Malware and Command and Control
Malicious code executes, maintains access, and communicates with adversary infrastructure through common or covert channels.
Cloud and SaaS compromise
An adversary abuses cloud identities, permissions, configurations, or application integrations to access services and data.
Insider threat and authorized access abuse
An insider or an adversary with a valid account abuses legitimate permissions to discover, copy, manipulate, or transfer sensitive data.
Data exfiltration and leakage
An adversary searches for, collects, and transfers sensitive data from endpoints, cloud services, email, or internal repositories.
Privilege escalation and persistence
An adversary expands privileges, creates or modifies accounts and policies, and establishes repeatable access to systems, identities, or cloud environments.