guidance_only — detection-evidence tag

Meaning and evidence boundary

Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.

Related pages

• T0800 Activate Firmware Update Mode detections · detection
• T0801 Monitor Process State detections · detection
• T0802 Automated Collection detections · detection
• T0806 Brute Force I/O detections · detection
• T0807 Command-Line Interface detections · detection
• T0809 Data Destruction detections · detection
• T0811 Data from Information Repositories detections · detection
• T0813 Denial of Control detections · detection
• T0814 Denial of Service detections · detection
• T0815 Denial of View detections · detection
• T0816 Device Restart/Shutdown detections · detection
• T0817 Drive-by Compromise detections · detection
• T0819 Exploit Public-Facing Application detections · detection
• T0820 Exploitation for Evasion detections · detection
• T0821 Modify Controller Tasking detections · detection
• T0822 External Remote Services detections · detection
• T0823 Graphical User Interface detections · detection
• T0826 Loss of Availability detections · detection
• T0827 Loss of Control detections · detection
• T0828 Loss of Productivity and Revenue detections · detection
• T0829 Loss of View detections · detection
• T0830 Adversary-in-the-Middle detections · detection
• T0831 Manipulation of Control detections · detection
• T0832 Manipulation of View detections · detection
• T0834 Native API detections · detection
• T0835 Manipulate I/O Image detections · detection
• T0836 Modify Parameter detections · detection
• T0837 Loss of Protection detections · detection
• T0838 Modify Alarm Settings detections · detection
• T0840 Network Connection Enumeration detections · detection
• T0842 Network Sniffing detections · detection
• T0843 Program Download detections · detection
• T0843.001 Download All detections · detection
• T0843.002 Online Edit detections · detection
• T0843.003 Program Append detections · detection
• T0845 Program Upload detections · detection
• T0846 Remote System Discovery detections · detection
• T0846.001 Port Scan detections · detection
• T0846.002 Broadcast Discovery detections · detection
• T0846.003 Multicast Discovery detections · detection
• T0847 Replication Through Removable Media detections · detection
• T0848 Rogue Master detections · detection
• T0849 Masquerading detections · detection
• T0851 Rootkit detections · detection
• T0852 Screen Capture detections · detection
• T0853 Scripting detections · detection
• T0858 Change Operating Mode detections · detection
• T0859 Valid Accounts detections · detection
• T0860 Wireless Compromise detections · detection
• T0861 Point & Tag Identification detections · detection
• T0862 Supply Chain Compromise detections · detection
• T0863 User Execution detections · detection
• T0864 Transient Cyber Asset detections · detection
• T0865 Spearphishing Attachment detections · detection
• T0866 Exploitation of Remote Services detections · detection
• T0867 Lateral Tool Transfer detections · detection
• T0868 Detect Operating Mode detections · detection
• T0869 Standard Application Layer Protocol detections · detection
• T0871 Execution through API detections · detection
• T0872 Indicator Removal on Host detections · detection
• T0873 Project File Infection detections · detection
• T0873.001 Siemens Project File Format detections · detection
• T0874 Hooking detections · detection
• T0877 I/O Image detections · detection
• T0878 Alarm Suppression detections · detection
• T0879 Damage to Property detections · detection
• T0880 Loss of Safety detections · detection
• T0881 Service Stop detections · detection
• T0882 Theft of Operational Information detections · detection
• T0883 Internet Accessible Device detections · detection
• T0884 Connection Proxy detections · detection
• T0885 Commonly Used Port detections · detection
• T0886 Remote Services detections · detection
• T0887 Wireless Sniffing detections · detection
• T0888 Remote System Information Discovery detections · detection
• T0889 Modify Program detections · detection
• T0890 Exploitation for Privilege Escalation detections · detection
• T0892 Change Credential detections · detection
• T0893 Data from Local System detections · detection
• T0894 System Binary Proxy Execution detections · detection
• T0895 Autorun Image detections · detection
• T1001 Data Obfuscation detections · detection
• T1001.001 Junk Data detections · detection
• T1001.002 Steganography detections · detection
• T1003.007 Proc Filesystem detections · detection
• T1003.008 /etc/passwd and /etc/shadow detections · detection
• T1011 Exfiltration Over Other Network Medium detections · detection
• T1011.001 Exfiltration Over Bluetooth detections · detection
• T1016.001 Internet Connection Discovery detections · detection
