GUIDE (TRIPWIRE)

MITRE ATT&CK Matrix withCIS Controls 2–6 and Tripwire Mapping

It’s not enough to cast a wide cybersecurity net and hope you catch theadversaries trying to compromise your data.
Instead, you need to narrow your focus to make your efforts truly impactful.
But which of the countless potential cybersecurity attacks
out there should you choose to prioritize? MITRE’s Adversarial
Tactics, Techniques, and Common Knowledge (ATT&CK)​
Framework and the Center for Internet Security’s CIS Controls
are two industry-leading sources clearly stating whichcybersecurity best practices organizations and agencies
should heed.
» MITRE is a not-for-profit organization that operates
federally-​funded research and development centers.
Their ATT&CK framework is a useful cybersecurity model
illustrating how adversaries behave and explaining thetactics you should use to mitigate risk and improve security.
» The Center for Internet Security (CIS) is a nonprofit
organization that sources knowledge from IT experts aroundthe world. The CIS Controls is a list of 18 critical security
controls prioritized to protect from attack vectors. We’ll focus
on the first six controls, known as their “basic controls” (notethat Control 1 does not apply to the ATT&CK framework).

How MITRE ATT&CK and the CIS Controls Intersect

Both MITRE ATT&CK framework and the CIS Controls provide
the crucial intelligence you need in order to maintain astrong cybersecurity stance. Where MITRE focuses on specificactions taken by adversaries in an enterprise network andshows you how to combat them proactively, CIS lays out
a step-by-step process for securing your data in terms ofconfiguration management and other system hardening
processes.
Both empower you to take charge of your data’s andsystems’ safety. All in all, these are two distinct models
addressing similar issues. It’s not a matter of picking which
institution’s guidelines to follow—you should be utilizing
both of these resources simultaneously and ensuring youralignment with them often.

MITRE’s Adversarial Tactics, Techniques, and Common
Knowledge (ATT&CK™) is a curated knowledge base andmodel for cyber adversary behavior, reflecting the various
phases of an adversary’s lifecycle and the platforms they
are known to target. ATT&CK is useful for understanding
security risk against known adversary behavior, forplanning security improvements, and verifying defenses
work as expected.
— MITRE
Many organizations facing the current cybersecurity
environment are overwhelmed by what we call the“Fog of More”—a constant stream of new informationand problems. ... The CIS Controls are designed to bringpriority and focus to this daunting task, to harness thepower of a large expert community to identify andsupport high-value practices and foundational steps, andto stop “admiring the problem.”— Center for Internet Security

MITRE ATT&CK Matrix — Where Fortra’s Tripwire Helps (Windows)
INITIAL ACCESSEXECUTIONPERSISTENCEPRIVILEGE ESCALATIONDEFENSE EVASION

