Threat Behavior & Adversary Reference

Advanced Persistent Threat (APT)

A sophisticated, well-resourced adversary, often state-sponsored, that gains and maintains prolonged, covert unauthorized access to a network while avoiding detection. The term names the actor; the campaign it runs is APT activity. Vendors track the same group under different names: numbered APT groups for well-established actors, and provisional labels such as Mandiant’s UNC clusters or Microsoft’s Storm- names for activity not yet tied to a known group.

Triage signal: Attribution is rarely a triage question. What you can see is the tradecraft: long dwell time, valid accounts, edge-device exploitation and living-off-the-land tools. Record the observed behavior and leave the name to threat intelligence.

AI Agent Abuse

Hijacking or misusing an AI agent’s tool access (mail, files, code execution, APIs) so it acts for the attacker, usually through prompt injection in content it reads, a poisoned tool or MCP server, or stolen agent credentials. The agent’s permissions become the attacker’s, and its actions look like normal automation.

Triage signal: Agent tool calls or data sends the user did not request, especially right after the agent read external content; new MCP servers, plugins or connectors; and agent tokens used from outside the agent’s host. Review the agent’s own action log, not only the user’s.

Application Shimming

Abuses the Windows Application Compatibility Infrastructure (shims) to inject malicious code or maintain persistence. An ATT&CK Persistence and Privilege Escalation technique.

Triage signal: sdbinst.exe running outside a software install, new .sdb files under C:\Windows\AppPatch\Custom, or new values under the AppCompatFlags Custom and InstalledSDB registry keys.

Business Logic Abuse

Exploiting flaws in an application’s workflow rather than its code: replaying a single-use coupon, skipping a payment step, or abusing a password-reset flow to take over an account. Every request looks valid on its own, so signature-based controls rarely fire; the signal is a sequence that the business process should not allow.

Triage signal: A per-account or per-session sequence the workflow should not allow: the same coupon redeemed many times, an order confirmed with no payment event, or a reset completed from a session that never received the reset link. Application and business-event logs carry it, not the WAF.

Collection

ATT&CK tactic: gathering the data the attacker came for (file shares, mailboxes, screenshots, keystrokes) before exfiltration. Archive tools such as 7-Zip or WinRAR creating large password-protected archives are a common tell.

Triage signal: One account reading files across many shares or folders in a short window, mailbox searches or exports (New-MailboxExportRequest, eDiscovery content searches) by someone outside legal or IT, and screenshots or clipboard captures by an unfamiliar process.

COM Hijacking

A persistence technique that abuses Windows Component Object Model (COM) registry entries to hijack the execution flow of legitimate applications.

Triage signal: New or changed InprocServer32 or LocalServer32 values under HKCU\Software\Classes\CLSID pointing to a DLL in a user-writable path, overriding a CLSID registered under HKLM (Sysmon events 12 and 13).

Compromised Host

A system under attacker control, often used for lateral movement, staging malware, or maintaining persistence within a network.

Triage signal: A conclusion, not an alert: you call a host compromised when the evidence shows attacker-controlled execution on it. Record that evidence and your confidence, because the label drives containment and scoping.

Defense Impairment

ATT&CK tactic: breaking security mechanisms, pipelines, and tooling so defenders cannot see or trust what is happening: disabling security tools such as endpoint detection and response (EDR) agents (EDR killers, BYOVD), modifying firewalls, and tampering with logging and trust controls. Created in ATT&CK v19 (April 2026) when Defense Evasion was split; the old T1562 Impair Defenses techniques now sit here, chiefly as T1685 Disable or Modify Tools. Pre-ransomware EDR killing is among the highest-signal events an analyst can catch.

Triage signal: A security agent that stops reporting, a new Defender exclusion or tamper event (Defender event 5007), a stopped log forwarder, or a cleared log. Silence from a sensor is evidence: find out why the telemetry stopped before you conclude nothing happened.

Discovery

ATT&CK tactic: learning the environment after access (whoami, net group “Domain Admins”, nltest, AdFind, BloodHound, cloud role enumeration). A burst of enumeration commands from one account or host is one of the earliest hands-on-keyboard signals.

Triage signal: Several enumeration commands (whoami /all, net group, nltest /domain_trusts, AdFind) from one account within minutes, or a burst of LDAP queries from a workstation, as BloodHound collection produces. Admins run these too, so weigh the account and the host.

Execution

The ATT&CK tactic (TA0002) for running attacker-controlled code on a local or remote system: through command interpreters, user-run files and lures, scheduled tasks, WMI, or exploits. It rarely stands alone: attackers execute code to discover, steal, move or persist.

Triage signal: A process whose parent does not fit its role: Office or a browser spawning a shell, a script host running from a download folder, or a signed binary with an unusual command line. Process-creation telemetry (Sysmon event 1, Security 4688 with command line) is the evidence.

Impact (ATT&CK Tactic)

The tactic for the damage itself (TA0040); not to be confused with ASSURED’s impact axis, which C.L.E.A.R. defines. Its techniques include Data Encrypted for Impact (T1486), Inhibit System Recovery such as shadow-copy deletion with vssadmin or bcdedit (T1490), Service Stop (T1489), data destruction, and Resource Hijacking such as cryptomining (T1496). Shadow-copy deletion and backup-service kills usually come minutes before encryption.

Triage signal: Shadow-copy deletion (vssadmin delete shadows, wmic shadowcopy delete) or bcdedit recovery changes, backup and database services stopped in a batch, or a sudden spike in file renames. Any one of these on a server needs an immediate look; confirmed, it fires the escalation tripwire.

Initial Access

The ATT&CK tactic covering how attackers first gain a foothold inside the environment: phishing, exploited edge devices and public-facing applications, valid or stolen credentials, and exposed remote services. Reconnaissance and Resource Development come before it.

Triage signal: The first event that does not fit: a sign-in from a new device or hosting IP, a child process under an internet-facing service, a user-run file from a download or email path. Record when and how it happened, or that it is still unknown, because the rest of the case hangs off this point.

Initial Access Broker (IAB)

A criminal who breaks in, or buys infostealer logs, and sells the resulting access (VPN credentials, RDP, a web shell) to ransomware and extortion crews. Explains why the intrusion you are triaging may have started weeks earlier under a different actor.

Triage signal: A gap between first access and hands-on activity: a valid-account or web-shell login weeks before the ransomware stage, often from different infrastructure. When you find a foothold, look back for earlier activity on the same credential or host.

Insider

Any person who has or had authorized access to, or knowledge of, an organization’s resources: employees, contractors, vendors and partners, including people who have left while their access or knowledge remains. The word, in CISA’s definition, says nothing about intent; see Insider Risk and Insider Threat.

Triage signal: Insider status is a fact about the account, not a finding: a valid account and expected access are where an insider case starts. Record what the account did. HR-held context reaches the case only through the insider-risk route, never as analyst-collected notes.

Insider Risk

The potential for harm from anyone with legitimate access, whether through mistakes, negligence, policy violations, well-meaning workarounds or deliberate misuse. It is the umbrella term, and most insider risk is not malicious. Insider threat is the deliberate subset. Some frameworks, including CISA’s, fold the whole spectrum into ‘insider threat’, so map these labels to your organization’s policy vocabulary.

Triage signal: Observable technical activity only: unusual data volume, new destinations, access outside the role, bypassed policy controls. HR-held context reaches the case only through the insider-risk route, never as analyst-collected notes.

Insider Risk Management (IRM)

The program and tool category that watches for insider risk: user and entity behavior analytics (UEBA), data loss prevention (DLP) and privileged access management (PAM), often joined to HR data through connectors. It is deployed only after legal and privacy review (and works-council review where one exists), and it is the route by which HR-held context reaches a case.

Triage signal: IRM alerts arrive as policy matches on technical activity (data movement, access outside the role). Work them like any alert: record what the account did. HR-held context reaches the case only through the insider-risk route, never as analyst-collected notes.

Insider Threat

A person with authorized access who uses it to harm the organization. CISA’s definition covers malicious, complacent and unintentional acts; many programs, ASSURED included, reserve ‘insider threat’ for the malicious subset and use ‘insider risk’ for the broader set.

Triage signal: The same evidence as any insider case: what the account did, from where, to which data. Intent is not a triage call; record the activity and route it through the insider-risk process.

Jailbreaking

Two senses. (1) Mobile: removing iOS or Android platform restrictions, usually by the device owner and sometimes by an attacker; for triage, a jailbroken or rooted device fails MDM compliance and cannot be trusted to enforce app sandboxing. (2) AI: prompts crafted to make a large language model ignore its safety policy; related to prompt injection (OWASP LLM01) and catalogued in MITRE ATLAS.

Triage signal: Mobile: an MDM compliance failure for a jailbroken or rooted device that still holds corporate sessions. AI: prompts in the AI gateway or audit log telling the model to ignore its instructions or role-play past its policy, followed by output the policy should have blocked.

Leaver Window

The period around a known departure, roughly the notice period, when insider data theft is most likely: CERT research on insider theft of intellectual property found that many of those who took data did so within about a month of leaving. The departure date reaches the SOC as a date, not as a reason to suspect anyone.

Triage signal: Bulk repository clones, mass downloads, uploads to personal storage or USB writes during the notice period, measured against the person’s own baseline and peer baselines. See Subject: insider analysis.

Lethal Trifecta

An AI agent that combines three capabilities: access to private data, exposure to untrusted content, and a way to send data out (links or images it renders, web fetches, email, tool calls). With all three, a prompt injection hidden in the untrusted content can make the agent read the private data and send it to the attacker. Removing any one leg breaks that path. The name is Simon Willison’s (June 2025). A triage assistant holds the first two legs by design, so ASSURED’s admission gate removes the third; see Governing automated triage.

Triage signal: In a case involving an AI assistant or agent, list the three legs: what data it could read, what untrusted content it processed, and which outbound channels it could use. An agent with all three that read attacker-reachable content is a possible exfiltration path; check its action log for sends, fetches or rendered links the user did not request.

