Detection Playbook: Spearphishing Link (T1566.002)
Spearphishing Link (T1566.002) is a targeted email attack where adversaries send carefully crafted messages containing malicious URLs to specific individuals…
Detection Playbooks
Daily MITRE ATT&CK-based detection playbooks covering common adversary techniques. Each playbook includes SIEM-agnostic detection logic and investigation and response guidance.
Detection Playbook: Spearphishing Attachment (T1566.001)
Spearphishing Attachment (T1566.001) is a targeted email-based attack where an adversary sends a crafted email to a specific individual, company, or industry…
Detection Playbook: Service Execution (T1569.002)
Service Execution (T1569.002) describes how adversaries abuse the Windows Service Control Manager (SCM) to run malicious commands or payloads — either by cre…
Detection Playbook: SMB/Windows Admin Shares (T1021.002)
SMB/Windows Admin Shares (T1021.002) is a lateral movement technique where attackers use valid credentials — stolen, brute-forced, or obtained through creden…
Detection Playbook: Remote Desktop Protocol (T1021.001)
Remote Desktop Protocol (RDP) lateral movement occurs when an adversary uses valid credentials to interactively log into a remote Windows system via port 338…
Detection Playbook: System Information Discovery (T1082)
System Information Discovery (T1082) is a technique where adversaries enumerate detailed information about a target system — including OS version, patch leve…
Detection Playbook: Domain Groups (T1069.002)
Domain Groups enumeration (T1069.002) is the act of querying Active Directory or a domain controller to map out domain-level groups and their memberships. At…
Detection Playbook: Domain Account (T1087.002)
Domain Account Discovery (T1087.002) is a technique where adversaries enumerate domain user accounts and groups to map out the Active Directory environment. …
Detection Playbook: Network Service Discovery (T1046)
Network Service Discovery (T1046) is a reconnaissance technique where adversaries scan local and remote systems to enumerate running services, open ports, an…
Detection Playbook: Obfuscated Files or Information (T1027)
Obfuscated Files or Information (T1027) describes the practice of encoding, encrypting, compressing, or otherwise obscuring malicious content to make it hard…