CREDENTIAL ACCESSDISCOVERYLATERAL MOVEMENTCOLLECTION

EXFILTRATIONCOMMAND AND CONTROL

Drive-by CompromiseAppleScript.bash_profile and .bashrc

Access Token Manipulation

Access Token Manipulation

Account Manipulation

Account Discovery

AppleScript

Audio Capture

Automated Exfiltration

Commonly Used Port

Exploit Public-Facing Application

CMSTP

Accessibility Features

Accessibility Features

BITS Jobs

Bash History

Application Window Discovery

Application Deployment Software

Automated Collection

Data Compressed

Communication Through Removable Media

Hardware Additions

Command-Line Interface

AppCert DLLs

AppCert Dlls

Binary Padding

Brute ForceBrowser Bookmark Discovery

Distributed Component Object Model

Clipboard Data

Data Encrypted

Connection Proxy

Replication Through Removable Media

Control Panel Items

AppInit DLLs

AppInit DLLs

Bypass User Account Control

Credential Dumping

File and Directory Discovery

Exploitation of Remote Services

Data Staged

Data Transfer Size Limits

Custom Command and Control Protocol

Spearphishing Attachments

Dynamic Data Exchange

Application Shimming

Application Shimming

CMSTP

Credentials in Files

Network Service Scanning

Logon Scripts

Data from Information Repositories

Exfiltration Over Alternative Protocol

Custom Cryptographic Protocol

Spearphishing Link

Execution through API

Authentication Package

Authentication Package

Clear Command History

Credentials in Registry

Network Share Discovery

Pass the Hash

Data from Local System

Exfiltration Over Command and Control Channel

Data Encoding

Spearphishing via Service

Execution through Module Load

BITS Jobs

DLL Search Order Hijacking

Code Signing

Exploitation for Credential Access

Password Policy Discovery

Pass the Ticket

Data from Network Shared Drive

Exfiltration Over Other Network Medium

Data Obfuscation

Supply Chain Compromise

Exploitation for Client Execution

BootkitDylib Hijacking

Component Firmware

Forced Authentication

Peripheral Device Discovery

Remote Desktop Protocol

Data from Removable Media

Exfiltration Over Physical Medium

Domain Fronting

Trusted Relationship

Graphical User Interface

Browser Extensions

Exploitation of Vulnerability

Component Object Model Hijacking

Hooking

Permission Groups Discovery

Remote File Copy

Email Collection

Scheduled Transfer

Fallback Channels

Valid Accounts

InstallUtil

Change Default File Association

Extra Window Memory Injection

Control Panel Items

Input Capture

Process Discovery

Remote Services

Input Capture

Multi-Stage Channels

LSASS DriverComponent Firmware

File System Permissions Weakness

DCShadow

Input Prompt

Query Registry

Replication Through Removable MediaMan in the Browser

Multi-hop Proxy

Launchctl

Component Object Model Hijacking

Hooking

DLL Search Order Hijacking

Kerberoasting

Remote System Discovery

SSH Hijacking

Screen Capture

Multiband Communication

Local Job Scheduling

DLL Search Order Hijacking

Image File Execution Options InjectionDLL Side-Loading

Keychain

Security Software Discovery

Shared WebrootVideo Capture

Multilayer Encryption

Mshta

Dylib Hijacking

Launch Daemon

Deobfuscate/Decode Files or Information

LLMNR/NBT-NS Poisoning

System Information Discovery

Taint Shared Content

Port Knocking

PowerShell

External Remote Services

New Service

Disabling Security Tools

Network Sniffing

System Network Configuration Discovery

Third-party Software

Remote Access Tools

Regsvcs/Regasm

File System Permissions Weakness

Path Interception

Exploitation of Vulnerability

Password Filter DLL

System Network Connections Discovery

Windows Admin Shares

Remote File Copy

Regsvr32

Hidden Files and Directories

Plist Modification

Extra Window Memory Injection

Private Keys

System Owner/User Discovery

Windows Remote Management

Standard Application Layer Protocol

Rundll32

Hooking

Port Monitors

File Deletion

Replication Through Removable Media

System Service Discovery

Standard Cryptographic Protocol

Scheduled Task

Hypervisor

Process Injection

File System Logical Offsets

Securityd Memory

System Time Discovery

Standard Non-Application Layer Protocol

Scripting

Image File Execution Options Injection

SID-History Injection

Gatekeeper Bypass

Two-Factor Authentication Interception

Service Execution

Kernel Modules and Extensions

Scheduled Task

HISTCONTROL

Signed Binary Proxy Execution

LC_LOAD_DYLIB Addition

Service Registry Permissions Weakness

Hidden Files and Directories

Signed Script Proxy Execution

LSASS Driver

Setuid and Setgid

Image File Execution Options Injection

SourceLaunch Agent

Startup Items

Hidden Users

Space after Filename

Launch Daemon

Sudo

Hidden Window

Third-party Software

Launchctl

Sudo Caching

Indicator Blocking

Trap

Local Job Scheduling

Valid Accounts

Indicator Removal from Tools

Trusted Developer Utilities

Login Item

Web Shell

Indicator Removal on Host

User Execution

Logon Scripts

Install Root Certificate

Windows Management Instrumentation

Modify Existing Service

InstallUtil

Windows Remote Management

Netsh Helper DLL

LC_MAIN Hijacking

New Service

Launchtctl

Office Application Startup

Masquerading

Path Interception

Modify Registry

Plist Modification

Mshta

Port Knocking

NTFS Extended Attributes

Port Monitors

Network Share Connection Removal

Rc.common

Obfuscated Files or Information

Re-opened Applications

Plist Modification

Redundant AccessPort Knocking

Registry Run Keys / Start Folder

Process Doppelgänging

SIP and Trust Provider Hijacking

Process Hollowing

Scheduled Task

Process Injection

Screensaver

Redundant Access

Security Support Provider

Regsvcs/Regasm

Service Registry Permissions Weakness

Regsvr32

Shortcut Modification

RootkitStartup Items

Rundll32

System Firmware

SIP and Trust Provider Hijacking

Time Providers

ScriptingTrap

Signed Binary Proxy Execution

Valid Accounts

Signed Script Proxy Execution

Web Shell

Software Packing

Windows Management Instrumentation Event Subscription

Space after Filename

Winlogon Helper DLLTimestomp

Create AccountTrusted Developer Utilities
Valid Accounts
Web Service

Uncommonly Used PortWeb Service

MITRE ATT&CK Matrix —=with CIS Control 2 overlay=Where Tripwire helps (Windows)

