Detection Playbooks

T1027 · 2026-06-27 Obfuscated Files or Information Stealth ESXi Linux macOS Network Devices MITRE ATT&CK → Technique Obfuscated Files or Information (T1027) Tactic Stealth Platforms ESXi, Linux, macOS, Network Devices, Windows Overview Obfuscated Files or Information (T1027) describes the practice of encoding, encrypting, compressing, or otherwise obscuring malicious content to make it harder for defenders … Read more

T1218.010 · 2026-06-26 Regsvr32 Stealth Windows MITRE ATT&CK → Technique Regsvr32 (T1218.010) Tactic Stealth Platforms Windows Overview Regsvr32.exe is a legitimate Windows utility designed to register and unregister COM objects and DLLs. Attackers abuse it to execute malicious scripts or DLLs while hiding behind a trusted, Microsoft-signed binary — a technique commonly called “Squiblydoo” when … Read more

T1218.011 · 2026-06-25 Rundll32 Stealth Windows MITRE ATT&CK → Technique Rundll32 (T1218.011) Tactic Stealth Platforms Windows Overview Rundll32.exe is a legitimate Windows utility designed to load and execute functions exported from DLL files. Attackers abuse it to execute malicious payloads — including DLLs, Control Panel items (.cpl), JavaScript, and remote scripts — while hiding behind … Read more

T1550.002 · 2026-06-24 Pass the Hash Lateral Movement Windows MITRE ATT&CK → Technique Pass the Hash (T1550.002) Tactic Lateral Movement Platforms Windows Overview Pass the Hash (PtH) is a credential-based lateral movement technique where an attacker uses a captured NTLM password hash — rather than the plaintext password — to authenticate to remote systems. Because … Read more

T1558.003 · 2026-06-23 Kerberoasting Credential Access Windows MITRE ATT&CK → Technique Kerberoasting (T1558.003) Tactic Credential Access Platforms Windows Overview Kerberoasting is a credential theft technique in which an attacker with any valid domain account requests Kerberos Ticket-Granting Service (TGS) tickets for accounts that have Service Principal Names (SPNs) registered. Because portions of these tickets are … Read more

T1110.003 · 2026-06-22 Password Spraying Credential Access Containers ESXi IaaS Identity Provider MITRE ATT&CK → Technique Password Spraying (T1110.003) Tactic Credential Access Platforms Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS Overview Password spraying is a credential access technique where an adversary attempts a single commonly used password — or … Read more

T1003.001 · 2026-06-21 LSASS Memory Credential Access Windows MITRE ATT&CK → Technique LSASS Memory (T1003.001) Tactic Credential Access Platforms Windows Overview LSASS Memory dumping (T1003.001) is a credential theft technique where attackers extract authentication material — including NTLM hashes, Kerberos tickets, and in some configurations cleartext passwords — directly from the memory of the Windows … Read more

T1574.002 · 2026-06-20 DLL Side-Loading Defense Evasion MITRE ATT&CK → Technique DLL Side-Loading (T1574.002) Tactic Defense Evasion Platforms Windows, Linux, macOS Overview DLL Side-Loading (T1574.002) is a technique where an attacker places a malicious DLL with a specific filename into a directory that a legitimate, often signed application will search before finding the real DLL. … Read more

T1543.003 · 2026-06-19 Windows Service Persistence Windows MITRE ATT&CK → Technique Windows Service (T1543.003) Tactic Persistence Platforms Windows Overview Windows Service persistence (T1543.003) allows adversaries to register a malicious executable as a Windows service so it automatically launches every time the system boots or restarts. Because services run under the SYSTEM account by default, attackers … Read more

T1547.001 · 2026-06-18 Registry Run Keys / Startup Folder Persistence Windows MITRE ATT&CK → Technique Registry Run Keys / Startup Folder (T1547.001) Tactic Persistence Platforms Windows Overview Registry Run Keys and Startup Folder persistence (T1547.001) is a technique where adversaries write entries to specific Windows registry keys or drop files into startup folders so that … Read more