https://dfir-lab.ch/_next/static/chunks/8676-4e7ce0593d97c8d8.js?dpl=dpl_3TCdhmKuVdziBBfDEiyuVRdY5ERS

1"use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[7531,8676],{72468:(t,e,i)=>{i.d(e,{QK:()=>s,QM:()=>c,Tw:()=>o,lP:()=>n});let a=[{id:"T1595",name:"Active Scanning",tactic:"Reconnaissance",description:"Probe victim infrastructure to gather information for targeting.",url:"https://attack.mitre.org/techniques/T1595/"},{id:"T1592",name:"Gather Victim Host Information",tactic:"Reconnaissance",description:"Collect details about victim hosts such as hardware, software, and configurations.",url:"https://attack.mitre.org/techniques/T1592/"},{id:"T1589",name:"Gather Victim Identity Information",tactic:"Reconnaissance",description:"Collect victim identity details like credentials, email addresses, or employee names.",url:"https://attack.mitre.org/techniques/T1589/"},{id:"T1583",name:"Acquire Infrastructure",tactic:"Resource Development",description:"Purchase or rent infrastructure such as servers, domains, or cloud services for operations.",url:"https://attack.mitre.org/techniques/T1583/"},{id:"T1587",name:"Develop Capabilities",tactic:"Resource Development",description:"Build custom malware, exploits, or tools for use in operations.",url:"https://attack.mitre.org/techniques/T1587/"},{id:"T1588",name:"Obtain Capabilities",tactic:"Resource Development",description:"Acquire tools, exploits, or malware from third-party sources.",url:"https://attack.mitre.org/techniques/T1588/"},{id:"T1566",name:"Phishing",tactic:"Initial Access",description:"Send deceptive messages to trick victims into executing malicious content.",url:"https://attack.mitre.org/techniques/T1566/"},{id:"T1566.001",name:"Spearphishing Attachment",tactic:"Initial Access",description:"Send targeted emails with malicious file attachments to gain initial access.",url:"https://attack.mitre.org/techniques/T1566/001/"},{id:"T1566.002",name:"Spearphishing Link",tactic:"Initial Access",description:"Send targeted emails with malicious links to credential harvesting or exploit pages.",url:"https://attack.mitre.org/techniques/T1566/002/"},{id:"T1190",name:"Exploit Public-Facing Application",tactic:"Initial Access",description:"Exploit vulnerabilities in internet-facing applications to gain access.",url:"https://attack.mitre.org/techniques/T1190/"},{id:"T1133",name:"External Remote Services",tactic:"Initial Access",description:"Abuse remote services like VPNs or RDP to gain access to the network.",url:"https://attack.mitre.org/techniques/T1133/"},{id:"T1078",name:"Valid Accounts",tactic:"Initial Access",description:"Use legitimate credentials to authenticate and gain access.",url:"https://attack.mitre.org/techniques/T1078/"},{id:"T1195",name:"Supply Chain Compromise",tactic:"Initial Access",description:"Manipulate products or delivery mechanisms before the victim receives them.",url:"https://attack.mitre.org/techniques/T1195/"},{id:"T1189",name:"Drive-by Compromise",tactic:"Initial Access",description:"Gain access through a user visiting a compromised website during normal browsing.",url:"https://attack.mitre.org/techniques/T1189/"},{id:"T1059",name:"Command and Scripting Interpreter",tactic:"Execution",description:"Abuse command-line interpreters and scripting languages to execute commands.",url:"https://attack.mitre.org/techniques/T1059/"},{id:"T1059.001",name:"PowerShell",tactic:"Execution",description:"Use PowerShell commands and scripts for execution and automation.",url:"https://attack.mitre.org/techniques/T1059/001/"},{id:"T1059.003",name:"Windows Command Shell",tactic:"Execution",description:"Use cmd.exe to execute commands and batch scripts.",url:"https://attack.mitre.org/techniques/T1059/003/"},{id:"T1204",name:"User Execution",tactic:"Execution",description:"Rely on user interaction to execute malicious payloads.",url:"https://attack.mitre.org/techniques/T1204/"},{id:"T1047",name:"Windows Management Instrumentation",tactic:"Execution",description:"Use WMI to execute commands and manage systems remotely.",url:"https://attack.mitre.org/techniques/T1047/"},{id:"T1053",name:"Scheduled Task/Job",tactic:"Execution",description:"Abuse task scheduling to execute malicious code at defined times or intervals.",url:"https://attack.mitre.org/techniques/T1053/"},{id:"T1547",name:"Boot or Logon Autostart Execution",tactic:"Persistence",description:"Configure code to run automatically during system boot or user logon.",url:"https://attack.mitre.org/techniques/T1547/"},{id:"T1547.001",name:"Registry Run Keys / Startup Folder",tactic:"Persistence",description:"Add programs to registry run keys or startup folders for automatic execution.",url:"https://attack.mitre.org/techniques/T1547/001/"},{id:"T1136",name:"Create Account",tactic:"Persistence",description:"Create new accounts to maintain access to victim