• T1016.002 Wi-Fi Discovery detections · detection
• T1020.001 Traffic Duplication detections · detection
• T1021.008 Direct Cloud VM Connections detections · detection
• T1025 Data from Removable Media detections · detection
• T1027.006 HTML Smuggling detections · detection
• T1027.007 Dynamic API Resolution detections · detection
• T1027.008 Stripped Payloads detections · detection
• T1027.012 LNK Icon Smuggling detections · detection
• T1027.013 Encrypted/Encoded File detections · detection
• T1027.014 Polymorphic Code detections · detection
• T1027.015 Compression detections · detection
• T1027.016 Junk Code Insertion detections · detection
• T1027.017 SVG Smuggling detections · detection
• T1027.018 Invisible Unicode detections · detection
• T1029 Scheduled Transfer detections · detection
• T1036.001 Invalid Code Signature detections · detection
• T1036.008 Masquerade File Type detections · detection
• T1036.009 Break Process Trees detections · detection
• T1036.010 Masquerade Account Name detections · detection
• T1036.011 Overwrite Process Arguments detections · detection
• T1036.012 Browser Fingerprint detections · detection
• T1037 Boot or Logon Initialization Scripts detections · detection
• T1037.002 Login Hook detections · detection
• T1037.003 Network Logon Script detections · detection
• T1037.004 RC Scripts detections · detection
• T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol detections · detection
• T1052 Exfiltration Over Physical Medium detections · detection
• T1052.001 Exfiltration over USB detections · detection
• T1053.006 Systemd Timers detections · detection
• T1053.007 Container Orchestration Job detections · detection
• T1055.002 Portable Executable Injection detections · detection
• T1055.004 Asynchronous Procedure Call detections · detection
• T1055.005 Thread Local Storage detections · detection
• T1055.008 Ptrace System Calls detections · detection
• T1055.013 Process Doppelgänging detections · detection
• T1055.014 VDSO Hijacking detections · detection
• T1055.015 ListPlanting detections · detection
• T1056.003 Web Portal Capture detections · detection
• T1056.004 Credential API Hooking detections · detection
• T1059.008 Network Device CLI detections · detection
• T1059.010 AutoHotKey & AutoIT detections · detection
• T1059.011 Lua detections · detection
• T1059.013 Container CLI/API detections · detection
• T1070.007 Clear Network Connection History and Configurations detections · detection
• T1070.008 Clear Mailbox Data detections · detection
• T1070.009 Clear Persistence detections · detection
• T1070.010 Relocate Malware detections · detection
• T1071.002 File Transfer Protocols detections · detection
• T1071.005 Publish/Subscribe Protocols detections · detection
• T1074.002 Remote Data Staging detections · detection
• T1080 Taint Shared Content detections · detection
• T1087.003 Email Account detections · detection
• T1090.004 Domain Fronting detections · detection
• T1092 Communication Through Removable Media detections · detection
• T1098.002 Additional Email Delegate Permissions detections · detection
• T1098.004 SSH Authorized Keys detections · detection
• T1098.006 Additional Container Cluster Roles detections · detection
• T1098.007 Additional Local or Domain Groups detections · detection
• T1104 Multi-Stage Channels detections · detection
• T1110.003 Password Spraying detections · detection
• T1110.004 Credential Stuffing detections · detection
• T1111 Multi-Factor Authentication Interception detections · detection
• T1114.002 Remote Email Collection detections · detection
• T1127.002 ClickOnce detections · detection
• T1127.003 JamPlus detections · detection
• T1132 Data Encoding detections · detection
• T1132.002 Non-Standard Encoding detections · detection
• T1137.001 Office Template Macros detections · detection
• T1137.004 Outlook Home Page detections · detection
• T1137.005 Outlook Rules detections · detection
• T1176 Software Extensions detections · detection
• T1176.002 IDE Extensions detections · detection
• T1195.003 Compromise Hardware Supply Chain detections · detection
• T1204.003 Malicious Image detections · detection
• T1204.005 Malicious Library detections · detection
• T1205 Traffic Signaling detections · detection
• T1205.001 Port Knocking detections · detection
• T1205.002 Socket Filters detections · detection
• T1213.001 Confluence detections · detection
• T1213.002 Sharepoint detections · detection
• T1213.004 Customer Relationship Management Software detections · detection
• T1213.005 Messaging Applications detections · detection
• T1213.006 Databases detections · detection
• T1216.002 SyncAppvPublishingServer detections · detection
• T1218.004 InstallUtil detections · detection
• T1218.012 Verclsid detections · detection
