Forcepoint

Attack coverage and defensive context

MITRE ATT&CK® Enterprise version 19.1 is used as a reference model. The mapping is a SecTec expert interpretation and does not imply endorsement by MITRE.

Practical attack scenarios

• Phishing and identity abuseAn adversary manipulates a user, obtains credentials, or abuses a trusted account to gain access to the environment.
• Credential theftAn adversary obtains passwords, tokens, sessions, or other authentication material and uses it to expand access.
• Public application or API abuseAn adversary exploits a vulnerable web application, API, client-side code, or software component for initial access and execution.
• Cloud and SaaS compromiseAn adversary abuses cloud identities, permissions, configurations, or application integrations to access services and data.
• Lateral movement inside the networkAfter initial access, an adversary discovers systems, accounts, and services and moves toward higher-value assets.
• Malware and Command and ControlMalicious code executes, maintains access, and communicates with adversary infrastructure through common or covert channels.
• Data exfiltration and leakageAn adversary searches for, collects, and transfers sensitive data from endpoints, cloud services, email, or internal repositories.
• Ransomware and availability impactAn adversary encrypts or manipulates data, stops services, inhibits recovery, and creates operational impact.
• Supply chain and trusted accessAn adversary abuses a supplier, software dependency, external access path, or trusted relationship to bypass normal controls.
• Attacks on OT and IoT environmentsAn adversary discovers industrial or connected devices, abuses remote access and network services, and threatens operational availability.
• Reconnaissance and attack surface mappingAn adversary collects information about people, systems, cloud services, and internet-facing infrastructure and searches for a viable initial-access path.
• Business Email Compromise and mailbox takeoverAn adversary takes over or impersonates a trusted email identity and abuses communications for fraud, payment diversion, data collection, or further phishing.
• Privilege escalation and persistenceAn adversary expands privileges, creates or modifies accounts and policies, and establishes repeatable access to systems, identities, or cloud environments.
• Defense evasion and control impairmentAn adversary hides activity, removes evidence, disguises code, or weakens security tools, encryption, firewalls, and recovery mechanisms.
• Insider threat and authorized access abuseAn insider or an adversary with a valid account abuses legitimate permissions to discover, copy, manipulate, or transfer sensitive data.
• DDoS and resource exhaustionAn adversary floods a network, application, API, or endpoint and exhausts capacity, connections, or compute resources to reduce service availability.
• BOLA – Broken Object Level AuthorizationAn adversary changes an object identifier in an API request and gains access to data or operations belonging to another user, account, or tenant.
• BOPLA – Broken Object Property Level AuthorizationAn API exposes or allows modification of sensitive object properties that the user should not access, including excessive data exposure and mass assignment.
• API resource and cost exhaustionAn adversary abuses expensive API operations, large inputs, or paid services to exhaust CPU, memory, storage, connectivity, or financial limits.
• SSRF – Server-Side Request ForgeryAn adversary causes a server or API to fetch an attacker-controlled address and reaches internal services, cloud metadata, or protected network targets.
• Credential stuffing and password sprayingAn adversary automatically tests leaked username-password pairs or a small set of common passwords against many accounts.
• Session and access-token hijackingAn adversary steals a cookie, OAuth token, or another session artifact and accesses a service without re-entering a password or MFA.
• Injection and command executionUntrusted input changes the meaning of a command, query, or template and enables data access, logic bypass, or code execution.
• Path traversal and file inclusionAn adversary manipulates a file path or imported name and reads, writes, or executes content outside the permitted directory.
• Malicious file upload and unsafe deserializationAn application accepts or processes a malicious file or serialized object and enables code execution, control bypass, or compromise of other users.

Relevant ATT&CK techniques

• T1005 · Data from Local SystemDetect, Prevent, Recover, Respond
• T1020 · Automated ExfiltrationDetect, Prevent, Respond
• T1021 · Remote ServicesDetect, Prevent, Respond
• T1027 · Obfuscated Files or InformationDetect, Prevent, Validate
• T1041 · Exfiltration Over C2 ChannelDetect, Prevent, Respond
• T1046 · Network Service DiscoveryDetect, Prevent, Respond
• T1048 · Exfiltration Over Alternative ProtocolDetect, Prevent, Respond
• T1059 · Command and Scripting InterpreterDetect, Prevent, Respond, Validate
• T1071 · Application Layer ProtocolDetect, Prevent, Respond
• T1078 · Valid AccountsDetect, Prevent, Respond
• T1095 · Non-Application Layer ProtocolDetect, Prevent, Respond
• T1105 · Ingress Tool TransferDetect, Prevent, Respond, Validate
• T1114 · Email CollectionDetect, Prevent, Respond
• T1133 · External Remote ServicesDetect, Prevent
• T1189 · Drive-by CompromiseDetect, Prevent, Validate
• T1190 · Exploit Public-Facing ApplicationDetect, Prevent, Respond, Validate
• T1204 · User ExecutionDetect, Prevent, Validate
• T1210 · Exploitation of Remote ServicesDetect, Prevent, Respond
• T1213 · Data from Information RepositoriesDetect, Prevent, Recover, Respond
• T1498 · Network Denial of ServiceDetect, Prevent, Respond
• T1530 · Data from Cloud StorageDetect, Prevent, Recover, Respond
• T1550 · Use Alternate Authentication MaterialDetect, Prevent
• T1565 · Data ManipulationPrevent, Recover
• T1566 · PhishingDetect, Prevent