ABEFGHIJKLMNOPQRSTU
1
3902215621011236
2
DetectionsSequence of Events (SOE) AnalysisProtocol AnalysisCrisis ManagementSite WalkthroughShodan ReviewSecurity Information and Event Management (SIEM) Log AnalysisFirewall Log ReviewConsequence-Driven Threat HuntingEmployee InterviewsUser and Entity Behavior Analytics (UEBA)Endpoint AnalysisMemory AnalysisCyber Deception
3
4
TypeCard Name
5
C&C/ExfilScreenshot Exfilxxx
6
C&C/ExfilBridged Systemxx
7
C&C/ExfilExfiltration Over Physical Mediumxx
8
C&C/ExfilHTTP as Exfilxx
9
C&C/ExfilTCP Handshakes as Morse Codexxx
10
C&C/ExfilDNS as C2xxxx
11
Initial CompromiseVendor Portalxxx
12
Initial CompromiseDual-Homed Devicexxxx
13
Initial CompromiseInfected Authorized Vendor Laptopxxxx
14
Initial CompromiseData Historian Compromisexxxx
15
Initial CompromiseIT Compromised With Shared Domain Trustxxx
16
Initial CompromiseDirty USBxxxx
17
Initial CompromiseInsider Threatxx
18
Initial CompromiseExploitable APIxxxx
19
PersistStolen Engineering Workstation (EWS) Accountxxx
20
PersistMalicious Logon Scriptsxxxxx
21
PersistGPO Modificationxxxx
22
PersistMalicious Report Macrosxxxx
23
PersistHMI Graphics Manipulationxxx
24
PersistMalicious Firmwarexxxx
25
PersistAutorun Malwarexxx
26
PersistNew User Addedx
27
PersistAccessibility Featuresx
28
Pivot & EscalateEWS Issues Rogue Commandsxxxx
29
Pivot & EscalateModifying Read/Write Scriptsxxx
30
Pivot & EscalateInternal Password Sprayxxxx
31
Pivot & EscalateBroadcast/Multicast Protocol Poisoningxxxx
32
Pivot & EscalateNew Service Creation/Modificationxxx
33
Pivot & EscalateLocal Privilege Escalationxxx
34
Pivot & EscalateGPO Push of Scheduled Tasksxxx
35
Pivot & EscalateMalicious Project Filesxxxxx