• T1218.015 Electron Applications detections · detection
• T1219.001 IDE Tunneling detections · detection
• T1219.003 Remote Access Hardware detections · detection
• T1398 Boot or Logon Initialization Scripts detections · detection
• T1404 Exploitation for Privilege Escalation detections · detection
• T1406 Obfuscated Files or Information detections · detection
• T1406.001 Steganography detections · detection
• T1406.002 Software Packing detections · detection
• T1407 Download New Code at Runtime detections · detection
• T1409 Stored Application Data detections · detection
• T1414 Clipboard Data detections · detection
• T1417 Input Capture detections · detection
• T1417.001 Keylogging detections · detection
• T1417.002 GUI Input Capture detections · detection
• T1418 Software Discovery detections · detection
• T1418.001 Security Software Discovery detections · detection
• T1420 File and Directory Discovery detections · detection
• T1421 System Network Connections Discovery detections · detection
• T1422 System Network Configuration Discovery detections · detection
• T1422.001 Internet Connection Discovery detections · detection
• T1422.002 Wi-Fi Discovery detections · detection
• T1423 Network Service Scanning detections · detection
• T1424 Process Discovery detections · detection
• T1426 System Information Discovery detections · detection
• T1428 Exploitation of Remote Services detections · detection
• T1429 Audio Capture detections · detection
• T1430 Location Tracking detections · detection
• T1430.001 Remote Device Management Services detections · detection
• T1430.002 Impersonate SS7 Nodes detections · detection
• T1437 Application Layer Protocol detections · detection
• T1437.001 Web Protocols detections · detection
• T1451 SIM Card Swap detections · detection
• T1453 Abuse Accessibility Features detections · detection
• T1456 Drive-By Compromise detections · detection
• T1458 Replication Through Removable Media detections · detection
• T1461 Lockscreen Bypass detections · detection
• T1464 Network Denial of Service detections · detection
• T1471 Data Encrypted for Impact detections · detection
• T1474 Supply Chain Compromise detections · detection
• T1474.001 Compromise Software Dependencies and Development Tools detections · detection
• T1474.002 Compromise Hardware Supply Chain detections · detection
• T1474.003 Compromise Software Supply Chain detections · detection
• T1480 Execution Guardrails detections · detection
• T1480.001 Environmental Keying detections · detection
• T1480.002 Mutual Exclusion detections · detection
• T1481 Web Service detections · detection
• T1481.001 Dead Drop Resolver detections · detection
• T1481.002 Bidirectional Communication detections · detection
• T1481.003 One-Way Communication detections · detection
• T1485.001 Lifecycle-Triggered Deletion detections · detection
• T1491 Defacement detections · detection
• T1491.002 External Defacement detections · detection
• T1496.001 Compute Hijacking detections · detection
• T1496.002 Bandwidth Hijacking detections · detection
• T1496.003 SMS Pumping detections · detection
• T1496.004 Cloud Service Hijacking detections · detection
• T1497 Virtualization/Sandbox Evasion detections · detection
• T1497.002 User Activity Based Checks detections · detection
• T1497.003 Time Based Checks detections · detection
• T1498.001 Direct Network Flood detections · detection
• T1498.002 Reflection Amplification detections · detection
• T1499.002 Service Exhaustion Flood detections · detection
• T1499.003 Application Exhaustion Flood detections · detection
• T1505.006 vSphere Installation Bundles detections · detection
• T1509 Non-Standard Port detections · detection
• T1512 Video Capture detections · detection
• T1513 Screen Capture detections · detection
• T1516 Input Injection detections · detection
• T1517 Access Notifications detections · detection
• T1518.002 Backup Software Discovery detections · detection
• T1521 Encrypted Channel detections · detection
• T1521.001 Symmetric Cryptography detections · detection
• T1521.002 Asymmetric Cryptography detections · detection
• T1521.003 SSL Pinning detections · detection
• T1530 Data from Cloud Storage detections · detection
• T1532 Archive Collected Data detections · detection
• T1533 Data from Local System detections · detection
• T1534 Internal Spearphishing detections · detection
• T1535 Unused/Unsupported Cloud Regions detections · detection
• T1538 Cloud Service Dashboard detections · detection
• T1541 Foreground Persistence detections · detection
• T1542 Pre-OS Boot detections · detection
• T1542.002 Component Firmware detections · detection
• T1542.004 ROMMONkit detections · detection
• T1542.005 TFTP Boot detections · detection
• T1543.005 Container Service detections · detection
