Secure

Threat techniques

Enterprise intrusions rarely look like malware in a sandbox. They look like a valid credential used through a legitimate remote access path, followed by ordinary administrative tooling. Each technique below is described defensively: what the activity looks like, where the evidence lives, and which controls remove it.

12 techniques

A security operations centre: a curved video wall of threat, endpoint and compliance dashboards above three analyst desks with multi monitor setups. — Detection is a coverage problem before it is a tooling problem: the technique you cannot see is the one you inherit.

Scope of this section

Defensive only. This section describes observable behaviour, telemetry sources and mitigations. It contains no offensive tooling, commands or exploitation detail.
Techniques are named against MITRE ATT&CK Enterprise so that coverage can be tracked against a common vocabulary rather than product marketing categories.
Every technique lists the control baselines that reduce it, because a technique catalogue without controls is a reading exercise.
Operational Technology techniques are out of scope here; ICS specific behaviour differs materially and belongs on OT Atlas.

Filter by tactic

Initial accessT1566

Credential phishing

A message directs the recipient to a page that captures credentials and, increasingly, proxies the whole authentication so the one time code and resulting session cookie are captured too.

How it plays out

A convincing message arrives, often from a genuine but compromised partner mailbox already in an existing thread.
The link resolves through a redirect chain or a legitimate hosting service, so URL reputation looks clean.
An attacker in the middle page relays the real sign in, defeating one time codes and push approvals.
The stolen session token is replayed from other infrastructure, and no further authentication is needed.

Where the evidence is

Sign ins where the token was issued in one location and used in another shortly afterwards
New or unexpected mail forwarding and inbox rules
Message trace records for a common sender or subject across many mailboxes
First seen domains registered days before the campaign

What reduces it

Phishing resistant authentication bound to the origin, rather than codes or push approvals
Device compliance as a condition of access, so a stolen token alone is insufficient
Token protection and short session lifetimes for privileged and remote access
Reporting that is one click away, with a triage process that actually responds

Control baselines: Identity access baseline, Email authentication and message hygiene

email security mfa passwordless conditional access

Initial accessT1190

Exploitation of internet facing access

An edge device, VPN appliance or remote desktop gateway is reachable from the internet and either unpatched or protected by single factor authentication.

How it plays out

The service is discovered by continuous internet wide scanning, usually within hours of exposure.
A known vulnerability or valid reused credential grants a foothold at the network edge.
The appliance itself is often outside endpoint monitoring, so the initial activity is unlogged.
Access into the internal network follows before anyone reviews the appliance logs.

Where the evidence is

Authentication success from an address range with no business relationship
Configuration changes on edge appliances outside change windows
Firmware versions trailing vendor advisories
New local accounts or certificates on the appliance

What reduces it

Inventory every internet facing service and justify each one, or remove it
Multi factor on every remote access path without exception
Emergency patch process for edge devices, measured in days not quarters
Forward appliance logs to the central platform and alert on administrative changes

Control baselines: Authoritative asset and identity inventory, Network segmentation and egress control, Vulnerability and patch cadence

vpn firewall vulnerability management network security

PersistenceT1078

Use of valid accounts

The most common intrusion pattern involves no malware at all: legitimate credentials used through legitimate remote access, which is why identity telemetry matters more than file signatures.

How it plays out

Credentials arrive from a phish, an infostealer log, a reused password or a former employee account.
Access is used during working hours from a plausible location.
Activity blends with normal administration because the tooling is genuine.
Additional accounts are created or existing dormant ones re enabled to survive a password reset.

Where the evidence is

Sign ins to accounts dormant for months
Authentication from new devices or unfamiliar user agents
Impossible travel and unusual sign in property alerts
Accounts with no manager or owner still enabled

What reduces it

Joiner mover leaver automation, so leaving actually removes access
Access reviews that expire membership rather than confirming it forever
Conditional access baselines that block legacy authentication outright
Monitoring the identity provider as a primary detection source, not an afterthought

Control baselines: Authoritative asset and identity inventory, Identity access baseline, Logging and detection coverage

identity governance access governance service accounts conditional access

Credential accessT1558.003

Service account credential attack

Service accounts with weak passwords and registered service names allow an attacker with any domain foothold to request tickets and attempt offline password recovery at leisure.