Malware

Software designed to disrupt, damage, or gain unauthorized access to systems. Encompasses ransomware, trojans, worms, viruses, spyware, wipers, rootkits, and the other malware types catalogued below.

Triage signal: A detection name tells you the family at best. Establish whether it executed (process, network or persistence evidence), not only whether a file was written. A file that a control blocked or quarantined, with no execution or follow-on evidence, is the contained-by-control path (recorded at P3 or P4, a pattern-entry candidate); malware that ran is a different case.

Post-Exploitation

Everything the attacker does after the first foothold: exploring the environment, escalating access, exfiltrating data, or setting up long-term control.

Triage signal: Hands-on-keyboard behavior after the first alert: discovery commands, credential access, remote logons. Its presence moves the case from ‘was there a foothold?’ to ‘how far did they get?’.

Privilege Chaining

The sequential use of multiple smaller privilege escalations or credential compromises to progressively gain more powerful access. Each step may look minor on its own (a misconfigured service, a readable credential file, an over-broad group membership), which is why tools such as BloodHound model attack paths rather than single permissions.

Triage signal: Several small privilege changes on one identity or host in a short span: a new group membership, a token or service abuse, then a logon to a more sensitive tier. Score the chain, not each step.

Prompt Injection

Text that an AI system reads as instructions instead of data: typed directly by a user, or hidden in an email, web page or document the model processes (indirect prompt injection). In agentic tools it can trigger actions with the agent’s permissions. OWASP ranks it first among LLM risks (LLM01).

Triage signal: In AI tool logs, an assistant or agent acting on instructions that came from content it read (an email, a page, a document) rather than from the user, especially a tool call, link or data send the user never asked for.

Reconnaissance

The pre-attack phase where attackers gather intelligence, enumerate exposed services, and identify vulnerabilities before launching an intrusion. ATT&CK v19.2 also tracks attackers querying public AI services to research targets (T1682).

Triage signal: Mostly invisible: it happens on public sources. You see its edges: scanning of external services, account-enumeration probes against sign-in endpoints, and phishing that cites details only an org chart would give.

Remote Execution

Running commands or malicious code on a target system from another host: PsExec and remote service creation, WMI and WinRM, scheduled tasks created remotely, SSH, or an exploit against a network service. Administrators do all of this legitimately, so the account and the source host decide the call.

Triage signal: A process on the target whose parent is services.exe, WmiPrvSE.exe or wsmprovhost.exe, preceded by a network logon from another host. Pair the target’s process telemetry with the source’s logon.

Resource Development

ATT&CK tactic: building or acquiring what the attack needs before it starts (registering look-alike domains, buying access or infostealer logs, compromising servers or routers to use as relays, staging tools).

Triage signal: Usually outside your telemetry. The traces arrive later: a newly registered look-alike domain in a phishing email, a sign-in from compromised router or VPS infrastructure, or one of your credentials in infostealer logs.

Sandbox Escape

An attack that breaks out of a restricted environment (browser sandbox, container, or VM) to reach the underlying host. Most often seen as browser sandbox escapes chained with a renderer bug. ATT&CK T1611 Escape to Host covers both container breakouts and virtual-machine-to-hypervisor escapes (for example, on ESXi).

Triage signal: A browser, container or VM process spawning something it should never spawn (a shell from a browser renderer, a host process from a container), or an unexpected kernel or hypervisor crash on the host.

Staged Payloads

A two-phase delivery process where a lightweight stager downloads and executes a more complex secondary payload. Payload deployment, the delivery and installation of the attacker’s tools, usually works this way: a dropper, script or stager fetches and runs the real implant.

Triage signal: A small first-stage process (script host, mshta, rundll32, a loader DLL) making an outbound request, then a new process or injected memory within seconds. Capture the second-stage URL: it often names the C2.

Stealth

ATT&CK tactic: hiding and concealing actions so they appear as normal behavior, through obfuscation, masquerading, process injection, and indicator removal. In ATT&CK v19 (April 2026), Defense Evasion was split: Stealth kept the TA0005 ID, and the new Defense Impairment (TA0112) took the defense-breaking techniques. Rules written against ‘Defense Evasion’ still match TA0005, but not Defense Impairment.

Triage signal: Something trusted behaving in an untrusted way: a system binary with an odd command line or path, a signed process loading an unsigned DLL, encoded scripts. The name looks normal; the context does not.

System Tampering

The unauthorized modification of system configurations, binaries, or behaviors to support attacker goals or disrupt operations: changing boot settings, replacing or patching system files, editing the hosts file or firewall rules, or weakening security settings. In ATT&CK terms most of it falls under Defense Impairment or Impact.

Triage signal: Configuration changes with no change record: bcdedit, netsh advfirewall, hosts-file writes, registry edits to security settings, or system binaries that fail signature checks.

Toxic Combination

An access-governance term: multiple individually benign roles or permissions that together create excessive, dangerous access (the classic separation-of-duties conflict). A condition attackers hunt for and access reviews exist to catch.

Triage signal: An access review or cloud entitlement tool flagging one identity that can both create and approve a payment, or both write and deploy code. In a case, check whether the activity under review used such a combination.

WMI Event Subscription

A filter, consumer and binding stored in the WMI repository that runs attacker code when an event fires (logon, a timer). It is fileless and survives reboots. A Persistence technique; for WMI used to run commands, see WMI Abuse under Execution.

Triage signal: Sysmon events 19, 20 and 21 (WMI filter, consumer and binding), WMI-Activity event 5861, or Get-CimInstance against root\subscription returning a CommandLineEventConsumer or ActiveScriptEventConsumer you cannot explain.

Callback Phishing

An email with no link or attachment (a fake invoice or subscription renewal) that tells the victim to call a phone number. The call center then talks them into installing remote-access software. Defeats link and attachment scanning entirely.

Triage signal: An email with an invoice or renewal and a phone number but no link, then a remote-access tool installed by the user within the hour. Search all mailboxes for the same sender or phone number.

Deepfake Impersonation

Using AI-generated voice or video to pose as a real person (an executive, IT staff, a job candidate) on a call or video meeting. In early 2024 an employee of the engineering firm Arup in Hong Kong paid out about US$25 million after a video call on which every other participant was a deepfake. ATT&CK v19.2 tracks the content creation as Generate Content: Audio-Visual Content (T1683.002).

Triage signal: A payment, reset or access request made on a call or video meeting that skips the normal approval path, often with urgency and secrecy. Recognizing a voice or face is not proof of identity: verify through a known, separate channel.

DPRK Remote IT Workers

North Korean operatives who get hired as remote IT contractors under stolen or fabricated identities (Microsoft: Jasper Sleet), then earn salaries for the regime, steal data, and sometimes extort the employer. A hiring and insider-risk scenario as much as an intrusion. See Lazarus Group.

Triage signal: A corporate laptop shipped to a forwarding address, remote-control tools or IP-KVM devices IT never deployed, sign-ins whose geolocation or network does not match where the laptop should be, and identity, payroll and HR records that disagree.

Drive-by Download

Compromise triggered by visiting a malicious or compromised site. The classic form was a silent browser exploit served by an exploit kit. Today it is usually a fake browser update or fake CAPTCHA that persuades the user to download or paste-and-run something (SocGholish, ClickFix). Fully silent exploit chains still exist but are rare and mostly used in targeted watering-hole attacks.

Triage signal: A browser spawning a script host or installer, a fake-update file (JS or MSI) in Downloads, or a paste-and-run command right after a site visit.

Email Attachment Exploit

Malware or exploit code embedded in an email attachment that runs when the user opens it, either through a document vulnerability (Follina, the Equation Editor bug) or by persuading the user to enable content or run a file. ATT&CK files it under Spearphishing Attachment (T1566.001).

Triage signal: An Office, PDF or archive process spawning a shell, script host or msdt shortly after a mail client opened the attachment. Find the message and check who else received it.

Exploit Public-Facing Application

Targets vulnerabilities in externally exposed applications (web servers, APIs, file-transfer platforms, VPN and other edge appliances) to gain unauthorized access or remote code execution (ATT&CK T1190). Edge devices and file-transfer platforms have been its most exploited targets in recent years.

Triage signal: A web or application server process spawning a shell, new files in web directories, and odd requests or error spikes in WAF and application logs just before. Check the exposed version against the CISA KEV catalog.

Exposed Remote Services (RDP, VPN, Citrix)

Logging in through internet-facing remote services (RDP, VPN, Citrix, other edge appliances) with stolen, bought or guessed credentials, or by exploiting the appliance itself. A leading initial-access vector that often leaves no endpoint telemetry, so VPN and appliance logs are the evidence. Using RDP from inside the network to move between hosts is Lateral Movement (T1021.001).

Triage signal: Successful VPN or remote-gateway sign-ins from new countries, hosting providers or residential proxies, especially without MFA, followed by internal RDP or SMB from the VPN address pool.

Help-Desk Social Engineering

Calling the IT help desk while posing as an employee to get a password reset, MFA reset or new MFA device registered. Scattered Spider’s signature entry path.

Triage signal: An MFA method change or reset shortly followed by a sign-in from a new device or location.

Malvertising

Paid ads, especially search ads, that impersonate legitimate software downloads and lead to trojanized installers (often loaders or infostealers). Sibling technique: SEO poisoning (T1608.006), which games organic search results instead of buying ads.

Triage signal: A search-ad click to a look-alike download site, then an installer for a common tool from that domain, signed by an unfamiliar publisher or not signed at all.

Quishing (QR-Code Phishing)

Phishing that hides the link in a QR code, often in an email or a printed notice, so the victim opens it on a phone outside corporate web filtering and email link scanning.

Triage signal: Emails carrying a QR-code image with little text, often about MFA or document signing, followed by sign-ins from mobile devices or IPs the user never used.

