Cyber threats

ATT&CK Techniques against Indonesia

Techniques used by the threat actors that target Indonesia, by tactic · MITRE ATT&CK profiles · darker = more actors
4
Actors with a profile
47
Techniques
T1018
Most used · 3 actors
Reset
Reconnaissance0
—
Resource Development3
T1583 Acquire Infrastructure1 T1584 Compromise Infrastructure1 T1588 Obtain Capabilities1
Initial Access4
T1078 Valid Accounts3 T1566 Phishing3 T1190 Exploit Public-Facing Application2 T1189 Drive-by Compromise1
Execution7
T1047 Windows Management Instrumentation3 T1053 Scheduled Task/Job2 T1059 Command and Scripting Interpreter1 T1106 Native API1 T1203 Exploitation for Client Execution1 T1204 User Execution1 T1574 Hijack Execution Flow1
Persistence7
T1078 Valid Accounts3 T1053 Scheduled Task/Job2 T1112 Modify Registry1 T1137 Office Application Startup1 T1543 Create or Modify System Process1 T1546 Event Triggered Execution1 T1547 Boot or Logon Autostart Execution1
Privilege Escalation6
T1078 Valid Accounts3 T1053 Scheduled Task/Job2 T1134 Access Token Manipulation1 T1543 Create or Modify System Process1 T1546 Event Triggered Execution1 T1547 Boot or Logon Autostart Execution1
Stealth5
T1078 Valid Accounts3 T1036 Masquerading2 T1134 Access Token Manipulation1 T1564 Hide Artifacts1 T1574 Hijack Execution Flow1
Defense Impairment3
T1112 Modify Registry1 T1553 Subvert Trust Controls1 T1686 Disable or Modify System Firewall1
Credential Access2
T1003 OS Credential Dumping1 T1539 Steal Web Session Cookie1
Discovery12
T1018 Remote System Discovery3 T1016 System Network Configuration Discovery2 T1046 Network Service Discovery2 T1049 System Network Connections Discovery2 T1083 File and Directory Discovery2 T1087 Account Discovery2 T1518 Software Discovery2 T1012 Query Registry1 T1057 Process Discovery1 T1069 Permission Groups Discovery1 T1482 Domain Trust Discovery1 T1680 Local Storage Discovery1
Lateral Movement2
T1021 Remote Services2 T1563 Remote Service Session Hijacking1
Collection3
T1560 Archive Collected Data3 T1005 Data from Local System2 T1074 Data Staged2
Command and Control3
T1001 Data Obfuscation1 T1090 Proxy1 T1095 Non-Application Layer Protocol1
Exfiltration1
T1567 Exfiltration Over Web Service1
Impact0
—
Techniques to detect first
TechniqueTacticsActorsUsed by, for example
T1018 Remote System Discovery discovery 3 NaikonToddyCatLOTUS PANDA
T1047 Windows Management Instrumentation execution 3 NaikonToddyCatLOTUS PANDA
T1078 Valid Accounts stealth, persistence, privilege-escalation, initial-access 3 NaikonToddyCatAPT17
T1560 Archive Collected Data collection 3 ToddyCatLOTUS PANDAAPT17
T1566 Phishing initial-access 3 NaikonToddyCatAPT17
T1005 Data from Local System collection 2 ToddyCatAPT17
T1016 System Network Configuration Discovery discovery 2 NaikonLOTUS PANDA
T1021 Remote Services lateral-movement 2 ToddyCatAPT17
T1036 Masquerading stealth 2 NaikonToddyCat
T1046 Network Service Discovery discovery 2 NaikonLOTUS PANDA
T1049 System Network Connections Discovery discovery 2 ToddyCatLOTUS PANDA
T1053 Scheduled Task/Job execution, persistence, privilege-escalation 2 NaikonToddyCat

Each actor counts once per technique; sub-techniques are counted under their parent. Only actors with a MITRE ATT&CK profile are included (4), so the map shows documented tradecraft, not everything that happens.