MITRE ATT&CK 정리 및 번역(작성중)

Active Scanning

Gather Victim Host Information

Gather Victim Identity Information

Gather Victim Network Information

Gather Victim Org Information

Phishing for Information

Search Closed Sources

Search Open Technical Databases

Search Open Websites/Domains

Search Victim-Owned Websites

Acquire Infrastructure

Compromise Accounts

Compromise Infrastructure

Develop Capabilities

Establish Accounts

Obtain Capabilities

Stage Capabilities

Drive-by Compromise

Exploit Public-Facing Application

External Remote Services

Hardware Additions

Phishing

Replication Through Removable Media

Supply Chain Compromise

Trusted Relationship

Valid Accounts

Command and Scripting Interpreter

Container Administration Command

Deploy Container

Exploitation for Client Execution

Inter-Process Communication

Native API

Scheduled Task/Job

Shared Modules

Software Deployment Tools

System Services

User Execution

Windows Management Instrumentation

Account Manipulation

BITS Jobs

Boot or Logon Autostart Execution

Boot or Logon Initialization Scripts

Browser Extensions

Compromise Client Software Binary

Create Account

Create or Modify System Process

Event Triggered Execution

External Remote Services

Hijack Execution Flow

Implant Internal Image

Modify Authentication Process

Office Application Startup

Pre-OS Boot

Scheduled Task/Job

Server Software Component

Traffic Signaling

Valid Accounts

Abuse Elevation Control Mechanism

Access Token Manipulation

Boot or Logon Autostart Execution

Boot or Logon Initialization Scripts

Create or Modify System Process

Domain Policy Modification

Escape to Host

Event Triggered Execution

Exploitation for Privilege Escalation

Hijack Execution Flow

Process Injection

Scheduled Task/Job

Valid Accounts

Abuse Elevation Control Mechanism

Access Token Manipulation

BITS Jobs

Build Image on Host

Deobfuscate/Decode Files or Information

Deploy Container

Direct Volume Access

Domain Policy

Execution Guardrails

Exploitation for Defense Evasion

File and Directory Permissions Modification

Hide Artifacts

Hijack Execution Flow

Impair Defenses

Indicator Removal on Host

Indirect Command Execution

Masquerading

Modify Authentication Process

Modify Cloud Compute Infrastructure

Modify Registry

Modify System Image

Network Boundary Bridging

Obfuscated Files or Information

Pre-OS Boot

Process Injection

Reflective Code Loading

Rogue Domain Controller

Rootkit

Signed Binary Proxy Execution

Signed Script Proxy Execution

Subvert Trust Controls

Template Injection

Traffic Signaling

Trusted Developer Utilities Proxy Execution

Unused/Unsupported Cloud Regions

Use Alternate Authentication

Valid Accounts

Virtualization/Sandbox Evasion

Weaken Encryption

XSL Script Processing

Adversary-in-the-Middle

Brute Force

Credentials from Password Stores

Exploitation for Credential Access

Forced Authentication

Forge Web Credentials

Input Capture

Modify Authentication Process

Network Sniffing

OS Credential Dumping

Steal Application Access Token

Steal or Forge Kerberos Tickets

Steal Web Session Cookie

Two-Factor Authentication Interception

Unsecured Credentials

Account Discovery

Application Window Discovery

Browser Bookmark Discovery

Cloud Infrastructure Discovery

Cloud Service Dashboard

Cloud Service Discovery

Cloud Storage Object Discovery

Container and Resource Discovery

Domain Trust Discovery

File and Directory Discovery

Group Policy Discovery

Network Service Scanning

Network Share Discovery

Network Sniffing

Pasword Policy Discovery

Peripheral Device Discovery

Process Discovery

Query Registry

Remote System Discovery

Software Discovery

System Information Discovery

System Location Discovery

System Network Configuration Discovery

System Owner/User Discovery

System Time Discovery

Virtualization/Sandbox Evasion

Exploitation of Remote Services

Internal Spearphishing

Lateral Tool Transfer

Remote Service Session Hijacking

Remote Services

Replication Through Removable

Software Deployment Tools

Taint Shared Content

Use Alternate Authentication Material