Smishing (SMS Phishing)

Phishing by text message: fake delivery notices, toll bills, or “IT support” texts that lead to a credential-harvesting page or a malicious app.

Triage signal: User reports of texts about deliveries, tolls or IT support, then sign-ins or MFA registrations from mobile carriers or new devices. SMS bypasses your mail gateway, so user reports are the main source.

Social Engineering

Manipulates people into performing actions or revealing information by exploiting trust, fear, urgency, or authority. Phishing, vishing and help-desk impersonation are all forms of it.

Triage signal: A request that uses urgency, authority or secrecy to skip a normal check: a password or MFA reset, a payment change, a remote session. Verify through a known channel, not the one the request came from.

Spear Phishing

Targeted phishing customized for a specific individual or organization to increase success rate.

Triage signal: A message that cites real projects, colleagues or vendors and comes from a look-alike or newly registered domain. Search for other recipients: targeted campaigns rarely hit one person.

Typosquatting

Registers look-alike domains (or package names in npm and PyPI) to trick users into visiting malicious sites or installing malicious code, often to harvest credentials or deliver malware.

Triage signal: DNS lookups or links to newly registered domains one character off from yours or your vendors’, and packages with names close to popular ones installed in builds.

USB / Removable Media Infection

Malware spread on USB drives, usually as a disguised shortcut (LNK) or executable the user is tricked into opening. Autorun from removable media is disabled by default on modern Windows, but some organizations re-enable it via legacy Group Policy. Devices that pose as keyboards (BadUSB, Rubber Ducky) execute without user action and fall under Hardware Additions (T1200).

Triage signal: Removable-media events (6416, Partition Diagnostic 1006), LNK or EXE files executed from a removable drive, and a new keyboard device that types at machine speed.

Valid Accounts

Logging in with real credentials that were stolen (often from infostealer logs), bought from an access broker, or left at defaults. Nothing is exploited, so the only signal is behavior: new device, new location, impossible travel, unusual hours or access. The Snowflake customer-account thefts were this, at scale.

Triage signal: A correct password used from a new device, location or ASN, at unusual hours, then access the user does not normally make. Check whether the credential appears in infostealer logs.

Vishing (Voice Phishing)

Phone calls or voicemails impersonating authority figures or institutions to extract credentials or prompt unsafe actions.

Triage signal: A user report of a call from ‘IT’ or ‘the bank’, then a password reset, MFA change or remote-access install within minutes. Line up the call time with identity and endpoint logs.

Whaling

Spear phishing targeting high-profile individuals like executives, often for financial fraud (business email compromise) or data theft.

Triage signal: Messages to executives or their assistants about payments, legal matters or board business from look-alike domains or compromised partner accounts. Verify payment-change requests out of band.

ClickFix (fake CAPTCHA / paste-and-run)

A lure that tells the user to press Win+R (or open a terminal) and paste an attacker command, usually mshta or PowerShell, to “verify they are human” or “fix” an error; the user executes it themselves.

Triage signal: RunMRU registry entries and explorer.exe spawning powershell or mshta.

Command and Scripting Interpreter

Using legitimate command-line shells or scripting environments to execute commands: PowerShell and cmd.exe on Windows, bash and zsh on Linux and macOS, Python, JavaScript, and AppleScript.

Triage signal: PowerShell script-block logs (4104) with encoded or downloaded content, cmd or bash launched by an unexpected parent (Office, a browser, a web server), and interpreters running from user download paths.

Macro-based Execution

Malicious VBA (or legacy Excel 4.0/XLM) macros in Office files that run when the user enables content, or automatically from a Trusted Location. Since 2022, Office on Windows blocks macros by default in files carrying Mark of the Web (downloads and email attachments), so attackers moved to container files (ISO, LNK), HTML smuggling (T1027.006) and paste-and-run lures (T1204.004). When a macro alert fires today, ask how the file got past the block: user Unblock, missing MOTW, a Trusted Location, or a policy exception.

Triage signal: WINWORD.EXE or EXCEL.EXE spawning cmd, powershell, wscript, mshta or rundll32, and Office trust records showing content enabled on a downloaded file.

Process Doppelgänging

Overwriting a legitimate executable inside a Transactional NTFS (TxF) transaction, creating a process from the modified image, then rolling the transaction back, so the file on disk never changes.

Triage signal: Transactional NTFS APIs used by a process that is not an installer, and a process whose image on disk does not match its memory. Rare; most EDRs flag it as process tampering.

Process Injection

Running code inside another live process’s memory (DLL injection, process hollowing, thread hijacking, and similar sub-techniques) so it inherits that process’s identity and trust. Sometimes loosely called memory injection, a phrase that can also mean fileless execution (see Fileless Malware).

Triage signal: A process writing to another process’s memory and starting execution there (Sysmon Event 8, CreateRemoteThread), or executable memory not backed by a file.

Reflective DLL Injection

A DLL that maps itself into memory with its own loader instead of the Windows loader, so it never appears as a file on disk or in the normal loaded-module list. EDR catches it as executable memory not backed by any file (T1620; remote-process variants fall under T1055.001).

Triage signal: Memory scans or EDR alerts for unbacked executable memory containing a PE header, often in a process that just made a network connection. Capture memory before any reboot: the evidence lives nowhere else.

Side-loading

Planting a malicious DLL next to a legitimate (often signed) program that loads a DLL of that name from its own folder, so trusted code runs the payload. Search-order hijacking is the sibling variant under the same ATT&CK ID, T1574.001 “DLL” (see DLL Search Order Hijacking).

Triage signal: A signed vendor EXE running from a user-writable path such as AppData or ProgramData alongside an unsigned DLL.

Thread Execution Hijacking

Suspending an existing thread in another process, writing code into that process, pointing the thread’s context (instruction pointer) at it with SetThreadContext, and resuming it. Unlike CreateRemoteThread-style injection, no new thread is created.

Triage signal: EDR alerts on SuspendThread, SetThreadContext and ResumeThread against another process, with the thread’s instruction pointer in unbacked memory. No new thread appears, so CreateRemoteThread-based rules miss it.

WMI Abuse

Using Windows Management Instrumentation to run commands and query system data on the local host or on remote hosts. Access is through PowerShell (Get-CimInstance, Invoke-CimMethod), COM/DCOM, or the deprecated wmic.exe (see the WMIC entry in the CLEAR glossary). WMI is native and looks like admin activity, so it blends in with legitimate management traffic. WMI event subscriptions used for persistence are a separate technique, T1546.003.

Triage signal: WmiPrvSE.exe spawning cmd or powershell, a network logon followed by a WmiPrvSE child process on the target, and wmic process call create in command lines.

Account Enumeration

Discovering valid usernames, either externally by probing authentication responses (Reconnaissance, T1589) or internally by listing domain/cloud accounts after access (Discovery, T1087).

Triage signal: External: many sign-in attempts returning ‘user does not exist’ (Entra error 50034, Windows 4625 with sub-status 0xC0000064) across many names. Internal: LDAP queries or net user /domain listings from a workstation.

Account Takeover

Adversary gains unauthorized control of a user’s account using stolen credentials or session tokens to impersonate the user.

Triage signal: A sign-in from a new device, location or ASN, then changes the real user would not make: a new MFA method, a new inbox rule, a changed recovery address, or edited payment details. The changes, not the sign-in, confirm it.

AD CS Abuse

Abusing misconfigured Active Directory Certificate Services templates or enrollment endpoints (the ESC1 to ESC8 family) to obtain a certificate that authenticates as another user, often a domain admin. Certificates outlive password resets, so revoke them during remediation.

Triage signal: Certificate requests (4886) and issuances (4887) where the requester and the subject differ, especially for privileged accounts, and certificate-based Kerberos logons (4768 with certificate fields) from unexpected hosts.

AiTM Phishing

Adversary-in-the-middle phishing: a kit proxies the real login page, so the victim completes their own password and MFA prompts while the proxy captures the resulting session cookie.

Triage signal: An interactive, MFA-satisfied sign-in from a hosting-provider IP right after a link click, followed by the same session used from a new device.

AS-REP Roasting

Requesting Kerberos authentication data for accounts that have pre-authentication disabled, then cracking it offline to recover the password.

Triage signal: Event 4768 with pre-authentication type 0 for accounts that should not have it disabled.

Compromised Credentials

Usernames and passwords exposed, stolen, or leaked, enabling attackers to gain unauthorized access to systems or services.

Triage signal: A credential that appears in infostealer logs, a breach corpus or a paste, or is used from infrastructure the user never used. A reset is not the end: revoke sessions and check what the credential already did.

Credential Theft

Stealing login information (passwords, hashes, tokens, session cookies) through phishing, infostealers, keyloggers, memory dumping, or system exploitation. An umbrella term: Credential Dumping, Token Theft and AiTM Phishing on this page describe the specific methods.

Triage signal: Look for the use that follows the theft: a new sign-in, device or token shortly after the phishing click, malware run or memory read. The theft itself is often visible only on the endpoint where it happened.

DCSync

Impersonating a domain controller and asking a real one to replicate password data, which returns the hash of any account, krbtgt included. Requires replication rights, so it follows a domain-admin-level compromise.

Triage signal: Directory replication requests (4662 with the replication GUIDs) from a host that is not a domain controller.

Device Code Phishing

Tricking a user into entering an attacker-generated device code on the real Microsoft or other IdP sign-in page, which hands the attacker tokens for the user’s account. No fake site and no password capture are involved. Used at scale by Storm-2372 from 2024. Blocking the device code flow where it is not needed is the main control.

Triage signal: Entra sign-in logs showing the device code authentication protocol for a user who does not use device-code apps, often right after a Teams or chat invite, then token use from a different IP.

Device Registration

Registering an attacker-controlled device to a compromised account so access survives a password change: as a new MFA method (an authenticator app or phone number), or as a registered or joined device in the identity provider or MDM, which can satisfy device-based Conditional Access and, in Microsoft Entra ID, obtain a Primary Refresh Token. Storm-2372 and Scattered Spider have both used it. An ATT&CK Persistence technique.

