Detection Playbook: Disable or Modify Security Tools (T1562.001)
Disable or Modify Security Tools (T1562.001) describes attacker actions taken to impair, stop, or tamper with defensive software — including antivirus engine…
Detection Playbooks
Daily MITRE ATT&CK-based detection playbooks covering common adversary techniques. Each playbook includes SIEM-agnostic detection logic and investigation and response guidance.
Detection Playbook: Clear Windows Event Logs (T1070.001)
Clear Windows Event Logs (T1070.001) is a defense evasion technique where attackers delete or wipe Windows event log channels — such as Security, System, App…
Detection Playbook: Process Injection (T1055)
Process injection (T1055) is a technique where adversaries insert and execute arbitrary code within the address space of a running, legitimate process. By hi…
Detection Playbook: Token Impersonation/Theft (T1134.001)
Token Impersonation/Theft (T1134.001) is a Windows privilege escalation technique in which an adversary duplicates an existing access token belonging to anot…
Detection Playbook: DNS (T1071.004)
DNS tunneling (T1071.004) is a command-and-control technique where adversaries embed data — including commands and exfiltrated output — inside DNS query and …
Detection Playbook: Web Protocols (T1071.001)
Web Protocols (T1071.001) describes adversaries using HTTP, HTTPS, and WebSocket as the transport layer for command-and-control (C2) communication. Rather th…
Detection Playbook: Service Stop (T1489)
Service Stop (T1489) is a technique where adversaries deliberately halt or disable running services on a target system to prevent legitimate users from acces…
Detection Playbook: Inhibit System Recovery (T1490)
Inhibit System Recovery (T1490) describes adversary actions taken to delete, disable, or corrupt the built-in recovery mechanisms of an operating system or p…
Detection Playbook: Data Encrypted for Impact (T1486)
Data Encrypted for Impact (T1486) describes adversary activity where files, drives, or entire systems are encrypted to deny the victim access to their own da…
Detection Playbook: Valid Accounts (T1078)
Valid Accounts (T1078) describes adversaries using legitimate, existing credentials — stolen, purchased, phished, or brute-forced — to access systems and ser…