Rapid7

Attack coverage and defensive context

MITRE ATT&CK® Enterprise version 19.1 is used as a reference model. The mapping is a SecTec expert interpretation and does not imply endorsement by MITRE.

Practical attack scenarios

• Phishing and identity abuseAn adversary manipulates a user, obtains credentials, or abuses a trusted account to gain access to the environment.
• Credential theftAn adversary obtains passwords, tokens, sessions, or other authentication material and uses it to expand access.
• Public application or API abuseAn adversary exploits a vulnerable web application, API, client-side code, or software component for initial access and execution.
• Cloud and SaaS compromiseAn adversary abuses cloud identities, permissions, configurations, or application integrations to access services and data.
• Lateral movement inside the networkAfter initial access, an adversary discovers systems, accounts, and services and moves toward higher-value assets.
• Malware and Command and ControlMalicious code executes, maintains access, and communicates with adversary infrastructure through common or covert channels.
• Data exfiltration and leakageAn adversary searches for, collects, and transfers sensitive data from endpoints, cloud services, email, or internal repositories.
• Ransomware and availability impactAn adversary encrypts or manipulates data, stops services, inhibits recovery, and creates operational impact.
• Supply chain and trusted accessAn adversary abuses a supplier, software dependency, external access path, or trusted relationship to bypass normal controls.
• Attacks on OT and IoT environmentsAn adversary discovers industrial or connected devices, abuses remote access and network services, and threatens operational availability.
• Reconnaissance and attack surface mappingAn adversary collects information about people, systems, cloud services, and internet-facing infrastructure and searches for a viable initial-access path.
• Business Email Compromise and mailbox takeoverAn adversary takes over or impersonates a trusted email identity and abuses communications for fraud, payment diversion, data collection, or further phishing.
• Privilege escalation and persistenceAn adversary expands privileges, creates or modifies accounts and policies, and establishes repeatable access to systems, identities, or cloud environments.
• Defense evasion and control impairmentAn adversary hides activity, removes evidence, disguises code, or weakens security tools, encryption, firewalls, and recovery mechanisms.
• Insider threat and authorized access abuseAn insider or an adversary with a valid account abuses legitimate permissions to discover, copy, manipulate, or transfer sensitive data.
• DDoS and resource exhaustionAn adversary floods a network, application, API, or endpoint and exhausts capacity, connections, or compute resources to reduce service availability.
• BOLA – Broken Object Level AuthorizationAn adversary changes an object identifier in an API request and gains access to data or operations belonging to another user, account, or tenant.
• BOPLA – Broken Object Property Level AuthorizationAn API exposes or allows modification of sensitive object properties that the user should not access, including excessive data exposure and mass assignment.
• BFLA – Broken Function Level AuthorizationA regular or unauthenticated user invokes an administrative or privileged API function that should not be available to them.
• Broken API authentication and token abuseAn adversary bypasses login, password recovery, or token validation and assumes the identity of a user or service.
• API resource and cost exhaustionAn adversary abuses expensive API operations, large inputs, or paid services to exhaust CPU, memory, storage, connectivity, or financial limits.
• Sensitive business flow and bot abuseAn automated adversary abuses legitimate functionality such as purchasing, booking, registration, voting, commenting, or account recovery.
• SSRF – Server-Side Request ForgeryAn adversary causes a server or API to fetch an attacker-controlled address and reaches internal services, cloud metadata, or protected network targets.
• API security misconfiguration and exposed interfacesInsecure defaults, debug endpoints, broken CORS, verbose errors, or missing security headers expose data and functionality to an adversary.
• Shadow and zombie APIs without managed inventoryUnknown, forgotten, or outdated API versions remain reachable without current controls, ownership, documentation, and monitoring.
• Unsafe consumption of third-party APIsAn application trusts data or redirects from a partner API more than ordinary input and propagates a supplier compromise into its own environment.
• Credential stuffing and password sprayingAn adversary automatically tests leaked username-password pairs or a small set of common passwords against many accounts.
• MFA fatigue, push bombing, and interceptionAn adversary floods a user with MFA prompts, intercepts a code, or uses social engineering to make the user approve an unauthorized sign-in.
• Session and access-token hijackingAn adversary steals a cookie, OAuth token, or another session artifact and accesses a service without re-entering a password or MFA.
• Injection and command executionUntrusted input changes the meaning of a command, query, or template and enables data access, logic bypass, or code execution.
• Path traversal and file inclusionAn adversary manipulates a file path or imported name and reads, writes, or executes content outside the permitted directory.
• Malicious file upload and unsafe deserializationAn application accepts or processes a malicious file or serialized object and enables code execution, control bypass, or compromise of other users.
• Client-side injection and Cross-Site ScriptingAn adversary injects untrusted content into a user's browser and executes script in the context of a trusted application.

Relevant ATT&CK techniques

• T1005 · Data from Local SystemDetect, Respond
• T1018 · Remote System DiscoveryDetect, Respond, Validate
• T1021 · Remote ServicesDetect, Respond, Validate
• T1040 · Network SniffingDetect, Respond
• T1041 · Exfiltration Over C2 ChannelDetect, Recover, Respond, Validate
• T1046 · Network Service DiscoveryDetect, Prevent, Respond, Validate
• T1059 · Command and Scripting InterpreterDetect, Prevent, Respond, Validate
• T1068 · Exploitation for Privilege EscalationPrevent, Respond
• T1069 · Permission Groups DiscoveryDetect, Prevent, Respond
• T1071 · Application Layer ProtocolDetect, Recover, Respond, Validate
• T1078 · Valid AccountsDetect, Prevent, Recover, Respond, Validate
• T1083 · File and Directory DiscoveryDetect, Respond, Validate
• T1087 · Account DiscoveryDetect, Respond, Validate
• T1098 · Account ManipulationDetect, Prevent, Respond, Validate
• T1105 · Ingress Tool TransferDetect, Prevent, Respond, Validate
• T1110 · Brute ForceDetect, Respond
• T1114 · Email CollectionDetect, Respond
• T1133 · External Remote ServicesPrevent, Validate
• T1136 · Create AccountDetect, Prevent, Respond
• T1189 · Drive-by CompromiseDetect, Prevent, Respond, Validate
• T1190 · Exploit Public-Facing ApplicationDetect, Prevent, Recover, Respond, Validate
• T1195 · Supply Chain CompromisePrevent, Validate
• T1210 · Exploitation of Remote ServicesDetect, Prevent, Respond, Validate
• T1484 · Domain or Tenant Policy ModificationDetect, Prevent, Respond, Validate