Cyber threats

ATT&CK Techniques against Thailand

Techniques used by the threat actors that target Thailand, by tactic · MITRE ATT&CK profiles · darker = more actors
9
Actors with a profile
80
Techniques
T1566
Most used · 8 actors
Reset
Reconnaissance4
T1589 Gather Victim Identity Information1 T1591 Gather Victim Org Information1 T1595 Active Scanning1 T1598 Phishing for Information1
Resource Development6
T1583 Acquire Infrastructure6 T1588 Obtain Capabilities4 T1608 Stage Capabilities4 T1584 Compromise Infrastructure1 T1585 Establish Accounts1 T1587 Develop Capabilities1
Initial Access7
T1566 Phishing8 T1078 Valid Accounts5 T1190 Exploit Public-Facing Application4 T1189 Drive-by Compromise2 T1195 Supply Chain Compromise2 T1199 Trusted Relationship2 T1133 External Remote Services1
Execution9
T1204 User Execution7 T1053 Scheduled Task/Job6 T1047 Windows Management Instrumentation5 T1059 Command and Scripting Interpreter5 T1574 Hijack Execution Flow4 T1106 Native API3 T1203 Exploitation for Client Execution1 T1559 Inter-Process Communication1 T1569 System Services1
Persistence9
T1053 Scheduled Task/Job6 T1078 Valid Accounts5 T1547 Boot or Logon Autostart Execution4 T1112 Modify Registry3 T1543 Create or Modify System Process2 T1098 Account Manipulation1 T1133 External Remote Services1 T1137 Office Application Startup1 T1505 Server Software Component1
Privilege Escalation8
T1053 Scheduled Task/Job6 T1078 Valid Accounts5 T1547 Boot or Logon Autostart Execution4 T1055 Process Injection3 T1543 Create or Modify System Process2 T1548 Abuse Elevation Control Mechanism2 T1068 Exploitation for Privilege Escalation1 T1098 Account Manipulation1
Stealth10
T1027 Obfuscated Files or Information5 T1078 Valid Accounts5 T1140 Deobfuscate/Decode Files or Information5 T1036 Masquerading4 T1574 Hijack Execution Flow4 T1055 Process Injection3 T1218 System Binary Proxy Execution3 T1070 Indicator Removal2 T1014 Rootkit1 T1564 Hide Artifacts1
Defense Impairment4
T1112 Modify Registry3 T1553 Subvert Trust Controls3 T1685 Disable or Modify Tools2 T1686 Disable or Modify System Firewall1
Credential Access4
T1003 OS Credential Dumping4 T1056 Input Capture2 T1555 Credentials from Password Stores2 T1552 Unsecured Credentials1
Discovery16
T1016 System Network Configuration Discovery5 T1018 Remote System Discovery5 T1049 System Network Connections Discovery4 T1087 Account Discovery4 T1033 System Owner/User Discovery3 T1046 Network Service Discovery3 T1057 Process Discovery3 T1083 File and Directory Discovery3 T1069 Permission Groups Discovery2 T1518 Software Discovery2 T1007 System Service Discovery1 T1012 Query Registry1 T1082 System Information Discovery1 T1217 Browser Information Discovery1 T1482 Domain Trust Discovery1 T1680 Local Storage Discovery1
Lateral Movement2
T1021 Remote Services3 T1210 Exploitation of Remote Services3
Collection6
T1560 Archive Collected Data4 T1005 Data from Local System3 T1074 Data Staged3 T1056 Input Capture2 T1119 Automated Collection2 T1039 Data from Network Shared Drive1
Command and Control5
T1105 Ingress Tool Transfer5 T1071 Application Layer Protocol3 T1090 Proxy2 T1568 Dynamic Resolution2 T1095 Non-Application Layer Protocol1
Exfiltration2
T1567 Exfiltration Over Web Service3 T1030 Data Transfer Size Limits1
Impact1
T1486 Data Encrypted for Impact2
Techniques to detect first
TechniqueTacticsActorsUsed by, for example
T1566 Phishing initial-access 8 NaikonEarth LuscaAPT27Lazarus GroupTA505
T1204 User Execution execution 7 NaikonEarth LuscaAPT27Lazarus GroupTA505
T1053 Scheduled Task/Job execution, persistence, privilege-escalation 6 NaikonEarth LuscaAPT27Lazarus GroupToddyCat
T1583 Acquire Infrastructure resource-development 6 Earth LuscaAPT41APT27Lazarus GroupTA505
T1016 System Network Configuration Discovery discovery 5 NaikonEarth LuscaAPT27Lazarus GroupAPT10
T1018 Remote System Discovery discovery 5 NaikonEarth LuscaAPT27ToddyCatAPT10
T1027 Obfuscated Files or Information stealth 5 Earth LuscaAPT27Lazarus GroupTA505APT10
T1047 Windows Management Instrumentation execution 5 NaikonEarth LuscaAPT27ToddyCatAPT10
T1059 Command and Scripting Interpreter execution 5 Earth LuscaAPT27TA505ToddyCatAPT10
T1078 Valid Accounts stealth, persistence, privilege-escalation, initial-access 5 NaikonAPT27TA505ToddyCatAPT10
T1105 Ingress Tool Transfer command-and-control 5 APT41APT27Lazarus GroupTA505APT10
T1140 Deobfuscate/Decode Files or Information stealth 5 Earth LuscaAPT27Lazarus GroupTA505APT10

Each actor counts once per technique; sub-techniques are counted under their parent. Only actors with a MITRE ATT&CK profile are included (9), so the map shows documented tradecraft, not everything that happens.