INITIAL ACCESSEXECUTIONPERSISTENCEPRIVILEGE ESCALATIONDEFENSE EVASION

CREDENTIAL ACCESSDISCOVERYLATERAL MOVEMENTCOLLECTION

EXFILTRATIONCOMMAND AND CONTROL

Drive-by CompromiseAppleScript.bash_profile and .bashrc

Access Token Manipulation

Access Token Manipulation

Account Manipulation

Account Discovery

AppleScript

Audio Capture

Automated Exfiltration

Commonly Used Port

Exploit Public-Facing Application

CMSTP

Accessibility Features

Accessibility Features

BITS Jobs

Bash History

Application Window Discovery

Application Deployment Software

Automated Collection

Data Compressed

Communication Through Removable Media

Hardware Additions

Command-Line Interface

AppCert DLLs

AppCert Dlls

Binary Padding

Brute ForceBrowser Bookmark Discovery

Distributed Component Object Model

Clipboard Data

Data Encrypted

Connection Proxy

Replication Through Removable Media

Control Panel Items

AppInit DLLs

AppInit DLLs

Bypass User Account Control

Credential Dumping

File and Directory Discovery

Exploitation of Remote Services

Data Staged

Data Transfer Size Limits

Custom Command and Control Protocol

Spearphishing Attachments

Dynamic Data Exchange

Application Shimming

Application Shimming

CMSTP

Credentials in Files

Network Service Scanning

Logon Scripts

Data from Information Repositories

Exfiltration Over Alternative Protocol

Custom Cryptographic Protocol

Spearphishing Link

Execution through API

Authentication Package

Authentication Package

Clear Command History

Credentials in Registry

Network Share Discovery

Pass the Hash

Data from Local System

Exfiltration Over Command and Control Channel

Data Encoding

Spearphishing via Service

Execution through Module Load

BITS Jobs

DLL Search Order Hijacking

Code Signing

Exploitation for Credential Access

Password Policy Discovery

Pass the Ticket

Data from Network Shared Drive

Exfiltration Over Other Network Medium

Data Obfuscation

Supply Chain Compromise

Exploitation for Client Execution

BootkitDylib Hijacking

Component Firmware

Forced Authentication

Peripheral Device Discovery

Remote Desktop Protocol

Data from Removable Media

Exfiltration Over Physical Medium

Domain Fronting

Trusted Relationship

Graphical User Interface

Browser Extensions

Exploitation of Vulnerability

Component Object Model Hijacking

Hooking

Permission Groups Discovery

Remote File Copy

Email Collection

Scheduled Transfer

Fallback Channels

Valid Accounts

InstallUtil

Change Default File Association

Extra Window Memory Injection

Control Panel Items

Input Capture

Process Discovery

Remote Services

Input Capture

Multi-Stage Channels

LSASS DriverComponent Firmware

File System Permissions Weakness

DCShadow

Input Prompt

Query Registry

Replication Through Removable MediaMan in the Browser

Multi-hop Proxy

Launchctl

Component Object Model Hijacking

Hooking

DLL Search Order Hijacking

Kerberoasting

Remote System Discovery

SSH Hijacking

Screen Capture

Multiband Communication

Video Capture

Multilayer Encryption

Create AccountLocal Job Scheduling

DLL Search Order Hijacking

Image File Execution Options InjectionDLL Side-Loading

Keychain

Security Software Discovery

Shared WebrootMshta

Dylib Hijacking

Launch Daemon

Deobfuscate/Decode Files or Information

LLMNR/NBT-NS Poisoning

System Information Discovery

Taint Shared Content

Port Knocking

PowerShell

External Remote Services

New Service

Disabling Security Tools

Network Sniffing

System Network Configuration Discovery

Third-party Software

Remote Access Tools

Regsvcs/Regasm

File System Permissions Weakness

Path Interception

Exploitation of Vulnerability

Password Filter DLL

System Network Connections Discovery

Windows Admin Shares

Remote File Copy

Regsvr32

Hidden Files and Directories

Plist Modification

Extra Window Memory Injection

Private Keys

System Owner/User Discovery

Windows Remote Management

Standard Application Layer Protocol

Rundll32

Hooking

Port Monitors

File Deletion

Replication Through Removable Media

System Service Discovery

Standard Cryptographic Protocol

Scheduled Task

Hypervisor

Process Injection

File System Logical Offsets

Securityd Memory

System Time Discovery

Standard Non-Application Layer Protocol

Scripting

Image File Execution Options Injection

SID-History Injection

Gatekeeper Bypass

Two-Factor Authentication Interception

Service Execution

Kernel Modules and Extensions

Scheduled Task

HISTCONTROL

Signed Binary Proxy Execution

LC_LOAD_DYLIB Addition

Service Registry Permissions Weakness

Hidden Files and Directories

Signed Script Proxy Execution

LSASS Driver

Setuid and Setgid

Image File Execution Options Injection

SourceLaunch Agent

Startup Items

Hidden Users

Space after Filename

Launch Daemon

Sudo

Hidden Window

Third-party Software

Launchctl

Sudo Caching

Indicator Blocking

Trap

Local Job Scheduling

Valid Accounts

Indicator Removal from Tools

Trusted Developer Utilities

Login Item

Web Shell

Indicator Removal on Host

User Execution

Logon Scripts

Install Root Certificate

Windows Management Instrumentation

Modify Existing Service

InstallUtil

Windows Remote Management

Netsh Helper DLL

LC_MAIN Hijacking

New Service

Launchtctl

Office Application Startup

Masquerading

Path Interception

Modify Registry

Plist Modification

Mshta

Port Knocking

NTFS Extended Attributes

Port Monitors

Network Share Connection Removal

Rc.common

Obfuscated Files or Information

Re-opened Applications

Plist Modification

Redundant AccessPort Knocking

Registry Run Keys / Start Folder

Process Doppelgänging

SIP and Trust Provider Hijacking

Process Hollowing

Scheduled Task

Process Injection

Screensaver

Redundant Access

Security Support Provider

Regsvcs/Regasm

Service Registry Permissions Weakness

Regsvr32

Shortcut Modification

RootkitStartup Items

Rundll32

System Firmware

SIP and Trust Provider Hijacking

Time Providers

ScriptingTrap

Signed Binary Proxy Execution

Valid Accounts

Signed Script Proxy Execution

Web Shell

Software Packing

Windows Management Instrumentation Event Subscription

Space after Filename

Winlogon Helper DLLTimestomp
Trusted Developer Utilities
Valid Accounts
Web Service

Uncommonly Used PortWeb Service

MITRE ATT&CK Matrix —=with CIS Control 3 overlay=Where Tripwire helps (Windows)

