Cyber threats

ATT&CK Techniques against Mongolia

Techniques used by the threat actors that target Mongolia, by tactic · MITRE ATT&CK profiles · darker = more actors
2
Actors with a profile
86
Techniques
T1003
Most used · 2 actors
Reset
Reconnaissance5
T1595 Active Scanning2 T1589 Gather Victim Identity Information1 T1591 Gather Victim Org Information1 T1596 Search Open Technical Databases1 T1598 Phishing for Information1
Resource Development5
T1583 Acquire Infrastructure2 T1584 Compromise Infrastructure2 T1588 Obtain Capabilities2 T1586 Compromise Accounts1 T1608 Stage Capabilities1
Initial Access8
T1189 Drive-by Compromise2 T1190 Exploit Public-Facing Application2 T1566 Phishing2 T1078 Valid Accounts1 T1091 Replication Through Removable Media1 T1133 External Remote Services1 T1199 Trusted Relationship1 T1669 Wi-Fi Networks1
Execution7
T1059 Command and Scripting Interpreter2 T1204 User Execution2 T1047 Windows Management Instrumentation1 T1053 Scheduled Task/Job1 T1203 Exploitation for Client Execution1 T1559 Inter-Process Communication1 T1574 Hijack Execution Flow1
Persistence12
T1098 Account Manipulation2 T1547 Boot or Logon Autostart Execution2 T1037 Boot or Logon Initialization Scripts1 T1053 Scheduled Task/Job1 T1078 Valid Accounts1 T1112 Modify Registry1 T1133 External Remote Services1 T1137 Office Application Startup1 T1505 Server Software Component1 T1542 Pre-OS Boot1 T1543 Create or Modify System Process1 T1546 Event Triggered Execution1
Privilege Escalation10
T1098 Account Manipulation2 T1547 Boot or Logon Autostart Execution2 T1037 Boot or Logon Initialization Scripts1 T1053 Scheduled Task/Job1 T1068 Exploitation for Privilege Escalation1 T1078 Valid Accounts1 T1134 Access Token Manipulation1 T1543 Create or Modify System Process1 T1546 Event Triggered Execution1 T1548 Abuse Elevation Control Mechanism1
Stealth14
T1027 Obfuscated Files or Information2 T1036 Masquerading2 T1140 Deobfuscate/Decode Files or Information2 T1218 System Binary Proxy Execution2 T1014 Rootkit1 T1070 Indicator Removal1 T1078 Valid Accounts1 T1134 Access Token Manipulation1 T1211 Exploitation for Stealth1 T1221 Template Injection1 T1542 Pre-OS Boot1 T1564 Hide Artifacts1 T1574 Hijack Execution Flow1 T1684 Social Engineering1
Defense Impairment2
T1112 Modify Registry1 T1685 Disable or Modify Tools1
Credential Access6
T1003 OS Credential Dumping2 T1040 Network Sniffing1 T1056 Input Capture1 T1110 Brute Force1 T1528 Steal Application Access Token1 T1557 Adversary-in-the-Middle1
Discovery10
T1057 Process Discovery2 T1007 System Service Discovery1 T1016 System Network Configuration Discovery1 T1018 Remote System Discovery1 T1033 System Owner/User Discovery1 T1040 Network Sniffing1 T1049 System Network Connections Discovery1 T1083 File and Directory Discovery1 T1120 Peripheral Device Discovery1 T1482 Domain Trust Discovery1
Lateral Movement4
T1210 Exploitation of Remote Services2 T1021 Remote Services1 T1091 Replication Through Removable Media1 T1550 Use Alternate Authentication Material1
Collection11
T1560 Archive Collected Data2 T1005 Data from Local System1 T1025 Data from Removable Media1 T1039 Data from Network Shared Drive1 T1056 Input Capture1 T1074 Data Staged1 T1113 Screen Capture1 T1114 Email Collection1 T1119 Automated Collection1 T1213 Data from Information Repositories1 T1557 Adversary-in-the-Middle1
Command and Control7
T1090 Proxy2 T1001 Data Obfuscation1 T1071 Application Layer Protocol1 T1092 Communication Through Removable Media1 T1102 Web Service1 T1105 Ingress Tool Transfer1 T1573 Encrypted Channel1
Exfiltration3
T1567 Exfiltration Over Web Service2 T1030 Data Transfer Size Limits1 T1048 Exfiltration Over Alternative Protocol1
Impact1
T1498 Network Denial of Service1
Techniques to detect first
TechniqueTacticsActorsUsed by, for example
T1003 OS Credential Dumping credential-access 2 Earth LuscaAPT28
T1027 Obfuscated Files or Information stealth 2 Earth LuscaAPT28
T1036 Masquerading stealth 2 Earth LuscaAPT28
T1057 Process Discovery discovery 2 Earth LuscaAPT28
T1059 Command and Scripting Interpreter execution 2 Earth LuscaAPT28
T1090 Proxy command-and-control 2 Earth LuscaAPT28
T1098 Account Manipulation persistence, privilege-escalation 2 Earth LuscaAPT28
T1140 Deobfuscate/Decode Files or Information stealth 2 Earth LuscaAPT28
T1189 Drive-by Compromise initial-access 2 Earth LuscaAPT28
T1190 Exploit Public-Facing Application initial-access 2 Earth LuscaAPT28
T1204 User Execution execution 2 Earth LuscaAPT28
T1210 Exploitation of Remote Services lateral-movement 2 Earth LuscaAPT28

Each actor counts once per technique; sub-techniques are counted under their parent. Only actors with a MITRE ATT&CK profile are included (2), so the map shows documented tradecraft, not everything that happens.