Threat Hunting in the Cloud

APPENDIX AMITRE ATT&CK Tactics

The following appendixes contain an in-depth analysis of MITRE ATT&CK framework Tactics, Techniques, and Procedures (TTPs). They detail information that articulates the threat, treat actors, and the impact and remediation processes.

NOTE The appendixes in this part are extracts from publicly available MITRE ATT&CK Framework documentation. We have carefully crafted the relevant attack vector information that relates to multi-cloud attacks to assist the readers. Consult https://attack.mitre.org/ for the latest revisions to ensure you're up to date with the latest TTP information.

ID	NAME	DESCRIPTION
TA0043	Reconnaissance	The adversary is trying to gather information they can use to plan future operations.
TA0042	Resource Development	The adversary is trying to establish resources they can use to support operations.
TA0001	Initial Access	The adversary is trying to get into your network.
TA0002	Execution	The adversary is trying to run malicious code.
TA0003	Persistence	The adversary is trying to maintain their foothold.
TA0004	Privilege Escalation	The adversary is trying to gain higher-level permissions.
TA0005	Defense Evasion	The adversary is trying to avoid being detected.
TA0006	Credential Access	The adversary is trying to steal account names and passwords.
TA0007	Discovery	The adversary is trying to figure out your environment.
TA0008	Lateral Movement	The adversary is trying to move through your environment.
TA0009 ...