INITIAL ACCESSEXECUTIONPERSISTENCEPRIVILEGE ESCALATIONDEFENSE EVASION

CREDENTIAL ACCESSDISCOVERYLATERAL MOVEMENTCOLLECTION

EXFILTRATIONCOMMAND AND CONTROL

Drive-by CompromiseAppleScript.bash_profile and .bashrc

Access Token Manipulation

Access Token Manipulation

Account Manipulation

Account Discovery

AppleScript

Audio Capture

Automated Exfiltration

Commonly Used Port

Exploit Public-Facing Application

CMSTP

Accessibility Features

Accessibility Features

BITS Jobs

Bash History

Application Window Discovery

Application Deployment Software

Automated Collection

Data Compressed

Communication Through Removable Media

Hardware Additions

Command-Line Interface

AppCert DLLs

AppCert Dlls

Binary Padding

Brute ForceBrowser Bookmark Discovery

Distributed Component Object Model

Clipboard Data

Data Encrypted

Connection Proxy

Replication Through Removable Media

Control Panel Items

AppInit DLLs

AppInit DLLs

Bypass User Account Control

Credential Dumping

File and Directory Discovery

Exploitation of Remote Services

Data Staged

Data Transfer Size Limits

Custom Command and Control Protocol

Spearphishing Attachments

Dynamic Data Exchange

Application Shimming

Application Shimming

CMSTP

Credentials in Files

Network Service Scanning

Logon Scripts

Data from Information Repositories

Exfiltration Over Alternative Protocol

Custom Cryptographic Protocol

Spearphishing Link

Execution through API

Authentication Package

Authentication Package

Clear Command History

Credentials in Registry

Network Share Discovery

Pass the Hash

Data from Local System

Exfiltration Over Command and Control Channel

Data Encoding

Spearphishing via Service

Execution through Module Load

BITS Jobs

DLL Search Order Hijacking

Code Signing

Exploitation for Credential Access

Password Policy Discovery

Pass the Ticket

Data from Network Shared Drive

Exfiltration Over Other Network Medium

Data Obfuscation

Supply Chain Compromise

Exploitation for Client Execution

BootkitDylib Hijacking

Component Firmware

Forced Authentication

Peripheral Device Discovery

Remote Desktop Protocol

Data from Removable Media

Exfiltration Over Physical Medium

Domain Fronting

Trusted Relationship

Graphical User Interface

Browser Extensions

Exploitation of Vulnerability

Component Object Model Hijacking

Hooking

Permission Groups Discovery

Remote File Copy

Email Collection

Scheduled Transfer

Fallback Channels

Valid Accounts

InstallUtil

Change Default File Association

Extra Window Memory Injection

Control Panel Items

Input Capture

Process Discovery

Remote Services

Input Capture

Multi-Stage Channels

LSASS DriverComponent Firmware

File System Permissions Weakness

DCShadow

Input Prompt

Query Registry

Replication Through Removable MediaMan in the Browser

Multi-hop Proxy

Launchctl

Component Object Model Hijacking

Hooking

DLL Search Order Hijacking

Kerberoasting

Remote System Discovery

SSH Hijacking

Screen Capture

Multiband Communication

Local Job Scheduling

DLL Search Order Hijacking

Image File Execution Options InjectionDLL Side-Loading

Keychain

Security Software Discovery

Shared WebrootVideo Capture

Multilayer Encryption

Mshta

Dylib Hijacking

Launch Daemon

Deobfuscate/Decode Files or Information

LLMNR/NBT-NS Poisoning

System Information Discovery

Taint Shared Content

Port Knocking

PowerShell

External Remote Services

New Service

Disabling Security Tools

Network Sniffing

System Network Configuration Discovery

Third-party Software

Remote Access Tools

Regsvcs/Regasm

File System Permissions Weakness

Path Interception

Exploitation of Vulnerability

Password Filter DLL

System Network Connections Discovery

Windows Admin Shares

Remote File Copy

Regsvr32

Hidden Files and Directories

Plist Modification

Extra Window Memory Injection

Private Keys

System Owner/User Discovery

Windows Remote Management

Standard Application Layer Protocol

Rundll32

Hooking

Port Monitors

File Deletion

Replication Through Removable Media

System Service Discovery

Standard Cryptographic Protocol

Scheduled Task

Hypervisor

Process Injection

File System Logical Offsets

Securityd Memory

System Time Discovery

Standard Non-Application Layer Protocol

Scripting

Image File Execution Options Injection

SID-History Injection

Gatekeeper Bypass

Two-Factor Authentication Interception

Service Execution

Kernel Modules and Extensions

Scheduled Task

HISTCONTROL

Signed Binary Proxy Execution

LC_LOAD_DYLIB Addition

Service Registry Permissions Weakness

Hidden Files and Directories

Signed Script Proxy Execution

LSASS Driver

Setuid and Setgid

Image File Execution Options Injection

SourceLaunch Agent

Startup Items

Hidden Users

Space after Filename

Launch Daemon

Sudo

Hidden Window

Third-party Software

Launchctl

Sudo Caching

Indicator Blocking

Trap

Local Job Scheduling

Valid Accounts

Indicator Removal from Tools

Trusted Developer Utilities

Login Item

Web Shell

Indicator Removal on Host

User Execution

Logon Scripts

Install Root Certificate

Windows Management Instrumentation

Modify Existing Service

InstallUtil

Windows Remote Management

Netsh Helper DLL

LC_MAIN Hijacking

New Service

Launchtctl

Office Application Startup

Masquerading

Path Interception

Modify Registry

Plist Modification

Mshta

Port Knocking

NTFS Extended Attributes

Port Monitors

Network Share Connection Removal

Rc.common

Obfuscated Files or Information

Re-opened Applications

Plist Modification

Redundant AccessPort Knocking

Registry Run Keys / Start Folder

Process Doppelgänging

SIP and Trust Provider Hijacking

Process Hollowing

Scheduled Task

Process Injection

Screensaver

Redundant Access

Security Support Provider

Regsvcs/Regasm

Service Registry Permissions Weakness

Regsvr32

Shortcut Modification

RootkitStartup Items

Rundll32

System Firmware

SIP and Trust Provider Hijacking

Time Providers

ScriptingTrap

Signed Binary Proxy Execution

Valid Accounts

Signed Script Proxy Execution

Web Shell

Software Packing

Windows Management Instrumentation Event Subscription

Space after Filename

Winlogon Helper DLLTimestomp
Trusted Developer Utilities
Valid Accounts
Web Service

Uncommonly Used PortWeb Service

MITRE ATT&CK Matrix —=with CIS Control 4 overlay=Where Tripwire helps (Windows)