Triage signal: Entra ID audit events such as “Register device”, “Add registered owner to device” or “User registered security info” soon after a risky sign-in, a help-desk reset or a device code sign-in, from an unfamiliar location, or with a device name outside your naming scheme. A password reset does not remove it: list the account’s devices and MFA methods and remove the ones nobody can account for. See Identity-persistence sweep.

Diamond and Sapphire Tickets

Stealthier relatives of the golden ticket that start from a real TGT. A diamond ticket decrypts a legitimately issued TGT with the krbtgt key and edits its privilege data; a sapphire ticket goes further and embeds a real privileged user’s privilege data obtained through Kerberos delegation (S4U2self). Because a genuine ticket request happened, the usual ‘service ticket with no TGT’ check misses them.

Triage signal: Harder to spot than a golden ticket because a matching 4768 exists. Look for privilege data that does not match the account (groups it does not hold), encryption types that do not fit the account, and how the attacker got the krbtgt key: any DCSync or NTDS.dit theft means krbtgt is compromised.

Golden SAML

Forging SAML tokens with a stolen federation token-signing key, such as an AD FS token-signing certificate. The attacker can then sign in to any service that trusts the key, as any user and with any claims, without a password or MFA, and resetting user passwords does not stop it. CyberArk named the technique in 2017; APT29 used it in the SolarWinds campaign.

Triage signal: Sign-ins at a federated service with no matching token issuance at the identity provider (for AD FS, no audit event 1200 for that user and time), an export of the token-signing certificate or a read of the AD FS key container in Active Directory, and federation-trust changes on a domain in the cloud audit log. Rotating the signing key ends it, once the attacker’s access to the identity provider is removed. See Identity-persistence sweep.

Illicit Consent Grant

Phishing a user (or admin) into granting a malicious OAuth app permissions to their mailbox or files. The app’s token keeps working after password resets and MFA changes, so revoking the grant is part of containment.

Triage signal: Entra audit events ‘Consent to application’ for an unfamiliar app requesting Mail.Read, Files.ReadWrite.All or offline_access, then Graph API activity from that app. Export the audit and sign-in records before the grant is revoked.

Kerberoasting

Requesting Kerberos service tickets for accounts with SPNs and cracking them offline to recover the service account’s password, which then enables privilege escalation, persistence or lateral movement. Since Microsoft’s CVE-2026-20833 hardening (enforced April 2026, rollback removed July 2026), domain controllers issue AES service tickets by default to accounts with no explicit msDS-SupportedEncryptionTypes, and AES tickets are far slower to crack. In event 4769, a Ticket Encryption Type of 0x17 (RC4-HMAC) is now a strong signal, and service accounts still explicitly configured for RC4 are the prime targets.

Triage signal: One account requesting service tickets (4769) for many SPNs in a short burst, especially with Ticket Encryption Type 0x17 (RC4). A honey SPN account that no one should ever request makes the call near-certain.

MFA Fatigue

Flooding a user with push-notification approval requests, sometimes paired with a call pretending to be IT, until they accept one. Also called push bombing. Number matching and phishing-resistant MFA defeat it.

Triage signal: Several MFA push denials or timeouts for one user within minutes (Entra error 500121), then an approval, often with a sign-in from a new location. Ask the user whether they approved it.

NTDS.dit Extraction

Copying the Active Directory database (ntds.dit) and the SYSTEM hive from a domain controller to extract every account’s hash offline.

Triage signal: Ntdsutil “ifm” or vssadmin shadow-copy commands on a domain controller, or ntds.dit appearing outside its normal path.

NTLM Relay

Forwarding a victim’s NTLM handshake to another service (SMB, LDAP, MSSQL, or AD CS HTTP enrollment) to authenticate as the victim without knowing the password. Relaying to an SMB server is often called SMB relay. Usually paired with authentication coercion (PetitPotam, the printer bug) or LLMNR/NBT-NS poisoning. Blunted by SMB signing (required by default for inbound and outbound on Windows 11 24H2 Pro/Enterprise/Education, outbound only on Server 2025), LDAP signing and channel binding, Extended Protection for Authentication on AD CS, and Microsoft’s deprecation of NTLM (announced 2024; NTLMv1 removed in Windows 11 24H2 / Server 2025).

Triage signal: NTLM network logons (4624 type 3) for a user or machine account from an IP that is not their host, especially machine accounts authenticating to AD CS web enrollment or LDAP, and LLMNR or NBT-NS responses from an unexpected host.

Overpass-the-Hash (Pass-the-Key)

Using a stolen NT hash or Kerberos key to request a real Kerberos ticket, so the attacker continues with Kerberos instead of NTLM and blends in with normal domain authentication.

Triage signal: TGT requests (4768) with RC4 encryption (0x17) for an account that normally gets AES, from a host the user is not logged on to.

Pass-the-Ticket

Stealing a Kerberos ticket (TGT or service ticket) from one session and injecting it into another to authenticate as that user without the password or hash. A stolen TGT can request tickets for any service the identity is entitled to; a stolen service ticket opens only the one service it was issued for.

Triage signal: A Kerberos ticket used from a host other than the one it was issued to (the client address in 4769 or 4624 does not match the 4768 that issued the TGT), and Rubeus or Mimikatz kerberos::ptt on the source host.

Password Cracking

Using brute force, dictionary attacks, or rainbow tables to recover plaintext passwords from hashes.

Triage signal: Offline, so invisible in your logs. You see the inputs (hash theft, Kerberoasting) and the result (a valid logon with a recovered password). Weak or old service-account passwords are the usual victims.

PRT Theft

Stealing an Entra ID Primary Refresh Token, the device-bound token Windows uses for single sign-on to Microsoft cloud services. A stolen PRT gives the attacker the user’s cloud sessions with MFA already satisfied. Token protection and hardware-backed keys make extraction harder.

Triage signal: Sign-ins with a PRT from a device ID or IP that does not match the registered device, browser-cookie or token tools on the endpoint, or a Defender alert for PRT access. Revoke sessions and review the device registration.

Rainbow Table

Precomputed table of hash values used to reverse cryptographic hashes, recovering plaintext passwords more efficiently. Salting defeats it: a unique random value added to each password before hashing makes precomputed tables useless, so rainbow tables matter mainly against unsalted hashes such as Windows LM and NTLM.

Triage signal: Offline, so there are no logs. Its triage relevance is exposure: treat any stolen unsalted hash (NTLM, legacy LM, old web-application MD5) as a recoverable password.

Shadow Credentials

Writing an attacker-controlled key to a target account’s msDS-KeyCredentialLink attribute, then using it to request Kerberos tickets as that account.

Triage signal: Unexpected changes to msDS-KeyCredentialLink (event 5136).

Silver Ticket Attack

Similar to Golden Ticket but forges a Kerberos service ticket (TGS) with the target service account’s key, giving access to that one service. The forged ticket never touches a domain controller, which makes it quieter than a golden ticket.

Triage signal: Service access (4624 on the target) with no matching service-ticket request (4769) on any domain controller, because a forged service ticket never touches one; also RC4 tickets presented to services that only use AES.

Token Impersonation

Duplicating another process’s existing Windows access token (for example with DuplicateTokenEx) and acting under it, the classic route from a service account holding SeImpersonatePrivilege to SYSTEM. Creating a fresh token from stolen credentials is the sibling technique T1134.003.

Triage signal: A service-account process (IIS, SQL Server) spawning a SYSTEM process, potato-family tools (JuicyPotato, PrintSpoofer, GodPotato) on disk or in command lines, or a SYSTEM shell under a web or database server parent.

Token Manipulation

ATT&CK’s umbrella technique (T1134) for abusing Windows access tokens: impersonating or stealing another process’s token (T1134.001), creating a process with a stolen token (T1134.002), building a new token from stolen credentials (T1134.003), and spoofing a parent process (T1134.004). Token Impersonation and Parent PID Spoofing on this page are its common forms.

Triage signal: A process running as a different user from its parent with no logon event to explain it, EDR alerts on DuplicateTokenEx or CreateProcessWithTokenW, and 4624 logon type 9 (new credentials) on the host.

Token Theft

Stealing an already-issued bearer credential that has passed MFA (browser session cookie, OAuth access or refresh token, Entra Primary Refresh Token, cloud CLI token) from browsers, disk caches, memory or an AiTM proxy, then replaying it from attacker infrastructure. Theft: T1539 Steal Web Session Cookie, T1528 Steal Application Access Token. Replay: T1550.004, T1550.001. Duplicating a Windows access token on an endpoint is the separate T1134.001 (see Token Impersonation).

Triage signal: The same session or refresh token used from a new IP or ASN with no new interactive sign-in, especially right after an infostealer or AiTM event. Revoke the sessions and tokens; a password reset alone does not end it.

Binary Obfuscation

Code is deliberately scrambled, encrypted, or disguised to make analysis harder and evade static analysis engines.

Tactic: Stealth (TA0005)

Triage signal: File analysis showing high entropy, few readable strings and few imports, or a sample that only unpacks in memory. Obfuscation raises suspicion; behavior decides the verdict.

Binary Padding

Adds non-functional data or junk code to malware files to change their hash, inflate them past scanner size limits, and avoid signature-based detection.

Tactic: Stealth (TA0005)

Triage signal: Files far larger than their content needs, often over 100 MB, with long runs of null or junk bytes at the end. Many scanners skip large files, which is the point.

Bring Your Own Vulnerable Driver (BYOVD)

Loading a legitimately signed but vulnerable kernel driver, then exploiting it to kill EDR processes or disable kernel protections from ring 0. The most common EDR-killer technique in 2025-2026 ransomware. Microsoft’s vulnerable driver blocklist prevents many known drivers.

Tactic: Defense Impairment (TA0112)

Triage signal: A new kernel driver service created (event 7045) or driver loaded (Sysmon event 6) shortly before security agents stop reporting.