• T1544 Ingress Tool Transfer detections · detection
• T1546.005 Trap detections · detection
• T1546.006 LC_LOAD_DYLIB Addition detections · detection
• T1546.016 Installer Packages detections · detection
• T1546.017 Udev Rules detections · detection
• T1546.018 Python Startup Hooks detections · detection
• T1547.007 Re-opened Applications detections · detection
• T1547.012 Print Processors detections · detection
• T1547.013 XDG Autostart Entries detections · detection
• T1548.004 Elevated Execution with Prompt detections · detection
• T1548.005 Temporary Elevated Cloud Access detections · detection
• T1548.006 TCC Manipulation detections · detection
• T1550.004 Web Session Cookie detections · detection
• T1552.005 Cloud Instance Metadata API detections · detection
• T1552.008 Chat Messages detections · detection
• T1553.006 Code Signing Policy Modification detections · detection
• T1555.002 Securityd Memory detections · detection
• T1555.006 Cloud Secrets Management Stores detections · detection
• T1556.001 Domain Controller Authentication detections · detection
• T1556.003 Pluggable Authentication Modules detections · detection
• T1556.005 Reversible Encryption detections · detection
• T1556.007 Hybrid Identity detections · detection
• T1556.008 Network Provider DLL detections · detection
• T1556.009 Conditional Access Policies detections · detection
• T1557.002 ARP Cache Poisoning detections · detection
• T1557.004 Evil Twin detections · detection
• T1558.001 Golden Ticket detections · detection
• T1558.002 Silver Ticket detections · detection
• T1558.004 AS-REP Roasting detections · detection
• T1558.005 Ccache Files detections · detection
• T1559 Inter-Process Communication detections · detection
• T1559.003 XPC Services detections · detection
• T1560.002 Archive via Library detections · detection
• T1560.003 Archive via Custom Method detections · detection
• T1561 Disk Wipe detections · detection
• T1563 Remote Service Session Hijacking detections · detection
• T1563.001 SSH Hijacking detections · detection
• T1564.005 Hidden File System detections · detection
• T1564.007 VBA Stomping detections · detection
• T1564.008 Email Hiding Rules detections · detection
• T1564.009 Resource Forking detections · detection
• T1564.010 Process Argument Spoofing detections · detection
• T1564.011 Ignore Process Interrupts detections · detection
• T1564.012 File/Path Exclusions detections · detection
• T1564.013 Bind Mounts detections · detection
• T1564.014 Extended Attributes detections · detection
• T1565.003 Runtime Data Manipulation detections · detection
• T1566.003 Spearphishing via Service detections · detection
• T1566.004 Spearphishing Voice detections · detection
• T1567.003 Exfiltration to Text Storage Sites detections · detection
• T1567.004 Exfiltration Over Webhook detections · detection
• T1568.001 Fast Flux DNS detections · detection
• T1568.003 DNS Calculation detections · detection
• T1569.003 Systemctl detections · detection
• T1573.001 Symmetric Cryptography detections · detection
• T1573.002 Asymmetric Cryptography detections · detection
• T1574.004 Dylib Hijacking detections · detection
• T1574.009 Path Interception by Unquoted Path detections · detection
• T1574.010 Services File Permissions Weakness detections · detection
• T1574.013 KernelCallbackTable detections · detection
• T1574.014 AppDomainManager detections · detection
• T1575 Native API detections · detection
• T1577 Compromise Application Executable detections · detection
• T1578.001 Create Snapshot detections · detection
• T1578.002 Create Cloud Instance detections · detection
• T1578.004 Revert Cloud Instance detections · detection
• T1578.005 Modify Cloud Compute Configurations detections · detection
• T1582 SMS Control detections · detection
• T1583 Acquire Infrastructure detections · detection
• T1583.001 Domains detections · detection
• T1583.002 DNS Server detections · detection
• T1583.003 Virtual Private Server detections · detection
• T1583.004 Server detections · detection
• T1583.005 Botnet detections · detection
• T1583.006 Web Services detections · detection
• T1583.007 Serverless detections · detection
• T1583.008 Malvertising detections · detection
• T1584.001 Domains detections · detection
• T1584.002 DNS Server detections · detection
• T1584.003 Virtual Private Server detections · detection
• T1584.004 Server detections · detection
• T1584.005 Botnet detections · detection
• T1584.006 Web Services detections · detection
• T1584.007 Serverless detections · detection
• T1584.008 Network Devices detections · detection
• T1585 Establish Accounts detections · detection
• T1585.001 Social Media Accounts detections · detection
• T1585.002 Email Accounts detections · detection
• T1585.003 Cloud Accounts detections · detection
