FortiTester ATT&CK DB Ver

Name ATT&CK Tactics & Techniques Status Update ATT&CK Version
Add Driver Persistence:
Boot or Logon Autostart Execution

Privilege Escalation:
Boot or Logon Autostart Execution

Add
 This ability installs a built-in, already installed windows driver via pnputil.exe for testing. V10
Add File to Local Library StartupItems Persistence:
Boot or Logon Initialization Scripts: Startup Items

Privilege Escalation:
Boot or Logon Initialization Scripts: Startup Items

Add
 This ability creates a file in /Library/StartupItems. V10
Clear Pagging Cache Defense Evasion:
Impair Defenses: Disable or Modify Tools

Add
 This ability clears pagging cache via system request. V10
Create and Hide a Service Defense Evasion:
Hide Artifacts

Add
 This ability utilizes sc.exe and sdset to change the security descriptor of a service. V10
Create HTTP Server Exfiltration:
Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

Add
 This ability creates a HTTP server on port 9090. V10
Decompile Local CHM File Defense Evasion:
Signed Binary Proxy Execution: Compiled HTML File

Add
 This ability uses hh.exe to decompile a local compiled HTML Help file. V10
Delete Windows Defender Scheduled Tasks Defense Evasion:
Impair Defenses: Disable or Modify Tools

Add
 This ability deletes the Windows Defender scheduled tasks. V10
Disable Memory Swap Defense Evasion:
Impair Defenses: Disable or Modify Tools

Add
 This ability disables swapping of device paging. V10
Enumerate Active Directory Users Discovery:
Account Discovery: Domain Account

Add
 This ability utilizes ADSISearcher to enumerate users within Active Directory. V10
Enumerate Camera Information Reconnaissance:
Gather Victim Host Information: Hardware

Add
 Enumerate camera info using powershell. V10
Event Viewer Registry Modification Defense Evasion:
Modify Registry

Add
 This ability modifies event viewer registry values to alter the behavior of the online help redirection. V10
Execute Local MSI file with an embedded EXE Defense Evasion:
Signed Binary Proxy Execution: Msiexec

Add
 This ability executes an MSI containing an embedded EXE using the WMI Win32_Product class. V10
Export the Local Security Policy via SecEdit.exe Discovery:
Password Policy Discovery

Add
 This ability uses SecEdit.exe to export the current local security policy applied to a host. V10
Hide Files Through Registry Defense Evasion:
Hide Artifacts: Hidden Files and Directories

Add
 Disable Show Hidden files switch in registry. V10
HTML Smuggling Remote Payload Defense Evasion:
Obfuscated Files or Information: HTML Smuggling

Add
 This ability opens the HTML file in the default browser, and then the iso file will be downloaded automatically. V10
List Google Chrome Bookmark Files on MacOS Discovery:
Browser Bookmark Discovery

Add
 This ability searches for Google Chrome Bookmark file. V10
LNK Payload Download Execution:
User Execution: Malicious File

Add
 This step executes the lnk file, which invokes powershell to download putty from the Internet and open it. V10
Logon Scripts on Mac Persistence:
Boot or Logon Initialization Scripts: Login Hook

Privilege Escalation:
Boot or Logon Initialization Scripts: Login Hook

Add
 This ability creates a plist file that points to a specific script to execute with root privileges upon user logon. V10
Loot local Wifi Credentials Credential Access:
Credentials from Password Stores

Add
 This ability dumps keys in clear text for saved WLAN profiles. V10
Obfuscated Command Line Scripts Execution:
Command and Scripting Interpreter: Unix Shell

Add
 Obfuscated Command Line Scripts. V10
Persistence using Windows Print Processors Persistence:
Boot or Logon Autostart Execution: Print Processors

Privilege Escalation:
Boot or Logon Autostart Execution: Print Processors

Add
 This ability registers the dll as an alternative Print Processor by setting registry values. V10
Printer Check Discovery:
Peripheral Device Discovery

Add
 This step finds the printer and checks for related vulnerabilities. V10
RDP hijacking Lateral Movement:
Remote Service Session Hijacking: RDP Hijacking

Add
 A SYSTEM account uses RDP to move laterally across the network without credentials. V10
Scheduled Task with At Privilege Escalation:
Scheduled Task/Job: At

Persistence:
Scheduled Task/Job: At

Execution:
Scheduled Task/Job: At

Add
 This ability scheduling tasks at a specified time. V10
Share Discovery Discovery:
Network Share Discovery

Add
 This ability enumerates Domain Shares the current user has access. V10
Simulate CPU Load with Yes Impact:
Resource Hijacking

Add
 This ability simulates a high CPU load as you might observe during cryptojacking attacks. V10
System Scope COR_PROFILER Persistence:
Hijack Execution Flow: COR_PROFILER

Privilege Escalation:
Hijack Execution Flow: COR_PROFILER

Defense Evasion:
Hijack Execution Flow: COR_PROFILER

Add
 This ability creates system scope environment variables. V10
System Shell Profile Scripts Persistence:
Event Triggered Execution: Unix Shell Configuration Modification

Privilege Escalation:
Event Triggered Execution: Unix Shell Configuration Modification

Add
 This ability establishes persistence by adding commands to the script file in a specified directory. V10
TinyTurla Backdoor Service Persistence:
Create or Modify System Process: Windows Service

Privilege Escalation:
Create or Modify System Process: Windows Service

Add
 This ability runs the Dll as a service to emulate the TinyTurla backdoor. V10
WMIObject Group Discovery Discovery:
Permission Groups Discovery: Local Groups

Add
 This ability enumerates local groups on the target machine. V10
Process Injection via mavinject.exe Defense Evasion:
Impair Defenses: Disable Windows Event Logging , System Binary Proxy Execution: Mavinject

Privilege Escalation:
Impair Defenses: Disable Windows Event Logging

Mod
 Windows 10 Utility mavinject.exe To Inject DLLS. V10