All authors
Claude Skills by CyberStrikeus
github.com/CyberStrikeus7,689 skills3 installs18,525 views
- T1597 Search Closed SourcesAdversaries may search and gather information about victims from closed (e.g., paid, private, or otherwise not freely available) sources that can be used during targeting.Votes: 0GitHub stars: 2,182
- T1598.001 Spearphishing ServiceAdversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting.Votes: 0GitHub stars: 2,182
- T1598.002 Spearphishing AttachmentAdversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting.Votes: 0GitHub stars: 2,182
- T1598.003 Spearphishing LinkAdversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting.Votes: 0GitHub stars: 2,182
- T1598.004 Spearphishing VoiceAdversaries may use voice communications to elicit sensitive information that can be used during targeting.Votes: 0GitHub stars: 2,182
- T1598 Phishing For InformationAdversaries may send phishing messages to elicit sensitive information that can be used during targeting.Votes: 0GitHub stars: 2,182
- T1681 Search Threat Vendor DataThreat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with...Votes: 0GitHub stars: 2,182
- T0801 Monitor Process StateAdversaries may gather information about the physical process state.Votes: 0GitHub stars: 2,182
- T0802 Automated CollectionAdversaries may automate collection of industrial environment information using tools or scripts.Votes: 0GitHub stars: 2,182
- T0811 Data From Information RepositoriesAdversaries may target and collect data from information repositories.Votes: 0GitHub stars: 2,182
- T0830 Adversary In The MiddleAdversaries with privileged network access may seek to modify network traffic in real time using adversary-in-the-middle (AiTM) attacks.Votes: 0GitHub stars: 2,182
- T0845 Program UploadAdversaries may attempt to upload a program from a PLC to gather information about an industrial process.Votes: 0GitHub stars: 2,182
- T0852 Screen CaptureAdversaries may attempt to perform screen capture of devices in the control system environment.Votes: 0GitHub stars: 2,182
- T0861 Point Tag IdentificationAdversaries may collect point and tag values to gain a more comprehensive understanding of the process environment.Votes: 0GitHub stars: 2,182
- T0868 Detect Operating ModeAdversaries may gather information about a PLCs or controllers current operating mode.Votes: 0GitHub stars: 2,182
- T0877 Io ImageAdversaries may seek to capture process values related to the inputs and outputs of a PLC.Votes: 0GitHub stars: 2,182
- T0893 Data From Local SystemAdversaries may target and collect data from local system sources, such as file systems, configuration files, or local databases.Votes: 0GitHub stars: 2,182
- T0869 Standard Application Layer ProtocolAdversaries may establish command and control capabilities over commonly used application layer protocols such as HTTP(S), OPC, RDP, telnet, DNP3, and modbus.Votes: 0GitHub stars: 2,182
- T0884 Connection ProxyAdversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications.Votes: 0GitHub stars: 2,182
- T0885 Commonly Used PortAdversaries may communicate over a commonly used port to bypass firewalls or network detection systems and to blend in with normal network activity, to avoid more detailed inspection.Votes: 0GitHub stars: 2,182
- T0840 Network Connection EnumerationAdversaries may perform network connection enumeration to discover information about device communication patterns.Votes: 0GitHub stars: 2,182
- T0842 Network SniffingNetwork sniffing is the practice of using a network interface on a computer system to monitor or capture information regardless of whether it is the specified destination for the information.Votes: 0GitHub stars: 2,182
- T0846 Remote System DiscoveryAdversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for subsequent Lateral Movement or Discovery techniques.Votes: 0GitHub stars: 2,182
- T0887 Wireless SniffingAdversaries may seek to capture radio frequency (RF) communication used for remote control and reporting in distributed environments.Votes: 0GitHub stars: 2,182
- T0888 Remote System Information DiscoveryAn adversary may attempt to get detailed information about remote systems and their peripherals, such as make/model, role, and configuration.Votes: 0GitHub stars: 2,182
