| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Dynamic-link Library Injection - T1055.001 (f4599aa0-4f85-4a32-80ea-fc39dc965945) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
System Network Connections Discovery - T1049 (7e150503-88e7-4861-866b-ff1ac82c4475) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Credentials from Web Browsers - T1555.003 (58a3e6aa-4453-4cc8-a51f-4befe80b31a8) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Parent PID Spoofing - T1134.004 (93591901-3172-4e94-abf8-6034ab26f44a) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Thread Execution Hijacking - T1055.003 (41d9846c-f6af-4302-a654-24bba2729bc6) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Elevated Execution with Prompt - T1548.004 (b84903f0-c7d5-435d-a69e-de47cc3578c0) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Remote System Discovery - T1018 (e358d692-23c0-4a31-9eb6-ecc13a8d7735) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Control Panel - T1218.002 (4ff5d6a8-c062-4c68-a778-36fc5edd564f) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
XSL Script Processing - T1220 (ebbe170d-aa74-4946-8511-9921243415a3) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Deobfuscate/Decode Files or Information - T1140 (3ccef7ae-cb5e-48f6-8302-897105fbf55c) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
System Time Discovery - T1124 (f3c544dc-673c-4ef3-accb-53229f1ae077) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Query Registry - T1012 (c32f7008-9fea-41f7-8366-5eb9b74bd896) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Asynchronous Procedure Call - T1055.004 (7c0f17c9-1af6-4628-9cbd-9e45482dd605) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Match Legitimate Name or Location - T1036.005 (1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Process Discovery - T1057 (8f4a33ec-8b1f-4b80-a2f6-642b2e479580) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
AppCert DLLs - T1546.009 (7d57b371-10c2-45e5-b3cc-83a8fb380e4c) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
System Owner/User Discovery - T1033 (03d7999c-1f4c-42cc-8373-e7690d318104) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
System Information Discovery - T1082 (354a7f88-63fb-41b5-a801-ce3b377b36f1) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
System Network Configuration Discovery - T1016 (707399d6-ab3e-4963-9315-d9d3818cd6a0) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Thread Local Storage - T1055.005 (e49ee9d2-0d98-44ef-85e5-5d3100065744) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Ptrace System Calls - T1055.008 (ea016b56-ae0e-47fe-967a-cc0ad51af67f) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Rundll32 - T1218.011 (045d0922-2310-4e60-b5e4-3302302cb3c5) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Mavinject - T1218.013 (1bae753e-8e52-4055-a66d-2ead90303ca9) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Native API - T1106 (391d824f-0ef1-47a0-b0ee-c59a75e27670) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Screen Capture - T1113 (0259baeb-9f63-4c69-bf10-eb038c390688) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Compiled HTML File - T1218.001 (a6937325-9321-4e2e-bb2b-3ed2d40b2a9d) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
CMSTP - T1218.003 (4cbc6a62-9e34-4f94-8a19-5c1a11392a49) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Process Doppelgänging - T1055.013 (7007935a-a8a7-4c0b-bd98-4e85be8ed197) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Application Window Discovery - T1010 (4ae4f953-fe58-4cc8-a327-33257e30a830) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Windows Management Instrumentation - T1047 (01a5a209-b94c-450b-b7f9-946497d91055) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Mshta - T1218.005 (840a987a-99bd-4a80-a5c9-0cb2baa6cade) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Local Data Staging - T1074.001 (1c34f7aa-9341-4a48-bfab-af22e51aca6c) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
SQL Stored Procedures - T1505.001 (f9e9365a-9ca2-4d9c-8e7c-050d73d1101a) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
System Service Discovery - T1007 (322bad5a-1c49-4d23-ab79-76d641794afa) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Security Software Discovery - T1518.001 (cba37adb-d6fb-4610-b069-dd04c0643384) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Time Based Evasion - T1497.003 (4bed873f-0b7d-41d4-b93a-b6905d1f90b0) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
VDSO Hijacking - T1055.014 (98be40f2-c86b-4ade-b6fc-4964932040e5) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