INITIAL ACCESSEXECUTIONPERSISTENCEPRIVILEGE ESCALATIONDEFENSE EVASION

CREDENTIAL ACCESSDISCOVERYLATERAL MOVEMENTCOLLECTION

EXFILTRATIONCOMMAND AND CONTROL

Drive-by CompromiseAppleScript.bash_profile and .bashrc

Access Token Manipulation

Access Token Manipulation

Account Manipulation

Account Discovery

AppleScript

Audio Capture

Automated Exfiltration

Commonly Used Port

Exploit Public-Facing Application

CMSTP

Accessibility Features

Accessibility Features

BITS Jobs

Bash History

Application Window Discovery

Application Deployment Software

Automated Collection

Data Compressed

Communication Through Removable Media

Hardware Additions

Command-Line Interface

AppCert DLLs

AppCert Dlls

Binary Padding

Brute ForceBrowser Bookmark Discovery

Distributed Component Object Model

Clipboard Data

Data Encrypted

Connection Proxy

Replication Through Removable Media

Control Panel Items

AppInit DLLs

AppInit DLLs

Bypass User Account Control

Credential Dumping

File and Directory Discovery

Exploitation of Remote Services

Data Staged

Data Transfer Size Limits

Custom Command and Control Protocol

Spearphishing Attachments

Dynamic Data Exchange

Application Shimming

Application Shimming

CMSTP

Credentials in Files

Network Service Scanning

Logon Scripts

Data from Information Repositories

Exfiltration Over Alternative Protocol

Custom Cryptographic Protocol

Spearphishing Link

Execution through API

Authentication Package

Authentication Package

Clear Command History

Credentials in Registry

Network Share Discovery

Pass the Hash

Data from Local System

Exfiltration Over Command and Control Channel

Data Encoding

Spearphishing via Service

Execution through Module Load

BITS Jobs

DLL Search Order Hijacking

Code Signing

Exploitation for Credential Access

Password Policy Discovery

Pass the Ticket

Data from Network Shared Drive

Exfiltration Over Other Network Medium

Data Obfuscation

Supply Chain Compromise

Exploitation for Client Execution

BootkitDylib Hijacking

Component Firmware

Forced Authentication

Peripheral Device Discovery

Remote Desktop Protocol

Data from Removable Media

Exfiltration Over Physical Medium

Domain Fronting

Trusted Relationship

Graphical User Interface

Browser Extensions

Exploitation of Vulnerability

Component Object Model Hijacking

Hooking

Permission Groups Discovery

Remote File Copy

Email Collection

Scheduled Transfer

Fallback Channels

Valid Accounts

InstallUtil

Change Default File Association

Extra Window Memory Injection

Control Panel Items

Input Capture

Process Discovery

Remote Services

Input Capture

Multi-Stage Channels

LSASS DriverComponent Firmware

File System Permissions Weakness

DCShadow

Input Prompt

Query Registry

Replication Through Removable MediaMan in the Browser

Multi-hop Proxy

Launchctl

Component Object Model Hijacking

Hooking

DLL Search Order Hijacking

Kerberoasting

Remote System Discovery

SSH Hijacking

Screen Capture

Multiband Communication

Local Job Scheduling

DLL Search Order Hijacking

Image File Execution Options InjectionDLL Side-Loading

Keychain

Security Software Discovery

Shared WebrootVideo Capture

Multilayer Encryption

Mshta

Dylib Hijacking

Launch Daemon

Deobfuscate/Decode Files or Information

LLMNR/NBT-NS Poisoning

System Information Discovery

Taint Shared Content

Port Knocking

PowerShell

External Remote Services

New Service

Disabling Security Tools

Network Sniffing

System Network Configuration Discovery

Third-party Software

Remote Access Tools

Regsvcs/Regasm

File System Permissions Weakness

Path Interception

Exploitation of Vulnerability

Password Filter DLL

System Network Connections Discovery

Windows Admin Shares

Remote File Copy

Regsvr32

Hidden Files and Directories

Plist Modification

Extra Window Memory Injection

Private Keys

System Owner/User Discovery

Windows Remote Management

Standard Application Layer Protocol

Rundll32

Hooking

Port Monitors

File Deletion

Replication Through Removable Media

System Service Discovery

Standard Cryptographic Protocol

Scheduled Task

Hypervisor

Process Injection

File System Logical Offsets

Securityd Memory

System Time Discovery

Standard Non-Application Layer Protocol

Scripting

Image File Execution Options Injection

SID-History Injection

Gatekeeper Bypass

Two-Factor Authentication Interception

Service Execution

Kernel Modules and Extensions

Scheduled Task

HISTCONTROL

Signed Binary Proxy Execution

LC_LOAD_DYLIB Addition

Service Registry Permissions Weakness

Hidden Files and Directories

Signed Script Proxy Execution

LSASS Driver

Setuid and Setgid

Image File Execution Options Injection

SourceLaunch Agent

Startup Items

Hidden Users

Space after Filename

Launch Daemon

Sudo

Hidden Window

Third-party Software

Launchctl

Sudo Caching

Indicator Blocking

Trap

Local Job Scheduling

Valid Accounts

Indicator Removal from Tools

Trusted Developer Utilities

Login Item

Web Shell

Indicator Removal on Host

User Execution

Logon Scripts

Bypass User Account Control

Install Root Certificate

Windows Management Instrumentation

Modify Existing Service

InstallUtil

Windows Remote Management

Netsh Helper DLL

LC_MAIN Hijacking

New Service

Launchtctl

Office Application Startup

Masquerading

Path Interception

Modify Registry

Plist Modification

Mshta

Port Knocking

NTFS Extended Attributes

Port Monitors

Network Share Connection Removal

Rc.common

Obfuscated Files or Information

Re-opened Applications

Plist Modification

Redundant AccessPort Knocking

Registry Run Keys / Start Folder

Process Doppelgänging

SIP and Trust Provider Hijacking

Process Hollowing

Scheduled Task

Process Injection

Screensaver

Redundant Access

Security Support Provider

Regsvcs/Regasm

Service Registry Permissions Weakness

Regsvr32

Shortcut Modification

RootkitStartup Items

Rundll32

System Firmware

SIP and Trust Provider Hijacking

Time Providers

ScriptingTrap

Signed Binary Proxy Execution

Valid Accounts

Signed Script Proxy Execution

Web Shell

Software Packing

Windows Management Instrumentation Event
Subscription

Space after Filename

Winlogon Helper DLLTimestomp

Create AccountTrusted Developer Utilities
Valid Accounts
Web Service

Uncommonly Used PortWeb Service

MITRE ATT&CK Matrix —=with CIS Control 5 overlay=Where Tripwire helps (Windows)

