Reference
ATT&CK index
Everything published here, arranged by the technique it teaches rather than by the topic it belongs to. Tactics run in kill-chain order, because that order is the thing worth internalising.
Initial Access
- T1566Guided lab: nine hours at Northwind Freight, from lure to scheduled task
- T1190CISA just added four old local privilege escalation bugs to KEV. That is the interesting part. · Zimbra, again: unauthenticated command injection over SMTP
- T1078
- T1133
- T1195Gitea's diffpatch endpoint plants a Git hook, and the hook does the rest
Execution
- T1059Guided lab: nine hours at Northwind Freight, from lure to scheduled task · Q3 detection rule pack — persistence and execution · Emulating T1059.001 until the detection actually fires · Gitea's diffpatch endpoint plants a Git hook, and the hook does the rest · Zimbra, again: unauthenticated command injection over SMTP
- T1204
- T1053Guided lab: nine hours at Northwind Freight, from lure to scheduled task · Guided lab: the scheduled task that looks like Windows
- T1569
Persistence
- T1547Guided lab: find the Run key before it finds you · Q3 detection rule pack — persistence and execution · Run key persistence: what the registry alone will not tell you
- T1543Guided lab: a service that starts before you do
- T1546Guided lab: the persistence that leaves almost no log · Gitea's diffpatch endpoint plants a Git hook, and the hook does the rest
- T1136
- T1505