Explore AI Agent Skills & Claude Prompts

attack-ent-t1600-001-reduce-key-space

by santosomar

star 22

Analyze MITRE ATT&CK T1600.001 Reduce Key Space in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1600.001, Reduce Key Space, or enterprise ATT&CK. Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.(Citation: Cisco Synful Knock Evolution) Adversaries can weake…

attack-ics-t0873-001-siemens-project-file-format

by santosomar

star 22

Analyze MITRE ATT&CK T0873.001 Siemens Project File Format in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0873.001, Siemens Project File Format, or ics ATT&CK. Adversaries may infect Siemens PLC project files (i.e., Step 7, WinCC, etc.) to achieve [Execution](https://attack.mitre.org/tactics/TA0104), [Persistence](https://attack.mitre.org/tactics/TA0110), and [Lateral Movement…

attack-mob-t1430-002-impersonate-ss7-nodes

by santosomar

star 22

Analyze MITRE ATT&CK T1430.002 Impersonate SS7 Nodes in the mobile matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1430.002, Impersonate SS7 Nodes, or mobile ATT&CK. Adversaries may exploit the lack of authentication in signaling system network nodes to track the location of mobile devices by impersonating a node.(Citation: Engel-SS7)(Citation: Engel-SS7-2008)(Citation: 3GPP-Securit…

attack-ics-t1695-block-communications

by santosomar

star 22

Analyze MITRE ATT&CK T1695 Block Communications in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1695, Block Communications, or ics ATT&CK. Operational technology communications occur over serial COM, Ethernet, Wi-Fi, cellular (4G/5G), and satellite mediums.

attack-ics-t1695-001-serial-com

by santosomar

star 22

Analyze MITRE ATT&CK T1695.001 Serial COM in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1695.001, Serial COM, or ics ATT&CK. Adversaries may block access to serial COM to prevent instructions or configurations from reaching target devices.

attack-ent-t1003-003-ntds

by santosomar

star 22

Analyze MITRE ATT&CK T1003.003 NTDS in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1003.003, NTDS, or enterprise ATT&CK. Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and a…

attack-mob-t1453-abuse-accessibility-features

by santosomar

star 22

Analyze MITRE ATT&CK T1453 Abuse Accessibility Features in the mobile matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1453, Abuse Accessibility Features, or mobile ATT&CK. Adversaries may abuse accessibility features in Android devices to steal sensitive data and to spread malware to other devices.

attack-ics-t0807-command-line-interface

by santosomar

star 22

Analyze MITRE ATT&CK T0807 Command-Line Interface in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0807, Command-Line Interface, or ics ATT&CK. Adversaries may utilize command-line interfaces (CLIs) to interact with systems and execute commands.

attack-ics-t0821-modify-controller-tasking

by santosomar

star 22

Analyze MITRE ATT&CK T0821 Modify Controller Tasking in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0821, Modify Controller Tasking, or ics ATT&CK. Adversaries may modify the tasking of a controller to allow for the execution of their own programs.

attack-ics-t0863-user-execution

by santosomar

star 22

Analyze MITRE ATT&CK T0863 User Execution in the ics matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T0863, User Execution, or ics ATT&CK. Adversaries may rely on a targeted organizations user interaction for the execution of malicious code.

attack-ent-t1547-013-xdg-autostart-entries

by santosomar

star 22

Analyze MITRE ATT&CK T1547.013 XDG Autostart Entries in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1547.013, XDG Autostart Entries, or enterprise ATT&CK. Adversaries may add or modify XDG Autostart Entries to execute malicious programs or commands when a user’s desktop environment is loaded at login.

attack-ent-t1055-014-vdso-hijacking

by santosomar

star 22

Analyze MITRE ATT&CK T1055.014 VDSO Hijacking in the enterprise matrix. Use for TTP triage, detection engineering, hunting, defensive emulation planning, mitigations, incident response mapping, ATT&CK coverage, or questions mentioning T1055.014, VDSO Hijacking, or enterprise ATT&CK. Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-based defenses as well as possibly elevate privileges.