Comprehensive Analysis of the Top 10 MITRE ATT&CK Techniques of 2024

The MITRE ATT&CK framework has become the common language for global cybersecurity defense. Cybersafe Security Labs discovered that in 2024, attackers relied more heavily on "stealth" and "automation" techniques, with 93% of attacks focusing on ten core methods. This article interprets the operational logic of these technologies from the perspectives of technical principles, attack cases, and defensive practices.

Technique 1: Process Injection (T1055) — The Art of Stealth

Core Principle: Inject malicious code into the memory space of a legitimate process (such as explorer.exe, svchost.exe) via APIs (such as VirtualAllocEx and CreateRemoteThread), bypassing detection by leveraging the privileges and credentials of the target process.

Sub-technique Evolution

• DLL Injection: Loading malicious dynamic-link libraries into a target process (e.g., utilizing PowerShell reflective injection).

• Process Hollowing: Creating a suspended legitimate process and then replacing its memory content (e.g., REMCOS RAT injecting into iexplore.exe).

• Thread Hijacking: Hijacking system threads to execute malicious instructions (e.g., Lumma Stealer attack chain).

Attack Cases

• RomCom APT Group: Exploiting the CVE-2024-9860 vulnerability to deploy backdoors through process injection.

• RedLine Stealer: Injecting malicious code into vbc.exe (Visual Basic Compiler process) to disguise it as compilation behavior.

Defensive Recommendations

• Deploy memory protection tools (such as Microsoft Defender Credential Guard).

• Monitor for process behavior anomalies (such as non-system processes calling WriteProcessMemory).

Technique 2: Command and Scripting Interpreter (T1059) — The Attacker's Swiss Army Knife

Abuse Scenarios

• PowerShell: Downloading payloads (Invoke-WebRequest), disabling defenses (Set-MpPreference -DisableRealtimeMonitoring $true).

• Bash/Python: Moving laterally within Linux systems (e.g., leveraging Cron jobs for persistence).

Stealth Techniques

• Fileless Attacks: Loading malicious scripts through memory (e.g., PowerShell calling .NET Assembly).

• Abuse of Legitimate Tools: Utilizing system tools such as PsExec and WMIC to execute malicious commands.

Attack Cases

• Black Basta Ransomware: Turning off Windows Defender real-time monitoring via PowerShell scripts.

• Earth Estries APT Group: Using Bash scripts to deploy cryptomining trojans on Linux servers.

Defensive Recommendations

• Enable script logging (such as PowerShell script block logging).

• Restrict the execution of high-risk commands (such as AppLocker whitelisting policies).

Technique 3: Credentials from Password Stores (T1555) — Theft of the Keys

Attack Paths

• Browser Credentials: Decrypting Chrome's Login Data file or Firefox's key4.db.

• Password Managers: Utilizing memory scraping tools (such as Mimikatz) to extract master password hashes.

Advanced Methods

• Cloud Key Hijacking: Stealing IAM credentials via AWS CLI (e.g., Operation SCARLETEL).

• Hardware Security Module (HSM) Attacks: Side-channel attacks targeting enterprise-class password management devices.

Defensive Recommendations

• Enable hardware security keys (e.g., using two-factor authentication (2FA) hardware to replace password-only authentication).

• Regularly rotate credentials and monitor for abnormal access (such as AWS CloudTrail log analysis).

Technique 4: Application Layer Protocol (T1071) — Stealth Communication Tunnels

Technical Segmentation

• HTTPS/DoH: Disguising C2 traffic as normal web requests (e.g., DarkGate malware).

• DNS Tunneling: Passing instructions via TXT records (e.g., Cobalt Strike Beacon).

Attack Cases

• Water Hydra APT Group: Exfiltrating data via the HTTPS protocol, with traffic characteristics mimicking Google Analytics.

• GhostEngine Botnet: Hiding mining pool communication via DNS-over-HTTPS.

Defensive Recommendations

• Deploy network traffic baseline analysis (such as NTA or NDR network threat traffic analysis for abnormal protocol detection).

• Enforce decryption inspections (such as TLS 1.3 man-in-the-middle decryption policies).

Technique 5: Impair Defenses (T1562) — The Attacker's "Blind Spot"

Core Principle: Attackers weaken the defensive capabilities of the target system by disabling or tampering with security tools, logs, and firewall configurations, ensuring that their malicious activities remain undetected.

Sub-technique Evolution

• Disabling Security Tools: Turning off Windows Defender through registry modifications (e.g., reg add HKLMSOFTWAREPoliciesMicrosoftWindows Defender /v DisableAntiSpyware /t REG_DWORD /d 1).

• Tampering with Logs: Deleting Windows event logs (e.g., wevtutil.exe cl Security).

• Modifying Firewall Rules: Allowing malicious traffic via the netsh command (e.g., netsh firewall set opmode mode=disable).

Attack Cases

• Mallox Ransomware: Disabling log generation using EtwEventWrite patching technology.

• RansomHub: Utilizing the EDRKINShifter tool to disable EDR and antivirus software.