INITIAL ACCESSEXECUTIONPERSISTENCEPRIVILEGE ESCALATIONDEFENSE EVASION

CREDENTIAL ACCESSDISCOVERYLATERAL MOVEMENTCOLLECTION

EXFILTRATIONCOMMAND AND CONTROL

Drive-by CompromiseAppleScript.bash_profile and .bashrc

Access Token Manipulation

Access Token Manipulation

Account Manipulation

Account Discovery

AppleScript

Audio Capture

Automated Exfiltration

Commonly Used Port

Exploit Public-Facing Application

CMSTP

Accessibility Features

Accessibility Features

BITS Jobs

Bash History

Application Window Discovery

Application Deployment Software

Automated Collection

Data Compressed

Communication Through Removable Media

Hardware Additions

Command-Line Interface

AppCert DLLs

AppCert Dlls

Binary Padding

Brute ForceBrowser Bookmark Discovery

Distributed Component Object Model

Clipboard Data

Data Encrypted

Connection Proxy

Replication Through Removable Media

Control Panel Items

AppInit DLLs

AppInit DLLs

Bypass User Account Control

Credential Dumping

File and Directory Discovery

Exploitation of Remote Services

Data Staged

Data Transfer Size Limits

Custom Command and Control Protocol

Spearphishing Attachments

Dynamic Data Exchange

Application Shimming

Application Shimming

CMSTP

Credentials in Files

Network Service Scanning

Logon Scripts

Data from Information Repositories

Exfiltration Over Alternative Protocol

Custom Cryptographic Protocol

Spearphishing Link

Execution through API

Authentication Package

Authentication Package

Clear Command History

Credentials in Registry

Network Share Discovery

Pass the Hash

Data from Local System

Exfiltration Over Command and Control Channel

Data Encoding

Spearphishing via Service

Execution through Module Load

BITS Jobs

DLL Search Order Hijacking

Code Signing

Exploitation for Credential Access

Password Policy Discovery

Pass the Ticket

Data from Network Shared Drive

Exfiltration Over Other Network Medium

Data Obfuscation

Supply Chain Compromise

Exploitation for Client Execution

BootkitDylib Hijacking

Component Firmware

Forced Authentication

Peripheral Device Discovery

Remote Desktop Protocol

Data from Removable Media

Exfiltration Over Physical Medium

Domain Fronting

Trusted Relationship

Graphical User Interface

Browser Extensions

Exploitation of Vulnerability

Component Object Model Hijacking

Hooking

Permission Groups Discovery

Remote File Copy

Email Collection

Scheduled Transfer

Fallback Channels

Valid Accounts

InstallUtil

Change Default File Association

Extra Window Memory Injection

Control Panel Items

Input Capture

Process Discovery

Remote Services

Input Capture

Multi-Stage Channels

LSASS DriverComponent Firmware

File System Permissions Weakness

DCShadow

Input Prompt

Query Registry

Replication Through Removable MediaMan in the Browser

Multi-hop Proxy

Launchctl

Component Object Model Hijacking

Hooking

DLL Search Order Hijacking

Kerberoasting

Remote System Discovery

SSH Hijacking

Screen Capture

Multiband Communication

Local Job Scheduling

DLL Search Order Hijacking

Image File Execution Options InjectionDLL Side-Loading

Keychain

Security Software Discovery

Shared WebrootVideo Capture

Multilayer Encryption

Mshta

Dylib Hijacking

Launch Daemon

Deobfuscate/Decode Files or Information

LLMNR/NBT-NS Poisoning

System Information Discovery

Taint Shared Content

Port Knocking

PowerShell

External Remote Services

New Service

Disabling Security Tools

Network Sniffing

System Network Configuration Discovery

Third-party Software

Remote Access Tools

Regsvcs/Regasm

File System Permissions Weakness

Path Interception

Exploitation of Vulnerability

Password Filter DLL

System Network Connections Discovery

Windows Admin Shares

Remote File Copy

Regsvr32

Hidden Files and Directories

Plist Modification

Extra Window Memory Injection

Private Keys

System Owner/User Discovery

Windows Remote Management

Standard Application Layer Protocol

Rundll32

Hooking

Port Monitors

File Deletion

Replication Through Removable Media

System Service Discovery

Standard Cryptographic Protocol

Scheduled Task

Hypervisor

Process Injection

File System Logical Offsets

Securityd Memory

System Time Discovery

Standard Non-Application Layer Protocol

Scripting

Image File Execution Options Injection

SID-History Injection

Gatekeeper Bypass

Two-Factor Authentication Interception

Service Execution

Kernel Modules and Extensions

Scheduled Task

HISTCONTROL

Signed Binary Proxy Execution

LC_LOAD_DYLIB Addition

Service Registry Permissions Weakness

Hidden Files and Directories

Signed Script Proxy Execution

LSASS Driver

Setuid and Setgid

Image File Execution Options Injection

SourceLaunch Agent

Startup Items

Hidden Users

Space after Filename

Launch Daemon

Sudo

Hidden Window

Third-party Software

Launchctl

Sudo Caching

Indicator Blocking

Trap

Local Job Scheduling

Valid Accounts

Indicator Removal from Tools

Trusted Developer Utilities

Login Item

Web Shell

Indicator Removal on Host

User Execution

Logon Scripts

Bypass User Account Control

Install Root Certificate

Windows Management Instrumentation

Modify Existing Service

InstallUtil

Windows Remote Management

Netsh Helper DLL

LC_MAIN Hijacking

New Service

Launchtctl

Office Application Startup

Masquerading

Path Interception

Modify Registry

Plist Modification

Mshta

Port Knocking

NTFS Extended Attributes

Port Monitors

Network Share Connection Removal

Rc.common

Obfuscated Files or Information

Re-opened Applications

Plist Modification

Redundant AccessPort Knocking

Registry Run Keys / Start Folder

Process Doppelgänging

SIP and Trust Provider Hijacking

Process Hollowing

Scheduled Task

Process Injection

Screensaver

Redundant Access

Security Support Provider

Regsvcs/Regasm

Service Registry Permissions Weakness

Regsvr32

Shortcut Modification

RootkitStartup Items

Rundll32

System Firmware

SIP and Trust Provider Hijacking

Time Providers

ScriptingTrap

Signed Binary Proxy Execution

Valid Accounts

Signed Script Proxy Execution

Web Shell

Software Packing

Windows Management Instrumentation Event
Subscription

Space after Filename

Winlogon Helper DLLTimestomp
Trusted Developer Utilities
Valid Accounts
Web Service

Uncommonly Used PortWeb Service

MITRE ATT&CK Matrix —=with CIS Control 6 overlay=Where Tripwire helps (Windows)