• T1586.001 Social Media Accounts detections · detection
• T1586.002 Email Accounts detections · detection
• T1587.002 Code Signing Certificates detections · detection
• T1587.003 Digital Certificates detections · detection
• T1587.004 Exploits detections · detection
• T1588.003 Code Signing Certificates detections · detection
• T1588.004 Digital Certificates detections · detection
• T1588.005 Exploits detections · detection
• T1588.006 Vulnerabilities detections · detection
• T1588.007 Artificial Intelligence detections · detection
• T1589.001 Credentials detections · detection
• T1589.003 Employee Names detections · detection
• T1590.003 Network Trust Dependencies detections · detection
• T1590.004 Network Topology detections · detection
• T1590.005 IP Addresses detections · detection
• T1590.006 Network Security Appliances detections · detection
• T1591 Gather Victim Org Information detections · detection
• T1591.001 Determine Physical Locations detections · detection
• T1591.002 Business Relationships detections · detection
• T1591.003 Identify Business Tempo detections · detection
• T1592 Gather Victim Host Information detections · detection
• T1592.001 Hardware detections · detection
• T1592.002 Software detections · detection
• T1592.003 Firmware detections · detection
• T1593 Search Open Websites/Domains detections · detection
• T1593.001 Social Media detections · detection
• T1593.002 Search Engines detections · detection
• T1594 Search Victim-Owned Websites detections · detection
• T1595.001 Scanning IP Blocks detections · detection
• T1595.003 Wordlist Scanning detections · detection
• T1596 Search Open Technical Databases detections · detection
• T1596.001 DNS/Passive DNS detections · detection
• T1596.002 WHOIS detections · detection
• T1596.003 Digital Certificates detections · detection
• T1596.004 CDNs detections · detection
• T1596.005 Scan Databases detections · detection
• T1597 Search Closed Sources detections · detection
• T1597.001 Threat Intel Vendors detections · detection
• T1597.002 Purchase Technical Data detections · detection
• T1598 Phishing for Information detections · detection
• T1598.001 Spearphishing Service detections · detection
• T1598.002 Spearphishing Attachment detections · detection
• T1598.003 Spearphishing Link detections · detection
• T1598.004 Spearphishing Voice detections · detection
• T1599 Network Boundary Bridging detections · detection
• T1600 Weaken Encryption detections · detection
• T1600.001 Reduce Key Space detections · detection
• T1600.002 Disable Crypto Hardware detections · detection
• T1601 Modify System Image detections · detection
• T1601.001 Patch System Image detections · detection
• T1601.002 Downgrade System Image detections · detection
• T1602 Data from Configuration Repository detections · detection
• T1602.001 SNMP (MIB Dump) detections · detection
• T1602.002 Network Device Configuration Dump detections · detection
• T1603 Scheduled Task/Job detections · detection
• T1604 Proxy Through Victim detections · detection
• T1606.001 Web Cookies detections · detection
• T1606.002 SAML Tokens detections · detection
• T1608.001 Upload Malware detections · detection
• T1608.002 Upload Tool detections · detection
• T1608.004 Drive-by Target detections · detection
• T1608.005 Link Target detections · detection
• T1608.006 SEO Poisoning detections · detection
• T1610 Deploy Container detections · detection
• T1612 Build Image on Host detections · detection
• T1614 System Location Discovery detections · detection
• T1616 Call Control detections · detection
• T1617 Hooking detections · detection
• T1623 Command and Scripting Interpreter detections · detection
• T1623.001 Unix Shell detections · detection
• T1624 Event Triggered Execution detections · detection
• T1624.001 Broadcast Receivers detections · detection
• T1625 Hijack Execution Flow detections · detection
• T1625.001 System Runtime API Hijacking detections · detection
• T1626 Abuse Elevation Control Mechanism detections · detection
• T1626.001 Device Administrator Permissions detections · detection
• T1627 Execution Guardrails detections · detection
• T1627.001 Geofencing detections · detection
• T1628 Hide Artifacts detections · detection
• T1628.001 Suppress Application Icon detections · detection
• T1628.002 User Evasion detections · detection
• T1628.003 Conceal Multimedia Files detections · detection
• T1629 Impair Defenses detections · detection
• T1629.001 Prevent Application Removal detections · detection
• T1629.002 Device Lockout detections · detection
• T1629.003 Disable or Modify Tools detections · detection
• T1630 Indicator Removal on Host detections · detection
• T1630.001 Uninstall Malicious Application detections · detection
• T1630.002 File Deletion detections · detection
