ATT&CK coverage
في هذه الصفحة
Which MITRE ATT&CK techniques Signal's built-in rules are tagged with, in ATT&CK 20.0's Windows matrix - and which no single host can show at all.
How to read this page
A rule is tagged only with what its evidence shows happened. A capability is not its use.
A technique with a rule is not "covered" in every form: a rule detects one high-fidelity pattern of it, not every way it can be done.
A technique with no rule is not invisible. Its traces may still appear in Signal's tables, telemetry and other modules' signals.
Signal does not write rules to fill gaps in the matrix: every rule must be suspicious in itself, and quiet on clean hosts.
Coverage by tactic
Tactic | Techniques with at least one rule |
|---|---|
Initial Access | 4 of 7 |
Execution | 7 of 14 |
Persistence | 15 of 20 |
Privilege Escalation | 11 of 13 |
Stealth | 10 of 27 |
Defense Impairment | 8 of 12 |
Credential Access | 8 of 14 |
Discovery | 0 of 29 |
Lateral Movement | 3 of 8 |
Collection | 2 of 15 |
Command and Control | 5 of 16 |
Exfiltration | 2 of 9 |
Impact | 4 of 12 |
Every technique a rule is tagged with
Technique | Name | Rules |
|---|---|---|
| LSASS Memory |
|
| Security Account Manager |
|
| NTDS |
|
| LSA Secrets |
|
| DCSync |
|
| Remote Services |
|
| Remote Desktop Protocol |
|
| SMB/Windows Admin Shares |
|
| SSH |
|
| Windows Remote Management |
|
| Obfuscated Files or Information |
|
| Masquerading |
|
| Rename Legitimate Utilities |
|
| Match Legitimate Resource Name or Location |
|
| Double File Extension |
|
| Masquerade File Type |
|
| Logon Script (Windows) |
|
| Exfiltration Over C2 Channel |
|
| Windows Management Instrumentation |
|
| Exfiltration Over Alternative Protocol |
|
| Scheduled Task/Job |
|
| At |
|
| Scheduled Task |
|
| Command and Scripting Interpreter |
|
| PowerShell |
|
| Visual Basic |
|
| Exploitation for Privilege Escalation |
|
| Indicator Removal |
|
| Clear Command History |
|
| Timestomp |
|
| Application Layer Protocol |
|
| Valid Accounts |
|
| Default Accounts |
|
| Domain Accounts |
|
| Local Accounts |
|
| Proxy |
|
| Account Manipulation |
|
| Ingress Tool Transfer |
|
| Brute Force |
|
| Password Guessing |
|
| Password Spraying |
|
| Modify Registry |
|
| External Remote Services |
|
| SID-History Injection |
|
| Local Account |
|
| Office Template Macros |
|
| Office Test |
|
| Add-ins |
|
| Deobfuscate/Decode Files or Information |
|
| Browser Extensions |
|
| Browser Session Hijacking |
|
| Forced Authentication |
|
| Exploit Public-Facing Application |
|
| BITS Jobs |
|
| Malicious File |
|
| System Binary Proxy Execution |
|
| Remote Access Tools |
|
| Group Policy Modification |
|
| Service Stop |
|
| Inhibit System Recovery |
|
| Compute Hijacking |
|
| Bandwidth Hijacking |
|
| Web Shell |
|
| IIS Components |
|
| Account Access Removal |
|
| Steal Web Session Cookie |
|
| Windows Service |
|
| Event Triggered Execution |
|
| Screensaver |
|
| Windows Management Instrumentation Event Subscription |
|
| Netsh Helper DLL |
|
| Accessibility Features |
|
| AppCert DLLs |
|
| AppInit DLLs |
|
| Image File Execution Options Injection |
|
| PowerShell Profile |
|
| Component Object Model Hijacking |
|
| Boot or Logon Autostart Execution |
|
| Registry Run Keys / Startup Folder |
|
| Authentication Package |
|
| Time Providers |
|
| Winlogon Helper DLL |
|
| Security Support Provider |
|
| Port Monitors |
|
| Print Processors |
|
| Active Setup |
|
| Bypass User Account Control |
|
| Pass the Hash |
|
| Group Policy Preferences |
|
| Password Filter DLL |
|
| Adversary-in-the-Middle |
|
| Steal or Forge Kerberos Tickets |
|
| AS-REP Roasting |
|
| Component Object Model |
|
| Hide Artifacts |
|
| Hidden Users |
|
| File/Path Exclusions |
|
| Spearphishing Attachment |
|
| Service Execution |
|
| Lateral Tool Transfer |
|
| Protocol Tunneling |
|
| Reflective Code Loading |
|
| Disable or Modify Tools |
|
| Disable or Modify Windows Event Log |
|
| Clear Windows Event Logs |
|
| Disable or Modify System Firewall |
|
| Safe Mode Boot |
|
| Downgrade Attack |
|
| Prevent Command History Logging |
|
