Impair Defenses: Safe Mode Boot

Defense Evasion [Mitre]

Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. …

Indicator Removal: Clear Network Connection History and Configurations

Defense Evasion [Mitre]

Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. Configuration settings as well as various artifacts that highlight connection history may be created on a system from behaviors that require network connections, such as Remote Services or External Remote Services. Defenders may use these artifacts to monitor or otherwise analyze …

Indicator Removal: Clear Persistence

Defense Evasion [Mitre]

Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, Modify Registry, Plist File Modification, or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.

In some instances, artifacts of persistence may also be …

Masquerading: Masquerade Task or Service

Defense Evasion [Mitre]

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description. Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries …

Modify Authentication Process

Defense Evasion [Mitre]

Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to …

Obfuscated Files or Information: Binary Padding

Defense Evasion [Mitre]

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations.

Binary padding effectively changes the checksum of the …

Rootkit

Defense Evasion [Mitre]

Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.

Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, …

System Script Proxy Execution: PubPrn

Defense Evasion [Mitre]

Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a Visual Basic script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the Windows Command Shell via Cscript.exe. For example, the following code publishes a printer within the specified domain: cscript pubprn Printer1 LDAP://CN=Container1,DC=Domain1,DC=Com.

Use Alternate Authentication Material: Pass the Ticket

Defense Evasion [Mitre]

Adversaries may "pass the ticket" using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system.

When …

Valid Accounts: Default Accounts

Defense Evasion [Mitre]

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the …

Search For Content

Search Result

Impair Defenses: Safe Mode Boot

Defense Evasion [Mitre]

Indicator Removal: Clear Network Connection History and Configurations

Defense Evasion [Mitre]

Indicator Removal: Clear Persistence

Defense Evasion [Mitre]

Masquerading: Masquerade Task or Service

Defense Evasion [Mitre]

Modify Authentication Process

Defense Evasion [Mitre]

Obfuscated Files or Information: Binary Padding

Defense Evasion [Mitre]

Rootkit

Defense Evasion [Mitre]

System Script Proxy Execution: PubPrn

Defense Evasion [Mitre]

Use Alternate Authentication Material: Pass the Ticket

Defense Evasion [Mitre]

Valid Accounts: Default Accounts

Defense Evasion [Mitre]