Cyber threats

ATT&CK Techniques against Malaysia

Techniques used by the threat actors that target Malaysia, by tactic · MITRE ATT&CK profiles · darker = more actors
8
Actors with a profile
68
Techniques
T1059
Most used · 6 actors
Reset
Reconnaissance2
T1589 Gather Victim Identity Information1 T1595 Active Scanning1
Resource Development6
T1584 Compromise Infrastructure2 T1587 Develop Capabilities2 T1583 Acquire Infrastructure1 T1585 Establish Accounts1 T1586 Compromise Accounts1 T1588 Obtain Capabilities1
Initial Access6
T1566 Phishing6 T1078 Valid Accounts3 T1189 Drive-by Compromise3 T1190 Exploit Public-Facing Application2 T1133 External Remote Services1 T1195 Supply Chain Compromise1
Execution9
T1059 Command and Scripting Interpreter6 T1204 User Execution6 T1053 Scheduled Task/Job4 T1047 Windows Management Instrumentation3 T1203 Exploitation for Client Execution2 T1574 Hijack Execution Flow2 T1106 Native API1 T1197 BITS Jobs1 T1559 Inter-Process Communication1
Persistence9
T1053 Scheduled Task/Job4 T1078 Valid Accounts3 T1547 Boot or Logon Autostart Execution3 T1133 External Remote Services1 T1136 Create Account1 T1137 Office Application Startup1 T1197 BITS Jobs1 T1505 Server Software Component1 T1546 Event Triggered Execution1
Privilege Escalation5
T1053 Scheduled Task/Job4 T1078 Valid Accounts3 T1547 Boot or Logon Autostart Execution3 T1055 Process Injection1 T1546 Event Triggered Execution1
Stealth10
T1036 Masquerading5 T1218 System Binary Proxy Execution4 T1078 Valid Accounts3 T1027 Obfuscated Files or Information2 T1574 Hijack Execution Flow2 T1055 Process Injection1 T1140 Deobfuscate/Decode Files or Information1 T1197 BITS Jobs1 T1221 Template Injection1 T1564 Hide Artifacts1
Defense Impairment2
T1553 Subvert Trust Controls2 T1686 Disable or Modify System Firewall1
Credential Access3
T1003 OS Credential Dumping3 T1056 Input Capture1 T1555 Credentials from Password Stores1
Discovery13
T1082 System Information Discovery3 T1083 File and Directory Discovery3 T1518 Software Discovery3 T1018 Remote System Discovery2 T1057 Process Discovery2 T1069 Permission Groups Discovery2 T1012 Query Registry1 T1016 System Network Configuration Discovery1 T1046 Network Service Discovery1 T1049 System Network Connections Discovery1 T1087 Account Discovery1 T1135 Network Share Discovery1 T1680 Local Storage Discovery1
Lateral Movement2
T1021 Remote Services2 T1534 Internal Spearphishing1
Collection5
T1560 Archive Collected Data3 T1005 Data from Local System2 T1074 Data Staged2 T1039 Data from Network Shared Drive1 T1056 Input Capture1
Command and Control7
T1071 Application Layer Protocol2 T1090 Proxy2 T1102 Web Service2 T1105 Ingress Tool Transfer2 T1095 Non-Application Layer Protocol1 T1572 Protocol Tunneling1 T1573 Encrypted Channel1
Exfiltration2
T1567 Exfiltration Over Web Service2 T1041 Exfiltration Over C2 Channel1
Impact0
—
Techniques to detect first
TechniqueTacticsActorsUsed by, for example
T1059 Command and Scripting Interpreter execution 6 ToddyCatBRONZE HIGHLANDAPT40Inception FrameworkEl Machete
T1204 User Execution execution 6 NaikonBRONZE HIGHLANDAPT30APT40Inception Framework
T1566 Phishing initial-access 6 NaikonToddyCatAPT30APT40Inception Framework
T1036 Masquerading stealth 5 NaikonToddyCatBRONZE HIGHLANDEl MacheteSowbug
T1053 Scheduled Task/Job execution, persistence, privilege-escalation 4 NaikonToddyCatBRONZE HIGHLANDEl Machete
T1218 System Binary Proxy Execution stealth 4 BRONZE HIGHLANDAPT40Inception FrameworkEl Machete
T1003 OS Credential Dumping credential-access 3 BRONZE HIGHLANDAPT40Sowbug
T1047 Windows Management Instrumentation execution 3 NaikonToddyCatAPT40
T1078 Valid Accounts stealth, persistence, privilege-escalation, initial-access 3 NaikonToddyCatAPT40
T1082 System Information Discovery discovery 3 BRONZE HIGHLANDInception FrameworkSowbug
T1083 File and Directory Discovery discovery 3 ToddyCatInception FrameworkSowbug
T1189 Drive-by Compromise initial-access 3 BRONZE HIGHLANDAPT40El Machete

Each actor counts once per technique; sub-techniques are counted under their parent. Only actors with a MITRE ATT&CK profile are included (8), so the map shows documented tradecraft, not everything that happens.