Cyber threats

ATT&CK Techniques against Singapore

Techniques used by the threat actors that target Singapore, by tactic · MITRE ATT&CK profiles · darker = more actors
8
Actors with a profile
64
Techniques
T1204
Most used · 6 actors
Reset
Reconnaissance0
—
Resource Development6
T1583 Acquire Infrastructure3 T1588 Obtain Capabilities3 T1584 Compromise Infrastructure1 T1585 Establish Accounts1 T1587 Develop Capabilities1 T1608 Stage Capabilities1
Initial Access3
T1566 Phishing6 T1078 Valid Accounts2 T1091 Replication Through Removable Media1
Execution8
T1204 User Execution6 T1059 Command and Scripting Interpreter4 T1053 Scheduled Task/Job3 T1106 Native API2 T1203 Exploitation for Client Execution2 T1574 Hijack Execution Flow2 T1047 Windows Management Instrumentation1 T1559 Inter-Process Communication1
Persistence6
T1053 Scheduled Task/Job3 T1078 Valid Accounts2 T1547 Boot or Logon Autostart Execution2 T1112 Modify Registry1 T1137 Office Application Startup1 T1546 Event Triggered Execution1
Privilege Escalation5
T1053 Scheduled Task/Job3 T1078 Valid Accounts2 T1547 Boot or Logon Autostart Execution2 T1055 Process Injection1 T1546 Event Triggered Execution1
Stealth10
T1027 Obfuscated Files or Information4 T1036 Masquerading4 T1078 Valid Accounts2 T1140 Deobfuscate/Decode Files or Information2 T1218 System Binary Proxy Execution2 T1574 Hijack Execution Flow2 T1014 Rootkit1 T1055 Process Injection1 T1220 XSL Script Processing1 T1564 Hide Artifacts1
Defense Impairment3
T1553 Subvert Trust Controls2 T1112 Modify Registry1 T1685 Disable or Modify Tools1
Credential Access3
T1003 OS Credential Dumping1 T1552 Unsecured Credentials1 T1555 Credentials from Password Stores1
Discovery14
T1016 System Network Configuration Discovery3 T1057 Process Discovery3 T1083 File and Directory Discovery2 T1087 Account Discovery2 T1007 System Service Discovery1 T1018 Remote System Discovery1 T1046 Network Service Discovery1 T1049 System Network Connections Discovery1 T1069 Permission Groups Discovery1 T1082 System Information Discovery1 T1124 System Time Discovery1 T1135 Network Share Discovery1 T1518 Software Discovery1 T1680 Local Storage Discovery1
Lateral Movement4
T1021 Remote Services1 T1091 Replication Through Removable Media1 T1550 Use Alternate Authentication Material1 T1570 Lateral Tool Transfer1
Collection4
T1005 Data from Local System1 T1114 Email Collection1 T1119 Automated Collection1 T1560 Archive Collected Data1
Command and Control6
T1071 Application Layer Protocol3 T1105 Ingress Tool Transfer3 T1001 Data Obfuscation1 T1090 Proxy1 T1568 Dynamic Resolution1 T1573 Encrypted Channel1
Exfiltration2
T1029 Scheduled Transfer1 T1041 Exfiltration Over C2 Channel1
Impact1
T1486 Data Encrypted for Impact1
Techniques to detect first
TechniqueTacticsActorsUsed by, for example
T1204 User Execution execution 6 NaikonTA505Aoqin DragonHigaisaMofang
T1566 Phishing initial-access 6 NaikonTA505HigaisaAPT1Mofang
T1027 Obfuscated Files or Information stealth 4 TA505Aoqin DragonHigaisaMofang
T1036 Masquerading stealth 4 NaikonAoqin DragonHigaisaAPT1
T1059 Command and Scripting Interpreter execution 4 TA505HigaisaAPT1RANCOR
T1016 System Network Configuration Discovery discovery 3 NaikonHigaisaAPT1
T1053 Scheduled Task/Job execution, persistence, privilege-escalation 3 NaikonHigaisaRANCOR
T1057 Process Discovery discovery 3 APT41HigaisaAPT1
T1071 Application Layer Protocol command-and-control 3 TA505HigaisaRANCOR
T1105 Ingress Tool Transfer command-and-control 3 APT41TA505RANCOR
T1583 Acquire Infrastructure resource-development 3 APT41TA505APT1
T1588 Obtain Capabilities resource-development 3 TA505Aoqin DragonAPT1

Each actor counts once per technique; sub-techniques are counted under their parent. Only actors with a MITRE ATT&CK profile are included (8), so the map shows documented tradecraft, not everything that happens.