Detection & response
Turn logs and intelligence into investigations and a coordinated response.
Abuse Elevation Control Mechanism
Elevation-control abuse bypasses or misuses mechanisms governing privileged execution.
Access Token Manipulation
Access token manipulation changes or adopts operating-system security contexts.
Account Manipulation
Account manipulation changes identity settings to preserve or expand access.
Alert triage
Decide what the signal means, how urgent it is, and who owns the next step.
Application security logging
Application security logging records meaningful decisions and events that infrastructure logs cannot fully explain.
Archive Collected Data
Archiving collected data packages information for easier staging or transfer.
Audio Capture
Audio capture records conversations or other sound available through an accessed device or application.
Automated Collection
Automated collection repeatedly gathers internal information according to rules or triggers.
BITS Jobs
BITS job abuse uses Windows background transfer functionality for unauthorized transfers or recurring activity.
Boot or Logon Autostart Execution
Boot or logon autostart execution runs a program when a system starts or a user signs in.
Boot or Logon Initialization Scripts
Boot and logon initialization scripts can establish repeatable execution when a machine starts or a user signs in.
Browser Session Hijacking
Browser session hijacking interferes with an active browser session or its content.
Build Image on Host
Building an image on a host creates a workload artifact locally rather than retrieving the completed image from a registry.
Clipboard Data
Clipboard collection captures information users copy between applications.
Cloud audit logs
Control-plane and data-plane records answer different questions.
Cloud incident response
Investigate identities, APIs, and delegated access as well as workloads.
Command and Scripting Interpreter
Interpreter abuse runs commands through shells and scripting environments already available on a host.
Compromise Host Software Binary
Host software binary compromise replaces or modifies an existing executable to retain access or introduce unauthorized behavior.
Container Administration Command
Container administration abuse uses management interfaces to run commands inside workloads.
Create Account
Unauthorized account creation establishes a new identity that can retain access independently of the original compromised credential.
Create or Modify System Process
Creating or modifying a system process establishes execution through services or daemons.
Data exfiltration
Distinguish accessing, staging, and transferring information.
Data from Cloud Storage
Collection from cloud storage reads information through managed storage services.
Data from Configuration Repository
Configuration repository collection retrieves management data that can reveal device settings, relationships, or secrets.
Data from Information Repositories
Collection from information repositories targets collaboration and knowledge systems where organizations accumulate valuable material.
Data from Local System
Collection from a local system gathers information available on the compromised host.
Data from Network Shared Drive
Collection from network shared drives accesses information on remote file resources.
Data from Removable Media
Collection from removable media targets information available on attached storage.
Data Staged
Data staging collects information in a location convenient for later transfer.
Deobfuscate/Decode Files or Information
Deobfuscation restores transformed content so it can be used during an operation.
Deploy Container
Unauthorized container deployment introduces a new workload through orchestration or runtime authority.
Detection engineering
Build and test signals that lead to useful investigations.
Direct Volume Access
Direct volume access reads storage below ordinary file access paths.
Domain or Tenant Policy Modification
Domain or tenant policy modification alters centralized identity and security settings.
Email Collection
Email collection accesses messages or mailbox data that may contain sensitive business and recovery information.
Endpoint detection and response
Investigate host behavior and apply controlled response actions.
Eradication and recovery
Remove the causes and surviving access before restoring trustworthy service.
Escape to Host
Container escape crosses the intended workload-to-host boundary.
Evaluating information sources
Know where a claim came from and what it can actually support.
Event Triggered Execution
Event-triggered execution connects code to a system or application event.
Execution Guardrails
Execution guardrails make a payload run only when selected environmental conditions are met.
Exploit Public-Facing Application
Exploitation of a public-facing application turns a reachable weakness into an initial access path.
Exploitation for Client Execution
Client application exploitation uses a vulnerability in software that processes content on an endpoint.
Exploitation for Privilege Escalation
Privilege-escalation exploitation uses a vulnerability to gain authority beyond the initial execution context.
Exploitation for Stealth
Exploitation for stealth targets weaknesses that help an actor avoid visibility or hide access.
Exploitation of Remote Services
Remote service exploitation uses a vulnerability in another reachable system after access to the environment.
External Remote Services
External remote service abuse uses internet-accessible access mechanisms to obtain or retain internal access.
File and Directory Permissions Modification
Permission modification changes file or directory access rules to enable unauthorized activity.
Showing 48 of 115 matching notes