Techniques

Techniques utilized by threat actors and tools, as observed in various incidents

Name	Tags	Incidents	ATT&CK Tactic	Tech	Status
Abuse access to existing KMS key	Cloud		Credential Access (TA0006)		Stub
Abuse naming patterns to guess resource IDs or fingerprint resources	Cloud		Discovery (TA0007)		Stub
Abuse of cross-job access in CI/CD system	CI/CD				Stub
Abuse trust and privileges across accounts	Cloud	LAPSUS$ campaigns	Lateral Movement (TA0008)		Stub
Abusing exposed Docker socket	K8s	Kiss-A-Dog campaign OracleIV campaign	Initial Access (TA0001)	Docker	Stub
Add attacker-controlled IdP via ADFS access	AAD	APT29 targeting Microsoft 365	Lateral Movement (TA0008)		Stub
App Script impersonation	Cloud		Persistence (TA0003)		Stub
Appstream abuse	Cloud		Initial Access (TA0001)	AWS Appstream	Stub
Attach administrative role to account		DangerDev SES abuse incident From refresh token theft to global admin			Stub
Auth token signing via ADFS access	AAD	APT29 targeting Microsoft 365	Lateral Movement (TA0008)		Stub
Auth token signing via Golden SAML	AAD	APT29 targeting Microsoft 365 Solarigate: Solarwinds supply chain attack Peach Sandstorm targeting Azure	Lateral Movement (TA0008)Credential Access (TA0006)		Finalized
Azure AD abuse	CloudAAD	Stealing the LIGHTSHOW			Stub
Azure Arc abuse	Cloud	Peach Sandstorm targeting Azure	Persistence (TA0003)Execution (TA0002)	Azure Arc	Stub
Azure Batch abuse	Cloud	Cryptojacking via Azure Batch		Azure Batch	Stub
Azure cross-tenant synchronization backdoor	CloudAAD		Persistence (TA0003)		Stub
Azure lateral movement via cross-tenant synchronization	CloudAAD		Lateral Movement (TA0008)		Stub
Azure Run Commands abuse	Cloud	Scattered Spider Azure Run abuse	Execution (TA0002)		Stub
Backdoor AMI	Cloud		Initial Access (TA0001)		Stub
Backdoor Docker image	K8s	AmberSquid campaign eBPF Rootkit Targeting AWS and Linux Environments	Initial Access (TA0001)	Docker	Stub
Backdoor IaC (StackSet, Terraform, etc.)	Cloud		Initial Access (TA0001)		Stub
Backdoor Lambda Layer	Cloud		Initial Access (TA0001)	AWS Lambda	Stub
Bootkit	LinuxWindows		Persistence (TA0003)		Stub
Bring Your Own Vulnerable Driver	Windows	Agenda Ransomware Targets ESXi and vCenter Servers CrazyHunter Ransomware Group Targets Critical Sectors in Taiwan	Execution (TA0002)Privilege Escalation (TA0004)		Stub
Bucket / storage ransomware	CloudRansomware	BlackCat Azure Storage Account RansomOp Codefinger Ransomware Campaign Targeting S3 Buckets JADEPUFFER Agentic Ransomware Targeting Cloud Environments	Impact (TA0040)		Stub
Bucket name squatting attack	Cloud		Initial Access (TA0001)		Stub
cAdvisor abuse	App Misconfig.		Reconnaissance (TA0043)Credential Access (TA0006)	cAdvisor	Stub
CI/CD system enumeration	CI/CD	JINX-0164 Targeting Cryptocurrency Development Infrastructure	Discovery (TA0007)		Stub
Cleartext cloud keys abuse		Supply Chain Risk in Axis Autodesk Revit Plugin Due to Exposed Azure Storage Credentials			Not started
Cloud account password reset		Phishing campaign leading to Azure account takeover			Not started
Cloud API enumeration	Cloud	Leaked long-lived AWS creds LAPSUS$ campaigns DangerDev SES abuse incident Muddled Libra campaigns (2024)LLMjacking via Laravel exploitation S3 RansomOp following long-term key exposure Scylla LLMJacking campaign Scattered Spider targeting Azure environment	Reconnaissance (TA0043)		Stub
Cloud compute cryptojacking	CloudK8s	Kiss-A-Dog campaign ScarletEel campaign (Feb ‘23)RBAC Buster Misconfigured firewall to cryptojacking botnet ScarletEel campaign (July ‘23)EleKtra-Leak Labrat GitLab campaign AmberSquid campaign DangerDev SES abuse incident ECS Fargate cryptojacking Dero cryptojacking targeting K8s DERO cryptojacking campaign (2024)SeleniumGreed: Threat actors exploit exposed Selenium Grid services for Cryptomining Confluence exploited for cryptojacking REF6138 campaign Ultralytics compromise Kong image compromise USAID cryptojacking incident Sysrv Apache Druid cryptojacking Lucifer Apache Druid cryptojacking Cryptojacking Campaign Targeting K8s Clusters Cryptomining campaign targeting Linux SSH servers	Impact (TA0040)		Featured
