unc6240

Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or serv

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive dat

Adversaries may obtain access to generative artificial intelligence (AI) tools, such as large language models (LLMs), to aid various techniques during

Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: Trend

Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense

Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the part

An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This in

Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on

Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate s

Adversaries may search public code repositories for information about victims that can be used during targeting. Victims may store code in repositorie

Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromi

Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated wit

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by use

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and networ

Adversaries may access data from cloud storage. Many IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage,

Adversaries may leverage databases to mine valuable information. These databases may be hosted on-premises or in the cloud (both in platform-as-a-serv

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense E

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse

Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their op

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerabi

Adversaries may develop exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file s

Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own fina

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the syste

Tor is a software suite and network that provides increased anonymity on the Internet. It creates a multi-h