- T0820 Exploitation For EvasionAdversaries may exploit a software vulnerability to take advantage of a programming error in a program, service, or within the operating system software or kernel itself to evade detection.Votes: 0GitHub stars: 2,182
- T0849 MasqueradingAdversaries may use masquerading to disguise a malicious application or executable as another file, to avoid operator and engineer suspicion.Votes: 0GitHub stars: 2,182
- T0851 RootkitAdversaries may deploy rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.Votes: 0GitHub stars: 2,182
- T0856 Spoof Reporting MessageAdversaries may spoof reporting messages in control system environments for evasion and to impair process control.Votes: 0GitHub stars: 2,182
- T0872 Indicator Removal On HostAdversaries may attempt to remove indicators of their presence on a system in an effort to cover their tracks.Votes: 0GitHub stars: 2,182
- T0894 System Binary Proxy ExecutionAdversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.Votes: 0GitHub stars: 2,182
- T0807 Command Line InterfaceAdversaries may utilize command-line interfaces (CLIs) to interact with systems and execute commands.Votes: 0GitHub stars: 2,182
- T0821 Modify Controller TaskingAdversaries may modify the tasking of a controller to allow for the execution of their own programs.Votes: 0GitHub stars: 2,182
- T0823 Graphical User InterfaceAdversaries may attempt to gain access to a machine via a Graphical User Interface (GUI) to enhance execution capabilities.Votes: 0GitHub stars: 2,182
- T0834 Native ApiAdversaries may directly interact with the native OS application programming interface (API) to access system functions.Votes: 0GitHub stars: 2,182
- T0853 ScriptingAdversaries may use scripting languages to execute arbitrary code in the form of a pre-written script or in the form of user-supplied code to an interpreter.Votes: 0GitHub stars: 2,182
- T0858 Change Operating ModeAdversaries may change the operating mode of a controller to gain additional access to engineering functions such as Program Download.Votes: 0GitHub stars: 2,182
- T0863 User ExecutionAdversaries may rely on a targeted organizations user interaction for the execution of malicious code.Votes: 0GitHub stars: 2,182
- T0871 Execution Through ApiAdversaries may attempt to leverage Application Program Interfaces (APIs) used for communication between control software and the hardware.Votes: 0GitHub stars: 2,182
- T0874 HookingAdversaries may hook into application programming interface (API) functions used by processes to redirect calls for execution and privilege escalation means.Votes: 0GitHub stars: 2,182
- T0895 Autorun ImageAdversaries may leverage AutoRun functionality or scripts to execute malicious code.Votes: 0GitHub stars: 2,182
- T0813 Denial Of ControlAdversaries may cause a denial of control to temporarily prevent operators and engineers from interacting with process controls.Votes: 0GitHub stars: 2,182
- T0815 Denial Of ViewAdversaries may cause a denial of view in attempt to disrupt and prevent operator oversight on the status of an ICS environment.Votes: 0GitHub stars: 2,182
- T0826 Loss Of AvailabilityAdversaries may attempt to disrupt essential components or systems to prevent owner and operator from delivering products or services.Votes: 0GitHub stars: 2,182
- T0827 Loss Of ControlAdversaries may seek to achieve a sustained loss of control or a runaway condition in which operators cannot issue any commands even if the malicious interference has subsided.Votes: 0GitHub stars: 2,182
- T0828 Loss Of Productivity And RevenueAdversaries may cause loss of productivity and revenue through disruption and even damage to the availability and integrity of control system operations, devices, and related processes.Votes: 0GitHub stars: 2,182
- T0829 Loss Of ViewAdversaries may cause a sustained or permanent loss of view where the ICS equipment will require local, hands-on operator intervention; for instance, a restart or manual operation.Votes: 0GitHub stars: 2,182
- T0831 Manipulation Of ControlAdversaries may manipulate physical process control within the industrial environment.Votes: 0GitHub stars: 2,182
- T0832 Manipulation Of ViewAdversaries may attempt to manipulate the information reported back to operators or controllers.Votes: 0GitHub stars: 2,182
- T0837 Loss Of ProtectionAdversaries may compromise protective system functions designed to prevent the effects of faults and abnormal conditions.Votes: 0GitHub stars: 2,182