Operational Process Monitoring

8 techniques, 19 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

• T1003OS Credential Dumping
  .006 DCSync
• T1070Indicator Removal
  .001 Clear Windows Event Logs.003 Clear Command History
• T1110Brute Force
  .001 Password Guessing.003 Password Spraying.004 Credential Stuffing
• T1134Access Token Manipulation
  .002 Create Process with Token.003 Make and Impersonate Token
• T1140Deobfuscate/Decode Files or Information
• T1187Forced Authentication
• T1546Event Triggered Execution
  .003 Windows Management Instrumentation Event Subscription.005 Trap
• T1548Abuse Elevation Control Mechanism
  .003 Sudo and Sudo Caching

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.