systems.",url:"https://attack.mitre.org/techniques/T1136/"},{id:"T1543",name:"Create or Modify System Process",tactic:"Persistence",description:"Create or modify system-level processes like services or daemons for persistence.",url:"https://attack.mitre.org/techniques/T1543/"},{id:"T1546",name:"Event Triggered Execution",tactic:"Persistence",description:"Establish persistence by hooking into system events like WMI subscriptions or traps.",url:"https://attack.mitre.org/techniques/T1546/"},{id:"T1068",name:"Exploitation for Privilege Escalation",tactic:"Privilege Escalation",description:"Exploit software vulnerabilities to gain elevated privileges on a system.",url:"https://attack.mitre.org/techniques/T1068/"},{id:"T1548",name:"Abuse Elevation Control Mechanism",tactic:"Privilege Escalation",description:"Bypass UAC or sudo controls to escalate privileges.",url:"https://attack.mitre.org/techniques/T1548/"},{id:"T1070",name:"Indicator Removal",tactic:"Defense Evasion",description:"Delete or modify artifacts such as logs and files to hide activity.",url:"https://attack.mitre.org/techniques/T1070/"},{id:"T1027",name:"Obfuscated Files or Information",tactic:"Defense Evasion",description:"Encrypt, encode, or obfuscate payloads and data to evade detection.",url:"https://attack.mitre.org/techniques/T1027/"},{id:"T1036",name:"Masquerading",tactic:"Defense Evasion",description:"Disguise malicious artifacts by manipulating names or locations to appear legitimate.",url:"https://attack.mitre.org/techniques/T1036/"},{id:"T1055",name:"Process Injection",tactic:"Defense Evasion",description:"Inject code into running processes to evade defenses and elevate privileges.",url:"https://attack.mitre.org/techniques/T1055/"},{id:"T1218",name:"System Binary Proxy Execution",tactic:"Defense Evasion",description:"Use signed system binaries to proxy execution of malicious content.",url:"https://attack.mitre.org/techniques/T1218/"},{id:"T1562",name:"Impair Defenses",tactic:"Defense Evasion",description:"Disable or modify security tools, logging, or defensive mechanisms.",url:"https://attack.mitre.org/techniques/T1562/"},{id:"T1140",name:"Deobfuscate/Decode Files or Information",tactic:"Defense Evasion",description:"Decode or deobfuscate data and files that were previously hidden or encrypted.",url:"https://attack.mitre.org/techniques/T1140/"},{id:"T1003",name:"OS Credential Dumping",tactic:"Credential Acce

1ss",description:"Dump credentials from the operating system or security software.",url:"https://attack.mitre.org/techniques/T1003/"},{id:"T1003.001",name:"LSASS Memory",tactic:"Credential Access",description:"Access LSASS process memory to extract credential material.",url:"https://attack.mitre.org/techniques/T1003/001/"},{id:"T1110",name:"Brute Force",tactic:"Credential Access",description:"Systematically guess passwords or credentials to gain access.",url:"https://attack.mitre.org/techniques/T1110/"},{id:"T1555",name:"Credentials from Password Stores",tactic:"Credential Access",description:"Extract credentials from password managers, browsers, or keychains.",url:"https://attack.mitre.org/techniques/T1555/"},{id:"T1558",name:"Steal or Forge Kerberos Tickets",tactic:"Credential Access",description:"Steal or forge Kerberos tickets to access resources without credentials.",url:"https://attack.mitre.org/techniques/T1558/"},{id:"T1082",name:"System Information Discovery",tactic:"Discovery",description:"Collect OS version, architecture, hostname, and other system details.",url:"https://attack.mitre.org/techniques/T1082/"},{id:"T1083",name:"File and Directory Discovery",tactic:"Discovery",description:"Enumerate files and directories to find sensitive data or binaries.",url:"https://attack.mitre.org/techniques/T1083/"},{id:"T1046",name:"Network Service Discovery",tactic:"Discovery",description:"Scan for services running on remote hosts across the network.",url:"https://attack.mitre.org/techniques/T1046/"},{id:"T1087",name:"Account Discovery",tactic:"Discovery",description:"Enumerate local, domain, or cloud accounts on a system or environment.",url:"https://attack.mitre.org/techniques/T1087/"},{id:"T1018",name:"Remote System Discovery",tactic:"Discovery",description:"Discover remote systems on the network for lateral movement targets.",url:"https://attack.mitre.org/techniques/T1018/"},{id:"T1021",name:"Remote Services",tactic:"Lateral Movement",description:"Use legitimate remote services like SSH, RDP, or SMB to move between systems.",url:"https://attack.mitre.org/techniques/T1021/"},{id:"T1021.001",name:"Remote Desktop Protocol",tactic:"Lateral Movement",description:"Use RDP to connect to and control remote systems.",url:"https://attack.mitre.org/techniques/T1021/001/"},{id:"T1021.002",name:"SMB/Windows Admin Shares",tactic:"Lateral Movement",description:"Use SMB and administrative shares (C$, ADMIN$) to