Kentik

Attack coverage and defensive context

MITRE ATT&CK® Enterprise version 19.1 is used as a reference model. The mapping is a SecTec expert interpretation and does not imply endorsement by MITRE.

Practical attack scenarios

• Phishing and identity abuseAn adversary manipulates a user, obtains credentials, or abuses a trusted account to gain access to the environment.
• Credential theftAn adversary obtains passwords, tokens, sessions, or other authentication material and uses it to expand access.
• Public application or API abuseAn adversary exploits a vulnerable web application, API, client-side code, or software component for initial access and execution.
• Cloud and SaaS compromiseAn adversary abuses cloud identities, permissions, configurations, or application integrations to access services and data.
• Lateral movement inside the networkAfter initial access, an adversary discovers systems, accounts, and services and moves toward higher-value assets.
• Malware and Command and ControlMalicious code executes, maintains access, and communicates with adversary infrastructure through common or covert channels.
• Ransomware and availability impactAn adversary encrypts or manipulates data, stops services, inhibits recovery, and creates operational impact.
• Supply chain and trusted accessAn adversary abuses a supplier, software dependency, external access path, or trusted relationship to bypass normal controls.
• Attacks on OT and IoT environmentsAn adversary discovers industrial or connected devices, abuses remote access and network services, and threatens operational availability.
• Reconnaissance and attack surface mappingAn adversary collects information about people, systems, cloud services, and internet-facing infrastructure and searches for a viable initial-access path.
• Business Email Compromise and mailbox takeoverAn adversary takes over or impersonates a trusted email identity and abuses communications for fraud, payment diversion, data collection, or further phishing.
• Privilege escalation and persistenceAn adversary expands privileges, creates or modifies accounts and policies, and establishes repeatable access to systems, identities, or cloud environments.
• Insider threat and authorized access abuseAn insider or an adversary with a valid account abuses legitimate permissions to discover, copy, manipulate, or transfer sensitive data.
• DDoS and resource exhaustionAn adversary floods a network, application, API, or endpoint and exhausts capacity, connections, or compute resources to reduce service availability.
• API resource and cost exhaustionAn adversary abuses expensive API operations, large inputs, or paid services to exhaust CPU, memory, storage, connectivity, or financial limits.
• Sensitive business flow and bot abuseAn automated adversary abuses legitimate functionality such as purchasing, booking, registration, voting, commenting, or account recovery.
• SSRF – Server-Side Request ForgeryAn adversary causes a server or API to fetch an attacker-controlled address and reaches internal services, cloud metadata, or protected network targets.
• API security misconfiguration and exposed interfacesInsecure defaults, debug endpoints, broken CORS, verbose errors, or missing security headers expose data and functionality to an adversary.
• Shadow and zombie APIs without managed inventoryUnknown, forgotten, or outdated API versions remain reachable without current controls, ownership, documentation, and monitoring.

Relevant ATT&CK techniques

• T1018 · Remote System DiscoveryDetect, Respond, Validate
• T1021 · Remote ServicesDetect, Respond, Validate
• T1040 · Network SniffingDetect, Respond, Validate
• T1046 · Network Service DiscoveryDetect, Prevent, Respond, Validate
• T1071 · Application Layer ProtocolDetect, Respond
• T1078 · Valid AccountsDetect, Respond, Validate
• T1087 · Account DiscoveryDetect, Validate
• T1090 · ProxyDetect, Respond
• T1095 · Non-Application Layer ProtocolDetect, Respond
• T1098 · Account ManipulationDetect, Respond, Validate
• T1136 · Create AccountDetect, Respond, Validate
• T1190 · Exploit Public-Facing ApplicationDetect, Prevent, Validate
• T1210 · Exploitation of Remote ServicesDetect, Respond, Validate
• T1484 · Domain or Tenant Policy ModificationDetect, Respond, Validate
• T1498 · Network Denial of ServiceDetect, Prevent, Respond
• T1499 · Endpoint Denial of ServiceDetect, Prevent, Respond
• T1526 · Cloud Service DiscoveryDetect, Respond, Validate
• T1557 · Adversary-in-the-MiddleDetect, Respond
• T1573 · Encrypted ChannelDetect, Respond
• T1578 · Modify Cloud Compute InfrastructureDetect, Respond, Validate
• T1592 · Gather Victim Host InformationDetect, Prevent, Validate
• T1595 · Active ScanningDetect, Prevent, Validate