Defensive Recommendations

• Enable log integrity protection (such as Windows Event Log Forwarding).

• Deploy behavior analysis tools (such as EDR, HIDS).

Technique 6: Data Encrypted for Impact (T1486) — The Ultimate Weapon of Extortion

Core Principle: Attackers force victims to pay ransom by encrypting critical data (such as financial records, customer contracts), while deleting backups to prevent recovery.

Sub-technique Evolution

• File Encryption: Locking critical files using the AES-256 encryption algorithm (e.g., Black Basta ransomware).

• Shadow Copy Deletion: Deleting backups via PowerShell commands (e.g., Get-WmiObject Win32_ShadowCopy | Remove-WmiObject).

Attack Cases

• Akira Ransomware: Utilizing PowerShell scripts to delete shadow copies, ensuring that data cannot be recovered.

• Black Basta: Through a double-extortion strategy, threatening public disclosure after encrypting data.

Defensive Recommendations

• Back up regularly and store critical data offline.

• Enable file integrity monitoring (such as EDR, HIDS).

Technique 7: System Information Discovery (T1082) — The Attacker's "Map"

Core Principle: Attackers understand the target environment by enumerating system information (such as operating system version, network configuration) to prepare for subsequent attacks.

Sub-technique Evolution

• Network Scanning: Enumerating network devices using Nmap or PowerShell scripts (e.g., 1..254 | % { Test-Connection -ComputerName "192.168.1.$_" -Count 1 }).

• Domain Information Gathering: Obtaining the domain administrator list via the net group /domain command.

Attack Cases

• BianLian Ransomware: Gathering system configuration information using the systeminfo command.

• Multiple APT Groups: Enumerating domain users via the net user /domain command.

Defensive Recommendations

• Restrict execution privileges of high-risk commands.

• Deploy network segmentation and micro-segmentation strategies.

Technique 8: Input Capture (T1056) — The "Spy" on the Keyboard

Core Principle: Attackers steal sensitive user information (such as passwords, credit card numbers) through keylogging, screenshots, and clipboard monitoring.

Sub-technique Evolution

• Keylogging: Capturing user input through hook functions (such as SetWindowsHookEx).

• Screenshots: Taking scheduled screenshots using Python's PIL library (e.g., CarnavalHeist malware).

• Clipboard Monitoring: Capturing clipboard content in real-time (e.g., Agent Tesla malware).

Attack Cases

• Atomic Stealer: Capturing macOS users' keyboard input via AppleScript.

• Snake Keylogger: Exfiltrating screenshots and clipboard data via the SMTP protocol.

Defensive Recommendations

• Enable User Entity Behavior Analytics (such as UEBA tools).

• Deploy Data Loss Prevention (DLP) solutions.

Technique 9: Boot or Logon Autostart Execution (T1547) — The "Seed" of Persistence

Core Principle: Attackers modify startup items or create scheduled tasks to ensure that malicious programs execute automatically upon system reboot or user login.

Sub-technique Evolution

• Registry Run Keys / Startup Folder: Adding malicious program paths via HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun.

• Scheduled Tasks: Creating scheduled tasks using the schtasks command (e.g., schtasks /create /tn "SystemMonitor" /tr "C:WindowsTempsvchost.exe" /sc DAILY).

• Service Creation: Disguising as system services via the sc create command (e.g., sc create SystemMonitor binPath= "C:WindowsTempsvchost.exe").

Attack Cases

• SneakThief Malware: Ensuring persistence through registry run keys.

• LemonDuck Cryptominer: Executing malicious scripts regularly using scheduled tasks.

Defensive Recommendations

• Regularly audit startup items and scheduled tasks.

• Deploy Endpoint Detection and Response (EDR) tools.

Technique 10: Data from Local System (T1005) — The "Harvester" of Data

Core Principle: Attackers search local file systems to gather sensitive data (such as financial records, customer information) for subsequent attacks or exfiltration.

Sub-technique Evolution

• File Searching: Finding sensitive files via the findstr command (e.g., findstr /spin "password" *.txt).

• Database Exporting: Exporting MySQL data using mysqldump (e.g., mysqldump -u root -p database > dump.sql).

• Clipboard Monitoring: Capturing clipboard content in real-time (e.g., Agent Tesla malware).

Attack Cases

• BianLian Ransomware: Searching for files containing "password" via the findstr command.

• Akira Ransomware: Exporting browser-stored passwords using esentutl.exe.

Defensive Strategies

• Enable file access control (such as NTFS permissions).

• Deploy data encryption and access auditing.

The TOP 10 MITRE ATT&CK techniques are not only a summary and synthesis of tactics and techniques used by attackers, but also the "tactical map" for defenders. Through continuous monitoring, behavioral analysis, and automated response, enterprises can take the initiative in the game of offense and defense.

The Cybersafe Security Metric Validation Platform now provides our users with the "MITRE ATT&CK TOP 10 Techniques" validation scenario. Easily search for and run this validation scenario with one click in the validation scenario library to assess the defensive capabilities and weak links of your security defense system against these TOP 10 techniques, thereby allowing for targeted reinforcement.