Protocol Metadata Anomaly Detection

48 techniques, 116 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

• T1001Data Obfuscation
  .001 Junk Data.002 Steganography.003 Protocol or Service Impersonation
• T1003OS Credential Dumping
  .006 DCSync
• T1008Fallback Channels
• T1011Exfiltration Over Other Network Medium
  .001 Exfiltration Over Bluetooth
• T1018Remote System Discovery
• T1020Automated Exfiltration
  .001 Traffic Duplication
• T1021Remote Services
  .001 Remote Desktop Protocol.002 SMB/Windows Admin Shares.003 Distributed Component Object Model.004 SSH.005 VNC.006 Windows Remote Management.007 Cloud Services.008 Direct Cloud VM Connections
• T1029Scheduled Transfer
• T1030Data Transfer Size Limits
• T1041Exfiltration Over C2 Channel
• T1047Windows Management Instrumentation
• T1048Exfiltration Over Alternative Protocol
  .001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol.003 Exfiltration Over Unencrypted Non-C2 Protocol
• T1071Application Layer Protocol
  .001 Web Protocols.002 File Transfer Protocols.003 Mail Protocols.004 DNS.005 Publish/Subscribe Protocols
• T1090Proxy
  .001 Internal Proxy.002 External Proxy.003 Multi-hop Proxy.004 Domain Fronting
• T1095Non-Application Layer Protocol
• T1098Account Manipulation
  .001 Additional Cloud Credentials
• T1102Web Service
  .001 Dead Drop Resolver.002 Bidirectional Communication.003 One-Way Communication
• T1104Multi-Stage Channels
• T1105Ingress Tool Transfer
• T1110Brute Force
  .003 Password Spraying.004 Credential Stuffing
• T1132Data Encoding
  .001 Standard Encoding.002 Non-Standard Encoding
• T1185Browser Session Hijacking
• T1189Drive-by Compromise
• T1190Exploit Public-Facing Application
• T1197BITS Jobs
• T1199Trusted Relationship
• T1204User Execution
  .001 Malicious Link
• T1205Traffic Signaling
  .001 Port Knocking.002 Socket Filters
• T1207Rogue Domain Controller
• T1210Exploitation of Remote Services
• T1218System Binary Proxy Execution
  .003 CMSTP
• T1219Remote Access Tools
  .001 IDE Tunneling.002 Remote Desktop Software.003 Remote Access Hardware
• T1498Network Denial of Service
  .001 Direct Network Flood.002 Reflection Amplification
• T1499Endpoint Denial of Service
  .002 Service Exhaustion Flood
• T1542Pre-OS Boot
  .005 TFTP Boot
• T1546Event Triggered Execution
  .003 Windows Management Instrumentation Event Subscription.008 Accessibility Features
• T1550Use Alternate Authentication Material
  .001 Application Access Token.004 Web Session Cookie
• T1557Adversary-in-the-Middle
  .001 Name Resolution Poisoning and SMB Relay.002 ARP Cache Poisoning.003 DHCP Spoofing.004 Evil Twin
• T1558Steal or Forge Kerberos Tickets
  .003 Kerberoasting
• T1563Remote Service Session Hijacking
  .001 SSH Hijacking.002 RDP Hijacking
• T1565Data Manipulation
  .002 Transmitted Data Manipulation
• T1566Phishing
  .001 Spearphishing Attachment.002 Spearphishing Link
• T1567Exfiltration Over Web Service
  .001 Exfiltration to Code Repository.002 Exfiltration to Cloud Storage.003 Exfiltration to Text Storage Sites.004 Exfiltration Over Webhook
• T1568Dynamic Resolution
  .001 Fast Flux DNS.002 Domain Generation Algorithms.003 DNS Calculation
• T1570Lateral Tool Transfer
• T1571Non-Standard Port
• T1572Protocol Tunneling
• T1573Encrypted Channel
  .001 Symmetric Cryptography.002 Asymmetric Cryptography

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.