On the MITRE ATT&CK Mapping page, any rules triggered by the sample are mapped to the MITRE ATT&CK matrix. The MITRE ATT&CK matrix contains a set of techniques used to accomplish specific objectives, or tactics, from gathering information about the target person or group, to extracting information from that target. For more information, click on a rule. The following table gives more information on each tactic:
Tactic | Description |
|---|---|
Initial access | Attempting to gain access to your system. For example, using a phising campaign. |
Execution | Running malicious code on your system. |
Persistence | Attempting to maintain access to your system. |
Privilege execution | Attempting to gain higher level permissions on your system |
Defense evasion | Attempting to avoid detection on your system. |
Credential access | Attempting to gain access to user names and passwords, for example by key logging. |
Discovery | Exploring your system to see what can be accessed and controlled. |
Lateral movement | Using legitimate credentials to move through your system. |
Collection | Gathering information of interest to the attacker. |
Comand and control | Communicating with compromised systems to control them. |
Exfiltration | Stealing data from your system. |
Impact | Manipulating, interrupting, or destroying systems and data. For example, using ransomware to encrypt data. |