How it plays out

Any authenticated account can request service tickets, no privilege is needed.
Tickets encrypted with a weak service account password are attacked offline, invisibly.
The recovered account is frequently over privileged and its password has never rotated.
Access then extends to the systems that account administers.

Where the evidence is

High volumes of service ticket requests from a single account
Ticket requests using weaker encryption types
Service accounts with passwords older than policy and membership of privileged groups
Service accounts interactively signing in, which they should never do

What reduces it

Managed service accounts with automatically rotated, long random passwords
Remove service accounts from privileged groups; grant only the rights they need
Disable weak encryption types across the domain
Deny interactive and remote sign in rights to service accounts

Control baselines: Identity access baseline

kerberos service accounts active directory privileged access

Lateral movementT1021

Lateral movement with administrative tooling

Movement between hosts uses the same remote administration channels the IT team uses, which is why flat networks and shared local administrator credentials are so consequential.

How it plays out

A local administrator credential valid on many machines is recovered from the first host.
Remote desktop, remote management or file shares carry the movement, all legitimate protocols.
East west traffic is usually unfiltered inside a network segment, so nothing blocks it.
Domain controllers and backup servers are the destinations that matter.

Where the evidence is

Workstation to workstation administrative sessions, which are rare in normal operation
The same local account authenticating across many hosts in a short window
New scheduled tasks or services created remotely
Administrative shares accessed outside patching and deployment windows

What reduces it

Unique local administrator passwords per device, rotated automatically
Block workstation to workstation traffic with host firewall policy
Tiered administration so server and domain admin credentials never touch workstations
Segment management protocols to dedicated administrative sources

Control baselines: Managed endpoint baseline, Network segmentation and egress control, Logging and detection coverage

rdp smb privileged access

Defence evasionT1562

Security tooling tampering

Before the damaging action, an intruder tries to blind the defenders: agents stopped, exclusions added, logging reduced and alerting recipients changed.

How it plays out

Endpoint agents are disabled or uninstalled using local administrator rights.
Broad path exclusions are added to the security product's own policy.
Audit log retention is shortened, or log forwarding is quietly broken.
Alert recipients and notification rules are changed so nobody is told.

Where the evidence is

Agent health gaps, a device that simply stops reporting is the loudest signal you have
Policy and exclusion changes in the security platform's audit trail
Log ingestion volume dropping for a source
Changes to alert rules and notification destinations

What reduces it

Tamper protection enforced centrally, not locally overridable
Remove standing local administrator rights from users
Alert on absence: monitor for missing telemetry, not just for events
Ship logs off host immediately, to storage the host cannot alter

Control baselines: Managed endpoint baseline, Logging and detection coverage

edr endpoint security logging security monitoring

ExfiltrationT1567

Data exfiltration to cloud storage

Data leaves over ordinary encrypted web traffic to a consumer file sharing service, which looks identical to legitimate business use unless volume and destination are examined.

How it plays out

Data is collected and staged, often compressed, on a single internal host.
Upload goes to a consumer cloud storage or paste service over HTTPS.
Volume is the only anomaly, and only if egress is measured at all.
Copies are retained for extortion regardless of whether encryption follows.

Where the evidence is

Outbound transfer volume by host and destination, compared against that host's baseline
Unusual mass file access or download from a document platform
Archive creation on servers that never normally compress data
Connections to file sharing domains from server subnets

What reduces it

Egress filtering from server networks, servers rarely need arbitrary internet access
Data loss prevention policy on the platforms where the data actually lives
Classification and labelling, so the highest value data is known and watched
Alerting on bulk download and mass access events

Control baselines: Network segmentation and egress control, Tested incident response capability

data loss prevention microsoft purview network security logging

ImpactT1490

Backup and recovery destruction

Before encryption, the backup estate is attacked: repositories deleted, retention shortened, snapshots removed and backup consoles used against the environment they protect.