Clear Windows Event Logs

Wiping Windows event logs (wevtutil cl, Clear-EventLog) to destroy evidence. T1685.005 in ATT&CK v19; previously T1070.001. Event 1102 (Security log cleared) and 104 (System log cleared) are themselves high-signal alerts.

Tactic: Defense Impairment (TA0112)

Triage signal: Security event 1102 or System event 104, wevtutil cl or Clear-EventLog in command lines, and gaps in forwarded logs. Clearing is rarely routine on a server, and your SIEM copy may still hold what was erased.

Command-Line Obfuscation

Malicious commands hidden using encoding (Base64), string concatenation, or misleading syntax to bypass command-line monitoring.

Tactic: Stealth (TA0005)

Triage signal: Command lines with -enc or -EncodedCommand, caret and escape characters, string concatenation or environment-variable substrings. Decode before judging: PowerShell script-block logging (4104) records the decoded script.

Debugger Evasion

Malware checks whether a debugger is attached (IsDebuggerPresent, timing checks) and changes behavior or exits so analysts cannot step through it.

Tactic: Stealth (TA0005)

Triage signal: Mostly a sandbox and reverse-engineering concern. A sample that behaves differently under analysis than in the field is evidence of evasion, not innocence.

Delayed Execution

Malware deliberately waits (sleep calls, scheduled tasks, ping loops, API hammering) before acting, so automated sandboxes time out before they see malicious behaviour. ATT&CK T1678 Delay Execution; also called time-based evasion. Waiting for user input such as mouse clicks or a document closing is a separate check, T1497.002 User Activity Based Checks.

Tactic: Stealth (TA0005)

Triage signal: Long sleeps, ping -n loops or timeout commands before the payload, and scheduled tasks set to run hours later. When a sandbox report is clean, check how long the sandbox ran.

Disable or Modify Tools

Stopping, uninstalling, or crippling security tools: killing EDR processes (often with EDR killers such as AvNeutralizer or through BYOVD), tampering with AMSI (Antimalware Scan Interface) or ETW (Event Tracing for Windows), adding Defender exclusions, or stopping log forwarders. Replaced T1562 Impair Defenses in ATT&CK v19. Pre-ransomware EDR killing is among the highest-signal events an analyst can catch; a host that suddenly stops reporting is a finding, not a gap.

Tactic: Defense Impairment (TA0112)

Triage signal: Defender event 5007 (configuration change) adding exclusions, EDR or log-forwarder services stopped, AMSI or ETW patching flagged by EDR, and agents that go silent. Check the agent’s health before trusting its silence.

Email Hiding Rules (Inbox Rules)

Mailbox rules an attacker creates in a compromised account to move, mark as read or delete the messages the owner should not see: security alerts, replies from a payment contact, anything containing words such as “invoice”, “wire” or “hacked”. Common in business email compromise. A forwarding rule that copies mail to an outside address is the collection side of the same trick (T1114.003). Both live in the mailbox and survive a password reset.

Tactic: Stealth (TA0005)

Triage signal: New-InboxRule, Set-InboxRule or UpdateInboxRules in the Microsoft 365 unified audit log, especially a rule that deletes mail or moves it to RSS Feeds, Archive or Conversation History, matches finance or security keywords, has a one-character name, or was created in the same session as a risky sign-in. Export the rules as evidence before they are removed; a password reset alone leaves them running.

Encoded Payloads

Payloads encoded or encrypted (Base64, XOR) to hide true content until runtime, evading static detection.

Tactic: Stealth (TA0005)

Triage signal: Long Base64 or hex strings in scripts, command lines or registry values, and processes decoding them (certutil -decode, FromBase64String).

Exploitation for Defense Impairment

Exploiting a vulnerability in security software or the operating system to switch off or bypass a defense, for example a flaw in an EDR agent or a kernel bug that lets the attacker unload protections. BYOVD is the most common form, using a vulnerable third-party driver.

Tactic: Defense Impairment (TA0112)

Triage signal: A security product crashing or its service stopping just after an exploit-like event or a new driver load, or a known-vulnerable version of the security tool itself. Check the agent version against vendor advisories.

File Extension Spoofing

Files disguised with misleading extensions (e.g., invoice.pdf.exe) to trick users and bypass basic file-type filters. It works because Windows File Explorer hides known file extensions by default. The Unicode right-to-left override character (U+202E, T1036.002) pulls off the same trick by visually reversing the end of the file name.

Tactic: Stealth (TA0005)

Triage signal: File names with double extensions or the right-to-left override character (U+202E) in attachments or downloads, and an executable launched from a file whose name ends in a document type.

HTML Smuggling

Building a malicious file inside the victim’s browser from JavaScript or encoded data in an HTML attachment or page, so email and web gateways only ever see HTML. LNK smuggling hides commands in shortcut files in a similar way (T1027.012).

Tactic: Stealth (TA0005)

Triage signal: An HTML attachment or page that builds a download in the browser (a Blob or data URI), then a ZIP, ISO or script in Downloads with no matching web download in the proxy logs.

LOLBins

Living Off the Land Binaries: trusted, signed system executables (certutil, rundll32, mshta) weaponized so the malicious part is the argument line, not the file on disk. The evasion face of the Living Off The Land technique covered under Execution.

Tactic: Stealth (TA0005)

Triage signal: Signed system binaries with network or script arguments: certutil -urlcache, mshta with a URL, regsvr32 /i: with a URL (Squiblydoo), rundll32 with a DLL from a user path. The parent and the arguments are the evidence.

Low-and-Slow

Performing actions gradually or in minimal increments (scheduled transfers, small data chunks, sparse logins) to remain under detection thresholds. Detection needs long look-back windows rather than per-hour thresholds.

Tactic: Exfiltration (TA0010)

Triage signal: Small, regular transfers or logins that never trip per-hour thresholds but add up over weeks. Use long look-back queries and per-entity totals.

MAC Address Spoofing

Changing a network interface’s hardware (MAC) address to impersonate an allowed device and slip past network access control (NAC) or MAC filtering. Note that phones and laptops now randomize Wi-Fi MACs by default, so a changing MAC is usually privacy behavior, not an attack.

Tactic: Stealth (TA0005); no dedicated ATT&CK technique

Triage signal: One MAC appearing on two switch ports, a known device’s MAC on a new port or with a new OS fingerprint, or NAC logs showing an allowed MAC failing posture checks.

Mark-of-the-Web Bypass

Delivering files in containers or formats that do not carry the Mark-of-the-Web zone tag (ISO, VHD, some archives) so SmartScreen and Office’s macro block never apply. A file from the internet that lacks MOTW is worth asking about.

Tactic: Defense Impairment (TA0112)

Triage signal: ISO, VHD, IMG or archive files mounted or opened from email or downloads, and executables or LNK files run from the mounted drive with no Zone.Identifier stream.

Masquerading

Disguising a malicious process, file or task as a trusted one (sometimes called process masquerading): svchost.exe running from C:\Users\Public, or a scheduled task named like a Windows one. Check the path, signer and parent, not the name. Matching a legitimate name or location (T1036.005) is the most common form.

Tactic: Stealth (TA0005)

Triage signal: A system binary name running from the wrong path (svchost.exe outside System32), a parent that does not fit (svchost not started by services.exe), or a signer that does not match the name.

Parent PID Spoofing

Spawns processes that appear to be launched by trusted executables (like explorer.exe), misleading analysts and EDR that rely on the process tree.

Tactic: Stealth (TA0005)

Triage signal: A process whose reported parent could not have created it (explorer.exe as the parent of a SYSTEM process), or EDR showing a creator process that differs from the PPID. The ParentImage field alone can be fooled.

Right-to-Left Override (RLO)

The Unicode control character U+202E, which displays the text after it in reverse. A file actually named invoice, then U+202E, then fdp.exe displays as “invoiceexe.pdf”, so an executable passes for a PDF. A Masquerading technique; see also File Extension Spoofing.

Tactic: Stealth (TA0005)

Triage signal: Search file, attachment and process-creation logs for the U+202E character itself, not for the displayed name, and treat any file name that contains it as suspect. An executable whose displayed name ends in a document extension is the same tell. Some tools render the character as garbled bytes; see Telemetry labs.

Safe Mode Boot

Rebooting a host into Safe Mode, where most security agents do not load, before running ransomware or other payloads (bcdedit /set safeboot).

Tactic: Defense Impairment (TA0112)

Triage signal: bcdedit /set safeboot in a command line, a service added under the SafeBoot registry keys, and a reboot shortly after. Security agents go quiet during that reboot.

Subdomain Abuse

Using subdomains that genuinely belong to trusted services, so attacker traffic inherits the parent domain’s reputation: an attacker’s own app or bucket on a shared cloud platform (anyone can create an Azure web app, and its hostname sits under azurewebsites.net), or the takeover of one of your DNS records that still points at a deprovisioned cloud resource.

Tactic: Resource Development (TA0042)

Triage signal: Links or connections to tenant-style subdomains on trusted platforms (azurewebsites.net, cloudfront.net, pages.dev) your business does not use, and your own DNS records pointing at deprovisioned cloud resources.

System Binary Proxy Execution (formerly Signed Binary Proxy Execution)

ATT&CK’s umbrella technique (T1218) for running malicious code through trusted system binaries such as rundll32, regsvr32, mshta and msiexec, so execution looks like normal OS activity. See LOLBins.

Tactic: Stealth (TA0005)

Triage signal: rundll32, regsvr32, mshta or msiexec loading a script or DLL from a URL or user-writable path, especially with an Office app, browser or script host as the parent.

User-Agent Spoofing

Alters HTTP headers to mimic trusted applications or browsers, blending into normal web traffic. A browser user agent coming from a process that is not a browser is the tell.

Tactic: Command and Control (TA0011)

Triage signal: Proxy logs where the user-agent string does not match the process making the request (from EDR network events), outdated or rare browser versions, or one host presenting many agents in a short window.

