Updates - October 2022

v12

Techniques

Enterprise

New Techniques

• Acquire Infrastructure: Serverless (v1.0)
• Compromise Accounts: Cloud Accounts (v1.0)
• Compromise Infrastructure: Serverless (v1.0)
• Establish Accounts: Cloud Accounts (v1.0)
• Event Triggered Execution: Installer Packages (v1.0)
• Indicator Removal: Clear Mailbox Data (v1.0)
• Indicator Removal: Clear Network Connection History and Configurations (v1.0)
• Indicator Removal: Clear Persistence (v1.0)
• Modify Authentication Process: Hybrid Identity (v1.0)
• Modify Authentication Process: Multi-Factor Authentication (v1.0)
• Obfuscated Files or Information: Dynamic API Resolution (v1.0)
• Obfuscated Files or Information: Embedded Payloads (v1.0)
• Obfuscated Files or Information: Stripped Payloads (v1.0)
• Search Open Websites/Domains: Code Repositories (v1.0)
• Serverless Execution (v1.0)
• Stage Capabilities: SEO Poisoning (v1.0)
• Steal or Forge Authentication Certificates (v1.0)
• Traffic Signaling: Socket Filters (v1.0)

Technique Changes

• Account Discovery: Domain Account (v1.0→v1.1)
• Account Discovery: Local Account (v1.2→v1.3)
• Account Manipulation (v2.3→v2.4)
• Additional Cloud Credentials (v2.3→v2.4)
• Additional Cloud Roles (v2.0→v2.1)
• Acquire Infrastructure: Domains (v1.1→v1.2)
• Adversary-in-the-Middle (v2.1→v2.2)
• DHCP Spoofing (v1.0→v1.1)
• LLMNR/NBT-NS Poisoning and SMB Relay (v1.2→v1.3)
• Application Layer Protocol: DNS (v1.0→v1.1)
• BITS Jobs (v1.2→v1.3)
• Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (v1.1→v1.2)
• Boot or Logon Autostart Execution: Shortcut Modification (v1.1→v1.2)
• Credentials from Password Stores: Windows Credential Manager (v1.0→v1.1)
• Data Encrypted for Impact (v1.3→v1.4)
• Data from Cloud Storage (v1.1→v2.0)
• Data from Information Repositories: Code Repositories (v1.0→v1.1)
• Data from Local System (v1.4→v1.5)
• Data from Network Shared Drive (v1.2→v1.3)
• Domain Policy Modification: Domain Trust Modification (v1.0→v1.1)
• Domain Trust Discovery (v1.1→v1.2)
• Escape to Host (v1.2→v1.3)
• Event Triggered Execution (v1.1→v1.2)
• Exfiltration Over Web Service (v1.1→v1.2)
• Exfiltration to Cloud Storage (v1.0→v1.1)
• Exploitation for Privilege Escalation (v1.3→v1.4)
• External Remote Services (v2.3→v2.4)
• File and Directory Discovery (v1.4→v1.5)
• File and Directory Permissions Modification (v2.1→v2.2)
• Firmware Corruption (v1.1→v1.2)
• Gather Victim Identity Information: Email Addresses (v1.1→v1.2)
• Gather Victim Network Information: DNS (v1.0→v1.1)
• Gather Victim Network Information: Domain Properties (v1.0→v1.1)
• Impair Defenses (v1.2→v1.3)
• Disable or Modify Tools (v1.2→v1.3)
• Impair Command History Logging (v2.1→v2.2)
• Indicator Blocking (v1.0→v1.1)
• Indicator Removal (v1.3→v2.0)
• Clear Command History (v1.2→v1.3)
• Modify Authentication Process (v2.1→v2.2)
• Obfuscated Files or Information (v1.2→v1.3)
• Password Policy Discovery (v1.4→v1.5)
• Permission Groups Discovery: Domain Groups (v1.0→v1.1)
• Permission Groups Discovery: Local Groups (v1.0→v1.1)
• Phishing: Spearphishing Link (v2.2→v2.3)
• Phishing for Information: Spearphishing Link (v1.2→v1.3)
• Process Injection (v1.2→v1.3)
• Dynamic-link Library Injection (v1.1→v1.2)
• VDSO Hijacking (v1.0→v1.1)
• Remote System Discovery (v3.3→v3.4)
• Replication Through Removable Media (v1.1→v1.2)
• Scheduled Task/Job: Scheduled Task (v1.1→v1.2)
• Search Open Websites/Domains (v1.0→v1.1)
• Server Software Component (v1.3→v1.4)
• Web Shell (v1.2→v1.3)
• Stage Capabilities (v1.1→v1.2)
• Link Target (v1.1→v1.2)
• Upload Tool (v1.1→v1.2)
• Subvert Trust Controls: Code Signing (v1.0→v1.1)
• Subvert Trust Controls: Gatekeeper Bypass (v1.1→v1.2)
• System Information Discovery (v2.4→v2.5)
• System Network Configuration Discovery (v1.4→v1.5)
• System Network Connections Discovery (v2.3→v2.4)
• System Service Discovery (v1.3→v1.4)
• System Shutdown/Reboot (v1.1→v1.2)
• Traffic Signaling (v2.3→v2.4)
• Transfer Data to Cloud Account (v1.2→v1.3)
• Trusted Relationship (v2.2→v2.3)
• Use Alternate Authentication Material: Application Access Token (v1.3→v1.4)
• Valid Accounts (v2.4→v2.5)

Minor Technique Changes

• Abuse Elevation Control Mechanism: Elevated Execution with Prompt (v1.0→v1.0)
• Adversary-in-the-Middle: ARP Cache Poisoning (v1.1→v1.1)
• Brute Force: Password Guessing (v1.3→v1.3)
• Command and Scripting Interpreter: AppleScript (v1.1→v1.1)
• Compromise Infrastructure (v1.2→v1.2)
• Create or Modify System Process: Windows Service (v1.2→v1.2)
• Data Staged (v1.4→v1.4)
• Defacement: Internal Defacement (v1.1→v1.1)
• Disk Wipe (v1.0→v1.0)
• Disk Content Wipe (v1.0→v1.0)
• Hijack Execution Flow: Path Interception by Unquoted Path (v1.1→v1.1)
• Multi-Factor Authentication Request Generation (v1.0→v1.0)
• OS Credential Dumping: LSASS Memory (v1.1→v1.1)
• OS Credential Dumping: Security Account Manager (v1.0→v1.0)
• Search Open Technical Databases (v1.0→v1.0)
• Service Stop (v1.2→v1.2)

Technique Revocations

• No changes

Technique Deprecations

• No changes

Mobile

New Techniques

• No changes

Technique Changes

• No changes

Minor Technique Changes

• Location Tracking: Impersonate SS7 Nodes (v1.0→v1.0)
• Location Tracking: Remote Device Management Services (v1.0→v1.0)

Technique Revocations

• No changes

Technique Deprecations

• No changes