Top 10 Most Common ATT&CK Tactics and Techniques in 2023

ATT&CK is an attack model framework developed by MITRE. Its full name is Adversarial Tactics, Techniques, and Common Knowledge. It is a public adversarial tactics and techniques knowledge base composed based on real-world observed attack vectors, which can be used as a development basis for specific threat models and methodologies by private institutions, government departments, and the cybersecurity product and service community. ATT&CK is a structured list that aggregates known attacker behaviors into tactics and techniques. Since this list presents a comprehensive view of the behaviors adopted by attackers when attacking networks, it is highly useful for various offensive and defensive consideration mechanisms.

By analyzing all the attack methods of various threat organizations collected in 2022, Pyxis Security Lab ranked these attack techniques based on the number and percentage used, and obtained the following reference data:

▍ Ten Most Common ATT&CK Techniques

1. T1059 Command and Scripting Interpreter

Command and scripting interpreters are an execution technique that allows attackers to execute arbitrary commands, scripts, and binary files on target systems. Attackers often use this technique to interact with compromised systems, download additional payloads and tools, or disable defense mechanisms, among other things. This technique takes advantage of command and scripting interpreters, which are designed to interpret and execute instructions written in specific programming or scripting languages without first translating the program into machine code. Since there is no compilation process, the interpreter runs instructions in a given program one by one, making it easier for attackers to run arbitrary code.

The T1059 Command and Scripting Interpreter technique has eight sub-techniques, including T1059.001 PowerShell, T1059.002 AppleScript, T1059.003 Windows Command Shell, T1059.004 Unix Shell, T1059.005 Visual Basic, T1059.006 Python, T1059.007 JavaScript, and T1059.008 Network Device CLI.

2. T1003 OS Credential Dumping

Obtaining credentials is a critical step in attack campaigns because it allows them to access other resources and systems in the target environment. Dumping credentials from operating systems and utilities is the most common technique used by attackers to obtain account logins and credentials, so much so that the usage of T1003 OS Credential Dumping has risen significantly in 2023.

The T1003 OS Credential Dumping technique has eight sub-techniques, namely: T1003.001 LSASS Memory, T1003.002 Security Account Manager, T1003.003 NTDS, T1003.004 LSA Secrets, T1003.005 Cached Domain Credentials, T1003.006 DCSync, T1003.007 Proc Filesystem, T1003.008 /etc/passwd and /etc/shadow.

If unable to connect to AD DS, domain credentials are cached in the registry to validate credentials. Domain account login information can be cached locally, so that if the domain controller cannot be reached during subsequent logins, the user can still log in.

3. T1486 Data Encrypted for Impact

Attackers maliciously use encryption techniques to compromise the availability of data and services in target systems. Whether used for ransomware attacks or data destruction attacks, encrypting data is a powerful way to disrupt businesses. The number of ransomware attacks has been on the rise in 2022 and is expected to continue to threaten the daily lives of organizations and individuals.

Attackers utilize advanced encryption algorithms to render victim data useless. In ransomware attacks, attackers hold the decryption key to obtain ransom, hoping to gain financial benefits from it. Patterns in notorious ransomware attacks indicate that attackers use multiple encryption algorithms to achieve speed, security, and efficiency.

4. T1055 Process Injection

Process injection is a common technique used by attackers to achieve higher levels of stealth, persistence, and privilege on target systems. Process injection involves injecting malicious code into legitimate processes, allowing attackers to execute their code in the context of the target process and avoid detection. Due to its extensive advantages, the T1055 Process Injection technique remains among the top five of the top ten attack techniques.

The T1055 Process Injection has twelve sub-techniques, namely: T1055.001 DLL Injection, T1055.002 Portable Executable (PE) Injection, T1055.003 Thread Execution Hijack, T1055.004 Asynchronous Procedure Call (APC) Injection, T1055.005 Thread Local Storage (TLS) Injection, T1055.008 Ptrace System Calls, T1055.009 Proc Memory Injection, T1055.011 Extra Window Memory (EWM) Injection, T1055.012 Process Hollowing, T1055.013 Process Doppelgänging, T1055.014 VDSO Hijacking, and T1055.015 ListPlanting.

5. T1082 System Information Discovery

System information discovery includes collecting data from computer systems or networks, such as hardware components, software applications, and network configurations. Attackers can use built-in tools to gather information about the current network, operating system version, kernel ID, and potential vulnerabilities to exploit. T1082 System Information Discovery is starting to be used by more malware, which is due to its role in facilitating lateral movement attacks.

6. T1021 Remote Services

Remote Services technique refers to the use of remote services, such as Remote Desktop Protocol (RDP), Secure Shell (SSH), Server Message Block (SMB), Virtual Network Computing (VNC), and Windows Remote Management (WinRM), to gain access and control over remote systems. This technique offers great advantages to attackers, such as remote access and pivoting to other systems in the network for lateral movement.

T1021 Remote Services has six sub-techniques, namely: T1021.001 Remote Desktop Protocol, T1021.002 SMB/Windows Admin Shares, T1021.003 Distributed Component Object Model (DCOM), T1021.004 Secure Shell (SSH), T1021.005 Virtual Network Computing (VNC), and T1021.006 Windows Remote Management.

7. T1047 Windows Management Instrumentation

Windows Management Instrumentation (WMI) is the infrastructure for managing data and operations on Windows-based operating systems. Attackers abuse the extensive capabilities of WMI to execute malicious commands and payloads within compromised Windows hosts. The WMI service also provides attackers with local and remote access. The versatility of WMI makes T1047 Windows Management Instrumentation the seventh most frequently used MITRE ATT&CK technique in the report.

8. T1053 Scheduled Task/Job

A scheduled task is an automated action executed at a specific time or in response to a specific event. This could be a single event occurring at a predetermined time in the future, a recurring event occurring periodically (e.g., every Monday at 3 AM), or an action triggered by a specific event, such as a user logging onto the system. Attackers frequently create scheduled tasks for remote code execution, persistence, and privilege escalation, which is why the scheduled task technique holds a place in the 2023 report.

T1053 Scheduled Task/Job has five sub-techniques, namely: T1053.002 At, T1053.003 Cron, T1053.005 Scheduled Task, T1053.006 Systemd Timers, and T1053.007 Container Orchestration Job.

9. T1497 Virtualization/Sandbox Evasion

Malware developers often design their malware with anti-virtualization or anti-sandbox capabilities to detect and evade virtualization and analysis environments, such as sandboxes. When malware detects that it is running in a virtual environment, it may stop running on the victim's machine (i.e., terminate) or avoid executing its malicious behavior, to make it harder for security researchers to understand the malware and develop effective countermeasures.

T1497 Virtualization/Sandbox Evasion has three sub-techniques, namely: T1497.001 System Checks, T1497.002 User Activity Checks, and T1497.003 Time Based Evasion.

10. T1018 Remote System Discovery

After gaining initial access to a victim's environment, attackers look for remote hosts and networks. Discovering remote hosts and networks has the potential to open up a whole new attack surface that can be exploited to achieve the attacker's objectives. Since advanced cyberattacks almost always involve multiple hosts and networks, remote system discovery has also entered the list of the top ten most prevalent ATT&CK techniques this year.

The Pyxis Security Breach and Attack Simulation library already contains the above attack techniques. We recommend that enterprises validate current mainstream or popular attack methods in advance. You only need to select the corresponding attack method on the Pyxis Security Measure and Verification Platform to verify whether your security defense system can respond effectively!

Scan the QR code at the bottom to add our official customer service and get the full report!