INITIAL ACCESSEXECUTIONPERSISTENCEPRIVILEGE ESCALATIONDEFENSE EVASION

CREDENTIAL ACCESSDISCOVERYLATERAL MOVEMENTCOLLECTION

EXFILTRATIONCOMMAND AND CONTROL

Drive-by CompromiseAppleScript.bash_profile and .bashrc

Access Token Manipulation

Access Token Manipulation

Account Manipulation

Account Discovery

AppleScript

Audio Capture

Automated Exfiltration

Commonly Used Port

Exploit Public-Facing Application

CMSTP

Accessibility Features

Accessibility Features

BITS Jobs

Bash History

Application Window Discovery

Application Deployment Software

Automated Collection

Data Compressed

Communication Through Removable Media

Hardware Additions

Command-Line Interface

AppCert DLLs

AppCert Dlls

Binary Padding

Brute ForceBrowser Bookmark Discovery

Distributed Component Object Model

Clipboard Data

Data Encrypted

Connection Proxy

Replication Through Removable Media

Control Panel Items

AppInit DLLs

AppInit DLLs

Bypass User Account Control

Credential Dumping

File and Directory Discovery

Exploitation of Remote Services

Data Staged

Data Transfer Size Limits

Custom Command and Control Protocol

Spearphishing Attachments

Dynamic Data Exchange

Application Shimming

Application Shimming

CMSTP

Credentials in Files

Network Service Scanning

Logon Scripts

Data from Information Repositories

Exfiltration Over Alternative Protocol

Custom Cryptographic Protocol

Spearphishing Link

Execution through API

Authentication Package

Authentication Package

Clear Command History

Credentials in Registry

Network Share Discovery

Pass the Hash

Data from Local System

Exfiltration Over Command and Control Channel

Data Encoding

Spearphishing via Service

Execution through Module Load

BITS Jobs

DLL Search Order Hijacking

Code Signing

Exploitation for Credential Access

Password Policy Discovery

Pass the Ticket

Data from Network Shared Drive

Exfiltration Over Other Network Medium

Data Obfuscation

Supply Chain Compromise

Exploitation for Client Execution

BootkitDylib Hijacking

Component Firmware

Forced Authentication

Peripheral Device Discovery

Remote Desktop Protocol

Data from Removable Media

Exfiltration Over Physical Medium

Domain Fronting

Trusted Relationship

Graphical User Interface

Browser Extensions

Exploitation of Vulnerability

Component Object Model Hijacking

Hooking

Permission Groups Discovery

Remote File Copy

Email Collection

Scheduled Transfer

Fallback Channels

Valid Accounts

InstallUtil

Change Default File Association

Extra Window Memory Injection

Control Panel Items

Input Capture

Process Discovery

Remote Services

Input Capture

Multi-Stage Channels

LSASS DriverComponent Firmware

File System Permissions Weakness

DCShadow

Input Prompt

Query Registry

Replication Through Removable MediaMan in the Browser

Multi-hop Proxy

Launchctl

Component Object Model Hijacking

Hooking

DLL Search Order Hijacking

Kerberoasting

Remote System Discovery

SSH Hijacking

Screen Capture

Multiband Communication

Local Job Scheduling

DLL Search Order Hijacking

Image File Execution Options InjectionDLL Side-Loading

Keychain

Security Software Discovery

Shared WebrootVideo Capture

Multilayer Encryption

Mshta

Dylib Hijacking

Launch Daemon

Deobfuscate/Decode Files or Information

LLMNR/NBT-NS Poisoning

System Information Discovery

Taint Shared Content

Port Knocking

PowerShell

External Remote Services

New Service

