Cyber threats

ATT&CK Techniques against Macau

Techniques used by the threat actors that target Macau, by tactic · MITRE ATT&CK profiles · darker = more actors
1
Actors with a profile
17
Techniques
T1003
Most used · 1 actors
Reset
Reconnaissance0
—
Resource Development2
T1584 Compromise Infrastructure1 T1587 Develop Capabilities1
Initial Access2
T1189 Drive-by Compromise1 T1195 Supply Chain Compromise1
Execution4
T1053 Scheduled Task/Job1 T1059 Command and Scripting Interpreter1 T1204 User Execution1 T1574 Hijack Execution Flow1
Persistence2
T1053 Scheduled Task/Job1 T1136 Create Account1
Privilege Escalation1
T1053 Scheduled Task/Job1
Stealth3
T1036 Masquerading1 T1218 System Binary Proxy Execution1 T1574 Hijack Execution Flow1
Defense Impairment1
T1553 Subvert Trust Controls1
Credential Access1
T1003 OS Credential Dumping1
Discovery2
T1012 Query Registry1 T1082 System Information Discovery1
Lateral Movement0
—
Collection0
—
Command and Control2
T1071 Application Layer Protocol1 T1105 Ingress Tool Transfer1
Exfiltration0
—
Impact0
—
Techniques to detect first
TechniqueTacticsActorsUsed by, for example
T1003 OS Credential Dumping credential-access 1 BRONZE HIGHLAND
T1012 Query Registry discovery 1 BRONZE HIGHLAND
T1036 Masquerading stealth 1 BRONZE HIGHLAND
T1053 Scheduled Task/Job execution, persistence, privilege-escalation 1 BRONZE HIGHLAND
T1059 Command and Scripting Interpreter execution 1 BRONZE HIGHLAND
T1071 Application Layer Protocol command-and-control 1 BRONZE HIGHLAND
T1082 System Information Discovery discovery 1 BRONZE HIGHLAND
T1105 Ingress Tool Transfer command-and-control 1 BRONZE HIGHLAND
T1136 Create Account persistence 1 BRONZE HIGHLAND
T1189 Drive-by Compromise initial-access 1 BRONZE HIGHLAND
T1195 Supply Chain Compromise initial-access 1 BRONZE HIGHLAND
T1204 User Execution execution 1 BRONZE HIGHLAND

Each actor counts once per technique; sub-techniques are counted under their parent. Only actors with a MITRE ATT&CK profile are included (1), so the map shows documented tradecraft, not everything that happens.