• T1630.003 Disguise Root/Jailbreak Indicators detections · detection
• T1631 Process Injection detections · detection
• T1631.001 Ptrace System Calls detections · detection
• T1632 Subvert Trust Controls detections · detection
• T1632.001 Code Signing Policy Modification detections · detection
• T1633 Virtualization/Sandbox Evasion detections · detection
• T1633.001 System Checks detections · detection
• T1634 Credentials from Password Store detections · detection
• T1634.001 Keychain detections · detection
• T1635 Steal Application Access Token detections · detection
• T1635.001 URI Hijacking detections · detection
• T1636 Protected User Data detections · detection
• T1636.001 Calendar Entries detections · detection
• T1636.002 Call Log detections · detection
• T1636.003 Contact List detections · detection
• T1636.004 SMS Messages detections · detection
• T1636.005 Accounts detections · detection
• T1637 Dynamic Resolution detections · detection
• T1637.001 Domain Generation Algorithms detections · detection
• T1638 Adversary-in-the-Middle detections · detection
• T1639 Exfiltration Over Alternative Protocol detections · detection
• T1639.001 Exfiltration Over Unencrypted Non-C2 Protocol detections · detection
• T1640 Account Access Removal detections · detection
• T1641 Data Manipulation detections · detection
• T1641.001 Transmitted Data Manipulation detections · detection
• T1642 Endpoint Denial of Service detections · detection
• T1643 Generate Traffic from Victim detections · detection
• T1644 Out of Band Data detections · detection
• T1645 Compromise Client Software Binary detections · detection
• T1646 Exfiltration Over C2 Channel detections · detection
• T1647 Plist File Modification detections · detection
• T1648 Serverless Execution detections · detection
• T1650 Acquire Access detections · detection
• T1651 Cloud Administration Command detections · detection
• T1652 Device Driver Discovery detections · detection
• T1654 Log Enumeration detections · detection
• T1655 Masquerading detections · detection
• T1655.001 Match Legitimate Name or Location detections · detection
• T1657 Financial Theft detections · detection
• T1658 Exploitation for Client Execution detections · detection
• T1659 Content Injection detections · detection
• T1660 Phishing detections · detection
• T1661 Application Versioning detections · detection
• T1662 Data Destruction detections · detection
• T1663 Remote Access Software detections · detection
• T1664 Exploitation for Initial Access detections · detection
• T1665 Hide Infrastructure detections · detection
• T1666 Modify Cloud Resource Hierarchy detections · detection
• T1667 Email Bombing detections · detection
• T1668 Exclusive Control detections · detection
• T1669 Wi-Fi Networks detections · detection
• T1670 Virtualization Solution detections · detection
• T1671 Cloud Application Integration detections · detection
• T1673 Virtual Machine Discovery detections · detection
• T1674 Input Injection detections · detection
• T1675 ESXi Administration Command detections · detection
• T1676 Linked Devices detections · detection
• T1677 Poisoned Pipeline Execution detections · detection
• T1678 Delay Execution detections · detection
• T1679 Selective Exclusion detections · detection
• T1680 Local Storage Discovery detections · detection
• T1681 Search Threat Vendor Data detections · detection
• T1682 Query Public AI Services detections · detection
• T1683 Generate Content detections · detection
• T1683.001 Written Content detections · detection
• T1683.002 Audio-Visual Content detections · detection
• T1684 Social Engineering detections · detection
• T1684.001 Impersonation detections · detection
• T1684.002 Email Spoofing detections · detection
• T1685.003 Modify or Spoof Tool UI detections · detection
• T1686.002 Network Device Firewall detections · detection
• T1687 Exploitation for Defense Impairment detections · detection
• T1688 Safe Mode Boot detections · detection
• T1691 Block Operational Technology Message detections · detection
• T1691.001 Command Message detections · detection
• T1691.002 Reporting Message detections · detection
• T1692 Unauthorized Message detections · detection
• T1692.001 Command Message detections · detection
• T1692.002 Reporting Message detections · detection
• T1693 Modify Firmware detections · detection
• T1693.001 System Firmware detections · detection
• T1693.002 Module Firmware detections · detection
• T1694 Insecure Credentials detections · detection
• T1694.001 Default Credentials detections · detection
• T1694.002 Hardcoded Credentials detections · detection
• T1695 Block Communications detections · detection
• T1695.001 Serial COM detections · detection
• T1695.002 Ethernet detections · detection
• T1695.003 Wi-Fi detections · detection