Bulletproof Hosting (BPH)

Hosting services known for ignoring abuse complaints and allowing malicious activities to operate with minimal risk of takedown. Traffic to a known BPH network is a strong risk multiplier during triage. CISA and partners published dedicated mitigation guidance in November 2025.

Triage signal: Connections to ASNs or IP ranges flagged as bulletproof hosting in threat intelligence, especially from servers. Weigh the process: a browser visiting is different from a service beaconing.

C2 Framework

A commercial or open-source toolkit that provides implants, listeners and operator consoles for hands-on-keyboard intrusions: Cobalt Strike, Sliver, Havoc, Mythic, Brute Ratel C4. Malleable profiles let operators reshape traffic to imitate legitimate services, so detection keys on implant behavior and beacon shape rather than fixed signatures.

Triage signal: Implant behaviors rather than names: default or odd named pipes, sacrificial processes (rundll32 or dllhost with no arguments), in-memory loaders, and regular beacons. One confirmed running implant means an operator whose access no control has contained: the escalation tripwire fires, and the case escalates as hands-on-keyboard activity.

Command and Control (C2)

The channel an attacker uses to send commands to compromised systems and receive results or stolen data (ATT&CK tactic TA0011). It usually hides in common protocols or trusted cloud services, so rhythm and destination give it away, not the port.

Triage signal: A host repeatedly talking to a destination it has no business with, on a rhythm. Confirmed C2 that no control has blocked means an attacker can act on that host now: the escalation tripwire fires.

Custom Encryption Protocols

Non-standard encryption schemes that wrap malicious traffic to avoid detection by DPI or SSL/TLS inspection.

Triage signal: High-entropy payloads on ports or protocols that should be plain text or standard TLS, with no recognizable TLS handshake. JA4 or JA3 fingerprints that match no known client help.

Custom Protocols over Non-Standard Ports

Known protocols on ports they are not normally paired with (HTTPS on 8088, SSH on 443), or fully custom protocols (a home-grown binary C2 protocol over raw TCP), chosen to slip past detection that expects known service behavior.

Triage signal: A protocol and port mismatch in network metadata (TLS on 8088, SSH on 443, an unknown binary protocol on 80), especially from servers. Zeek or firewall application identification usually flags it.

Dead Drop Resolver (DDR)

Malware fetches a pointer, usually an encoded domain or IP, from content posted on a legitimate service (Pastebin, GitHub, a social-media profile) and then connects to the real C2 server it points to. The legitimate site hides the C2 address from static analysis and lets the operator rotate infrastructure. Pivot on whatever the host connects to next. If the commands themselves are read from the web service, that is T1102.002 (bidirectional) or T1102.003 (one-way).

Triage signal: A non-browser process fetching a specific Pastebin, GitHub or social-media page, then connecting to a new IP or domain within seconds.

Dynamic Resolution / Fallback Channels

Ways an implant finds its C2 when the primary address is blocked: computed domains (DGA), rotating DNS answers (fast flux), or a built-in list of backup domains and protocols it falls back to (sometimes called callback domain rotation). Blocklisting one address rarely ends the session; hunt for the next destination the host tries.

Triage signal: After a block, the same host trying new domains or IPs within minutes on the same cadence and from the same process. Pivot on the process and the timing, not the indicator.

Email-based C2

Using SMTP/IMAP or a cloud mail API to send or receive commands and data, hidden in attachments or content that blends with business traffic.

Triage signal: A non-mail process connecting to SMTP, IMAP or a mail API, or a mailbox whose drafts or folders change on a schedule with no user activity. Mailbox audit and Graph API logs carry it.

ICMP Tunneling

Embedding commands or data in ICMP echo packets (ping) to establish covert C2 communication that traditional firewalls often miss.

Triage signal: ICMP echo packets with large or varying payloads, steady pings to one external host, or ICMP volume far above baseline from one machine.

ORB Network

Operational relay box network: compromised or leased routers, IoT devices and VPS nodes chained into a proxy mesh that nation-state actors route through (Volt Typhoon’s KV botnet is one example). Traffic arrives from residential or small-business IPs near the victim, which defeats IP reputation and geolocation checks.

Triage signal: Activity from residential or small-business IPs near you that change often, against VPN or edge devices. IP reputation will look clean, so pivot on the account, the device and the behavior.

Peer-to-Peer (P2P) C2

Mesh-like networks where infected systems communicate with each other to share commands and updates without a centralized server, so taking down one node does not cut the botnet off.

Triage signal: Internal hosts talking to each other on unusual high ports, or many internal hosts reaching many external consumer IPs with no central destination.

Protocol Tunneling

Encapsulates malicious traffic within legitimate protocols (HTTPS, DNS, ICMP) to bypass network detection.

Triage signal: One protocol carrying traffic it should not: SSH inside HTTPS, RDP over an SSH tunnel (plink, chisel), or a tunneling tool binary on a server. Find the tool, then the session.

Residential Proxies

Commercial or criminal proxy services that route attacker traffic through home internet connections, so sign-ins and sprays appear to come from ordinary consumer ISPs. A reason “one source” detections fail and per-IP rate limits barely slow attackers.

Triage signal: Sign-ins from consumer ISPs in unexpected regions that change between attempts while the user agent or device fingerprint stays the same. Detect on the account and the fingerprint, not the IP.

Slack-based C2

Abuse of Slack’s APIs, webhooks, or tokens to create covert C2 by embedding commands or exfiltrated data within messages or bots. The same pattern runs over Discord, Microsoft Graph/OneDrive, Google Sheets/Drive and Dropbox; pivot on which process is talking to the API, not on the destination.

Triage signal: A process other than the Slack client calling Slack API or webhook endpoints, or a bot token used from an unexpected host.

Social Media C2

Using X (formerly Twitter), Facebook or Instagram posts, images or profiles on trusted domains to carry encoded commands or retrieve data.

Triage signal: A non-browser process fetching social-media profile or post URLs on a schedule, followed by new outbound connections or commands.

Telegram Bots

Leveraging Telegram’s bot API to issue commands or receive data, creating C2 over an encrypted, trusted messaging platform.

Triage signal: Connections to api.telegram.org from processes that are not the Telegram client, especially from servers or scripts. Infostealers and RATs use it to send stolen data.

Tor-based C2

Leveraging Tor to anonymize attacker and malware communication, making attribution and traffic analysis significantly harder.

Triage signal: Connections to known Tor relays or Tor ports (9001, 9030, or 9050 locally), tor.exe or a renamed copy on a host. Tor from a server is suspicious in most organizations.

Tunneling Services

Legitimate reverse-tunnel services (ngrok, Cloudflare Tunnel, Microsoft dev tunnels) that expose an internal host or relay C2 through a trusted vendor domain. The domain is reputable, so pivot on which process opened the tunnel and whether the organization uses the service.

Triage signal: ngrok, cloudflared or devtunnel binaries on hosts that do not use them, DNS lookups for those services’ domains, and a long-lived outbound session from a server. Ask who started the tunnel.

Archive Collected Data

Compressing and often password-protecting collected files (7-Zip, WinRAR, tar) before exfiltration, which shrinks transfers and hides content from inspection.

Triage signal: 7z.exe, rar.exe or tar run with a password switch (-p, -hp) against shares or user folders, producing large archives in Temp, ProgramData or a share root.

Data Harvesting

Automated or bulk collection of data via scrapers, malware, or scripts, often used for profiling, fraud, or resale.

Triage signal: High request rates from one client or rotating proxies walking through IDs or pages in order, unusual API pagination, and accounts that read far more records than they work on.

Data Staging

Collected data consolidated in one place before exfiltration (a local directory, a file share, or a cloud instance), often compressed and encrypted into archives (T1560). Staging reduces the number of outbound connections. A multi-gigabyte .7z or .rar appearing in ProgramData, %TEMP% or a share root is one of the best pre-exfiltration detection opportunities. Splitting transfers to stay under thresholds is a separate technique (T1030).

Triage signal: Large archives or copied file sets appearing in Temp, ProgramData, the recycle bin or a share root, created by a server process or remote session shortly before outbound transfers.

Data-Theft Extortion

Stealing data and demanding payment to keep it off a leak site, with no encryption at all (Cl0p’s file-transfer campaigns are the defining example). There may be no ransomware alert, so the exfiltration itself is the incident.

Triage signal: Exploitation of an internet-facing file-transfer or data platform, then bulk downloads, then an extortion email to executives. The platform’s own logs show which files left.

Encrypted Web Uploads

Data uploaded over HTTPS to cloud storage or attacker-controlled servers, so content inspection sees only encrypted traffic. Volume, destination age and the uploading process are the signals.

Triage signal: Bytes out far larger than bytes in to a single new destination, from a process that does not normally upload, often outside working hours.

Exfiltration Over C2 Channel

Sending stolen data out over the same channel the implant already uses for commands, so there is no new destination to spot; the signal is a change in upload volume on an existing beacon.

Triage signal: An existing beacon’s upload size jumps, or its interval changes during a data copy. Compare bytes out before and after the staging activity.

Exfiltration to Cloud Storage

Bulk upload or sync of stolen data to a cloud storage service (MEGA, Dropbox, a cloud bucket) with tools such as rclone.

Triage signal: Rclone.exe or a renamed copy on a server, its config file, or sustained outbound volume to a storage provider the host never used before.

Insider Data Theft

Unauthorized removal of sensitive data by someone with legitimate access: an employee, contractor, or a fraudulent remote hire such as a DPRK IT worker. Signals are behavioral (unusual volume, new destinations, off-hours access), not malware.

Triage signal: Observable technical activity only: bulk downloads or repository clones, uploads to personal storage, USB writes (event 6416 plus DLP), or printing far outside the person’s baseline. HR-held context reaches the case only through the insider-risk route.

