OctoXLabs

Attack coverage and defensive context

MITRE ATT&CK® Enterprise version 19.1 is used as a reference model. The mapping is a SecTec expert interpretation and does not imply endorsement by MITRE.

Practical attack scenarios

• Phishing and identity abuseAn adversary manipulates a user, obtains credentials, or abuses a trusted account to gain access to the environment.
• Public application or API abuseAn adversary exploits a vulnerable web application, API, client-side code, or software component for initial access and execution.
• Cloud and SaaS compromiseAn adversary abuses cloud identities, permissions, configurations, or application integrations to access services and data.
• Lateral movement inside the networkAfter initial access, an adversary discovers systems, accounts, and services and moves toward higher-value assets.
• Malware and Command and ControlMalicious code executes, maintains access, and communicates with adversary infrastructure through common or covert channels.
• Data exfiltration and leakageAn adversary searches for, collects, and transfers sensitive data from endpoints, cloud services, email, or internal repositories.
• Ransomware and availability impactAn adversary encrypts or manipulates data, stops services, inhibits recovery, and creates operational impact.
• Supply chain and trusted accessAn adversary abuses a supplier, software dependency, external access path, or trusted relationship to bypass normal controls.
• Attacks on OT and IoT environmentsAn adversary discovers industrial or connected devices, abuses remote access and network services, and threatens operational availability.
• Reconnaissance and attack surface mappingAn adversary collects information about people, systems, cloud services, and internet-facing infrastructure and searches for a viable initial-access path.
• Business Email Compromise and mailbox takeoverAn adversary takes over or impersonates a trusted email identity and abuses communications for fraud, payment diversion, data collection, or further phishing.
• Privilege escalation and persistenceAn adversary expands privileges, creates or modifies accounts and policies, and establishes repeatable access to systems, identities, or cloud environments.
• Insider threat and authorized access abuseAn insider or an adversary with a valid account abuses legitimate permissions to discover, copy, manipulate, or transfer sensitive data.
• BFLA – Broken Function Level AuthorizationA regular or unauthenticated user invokes an administrative or privileged API function that should not be available to them.
• Sensitive business flow and bot abuseAn automated adversary abuses legitimate functionality such as purchasing, booking, registration, voting, commenting, or account recovery.
• API security misconfiguration and exposed interfacesInsecure defaults, debug endpoints, broken CORS, verbose errors, or missing security headers expose data and functionality to an adversary.
• Shadow and zombie APIs without managed inventoryUnknown, forgotten, or outdated API versions remain reachable without current controls, ownership, documentation, and monitoring.

Relevant ATT&CK techniques

• T1018 · Remote System DiscoveryDetect, Validate
• T1021 · Remote ServicesDetect, Respond, Validate
• T1040 · Network SniffingDetect, Validate
• T1041 · Exfiltration Over C2 ChannelDetect, Recover, Respond
• T1046 · Network Service DiscoveryDetect, Prevent, Validate
• T1059 · Command and Scripting InterpreterDetect, Respond
• T1069 · Permission Groups DiscoveryDetect, Prevent, Respond
• T1071 · Application Layer ProtocolDetect, Recover, Respond
• T1078 · Valid AccountsDetect, Prevent, Recover, Respond, Validate
• T1087 · Account DiscoveryDetect, Validate
• T1098 · Account ManipulationDetect, Prevent, Respond, Validate
• T1136 · Create AccountDetect, Prevent, Respond
• T1190 · Exploit Public-Facing ApplicationDetect, Prevent, Recover, Respond, Validate
• T1210 · Exploitation of Remote ServicesDetect, Validate
• T1484 · Domain or Tenant Policy ModificationDetect, Prevent, Respond, Validate
• T1486 · Data Encrypted for ImpactDetect, Recover, Respond
• T1566 · PhishingRecover, Respond
• T1578 · Modify Cloud Compute InfrastructureDetect, Prevent, Validate
• T1580 · Cloud Infrastructure DiscoveryDetect, Prevent, Validate
• T1592 · Gather Victim Host InformationDetect, Prevent, Validate
• T1595 · Active ScanningDetect, Prevent, Validate
• T1685 · Disable or Modify ToolsDetect, Prevent, Respond, Validate