Loading…
MITRE ATT&CK-based attack techniques — Exploit · Prevention · Detection
38 techniques
A guide to hardening the email and DNS layer. DMARC enforcement (p=reject) on top of SPF/DKIM, MTA-STS/TLS-RPT and BIMI, secure email gateway (Safe Links/Attachments, anti-impersonation), blocking automatic forwarding, DNSSEC, protective DNS (PDNS), and registrar/registry lock. Significantly reduces phishing, BEC, and domain spoofing.
A comprehensive defense-perspective analysis of data exfiltration and C2 channels: DNS tunneling (iodine/dnscat2), HTTPS C2, beaconing and jitter, domain fronting (largely blocked by major CDNs), malleable C2 (Cobalt Strike), staging/compression/encryption, ICMP and cloud storage exfil, and DoH. For detection: NetFlow/Zeek, JA3/JARM/JA4+, RITA beacon analysis, DNS entropy; for prevention: egress filtering, DNS RPZ, and TLS inspection.
A comprehensive map of NT hash, Kerberos ticket, and plaintext password theft via memory dumping of Windows authentication backbone LSASS (lsass.exe): Mimikatz/sekurlsa, comsvcs LOLBin, ProcDump, and nanodump attack methods; Sysmon EID 10 GrantedAccess masks + Sigma-based technical detection; Credential Guard, RunAsPPL, WDigest disable, and ASR rule hardening controls.
A comprehensive map of Windows UAC bypass (T1548.002) and access token manipulation (T1134) techniques: integrity levels, HKCU registry hijack families (fodhelper/eventvwr/sdclt/computerdefaults/SilentCleanup), token theft API chain, SeImpersonatePrivilege, and the Potato family (JuicyPotato/PrintSpoofer/RoguePotato/GodPotato). For each technique, the how-it-works → how-to-detect → how-to-prevent triad is provided.
Windows Management Instrumentation (WMI) event subscription writes the __EventFilter (WQL trigger), __EventConsumer (command/script payload), and __FilterToConsumerBinding triplet persistently into the root\\subscription CIM repository, providing a backdoor that runs with SYSTEM privileges and leaves no traditional autorun trace on disk. For detection, Sysmon EID 19/20/21 and WMI-Activity EID 5861 form the primary signature layer; process tree anomaly and subscription hunting form the behavioral layer.
When dangerous rights on DACLs attached to every Active Directory object (GenericAll, WriteDACL, WriteOwner, AllExtendedRights, ForceChangePassword, AddMember) are exploited, an attacker can trigger chains of password resets, group additions, targeted Kerberoasting, shadow credential injection, and DCSync permission grants with just a few LDAP operations. A single ACE added to the AdminSDHolder object propagates to all protected objects in a 60-minute cycle via the SDProp mechanism, creating a self-repairing backdoor. Detection relies on attribute-level behavioral monitoring on Events 5136/4662/4670; prevention relies on least privilege, tiered architecture, and periodic BloodHound ACL auditing.
A guide to establishing CIS Critical Security Controls v8 as an implementation roadmap. The structure of 18 controls and safeguards, prioritization via Implementation Groups (IG1/IG2/IG3), basic hygiene (IG1) first, measurement and maturity, and linking to the platform baseline/mitigation layer. Transforms hardening effort from a scattered checklist into a measurable program.
A practical guide for managing and hardening iOS and Android corporate fleets. Covers MDM/UEM enrollment, compliance policies, MAM app protection (corporate/personal separation, BYOD), encryption/passcode enforcement, jailbreak/root detection, sideloading prevention, remote lock/wipe, and compliance-based Conditional Access. Defense is organized across three axes: configuration, security features, and visibility/access control.
A guide to hardening macOS endpoints. Covers FileVault disk encryption, System Integrity Protection and Gatekeeper/notarization, TCC privacy controls, application firewall, MDM configuration profiles and compliance, Secure Boot, standard user, and EDR with centralized logging. Significantly reduces the macOS-specific execution and persistence surface.
A guide to risk-based vulnerability and patch management. Continuous asset-contextualized scanning, prioritization with KEV and EPSS, external attack surface management (EASM), remediation SLAs and verification, virtual patching, and the exception process. Significantly reduces the exposure window of exploited vulnerabilities.
A guide to hardening container and Kubernetes environments. Covers Pod Security (non-root, read-only rootfs, seccomp/capability reduction), RBAC least privilege and ServiceAccount token control, network policies (default-deny), signature/admission validation and image scanning, etcd/kubelet/API server hardening, and CWPP. Significantly raises the bar for container escape and cluster takeover.
A guide to protecting organizational data. Covers data classification and labeling, encryption at rest/in transit and key management, rights management (IRM/label-based protection), Data Loss Prevention (DLP), and access/file permissions. Significantly reduces the value of exfiltrated data in data theft and double-extortion scenarios.
A protocol and service-level hardening guide for Active Directory. Covers SMB signing and NTLM relay prevention, LDAP signing + channel binding, RC4 removal and Kerberos armoring (FAST), AD CS (ESC) defense, PrintNightmare/Print Spooler and SMBv1 removal. Significantly reduces the attack surface for relay, downgrade, and service-abuse attack paths.
A backup resilience guide that guarantees recoverability against ransomware. The 3-2-1(-1-0) rule, immutable (immutable/WORM) and offline/air-gapped copies, isolation of backup infrastructure and identity protection, encryption, regular restore tests (RTO/RPO), and forwarding backup events to SIEM. Significantly complicates the attacker's "I encrypted the backups too" scenario.
A guide to hardening Linux servers in line with the CIS Benchmark. Covers SSH (key-based authentication, strong ciphers), sudo and least privilege, SUID/SGID inventory, SELinux/AppArmor mandatory access control, sysctl/kernel lockdown, filesystem mount hardening, service reduction and patching, auditd with file integrity monitoring (AIDE), and centralizing logs to a SIEM. Significantly raises the bar for privilege escalation and persistence.
A guide explaining how flat networks facilitate lateral movement and how Zero Trust segmentation breaks that pattern. Covers macro/micro segmentation, default-deny and egress filtering, ZTNA beyond VPN, device authentication with NAC/802.1X, east-west traffic control, and visibility with NetFlow/NDR. Significantly reduces breach blast radius.
A guide to IAM hardening and secrets management in AWS/Azure/GCP environments. Covers least privilege and wildcard cleanup, root/management account protection, temporary credentials and workload identity federation instead of static keys, guardrails (SCP/Azure Policy), IMDSv2 hardening, centralized secret vaults and rotation, and CSPM and audit log forwarding to SIEM. Significantly raises the bar for cloud takeover via stolen credentials or secrets.
A guide to closing local administrator password reuse risk with Windows LAPS and managing privileged access with PAM/JIT. Covers migration from legacy LAPS to Windows LAPS, password encryption and access control, rotation, gMSA/dMSA service accounts, privilege lifecycle (request→approval→time-limited→remove), break-glass account management, and logging. Significantly raises the bar against a single host compromise spreading across the entire fleet.
