Restore Configuration

24 techniques, 74 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

• T1037Boot or Logon Initialization Scripts
  .004 RC Scripts.005 Startup Items
• T1114Email Collection
  .003 Email Forwarding Rule
• T1134Access Token Manipulation
  .005 SID-History Injection
• T1137Office Application Startup
  .001 Office Template Macros.002 Office Test.004 Outlook Home Page.005 Outlook Rules
• T1218System Binary Proxy Execution
  .002 Control Panel
• T1222File and Directory Permissions Modification
  .001 Windows Permissions.002 Linux and Mac Permissions
• T1484Domain or Tenant Policy Modification
  .001 Group Policy Modification.002 Trust Modification
• T1490Inhibit System Recovery
• T1518Software Discovery
  .001 Security Software Discovery
• T1526Cloud Service Discovery
• T1538Cloud Service Dashboard
• T1546Event Triggered Execution
  .001 Change Default File Association.002 Screensaver.007 Netsh Helper DLL.008 Accessibility Features.009 AppCert DLLs.010 AppInit DLLs.011 Application Shimming.014 Emond
• T1547Boot or Logon Autostart Execution
  .001 Registry Run Keys / Startup Folder.002 Authentication Package.003 Time Providers.004 Winlogon Helper DLL.005 Security Support Provider.010 Port Monitors
• T1548Abuse Elevation Control Mechanism
  .001 Setuid and Setgid.002 Bypass User Account Control.005 Temporary Elevated Cloud Access
• T1552Unsecured Credentials
  .005 Cloud Instance Metadata API.006 Group Policy Preferences
• T1553Subvert Trust Controls
  .003 SIP and Trust Provider Hijacking
• T1556Modify Authentication Process
  .002 Password Filter DLL.009 Conditional Access Policies
• T1562Impair Defenses
  .002 Disable Windows Event Logging.003 Impair Command History Logging.004 Disable or Modify System Firewall.007 Disable or Modify Cloud Firewall.008 Disable or Modify Cloud Logs.009 Safe Mode Boot
• T1564Hide Artifacts
  .008 Email Hiding Rules
• T1574Hijack Execution Flow
  .011 Services Registry Permissions Weakness.012 COR_PROFILER
• T1578Modify Cloud Compute Infrastructure
  .002 Create Cloud Instance.003 Delete Cloud Instance.004 Revert Cloud Instance.005 Modify Cloud Compute Configurations
• T1614System Location Discovery
  .001 System Language Discovery
• T1615Group Policy Discovery
• T1666Modify Cloud Resource Hierarchy

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.