How it plays out

The backup console is often domain joined and reachable with recovered credentials.
Retention is reduced or jobs are disabled so recent restore points age out.
Snapshots and replicas on the same fabric as production are deleted.
Only then does encryption begin, leaving payment as the apparent option.

Where the evidence is

Backup job deletion, retention changes and repository removal events
Administrative sign ins to backup infrastructure from unusual sources
Snapshot deletion at the storage or hypervisor layer
Backup success rate falling without an operational explanation

What reduces it

Immutable backup copies that cannot be deleted within the retention window
One offline or logically isolated copy, on separate credentials and separate identity
Backup administration accounts outside the production directory
Restore tests on a schedule, with the result recorded

Control baselines: Protected and tested recovery, Tested incident response capability

backup disaster recovery snapshots replication rpo rto

ImpactT1486

Ransomware deployment

Encryption is the last step of an intrusion that has usually been present for days or weeks, deployed through the same management channels used for legitimate software distribution.

How it plays out

Domain wide administrative access is obtained first.
Deployment uses group policy, a management platform or a scripted remote execution.
Detection tooling has typically already been disabled or excluded.
Timing favours a weekend or holiday, when response is slowest.

Where the evidence is

Mass file modification rates on file servers
Volume shadow copy deletion commands
Unexpected software deployment or group policy changes
Simultaneous agent health failures across many hosts

What reduces it

Tiered administration and no reuse of privileged credentials on workstations
Application control on servers, and strict change control on deployment tooling
Immutable, tested backups outside the production identity boundary
A rehearsed response plan with authority to disconnect, agreed in advance

Control baselines: Managed endpoint baseline, Protected and tested recovery, Tested incident response capability

incident response backup edr security operations

Initial accessT1580

Cloud storage and permission misconfiguration

No exploitation is required when a storage container is public, a key is committed to a repository, or a role grants far more than the workload needs.

How it plays out

A template or a hurried change makes a storage endpoint publicly readable.
Automated scanning finds it, as it finds every such endpoint, continuously.
Long lived access keys in code or pipeline variables extend the access.
Over broad roles allow enumeration well beyond the original workload.

Where the evidence is

Configuration drift against policy in the cloud posture tooling
Anonymous or unauthenticated access to storage endpoints
Access key age, and keys used from unexpected regions
Role assignment changes at subscription scope

What reduces it

Policy guardrails that deny public exposure rather than reporting it later
Workload identity and short lived credentials instead of static keys
Least privilege roles reviewed against actual API usage
Secret scanning in repositories and pipelines

Control baselines: Vulnerability and patch cadence

cloud security cloud governance shared responsibility model cloud storage

Initial accessT1199

Trusted relationship and supply chain access

An outsourced provider, software vendor or integration partner holds standing privileged access to your environment, and their compromise becomes yours.

How it plays out

A provider holds permanent administrative access, often without multi factor.
Their tooling is trusted by your endpoint controls, so its activity looks sanctioned.
Integration accounts and application registrations sit outside normal access reviews.
Detection depends on your telemetry, not theirs, and often nobody is looking.

Where the evidence is

Privileged activity from partner accounts outside agreed windows
Application registrations and integration accounts with directory scopes
Remote management tool installation events
Partner sign in locations and device compliance state

What reduces it

Just in time, approved, time bound access for third parties, never standing privilege
Separate partner identities with your own multi factor requirements
Contractual notification and log sharing obligations
Inventory of every integration, with a named internal owner

Control baselines: Third party and integration access control

vendor management privileged access identity governance risk management

Scope of this section

Filter by tactic

Credential phishing

Illicit consent grant

Exploitation of internet facing access

Use of valid accounts

Service account credential attack

Lateral movement with administrative tooling

Security tooling tampering

Data exfiltration to cloud storage

Backup and recovery destruction

Ransomware deployment

Cloud storage and permission misconfiguration

Trusted relationship and supply chain access