AppInit DLLs - T1546.010 (cc89ecbd-3d33-4a41-bcca-001e702d18fd) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Bypass User Account Control - T1548.002 (120d5519-3098-4e1c-9191-2aa61232f073) |
Attack Pattern |
1 |
| System Call Analysis (8efc9cbd-0353-5a6f-8b9b-dcc72a91e8cd) |
MITRE D3FEND |
Scheduled Task/Job - T1053 (35dd844a-b219-4e2b-a6bb-efa9a75995a9) |
Attack Pattern |
1 |
| Process Injection - T1055 (43e7dc91-05b2-474c-b9ac-2ed4fe101f4d) |
Attack Pattern |
Dynamic-link Library Injection - T1055.001 (f4599aa0-4f85-4a32-80ea-fc39dc965945) |
Attack Pattern |
2 |
| Credentials from Web Browsers - T1555.003 (58a3e6aa-4453-4cc8-a51f-4befe80b31a8) |
Attack Pattern |
Credentials from Password Stores - T1555 (3fc9b85a-2862-4363-a64d-d692e3ffbee0) |
Attack Pattern |
2 |
| Parent PID Spoofing - T1134.004 (93591901-3172-4e94-abf8-6034ab26f44a) |
Attack Pattern |
Access Token Manipulation - T1134 (dcaa092b-7de9-4a21-977f-7fcb77e89c48) |
Attack Pattern |
2 |
| Process Injection - T1055 (43e7dc91-05b2-474c-b9ac-2ed4fe101f4d) |
Attack Pattern |
Thread Execution Hijacking - T1055.003 (41d9846c-f6af-4302-a654-24bba2729bc6) |
Attack Pattern |
2 |
| Elevated Execution with Prompt - T1548.004 (b84903f0-c7d5-435d-a69e-de47cc3578c0) |
Attack Pattern |
Abuse Elevation Control Mechanism - T1548 (67720091-eee3-4d2d-ae16-8264567f6f5b) |
Attack Pattern |
2 |
| Control Panel - T1218.002 (4ff5d6a8-c062-4c68-a778-36fc5edd564f) |
Attack Pattern |
System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) |
Attack Pattern |
2 |
| Process Injection - T1055 (43e7dc91-05b2-474c-b9ac-2ed4fe101f4d) |
Attack Pattern |
Asynchronous Procedure Call - T1055.004 (7c0f17c9-1af6-4628-9cbd-9e45482dd605) |
Attack Pattern |
2 |
| Masquerading - T1036 (42e8de7b-37b2-4258-905a-6897815e58e0) |
Attack Pattern |
Match Legitimate Name or Location - T1036.005 (1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2) |
Attack Pattern |
2 |
| AppCert DLLs - T1546.009 (7d57b371-10c2-45e5-b3cc-83a8fb380e4c) |
Attack Pattern |
Event Triggered Execution - T1546 (b6301b64-ef57-4cce-bb0b-77026f14a8db) |
Attack Pattern |
2 |
| Process Injection - T1055 (43e7dc91-05b2-474c-b9ac-2ed4fe101f4d) |
Attack Pattern |
Thread Local Storage - T1055.005 (e49ee9d2-0d98-44ef-85e5-5d3100065744) |
Attack Pattern |
2 |
| Process Injection - T1055 (43e7dc91-05b2-474c-b9ac-2ed4fe101f4d) |
Attack Pattern |
Ptrace System Calls - T1055.008 (ea016b56-ae0e-47fe-967a-cc0ad51af67f) |
Attack Pattern |
2 |
| System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) |
Attack Pattern |
Rundll32 - T1218.011 (045d0922-2310-4e60-b5e4-3302302cb3c5) |
Attack Pattern |
2 |
| Mavinject - T1218.013 (1bae753e-8e52-4055-a66d-2ead90303ca9) |
Attack Pattern |
System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) |
Attack Pattern |
2 |
| Compiled HTML File - T1218.001 (a6937325-9321-4e2e-bb2b-3ed2d40b2a9d) |
Attack Pattern |
System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) |
Attack Pattern |
2 |
| CMSTP - T1218.003 (4cbc6a62-9e34-4f94-8a19-5c1a11392a49) |
Attack Pattern |
System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) |
Attack Pattern |
2 |
| Process Injection - T1055 (43e7dc91-05b2-474c-b9ac-2ed4fe101f4d) |
Attack Pattern |
Process Doppelgänging - T1055.013 (7007935a-a8a7-4c0b-bd98-4e85be8ed197) |
Attack Pattern |
2 |
| Mshta - T1218.005 (840a987a-99bd-4a80-a5c9-0cb2baa6cade) |
Attack Pattern |
System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) |
Attack Pattern |
2 |
| Local Data Staging - T1074.001 (1c34f7aa-9341-4a48-bfab-af22e51aca6c) |
Attack Pattern |
Data Staged - T1074 (7dd95ff6-712e-4056-9626-312ea4ab4c5e) |
Attack Pattern |
2 |
| SQL Stored Procedures - T1505.001 (f9e9365a-9ca2-4d9c-8e7c-050d73d1101a) |
Attack Pattern |
Server Software Component - T1505 (d456de47-a16f-4e46-8980-e67478a12dcb) |
Attack Pattern |
2 |
| Software Discovery - T1518 (e3b6daca-e963-4a69-aee6-ed4fd653ad58) |
Attack Pattern |
Security Software Discovery - T1518.001 (cba37adb-d6fb-4610-b069-dd04c0643384) |
Attack Pattern |
2 |
| Time Based Evasion - T1497.003 (4bed873f-0b7d-41d4-b93a-b6905d1f90b0) |
Attack Pattern |
Virtualization/Sandbox Evasion - T1497 (82caa33e-d11a-433a-94ea-9b5a5fbef81d) |
Attack Pattern |
2 |
| VDSO Hijacking - T1055.014 (98be40f2-c86b-4ade-b6fc-4964932040e5) |
Attack Pattern |
Process Injection - T1055 (43e7dc91-05b2-474c-b9ac-2ed4fe101f4d) |
Attack Pattern |
2 |
| AppInit DLLs - T1546.010 (cc89ecbd-3d33-4a41-bcca-001e702d18fd) |
Attack Pattern |
Event Triggered Execution - T1546 (b6301b64-ef57-4cce-bb0b-77026f14a8db) |
Attack Pattern |
2 |
| Abuse Elevation Control Mechanism - T1548 (67720091-eee3-4d2d-ae16-8264567f6f5b) |
Attack Pattern |
Bypass User Account Control - T1548.002 (120d5519-3098-4e1c-9191-2aa61232f073) |
Attack Pattern |
2 |