Detection Playbook: Service Stop (T1489)
Service Stop (T1489) is a technique where adversaries deliberately halt or disable running services on a target system to prevent legitimate users from acces…
Detection Playbooks
Daily MITRE ATT&CK-based detection playbooks covering common adversary techniques. Each playbook includes SIEM-agnostic detection logic and investigation and response guidance.
Detection Playbook: Inhibit System Recovery (T1490)
Inhibit System Recovery (T1490) describes adversary actions taken to delete, disable, or corrupt the built-in recovery mechanisms of an operating system or p…
Detection Playbook: Data Encrypted for Impact (T1486)
Data Encrypted for Impact (T1486) describes adversary activity where files, drives, or entire systems are encrypted to deny the victim access to their own da…
Detection Playbook: Valid Accounts (T1078)
Valid Accounts (T1078) describes adversaries using legitimate, existing credentials — stolen, purchased, phished, or brute-forced — to access systems and ser…
Detection Playbook: Spearphishing Link (T1566.002)
Spearphishing Link (T1566.002) is a targeted email attack where adversaries send carefully crafted messages containing malicious URLs to specific individuals…
Detection Playbook: Spearphishing Attachment (T1566.001)
Spearphishing Attachment (T1566.001) is a targeted email-based attack where an adversary sends a crafted email to a specific individual, company, or industry…
Detection Playbook: Service Execution (T1569.002)
Service Execution (T1569.002) describes how adversaries abuse the Windows Service Control Manager (SCM) to run malicious commands or payloads — either by cre…
Detection Playbook: SMB/Windows Admin Shares (T1021.002)
SMB/Windows Admin Shares (T1021.002) is a lateral movement technique where attackers use valid credentials — stolen, brute-forced, or obtained through creden…
Detection Playbook: Remote Desktop Protocol (T1021.001)
Remote Desktop Protocol (RDP) lateral movement occurs when an adversary uses valid credentials to interactively log into a remote Windows system via port 338…
Detection Playbook: System Information Discovery (T1082)
System Information Discovery (T1082) is a technique where adversaries enumerate detailed information about a target system — including OS version, patch leve…