File Integrity Monitoring

46 techniques, 150 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

• T1003OS Credential Dumping
  .007 Proc Filesystem.008 /etc/passwd and /etc/shadow
• T1005Data from Local System
• T1014Rootkit
• T1016System Network Configuration Discovery
  .001 Internet Connection Discovery.002 Wi-Fi Discovery
• T1018Remote System Discovery
• T1027Obfuscated Files or Information
  .001 Binary Padding.002 Software Packing.004 Compile After Delivery
• T1033System Owner/User Discovery
• T1036Masquerading
  .001 Invalid Code Signature.003 Rename Legitimate Utilities.005 Match Legitimate Resource Name or Location.006 Space after Filename
• T1037Boot or Logon Initialization Scripts
  .001 Logon Script (Windows).002 Login Hook.003 Network Logon Script.004 RC Scripts
• T1041Exfiltration Over C2 Channel
• T1048Exfiltration Over Alternative Protocol
  .002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
• T1053Scheduled Task/Job
  .004 Launchd
• T1055Process Injection
  .001 Dynamic-link Library Injection.002 Portable Executable Injection.003 Thread Execution Hijacking.009 Proc Memory.014 VDSO Hijacking
• T1059Command and Scripting Interpreter
  .001 PowerShell.002 AppleScript.003 Windows Command Shell.004 Unix Shell.005 Visual Basic.006 Python.007 JavaScript.008 Network Device CLI.009 Cloud API.010 AutoHotKey & AutoIT.011 Lua.012 Hypervisor CLI.013 Container CLI/API
• T1070Indicator Removal
  .002 Clear Linux or Mac System Logs.004 File Deletion
• T1071Application Layer Protocol
  .001 Web Protocols.002 File Transfer Protocols.003 Mail Protocols.004 DNS.005 Publish/Subscribe Protocols
• T1072Software Deployment Tools
• T1074Data Staged
  .001 Local Data Staging
• T1083File and Directory Discovery
• T1114Email Collection
  .001 Local Email Collection
• T1119Automated Collection
• T1127Trusted Developer Utilities Proxy Execution
  .001 MSBuild
• T1137Office Application Startup
  .001 Office Template Macros.003 Outlook Forms
• T1140Deobfuscate/Decode Files or Information
• T1187Forced Authentication
• T1204User Execution
  .002 Malicious File
• T1218System Binary Proxy Execution
  .005 Mshta.011 Rundll32
• T1220XSL Script Processing
• T1486Data Encrypted for Impact
• T1505Server Software Component
  .003 Web Shell
• T1534Internal Spearphishing
• T1543Create or Modify System Process
  .001 Launch Agent.002 Systemd Service.004 Launch Daemon
• T1546Event Triggered Execution
  .002 Screensaver.004 Unix Shell Configuration Modification.005 Trap.006 LC_LOAD_DYLIB Addition.008 Accessibility Features.009 AppCert DLLs.010 AppInit DLLs.013 PowerShell Profile.014 Emond.015 Component Object Model Hijacking
• T1547Boot or Logon Autostart Execution
  .001 Registry Run Keys / Startup Folder.006 Kernel Modules and Extensions.007 Re-opened Applications.008 LSASS Driver.009 Shortcut Modification.011 Plist Modification
• T1548Abuse Elevation Control Mechanism
  .002 Bypass User Account Control.003 Sudo and Sudo Caching
• T1552Unsecured Credentials
  .001 Credentials In Files.003 Shell History
• T1555Credentials from Password Stores
  .001 Keychain.002 Securityd Memory.003 Credentials from Web Browsers.004 Windows Credential Manager.005 Password Managers.006 Cloud Secrets Management Stores
• T1556Modify Authentication Process
  .002 Password Filter DLL.003 Pluggable Authentication Modules
• T1560Archive Collected Data
  .001 Archive via Utility.002 Archive via Library.003 Archive via Custom Method
• T1562Impair Defenses
  .003 Impair Command History Logging
• T1564Hide Artifacts
  .002 Hidden Users.003 Hidden Window.006 Run Virtual Instance.007 VBA Stomping
• T1565Data Manipulation
  .001 Stored Data Manipulation.003 Runtime Data Manipulation
• T1566Phishing
  .001 Spearphishing Attachment.002 Spearphishing Link.003 Spearphishing via Service
• T1573Encrypted Channel
  .002 Asymmetric Cryptography
• T1574Hijack Execution Flow
  .001 DLL.002 DLL Side-Loading.004 Dylib Hijacking.006 Dynamic Linker Hijacking.007 Path Interception by PATH Environment Variable.008 Path Interception by Search Order Hijacking.009 Path Interception by Unquoted Path.012 COR_PROFILER
• T1649Steal or Forge Authentication Certificates

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.