Salt Typhoon

Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversar

In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an i

Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system log

Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. Configuration settings as w

Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may inv

Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns wi

Adversaries may abuse built-in CLI tools or API calls to execute malicious commands in containerized environments. The Docker CLI is used for managin

Adversaries may create or modify container or container cluster management tools that run as daemons, agents, or services on individual hosts. These i

Adversaries may create an account to maintain access to victim systems. With a sufficient level of access,

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by use

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new containe

Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversarie

Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gath

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detectio

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The d

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a

Adversaries may buy, steal, or download exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to c

Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in w

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users,

Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of p

Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The auth

Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last p

Adversaries may bridge network boundaries by compromising perimeter network devices or internal devices responsible for network segmentation. Breachin

Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads. The CLI is t

Adversaries may access network configuration files to collect sensitive data about the device and the network. The network configuration is a file con

Adversaries may disable network device-based firewall mechanisms entirely or add, delete, or modify particular rules in order to bypass controls limit

Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) rou

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vul

JumbledPath is a custom-built utility written in GO that has been used by [Salt Typhoon](https://attack.mit