscate their payloads or files. Compressed file formats such as ZIP, gzip, 7z, and RAR can compress and archive multiple files together to make it easier and faster to transfer files. In addition to compressing files, adversaries may also compress shellcode directly - for example, in order to store it in a Windows Registry key (i.e., [Fileless Storage](https://attack.mitre.org/techniques/T1027/011)).(Citation: Trustwave Pillowmint June 2020)","rdfs:label":"Compression"},{"@id":"d3f:T1027.016","d3f:attack-id":"T1027.016","d3f:definition":"Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does not execute, or if it does execute, does not change the functionality of the code. Junk code makes analysis more difficult and time-consuming, as the analyst steps through non-functional code instead of analyzing the main code. It also may hinder detections that rely on static code analysis due to the use of benign functionality, especially when combined with [Compression](https://attack.mitre.org/techniques/T1027/015) or [Software Packing](https://attack.mitre.org/techniques/T1027/002).(Citation: ReasonLabs)(Citation: ReasonLabs Cyberpedia Junk Code)","rdfs:label":"Junk Code Insertion"},{"@id":"d3f:T1027.017","d3f:attack-id":"T1027.017","d3f:definition":"Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files.(Citation: Trustwave SVG Smuggling 2025) SVGs, or Scalable Vector Graphics, are vector-based image files constructed using XML. As such, they can legitimately include `

Search By

Type