Interception in Transit (Adversary-in-the-Middle)

Capturing or altering data as it crosses a network, by sniffing unencrypted protocols, ARP or LLMNR poisoning, or proxying a TLS session (as AiTM phishing kits do to steal session cookies).

Triage signal: ARP, LLMNR or NBT-NS responses from an unexpected host, clients presented with untrusted certificates, and sign-ins from a phishing proxy’s IP right after the user’s own.

Transfer Data to Cloud Account

Moving data to another cloud account the attacker controls inside the same provider (sharing a snapshot or bucket cross-account), so no data crosses the network perimeter. Only cloud audit logs show it.

Triage signal: Cloud audit events that share a snapshot, image, disk or bucket with an external account ID, such as ModifySnapshotAttribute or a bucket policy granting another account in AWS CloudTrail.

Data Breach

A security incident that results in unauthorized access to, or accidental or unlawful loss, alteration, destruction or disclosure of, protected data. Whether an event is legally a breach (and starts a notification clock) is for privacy or legal counsel to decide, not the analyst. Scale is irrelevant, and accidental disclosures can qualify. See Scope > Regulatory.

Triage signal: Not an analyst call. Your job is the facts: what data, how many records, whose, whether it was accessed or taken, and when you became aware of it. Record the time of awareness, because legal clocks may run from it.

Data Exposure

Data left accessible without proper controls, often due to misconfigurations like open cloud storage, unsecured APIs, or an application revealing internal details or user data. Information disclosure is the matching vulnerability class (CWE-200): a system reveals internal details, metadata or user data to someone not entitled to it. Exposure is a condition, not proof of access: check the access logs before you call it theft.

Triage signal: A public bucket, open share, unauthenticated API or verbose error found by a scan or report. Pull the access logs for the whole exposure window before deciding whether anyone took anything.

Data Leak

Informal term for data exposed outside its intended boundary, often accidentally (misdirected email, public bucket). An accidental leak of personal data or protected health information (PHI) can still be a reportable breach, so escalate it the same way. Not the same as extortion leak sites, where stolen data is published deliberately. See Scope > Regulatory.

Triage signal: A misdirected email, public link or open bucket reported by a user or scanner. Capture who could reach the data, for how long, and whether access logs show anyone did.

Shadow Data

Sensitive or regulated data stored in unmanaged, forgotten, or unsanctioned locations: abandoned cloud buckets, rogue spreadsheets, old backups, and prompts or files pasted into unsanctioned AI tools.

Triage signal: Data discovery or DSPM tools finding regulated data in unmanaged locations, and uploads of sensitive files to unsanctioned SaaS or AI tools in CASB or proxy logs.

Third-Party Data Exposure

Compromise or exposure of sensitive data caused by a breach, misconfiguration, or negligence on the part of an external vendor or partner. Your own logs may show nothing, yet the data is still yours, and so is the notification decision.

Triage signal: Vendor breach notices, threat-intelligence reports or leak-site listings naming a supplier, and unusual activity by that vendor’s integrations or accounts in your tenant (OAuth apps, API keys, support access).

Unstructured Data Exposure

Leakage of documents, logs, screenshots, or audio: content that is harder to classify or monitor with traditional DLP tools.

Triage signal: DLP alerts on documents, screenshots or recordings leaving through chat, email or upload, and bulk access to file shares or meeting recordings by one account.

BlueKeep (CVE-2019-0708)

Critical RDP vulnerability allowing remote code execution without authentication on older Windows versions. “Wormable”: it could in principle self-propagate like WannaCry, though no worm ever appeared (in-the-wild use from late 2019 was human-operated coin mining). Microsoft fixed it in the May 2019 Patch Tuesday and took the rare step of also patching out-of-support XP and Server 2003. Highlighted the danger of exposing RDP directly to the internet.

Triage signal: Inbound RDP (3389) from the internet to unpatched Windows 7, Server 2008 or older hosts, termdd.sys crashes, and IDS hits for the MS_T120 channel request. Start with exposure: is any unpatched RDP reachable?

Citrix Bleed (CVE-2023-4966)

Memory over-read in Citrix NetScaler ADC and Gateway that leaks valid session tokens, letting attackers hijack already-authenticated sessions and skip passwords and MFA. Exploited as a zero-day from August 2023 and then by LockBit affiliates. Patching did not end the exposure: stolen sessions stayed valid until every session was killed.

Triage signal: Oversized requests to the appliance’s OpenID configuration endpoint, then one session ID used from several IPs. Patching is not enough: every active session has to be killed, as the advisory required.

Dirty COW (CVE-2016-5195)

Linux kernel privilege escalation via a race condition in the copy-on-write handling of memory mappings. An unprivileged process with read access to a file can race the COW path to write the underlying page, modifying files it should only be able to read, including system binaries owned by root. Discovered after an in-the-wild exploit was captured against a Linux server; later weaponized by Android malware (ZNIU) to root devices. Impacted a wide range of distributions and Android.

Triage signal: An unprivileged local process gaining root on an old Linux kernel, often with modified setuid binaries or /etc/passwd. Mostly relevant now on embedded and legacy Linux, so check kernel versions.

EternalBlue

NSA SMBv1 exploit leaked by Shadow Brokers in 2017. Buffer overflow allows unauthenticated remote code execution. It was instrumental in WannaCry and NotPetya, and spurred deprecation of SMBv1 and stronger patching practices.

Triage signal: SMBv1 traffic, especially one host reaching many on port 445, IDS signatures for the exploit, and SYSTEM-level processes appearing on the target with no logon. SMBv1 still enabled anywhere is a Scope finding.

Follina (CVE-2022-30190)

Vulnerability in the Microsoft Support Diagnostic Tool (MSDT) triggered via crafted Word documents. Executes code through the ms-msdt protocol handler without macros when the document is opened; the RTF variant fires from the Explorer preview pane with no click at all. Stealthier than VBA-based attacks, it was used in phishing campaigns before it was fully addressed; MSDT itself is now deprecated.

Triage signal: msdt.exe launched by an Office process with ms-msdt or PCWDiagnostic on the command line, followed by sdiagnhost.exe spawning a shell.

Ivanti Connect Secure (CVE-2023-46805 / CVE-2024-21887)

An authentication bypass chained with a command injection in Ivanti’s VPN appliance, exploited as zero-days by a China-nexus actor from December 2023 and then at scale in January 2024, prompting a CISA emergency directive. A defining case of edge-device exploitation that leaves little or no endpoint telemetry, and of attackers persisting through appliance upgrades.

Triage signal: Appliance logs and the vendor’s integrity checker, not endpoint telemetry: unexpected files on the appliance, web shell paths, and internal connections from the appliance that it would not normally make. Reset credentials that passed through it.

PAN-OS GlobalProtect (CVE-2024-3400)

Unauthenticated command injection (CVSS 10.0) in the GlobalProtect feature of Palo Alto Networks firewalls, exploited as a zero-day in April 2024 to run code as root on the firewall itself. Another reminder that the security appliance at the edge is itself attack surface.

Triage signal: Unusual entries in the firewall’s GlobalProtect and telemetry logs, unexpected files or cron jobs on the device, and outbound connections from the firewall itself. Run the vendor’s checks: endpoint tools cannot see inside the appliance.

ProxyLogon

The March 2021 Exchange Server zero-day chain (CVE-2021-26855 server-side request forgery, chained with CVE-2021-26857, -26858 and -27065) first used by HAFNIUM and then mass-exploited by many groups to plant web shells. ProxyShell, a separate chain, followed in August 2021.

Triage signal: Exchange application pools (w3wp.exe) spawning cmd or powershell, new .aspx files in Exchange web directories, and unusual requests to /ecp/ or /owa/auth/. Web shells from 2021 may still sit on servers that were patched without being checked.

ProxyShell

Three chained Exchange vulnerabilities (CVE-2021-34473, -34523, -31207) allowing unauthenticated SYSTEM-level RCE through AutoDiscover and PowerShell endpoint abuse. Mass exploitation followed the August 2021 Black Hat talk, with attackers dropping web shells and staging ransomware. Not the same as ProxyLogon, the March 2021 zero-day chain.

Triage signal: Requests to /autodiscover/autodiscover.json carrying /mapi/nspi or /powershell, New-MailboxExportRequest writing .aspx files, and new web shells in Exchange directories.

Shellshock (CVE-2014-6271)

GNU Bash flaw allowing arbitrary command execution via environment variables. Especially dangerous through CGI scripts. It affected web servers, routers and IoT devices, exploits appeared within hours of disclosure, and it drove a broad review of UNIX-based software.

Triage signal: Request headers (User-Agent, Referer, Cookie) carrying a Bash function definition, the pattern that starts with ’() ’, aimed at CGI scripts or appliances, then the web server spawning bash, curl or wget.

Spectre / Meltdown

Hardware vulnerabilities in modern processors. Spectre (CVE-2017-5753, CVE-2017-5715) affects virtually all modern speculative CPUs (Intel, AMD, Arm); Meltdown (CVE-2017-5754) chiefly Intel, plus some Arm and IBM POWER cores (not AMD). Both exploit speculative execution to leak memory across trust boundaries. No confirmed in-the-wild exploitation, but the firmware, OS and cloud-hypervisor mitigations reshaped how hardware trust boundaries are viewed.

Triage signal: No practical triage signal: exploitation would happen in memory and leave little trace. The work is exposure management: microcode, OS and hypervisor patches on shared hosts.

Zerologon (CVE-2020-1472)

Netlogon protocol flaw. Netlogon used AES-CFB8 with a fixed all-zero IV, so about one in 256 all-zero authentication attempts succeeds. An unauthenticated attacker on the network can impersonate a domain controller, reset its machine-account password to empty, and then dump domain hashes (DCSync). Actively exploited soon after disclosure.

Triage signal: Netlogon events 5827 to 5829 (vulnerable Netlogon connections), a domain controller’s machine-account password changed by ANONYMOUS LOGON (4742), then replication requests from a host that is not a domain controller.

