Process Termination

10 techniques, 37 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

• T1003OS Credential Dumping
  .001 LSASS Memory.002 Security Account Manager.004 LSA Secrets
• T1033System Owner/User Discovery
• T1053Scheduled Task/Job
  .001 At (Linux) Execution.002 At.003 Cron.004 Launchd.005 Scheduled Task.006 Systemd Timers.007 Container Orchestration Job
• T1212Exploitation for Credential Access
• T1505Server Software Component
  .002 Transport Agent.003 Web Shell
• T1546Event Triggered Execution
  .007 Netsh Helper DLL
• T1550Use Alternate Authentication Material
  .001 Application Access Token.002 Pass the Hash.003 Pass the Ticket.004 Web Session Cookie
• T1556Modify Authentication Process
  .001 Domain Controller Authentication.002 Password Filter DLL.003 Pluggable Authentication Modules.004 Network Device Authentication.005 Reversible Encryption.006 Multi-Factor Authentication.007 Hybrid Identity.008 Network Provider DLL.009 Conditional Access Policies
• T1562Impair Defenses
  .001 Disable or Modify Tools
• T1621Multi-Factor Authentication Request Generation

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.