Detection Strategies

MITRE ATT&CK detection strategies (DET-XXXX) and their analytics that detect adversary techniques.

697

1,745

Analytics

ID	Strategy	Analytics
DET0001	Detect Access to Cloud Instance Metadata API (IaaS)	1
DET0002	Behavioral Detection of Publish/Subscribe Protocol Misuse for C2	4
DET0003	T1136.002 Detection Strategy - Domain Account Creation Across Platforms	3
DET0004	Detection Strategy for Hijack Execution Flow using Path Interception by PATH Environment Variable.	3
DET0005	Renamed Legitimate Utility Execution with Metadata Mismatch and Suspicious Path	3
DET0006	Detection Strategy for Network Boundary Bridging	1
DET0007	Detection of Domain Trust Discovery via API, Script, and CLI Enumeration	1
DET0008	Behavioral Detection of Remote Cloud Logins via Valid Accounts	4
DET0009	Supply-chain tamper in dependencies/dev-tools (manager→write/install→first-run→egress)	3
DET0010	Behavioral Detection of Event Triggered Execution Across Platforms	6
DET0011	Detecting Junk Data in C2 Channels via Behavioral Analysis	4
DET0012	Detection Strategy for VBA Stomping	3
DET0013	Detection of Local Browser Artifact Access for Reconnaissance	3
DET0014	Detection of Data Staging Prior to Exfiltration	5
DET0015	Detection Strategy for Exclusive Control	3
DET0016	Security Software Discovery Across Platforms	3
DET0017	Detection Strategy for Application Shimming via sdbinst.exe and Registry Artifacts (Windows)	1
DET0018	Behavior-chain, platform-aware detection strategy for T1129 Shared Modules	3
DET0019	Detection Strategy for Stripped Payloads Across Platforms	4
DET0020	Detect Shell Configuration Modification for Persistence via Event-Triggered Execution	2
DET0021	Behavioral Detection for Service Stop across Platforms	4
DET0022	Detect Forced SMB/WebDAV Authentication via lure files and outbound NTLM	1
DET0023	Obfuscated Binary Unpacking Detection via Behavioral Patterns	3
DET0024	Detect Kerberos Ccache File Theft or Abuse (T1558.005)	2
DET0025	Detecting Electron Application Abuse for Proxy Execution	3
DET0026	Windows Detection Strategy for T1547.012 - Print Processor DLL Persistence	1
DET0027	Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets	5
DET0028	Detect Excessive or Unauthorized Bandwidth Usage for Botnet, Proxyjacking, or Scanning Purposes	5
DET0029	Detect Persistence via Outlook Custom Forms Triggered by Malicious Email	2
DET0030	Detect Conditional Access Policy Modification in Identity and Cloud Platforms	2