Detection Playbook: DLL Side-Loading (T1574.002)
DLL Side-Loading (T1574.002) is a technique where an attacker places a malicious DLL with a specific filename into a directory that a legitimate, often signe…
Detection Playbooks
Daily MITRE ATT&CK-based detection playbooks covering common adversary techniques. Each playbook includes SIEM-agnostic detection logic and investigation and response guidance.
Detection Playbook: Windows Service (T1543.003)
Windows Service persistence (T1543.003) allows adversaries to register a malicious executable as a Windows service so it automatically launches every time th…
Detection Playbook: Registry Run Keys / Startup Folder (T1547.001)
Registry Run Keys and Startup Folder persistence (T1547.001) is a technique where adversaries write entries to specific Windows registry keys or drop files i…
Detection Playbook: Visual Basic (T1059.005)
Visual Basic (VB) and its derivatives — Visual Basic for Applications (VBA) and VBScript — are scripting and programming languages that adversaries abuse to …
Detection Playbook: Scheduled Task (T1053.005)
Windows Scheduled Tasks (T1053.005) allow adversaries to register code to run automatically at a specified time, interval, or system event. Attackers use thi…
Detection Playbook: Windows Management Instrumentation (T1047)
Windows Management Instrumentation (WMI) is a built-in Windows administration framework that allows querying system state, executing commands, and managing c…
Detection Playbook: Windows Command Shell (T1059.003)
Windows Command Shell (T1059.003) refers to adversary abuse of cmd.exe — the native Windows command interpreter — to execute commands, run batch scripts (.ba…
Detection Playbook: PowerShell (T1059.001)
PowerShell (T1059.001) refers to adversary abuse of Windows PowerShell — Microsoft’s built-in scripting language and interactive shell — to execute commands,…