Disabling Security Tools

Network Sniffing

System Network Configuration Discovery

Third-party Software

Remote Access Tools

Regsvcs/Regasm

File System Permissions Weakness

Path Interception

Exploitation of Vulnerability

Password Filter DLL

System Network Connections Discovery

Windows Admin Shares

Remote File Copy

Regsvr32

Hidden Files and Directories

Plist Modification

Extra Window Memory Injection

Private Keys

System Owner/User Discovery

Windows Remote Management

Standard Application Layer Protocol

Rundll32

Hooking

Port Monitors

File Deletion

Replication Through Removable Media

System Service Discovery

Standard Cryptographic Protocol

Scheduled Task

Hypervisor

Process Injection

File System Logical Offsets

Securityd Memory

System Time Discovery

Standard Non-Application Layer Protocol

Scripting

Image File Execution Options Injection

SID-History Injection

Gatekeeper Bypass

Two-Factor Authentication Interception

Service Execution

Kernel Modules and Extensions

Scheduled Task

HISTCONTROL

Signed Binary Proxy Execution

LC_LOAD_DYLIB Addition

Service Registry Permissions Weakness

Hidden Files and Directories

Signed Script Proxy Execution

LSASS Driver

Setuid and Setgid

Image File Execution Options Injection

SourceLaunch Agent

Startup Items

Hidden Users

Space after Filename

Launch Daemon

Sudo

Hidden Window

Third-party Software

Launchctl

Sudo Caching

Indicator Blocking

Trap

Local Job Scheduling

Valid Accounts

Indicator Removal from Tools

Trusted Developer Utilities

Login Item

Web Shell

Indicator Removal on Host

User Execution

Logon Scripts

Install Root Certificate

Windows Management Instrumentation

Modify Existing Service

InstallUtil

Windows Remote Management

Netsh Helper DLL

LC_MAIN Hijacking

New Service

Launchtctl

Office Application Startup

Masquerading

Path Interception

Modify Registry

Plist Modification

Mshta

Port Knocking

NTFS Extended Attributes

Port Monitors

Network Share Connection Removal

Rc.common

Obfuscated Files or Information

Re-opened Applications

Plist Modification

Redundant AccessPort Knocking

Registry Run Keys / Start Folder

Process Doppelgänging

SIP and Trust Provider Hijacking

Process Hollowing

Scheduled Task

Process Injection

Screensaver

Redundant Access

Security Support Provider

Regsvcs/Regasm

Service Registry Permissions Weakness

Regsvr32

Shortcut Modification

RootkitStartup Items

Rundll32

System Firmware

SIP and Trust Provider Hijacking

Time Providers

ScriptingTrap

Signed Binary Proxy Execution

Valid Accounts

Signed Script Proxy Execution

Web Shell

Software Packing

Windows Management Instrumentation Event
Subscription

Space after Filename

Winlogon Helper DLLTimestomp

Create AccountTrusted Developer Utilities
Valid Accounts
Web Service

Uncommonly Used PortWeb Service

About Fortra
Fortra is a cybersecurity company like no other. We’re creating a simpler, stronger future for ourcustomers. Our trusted experts and portfolio of integrated, scalable solutions bring balance andFortra.com

control to organizations around the world. We’re the positive changemakers and your relentless ally toprovide peace of mind through every step of your cybersecurity journey. Learn more at fortra.com.

© Fortra, LLC and its group of companies. All trademarks and registered trademarks are the property of their respective owners.

(fta-tw-gd-0123-r1-hm)