Cloud key compromise		Apple cloud key exposure BMW exposed cloud storage Zenlayer exposed database From social engineering to cryptocurrency theft Football Australia exposed cloud key Abusing management tooling for cloud access Personal local drive to AWS ransomware Third party to cloud compromise Scylla LLMJacking campaign Attack abusing Amazon SES From social engineering to Lambda modification JavaGhost SES abuse Compromised cloud keys exfiltrated to bucket	Credential Access (TA0006)		Stub
Cloud storage cryptojacking	Cloud		Impact (TA0040)		Finalized
Cloud to on-prem lateral movement		Third party to cloud compromise Smishing into Entra onto VMWare ransomware Storm-0501 attacking hybrid environments with ransomware UNC2165 Targets Hybrid Environments with Ransomware			Not started
Cloud-init persistence	Cloud		Persistence (TA0003)		Stub
Cluster anonymous access	K8s	RBAC Buster	Initial Access (TA0001)		Stub
Command execution via Lambda		From social engineering to Lambda modification			Not started
Container enumeration	K8s	Commando Cat campaign	Discovery (TA0007)		Stub
Container escape					Not started
Create an IAM Roles Anywhere trust anchor	Cloud		Initial Access (TA0001)		Stub
Create new application user		Cloudflare incident following Okta breach Earth Lamia Custom Toolkit Targets Multiple Sectors via Web Vulnerabilities			Stub
Create new cloud user	Cloud	RBAC Buster SIM-Swap to Data Leak on Dark Web DangerDev SES abuse incident S3 data exfiltration Leaked long-lived AWS creds ScarletEel campaign (Feb ‘23)ScarletEel campaign (July ‘23)S3 RansomOp following long-term key exposure Scattered Spider SaaS targeting (2023)Phishing campaign leading to Azure account takeover From stolen cloud key to persistence-as-a-service GENESIS PANDA's Cloud Intrusions: Persistent Control Plane Exploitation and Access Brokerage TruffleNet Campaign Exploits AWS SES for Large-Scale Cloud Abuse and BEC Fraud Cloud-Native Phishing Infrastructure via Abused AWS WorkMail	Persistence (TA0003)		Stub
Create new local user	LinuxWindows	Commando Cat campaign	Persistence (TA0003)		Stub
Create or modify cloud key		From refresh token theft to global admin	Persistence (TA0003)Credential Access (TA0006)		Stub
Create or modify firewall or security group rules		Cosmic Wolf cloud activity DangerDev SES abuse incident From password reset to data exfiltration Scattered Spider targeting GCP environment EC2 Grouper campaign	Defense Evasion (TA0005)		Stub
Create SSH backdoor		SilentBob cryptomining campaign Qubitstrike Crypto Mining and Rootkit Campaign Commando Cat campaign CRYSTALRAY: threat actors exploiting OSS tools Scattered Spider targeting GCP environment Operation Windigo Gelsemium’s Shift to Linux Malware with WolfsBane and FireWood Plague PAM-Based Backdoor for Linux DripDropper Malware Exploits Patched Apache ActiveMQ for Persistence on Cloud Linux Systems eBPF Rootkit Targeting AWS and Linux Environments Unauthenticated Remote Access via Triofox Vulnerability Exploited by UNC6485 Cryptomining Campaign Exploiting Exposed Ray AI Infrastructure	Persistence (TA0003)		Stub
Credential compromise via Infostealer infection		Otelier data breach Shai-Hulud 2.0 Supply Chain Attack Trivy supply chain attack Megalodon Campaign Backdoors GitHub Repositories via CI Workflow Compromise			Not started
Credential harvesting from code repository	CI/CD	SIM-Swap to Data Leak on Dark Web EleKtra-Leak Sisense breach Rabbit AI exposed keys in code Mercedes-Benz source code exposure ShinyHunters Ransomware Targeting Cloud Environments tj-actions/changed-files supply chain attack Zapier data breach xAI leaked API key GhostAction campaign Shai-Hulud: Ongoing Package Supply Chain Compromise Delivering Data-Stealing Malware Shai-Hulud 2.0 Supply Chain Attack Apifox supply chain attack	Credential Access (TA0006)		Stub
