Attack path: CVE-2025-66389
Where this CVE sits in the complete attacker lifecycle.
0 techniques directly attributed and 11 inferred, across 2 phases. Each technique shows its mapping confidence; follow-on techniques come from shared-actor co-occurrence.
Highlighted from CVE-2025-66389 · primary technique T1003
Reconnaissance
Initial Access
T1566.004
5.9x
Spearphishing Voice
T1195.002
5.7x
Compromise Software Supply Chain
✓ detection content available
T1195
3.9x
Supply Chain Compromise
✓ detection content available
T1200
2.0x
Hardware Additions
✓ detection content available
T1195.001
1.7x
Compromise Software Dependencies and Development Tools
✓ detection content available
T1659
Content Injection
Execution
Persistence
Priv Escalation
Stealth
T1562.008
6.8x
Disable or Modify Cloud Logs
T1078.001
6.5x
Default Accounts
✓ detection content available
T1480
5.7x
Execution Guardrails
T1027.010
5.3x
Command Obfuscation
✓ detection content available
T1134.002
4.1x
Create Process with Token
✓ detection content available
T1564.004
2.2x
NTFS File Attributes
✓ detection content available
T1562.009
2.0x
Safe Mode Boot
T1542.001
2.0x
System Firmware
✓ detection content available
Defense Impairment
Credential Access
T1003
inferred
OS Credential Dumping
✓ detection content available
T1552.004
inferred
Private Keys
✓ detection content available
T1552.001
inferred
Credentials In Files
✓ detection content available
T1552.003
inferred
Shell History
✓ detection content available
T1552.006
inferred
Group Policy Preferences
✓ detection content available
T1555
inferred
Credentials from Password Stores
✓ detection content available
T1003.006
7.1x
DCSync
✓ detection content available
T1552.005
7.1x
Cloud Instance Metadata API
Discovery
Lateral Movement
Collection
T1119
inferred
Automated Collection
✓ detection content available
T1039
inferred
Data from Network Shared Drive
✓ detection content available
T1213
inferred
Data from Information Repositories
✓ detection content available
T1530
inferred
Data from Cloud Storage
T1602
inferred
Data from Configuration Repository
T1213.002
1.7x
Sharepoint
T1074.002
1.7x
Remote Data Staging
T1213.003
1.7x
Code Repositories
✓ detection content available
C2
Exfiltration
Want your real detection gaps for this chain?
Declare your detection stack - your rules, telemetry, and techniques - and we will show exactly which of these techniques you cannot see. We do not grade you against a public rule corpus, only against what you actually run.
Direct - an ATT&CK/nuclei source names this CVE
Inferred - derived via CWE/CAPEC (lower confidence, may be off)
Likely follow-on (shared-actor co-occurrence)
✓We hold public detection content
Lift = how strongly a follow-on co-occurs with this CVE across shared threat actors (1x expected, 5x highly distinctive).
Hunt package
All 65 techniques in this view - Sigma rules, Atomic tests, and coverage in one place.