System Call Filtering

33 techniques, 86 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

• T1003OS Credential Dumping
  .001 LSASS Memory.002 Security Account Manager.004 LSA Secrets
• T1007System Service Discovery
• T1010Application Window Discovery
• T1012Query Registry
• T1016System Network Configuration Discovery
  .001 Internet Connection Discovery.002 Wi-Fi Discovery
• T1018Remote System Discovery
• T1033System Owner/User Discovery
• T1036Masquerading
  .005 Match Legitimate Resource Name or Location
• T1047Windows Management Instrumentation
• T1049System Network Connections Discovery
• T1053Scheduled Task/Job
  .001 At (Linux) Execution.002 At.003 Cron.004 Launchd.005 Scheduled Task.006 Systemd Timers.007 Container Orchestration Job
• T1055Process Injection
  .001 Dynamic-link Library Injection.003 Thread Execution Hijacking.004 Asynchronous Procedure Call.005 Thread Local Storage.008 Ptrace System Calls.013 Process Doppelgänging.014 VDSO Hijacking
• T1057Process Discovery
• T1074Data Staged
  .001 Local Data Staging
• T1082System Information Discovery
• T1106Native API
• T1113Screen Capture
• T1124System Time Discovery
• T1134Access Token Manipulation
  .004 Parent PID Spoofing
• T1140Deobfuscate/Decode Files or Information
• T1212Exploitation for Credential Access
• T1218System Binary Proxy Execution
  .001 Compiled HTML File.002 Control Panel.003 CMSTP.005 Mshta.011 Rundll32.013 Mavinject
• T1220XSL Script Processing
• T1497Virtualization/Sandbox Evasion
  .003 Time Based Checks
• T1505Server Software Component
  .001 SQL Stored Procedures.002 Transport Agent.003 Web Shell
• T1518Software Discovery
  .001 Security Software Discovery
• T1546Event Triggered Execution
  .007 Netsh Helper DLL.009 AppCert DLLs.010 AppInit DLLs
• T1548Abuse Elevation Control Mechanism
  .002 Bypass User Account Control.004 Elevated Execution with Prompt
• T1550Use Alternate Authentication Material
  .001 Application Access Token.002 Pass the Hash.003 Pass the Ticket.004 Web Session Cookie
• T1555Credentials from Password Stores
  .003 Credentials from Web Browsers
• T1556Modify Authentication Process
  .001 Domain Controller Authentication.002 Password Filter DLL.003 Pluggable Authentication Modules.004 Network Device Authentication.005 Reversible Encryption.006 Multi-Factor Authentication.007 Hybrid Identity.008 Network Provider DLL.009 Conditional Access Policies
• T1562Impair Defenses
  .001 Disable or Modify Tools
• T1621Multi-Factor Authentication Request Generation

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.