Adware

Malware that displays unwanted advertisements, often bundled with legitimate software. Advanced adware can harvest data or serve as a delivery mechanism for more serious malware.

Triage signal: Browser extensions or bundled installers the user did not knowingly choose, scheduled tasks that relaunch them, and ad or redirect traffic. On its own it usually scores low impact; re-score if it downloads further payloads or harvests data.

Backdoors

Malicious code that provides unauthorized access to a compromised system, bypassing normal authentication. Often installed post-exploitation to maintain persistent remote control.

Triage signal: A listening port or outbound connection from a process with no business reason, a new service or account with no change record, or a modified authentication module (sshd, PAM, an IIS module). A confirmed backdoor means the host is compromised.

Banker Trojans

Malware designed to steal banking credentials and financial information by intercepting login sessions, injecting fake forms, or logging keystrokes. Often targets online banking and payment systems.

Triage signal: Browser processes with injected code, certificates or proxy settings added to the browser, and bank fraud alerts that line up with the host’s sign-in times.

Bootkits

Malware that tampers with the boot chain so it runs before the OS loads. On legacy BIOS systems that means the MBR/VBR; on UEFI systems it means boot files in the EFI System Partition (ATT&CK T1542.003). BlackLotus (2023) was the first publicly known UEFI bootkit to bypass Secure Boot on fully updated Windows 11. Firmware implants (e.g., MoonBounce, CosmicStrand) go further and live in SPI flash, where they survive disk wipes and replacement, so remediation may require reflashing firmware, not just reimaging.

Triage signal: Changes in the EFI System Partition or boot configuration, Secure Boot reported as off, or a measured-boot or boot-integrity alert. Reimaging the OS volume alone may not remove it; the boot partition and firmware need checking too.

Click Fraud Malware

Malware that simulates user clicks on advertisements to generate fraudulent revenue. Often run on compromised systems in large volumes to exploit pay-per-click ad platforms.

Triage signal: Hidden or headless browser instances generating ad traffic, and high volumes of requests to ad networks from servers or idle hosts.

Crypters / Packers

Tooling that uses encryption or obfuscation to hide malicious code and evade antivirus. Not malicious on their own but commonly paired with trojans, RATs, or ransomware.

Triage signal: High entropy, unusual or missing section names (UPX0), and a tiny import table in a file analysis report. Legitimate software is packed too, so packing raises suspicion but does not settle the verdict.

Cryptojacker

Malware that mines cryptocurrency on someone else’s compute: hijacked servers, cloud instances created with stolen keys, or containers. The signal is sustained high CPU or GPU, connections to mining pools, and unexpected cloud spend.

Triage signal: CPU or GPU pinned near 100 percent on a server or container, connections to mining-pool ports (3333, 4444, 5555) or stratum URLs, xmrig or a renamed copy, and new compute instances in regions the organization does not use.

Double Extortion

Encrypting a victim’s systems and stealing data, then threatening to publish it on a leak site if the ransom is not paid. Popularized by Maze in late 2019 and now standard; some crews skip encryption entirely (data-theft-only extortion). Restoring from backup does not end the incident, because the stolen data is still out there.

Triage signal: Large outbound transfers or rclone-style sync in the days before encryption, and archives staged on servers. When encryption hits, assume theft too until the exfiltration evidence says otherwise.

Droppers and Loaders

A dropper carries its payload inside itself; a downloader/loader fetches it from the network. Both exist to get a follow-on payload (stealer, C2 implant, ransomware) running, and in practice the terms are often used interchangeably. Notable families: Emotet, ZLoader, SmokeLoader, IcedID, Bumblebee, Latrodectus, HijackLoader, GootLoader, SocGholish. Europol’s Operation Endgame (May 2024 onward, with further phases through 2026) has repeatedly disrupted this ecosystem, but operators tend to rebuild or move to new families.

Triage signal: A user-run file (script, MSI, LNK, ISO contents) followed within seconds by a new process from AppData or Temp, a scheduled task, and periodic outbound connections. Loader alerts come early: catch one and you head off what it was sent to fetch.

Fileless Malware

Malware that runs from memory, keeping little or nothing on disk (payloads often hide in the registry or WMI), which makes it harder for file-scanning AV to detect. Often leverages legitimate system tools like PowerShell or WMI for execution.

Triage signal: Encoded PowerShell command lines, scripts stored in registry values, WMI subscriptions, and script-block logs (PowerShell event 4104) showing decoded content. The evidence lives in memory, so preserve it before any reboot.

Infostealers

Software that harvests sensitive data from victims: passwords, session cookies, browser history, autofill, crypto wallets. The resulting logs are sold in bulk and are a leading source of the valid credentials and session tokens used for initial access.

Triage signal: A cracked installer or fake update run by the user, then bulk reads of browser credential and cookie stores, then an upload to one new destination. Every credential and session on that device is exposed: passwords reset, sessions revoked, MFA methods reviewed.

IoT Malware

Designed to infect Internet of Things devices like routers, cameras, smart appliances. Often used in botnets (e.g., Mirai) due to weak authentication and outdated firmware.

Triage signal: IoT devices making outbound connections to rare destinations, scanning telnet or SSH internally, or sending sudden traffic bursts. These devices seldom keep logs; network flow data is the evidence.

Keylogger

Malware or a malware module that records keystrokes, usually to capture passwords and messages. Often bundled into RATs, infostealers and banker trojans.

Triage signal: A process installing a low-level keyboard hook (SetWindowsHookEx with WH_KEYBOARD_LL) or polling GetAsyncKeyState, and small periodic uploads or log files appearing in user folders.

Logic Bombs

Malicious code triggered by specific conditions, such as a date or user action. Can remain dormant until activated, then execute destructive or stealthy functions.

Triage signal: Scheduled tasks, cron jobs or code paths keyed to a date or to an account being disabled, usually planted by someone with administrative rights. Review recent privileged changes to scripts and jobs when an administrator’s access is removed.

Mobile Malware

Malware targeting mobile devices, often distributed via malicious apps or phishing links. Includes SMS stealers, fake banking apps, mobile RATs.

Triage signal: MDM or mobile threat defense alerts for sideloaded apps, apps requesting accessibility or SMS permissions, or a configuration profile installed outside MDM. Corporate sessions from that device are suspect until it is cleaned.

Ransomware-as-a-Service (RaaS)

A business model in which developers rent their ransomware, leak site and negotiation services to affiliates who carry out the intrusions, splitting each ransom. Explains why the same ransomware brand shows very different tradecraft from one victim to the next: the affiliate, not the brand, did the intrusion.

Triage signal: Do not scope from the brand’s profile alone. The affiliate’s own tradecraft (entry vector, tools, exfiltration method) is what you will find on your hosts, so let the evidence drive scope.

Remote Access Trojan (RAT)

Malware that gives an operator interactive remote control of a host (keylogging, screen capture, file transfer, webcam). It is often delivered as a trojan the user runs, but loaders, exploits and hands-on-keyboard operators install RATs too. Attackers also commonly skip custom RATs and abuse legitimate remote-access/RMM tools (AnyDesk, ScreenConnect, Quick Assist, NetSupport), which are signed and often allowlisted: ATT&CK T1219 (Remote Access Tools), sub-technique T1219.002. See RMM Tool Abuse.

Triage signal: A persistent process holding a long-lived outbound connection, screen or webcam capture in use, and an operator issuing commands at human timing. Check for legitimate RMM tools installed alongside it.

RMM Tool Abuse

Using legitimate remote monitoring and management or remote-access software (AnyDesk, ScreenConnect, Quick Assist, TeamViewer, NetSupport) as the attacker’s remote-control channel. The binaries are signed and often allowlisted, so the signal is context: an RMM tool the organization does not use, installed by a user after a help-desk call or a phishing lure, or run as a portable executable from a user folder.

Triage signal: An RMM installer arriving after a phone call or help-desk contact, a remote session the IT team cannot account for, or an agent enrolled to an account or tenant that is not the organization’s.

Rootkits

Malware that hides its presence by subverting the OS or using kernel-level access. Often combined with other malware to maintain stealth and persistence.

Triage signal: Disagreement between views: a process, file, driver or connection visible in a memory image or offline scan but not from the live OS. The live host is not a reliable witness, so memory and offline analysis decide it.

Scareware

Software that tricks users into believing their device is infected, pressuring them to buy fake antivirus tools. Often a social-engineering precursor to real malware.

Triage signal: Browser pop-ups or notifications claiming infection, with a phone number or download link. Check whether the user called the number or installed anything, which turns it into a remote-access case.

Spyware

Malware that secretly monitors user activity: keystrokes, screen captures, camera or microphone access. Used for surveillance, espionage, or credential theft.

Triage signal: Unexpected processes using the camera, microphone or screen-capture APIs, and small regular uploads. On phones, MDM or mobile threat defense alerts on profiles or exploits.

Virus

Malware that infects other files or programs and spreads when they are run. Rare in modern intrusions compared with worms and trojans, but the word is still used loosely for any malware.

Triage signal: Many executables on a host or share changing at once with the same appended code, so their hashes change together. Rare today; most ‘virus’ alerts are other malware types, so read the detection details.

Web Shell

A script planted on a web server that gives the attacker remote command execution through ordinary HTTP requests; the standard foothold after edge-device and file-transfer exploitation (HAFNIUM, ProxyShell, MOVEit, SharePoint ToolShell).

Triage signal: The web server process (w3wp.exe, httpd, java) spawning a shell such as cmd.exe, powershell or /bin/sh.

Worm

Self-propagating malware that spreads host to host without user action, usually through a network-reachable vulnerability (‘wormable’ describes such a flaw, e.g. EternalBlue, BlueKeep).

Triage signal: One host scanning many others on the same port (SMB 445, RDP 3389), then the same malware appearing on them. Spread is measured in minutes, so escalate immediately and let IR choose the containment.