access remote systems.",url:"https://attack.mitre.org/techniques/T1021/002/"},{id:"T1570",name:"Lateral Tool Transfer",tactic:"Lateral Movement",description:"Transfer tools and files between compromised systems within the network.",url:"https://attack.mitre.org/techniques/T1570/"},{id:"T1005",name:"Data from Local System",tactic:"Collection",description:"Collect sensitive data stored on the local file system.",url:"https://attack.mitre.org/techniques/T1005/"},{id:"T1074",name:"Data Staged",tactic:"Collection",description:"Stage collected data in a central location before exfiltration.",url:"https://attack.mitre.org/techniques/T1074/"},{id:"T1114",name:"Email Collection",tactic:"Collection",description:"Collect email messages from mailboxes or mail servers.",url:"https://attack.mitre.org/techniques/T1114/"},{id:"T1560",name:"Archive Collected Data",tactic:"Collection",description:"Compress or encrypt collected data into archives before exfiltration.",url:"https://attack.mitre.org/techniques/T1560/"},{id:"T1071",name:"Application Layer Protocol",tactic:"Command and Control",description:"Communicate using application layer protocols like HTTP, DNS, or SMTP.",url:"https://attack.mitre.org/techniques/T1071/"},{id:"T1105",name:"Ingress Tool Transfer",tactic:"Command and Control",description:"Download additional tools or payloads from an external system.",url:"https://attack.mitre.org/techniques/T1105/"},{id:"T1572",name:"Protocol Tunneling",tactic:"Command and Control",description:"Tunnel network traffic through an existing protocol to avoid detection.",url:"https://attack.mitre.org/techniques/T1572/"},{id:"T1090",name:"Proxy",tactic:"Command and Control",description:"Route C2 traffic through intermediary proxies to obscure the source.",url:"https://attack.mitre.org/techniques/T1090/"},{id:"T1219",name:"Remote Access Software",tactic:"Command and Control",description:"Use legitimate remote access tools like TeamViewer or AnyDesk for C2.",url:"https://attack.mitre.org/techniques/T1219/"},{id:"T1573",name:"Encrypted Channel",tactic:"Command and Control",description:"Encrypt C2 communications to prevent content inspection.",url:"https://attack.mitre.org/techniques/T1573/"},{id:"T1041",name:"Exfiltration Over C2 Channel",tactic:"Exfiltration",description:"Exfiltrate stolen data over the existing command and control channel.",url:"https://attack.mitre.org/techniques/T1041/"},{id:"T1048",name:"Exfiltration Over Alternative Protocol",tactic:"Exfiltration",description:"Exfiltrate data using a different protocol than the primary C2 channel.",url:"https://attack.mitre.org/techniques/T1048/"},{id:"T1567",name:"Exfiltration Over Web Service",tactic:"Exfiltration",description:"Exfiltrate data to cloud storage services like Google Drive or Dropbox.",url:"https://attack.mitre.org/techniques/T1567/"},{id:"T1486",name:"Data Encrypted for Impact",tactic:"Impact",description:"Encrypt victim data to disrupt availability, typically for ransom.",url:"https://attack.mitre.org/techniques/T1486/"},{id:"T1489",name:"Service Stop",tactic:"Impact",description:"Stop critical services to disrupt operations or aid in data destruction.",url:"https://attack.mitre.org/techniques/T1489/"},{id:"T1490",name:"Inhibit System Recovery",tactic:"Impact",description:"Delete backups, shadow copies, or recovery partitions to prevent restoration.",url:"https://attack.mitre.org/techniques/T1490/"},{id:"T1491",name:"Defacement",tactic:"Impact",description:"Modify visual content on websites or systems to deliver messaging.",url:"https://attack.mitre.org/techniques/T1491/"},{id:"T1529",name:"System Shutdown/Reboot",tactic:"Impact",description:"Shut down or reboot systems to disrupt operations.",url:"https://attack.mitre.org/techniques/T1529/"},{id:"T1531",name:"Account Access Removal",tactic:"Impact",description:"Delete or lock accounts to interrupt victim access to systems.",url:"https://attack.mitre.org/techniques/T1531/"},{id:"T1485",name:"Data Destruction",tactic:"Impact",description:"Destroy data and files on victim systems to disrupt operations.",url:"https://attack.mitre.org/techniques/T1485/"}],r=new Map(a.map(t=>[t.id,t]));function s(t){return r.has(t)}function c(t){return r.get(t)}function o(t){return"https://attack.mitre.org/techniques/".concat(t.replace(".","/"),"/")}function n(t){if(!t.trim())return[];let e=t.toLowerCase();return a.filter(t=>t.id.toLowerCase().includes(e)||t.name.toLowerCase().includes(e)||t.tactic.toLowerCase().includes(e))}},87531:(t,e,i)=>{i.d(e,{cn:()=>s});var a=i(2821);let r=(0,i(75889).zu)({extend:{classGroups:{"font-size":[{text:["display-xl","display-lg","display-md","display-sm","body-lg","body-md","body-sm","mono-lg","mono-md","mono-sm","mono-xs","label"]}]}}});function s(){for(var t=arguments.length,e=Array(t),i=0;i<t;i++)e[i]=arguments[i];return r((0,a.$)(e))}}}]);