Credential stuffing	CloudLinux	Fast Company incident New Relic incident (November 2023)	Initial Access (TA0001)		Stub
Credential theft		SilentBob cryptomining campaign Qubitstrike Crypto Mining and Rootkit Campaign LAPSUS$ campaigns FBot toolkit targets cloud environments Commando Cat campaign From S3 bucket to Jenkins credential dump Affirmed Networks breach LLMjacking via Laravel exploitation Atlas Lion phishing campaign Smishing into Entra onto VMWare ransomware Scattered Spider SaaS targeting (2024)CRYSTALRAY: threat actors exploiting OSS tools Ransomware operators exploit ESXi vulnerability Scattered Spider Abuses Cloud Management Agent ShinyHunters Ransomware Targeting Cloud Environments Extortion Campaign Exploiting Exposed Environment Variable APT29 Targeting Zimbra and TeamCity Servers Earth Simnavaz (APT34) Targeting UAE and Gulf Regions UNC5820 exploiting FortiManager flaw BrowserStack Data Breach Dropbox Github breach Mozi Botnet Using AndroxGh0st Toolkit to Target Cloud Environments SharePoint Vulnerability Exploited in-the-Wild Earth Kasha’s Campaign Exploiting Fortinet Vulnerability Volkswagen data leak through Spring Boot Actuator misconfiguration Phishing campaign leading to Azure account takeover Storm-0501 attacking hybrid environments with ransomware Bapak Exploiting Stolen Cloud Access Keys TRIPLESTRENGTH: Cloud Account Hijacking and Cryptocurrency Mining via Stolen Credentials Seashell Blizzard Subgroup's Campaign Exploiting Vulnerabilities for Data Exfiltration RevivalStone Campaign by Winnti Zapier data breach Weaver Ant data exfiltration campaign Atlas Lion Campaign Exploits Device Enrollment and MFA for Persistence Grafana GitHub Action attempted supply chain attack Rspack supply chain attack UNC5174 Exploits Ivanti CSA Zero-Days in “Houken” Campaign Azure Account Hijack via Stolen Tokens AWS CodeBuild Vulnerability Allows Build Process Secrets Extraction UAT-7237 Targets Taiwanese Web Infrastructure Using Customized Open-Source Tools GENESIS PANDA's Cloud Intrusions: Persistent Control Plane Exploitation and Access Brokerage Compromised Salesloft Drift Tokens Enable Data Theft Across Integrations GhostAction campaign Shai-Hulud: Ongoing Package Supply Chain Compromise Delivering Data-Stealing Malware BRICKSTORM Espionage Backdoor Targeting U.S. Tech and Legal Sectors IIS Backdoor Exploiting Exposed ASP.NET Machine Keys TruffleNet Campaign Exploits AWS SES for Large-Scale Cloud Abuse and BEC Fraud Cisco ISE Vulnerability Exploited as 0day by APT Cryptomining Campaign Exploiting Exposed Ray AI Infrastructure Shai-Hulud 2.0 Supply Chain Attack Amadey Loader Abuses Compromised Self-Hosted GitLab to Deliver StealC Infostealer VoidLink: A Cloud-Native Linux Malware Framework LLMJacking for Roleplaying Campaign Supply-Chain Attack via Force Pushes on Plone GitHub Repositories Supply-Chain Hijacking of Notepad++ Updates via Hosting Provider Compromise Axios supply chain attack Trivy supply chain attack LexisNexis breach xygeni-action repository hijack BuddyBoss supply chain attack Apifox supply chain attack UAT-10608 Campaign Abuses React2Shell for Cloud Credential Harvesting Checkmarx KICS and Bitwarden CLI Compromised in Fresh Supply Chain Attack Compromise of Checkmarx Jenkins AST Plugin by TeamPCP Tanstack and other Packages Compromised in Supply Chain Attack node-ipc npm Distribution Compromised New Mini-Shai-Hulud Wave Targets NPM, PyPi Packages and VSCode Extension JINX-0164 Targeting Cryptocurrency Development Infrastructure Megalodon Campaign Backdoors GitHub Repositories via CI Workflow Compromise Compromised Injective SDK npm Package Exfiltrates Cryptocurrency Wallet Keys Jscrambler npm Package Compromised in Supply Chain Attack keyv and cacheable npm Package Hijacked in Supply Chain Attack	Credential Access (TA0006)		Stub