Detection Playbook: Scheduled Task (T1053.005)
Windows Scheduled Tasks (T1053.005) allow adversaries to register code to run automatically at a specified time, interval, or system event. Attackers use thi…
Detection Playbooks
Daily MITRE ATT&CK-based detection playbooks covering common adversary techniques. Each playbook includes SIEM-agnostic detection logic and investigation and response guidance.
Detection Playbook: Windows Management Instrumentation (T1047)
Windows Management Instrumentation (WMI) is a built-in Windows administration framework that allows querying system state, executing commands, and managing c…
Detection Playbook: Windows Command Shell (T1059.003)
Windows Command Shell (T1059.003) refers to adversary abuse of cmd.exe — the native Windows command interpreter — to execute commands, run batch scripts (.ba…
Detection Playbook: PowerShell (T1059.001)
PowerShell (T1059.001) refers to adversary abuse of Windows PowerShell — Microsoft’s built-in scripting language and interactive shell — to execute commands,…