Cyber threats

ATT&CK Techniques against Brunei

Techniques used by the threat actors that target Brunei, by tactic · MITRE ATT&CK profiles · darker = more actors
1
Actors with a profile
9
Techniques
T1003
Most used · 1 actors
Reset
Reconnaissance0
—
Resource Development0
—
Initial Access0
—
Execution1
T1059 Command and Scripting Interpreter1
Persistence0
—
Privilege Escalation0
—
Stealth1
T1036 Masquerading1
Defense Impairment0
—
Credential Access2
T1003 OS Credential Dumping1 T1056 Input Capture1
Discovery3
T1082 System Information Discovery1 T1083 File and Directory Discovery1 T1135 Network Share Discovery1
Lateral Movement0
—
Collection3
T1039 Data from Network Shared Drive1 T1056 Input Capture1 T1560 Archive Collected Data1
Command and Control0
—
Exfiltration0
—
Impact0
—
Techniques to detect first
TechniqueTacticsActorsUsed by, for example
T1003 OS Credential Dumping credential-access 1 Sowbug
T1036 Masquerading stealth 1 Sowbug
T1039 Data from Network Shared Drive collection 1 Sowbug
T1056 Input Capture collection, credential-access 1 Sowbug
T1059 Command and Scripting Interpreter execution 1 Sowbug
T1082 System Information Discovery discovery 1 Sowbug
T1083 File and Directory Discovery discovery 1 Sowbug
T1135 Network Share Discovery discovery 1 Sowbug
T1560 Archive Collected Data collection 1 Sowbug

Each actor counts once per technique; sub-techniques are counted under their parent. Only actors with a MITRE ATT&CK profile are included (1), so the map shows documented tradecraft, not everything that happens.