Techniques no single host can show
Technique | Name | Why a host does not record it |
|---|---|---|
| Supply Chain Compromise | the compromise happens at the supplier, before the software reaches the host; the host shows only the software it installed (Applications) |
| Trusted Relationship | the trust lives with a third party outside the host; on the host the access is a valid account or a remote service, mapped there |
| Network Denial of Service | a flood of the network or its links, not of the host's own records |
| Internal Spearphishing | phishing sent through the organization's mail service, which records it - not the host |
| Acquire Infrastructure | done on the adversary's own infrastructure before the intrusion - nothing on the host records it |
| Compromise Infrastructure | done on the adversary's own infrastructure before the intrusion - nothing on the host records it |
| Establish Accounts | done on the adversary's own infrastructure before the intrusion - nothing on the host records it |
| Compromise Accounts | done on the adversary's own infrastructure before the intrusion - nothing on the host records it |
| Develop Capabilities | done on the adversary's own infrastructure before the intrusion - nothing on the host records it |
| Obtain Capabilities | done on the adversary's own infrastructure before the intrusion - nothing on the host records it |
| Gather Victim Identity Information | done before the intrusion, against the organization - nothing on the host records it |
| Gather Victim Network Information | done before the intrusion, against the organization - nothing on the host records it |
| Gather Victim Org Information | done before the intrusion, against the organization - nothing on the host records it |
| Gather Victim Host Information | done before the intrusion, against the organization - nothing on the host records it |
| Search Open Websites/Domains | done before the intrusion, against the organization - nothing on the host records it |
| Search Victim-Owned Websites | done before the intrusion, against the organization - nothing on the host records it |
| Active Scanning | done before the intrusion, against the organization - nothing on the host records it |
| Search Open Technical Databases | done before the intrusion, against the organization - nothing on the host records it |
| Search Closed Sources | done before the intrusion, against the organization - nothing on the host records it |
| Phishing for Information | done before the intrusion, against the organization - nothing on the host records it |
| Forge Web Credentials | credentials forged off the host and presented to a web service, which records them |
| Stage Capabilities | done on the adversary's own infrastructure before the intrusion - nothing on the host records it |
| Multi-Factor Authentication Request Generation | the requests are made to the identity provider, which records them |
| Acquire Access | done on the adversary's own infrastructure before the intrusion - nothing on the host records it |
| Financial Theft | theft through business processes and payment services outside the host |
| Content Injection | content injected on the network path, outside the host |
| Hide Infrastructure | concerns the adversary's own infrastructure |
| Email Bombing | a flood of the mail service, which records it - not the host |
| Wi-Fi Networks | access to the organization's wireless network, recorded by its access points - not the host |
| Search Threat Vendor Data | done before the intrusion, against the organization - nothing on the host records it |
| Query Public AI Services | done before the intrusion, against the organization - nothing on the host records it |
| Generate Content | done on the adversary's own infrastructure before the intrusion - nothing on the host records it |
| Social Engineering | deception of a person, which no host record shows |
| Indirect Prompt Injection | instructions planted in content an AI service reads, recorded by that service |
| Direct Prompt Injection | instructions given to an AI service directly, recorded by that service |