Attack path: CVE-2026-7165
Where this CVE sits in the complete attacker lifecycle.
0 techniques directly attributed and 7 inferred, across 3 phases. Each technique shows its mapping confidence; follow-on techniques come from shared-actor co-occurrence.
Highlighted from CVE-2026-7165 · primary technique T1027
Reconnaissance
·
Resource Dev
Initial Access
Execution
Persistence
Stealth
T1574.007
inferred
Path Interception by PATH Environment Variable
✓ detection content available
T1036.001
inferred
Invalid Code Signature
T1574.006
inferred
Dynamic Linker Hijacking
✓ detection content available
T1027
inferred
Obfuscated Files or Information
✓ detection content available
T1070.002
14.7x
Clear Linux or Mac System Logs
T1027.007
8.5x
Dynamic API Resolution
T1542.001
4.9x
System Firmware
✓ detection content available
T1070.003
4.4x
Clear Command History
✓ detection content available
Defense Impairment
Credential Access
T1539
inferred
Steal Web Session Cookie
✓ detection content available
T1003.008
8.1x
/etc/passwd and /etc/shadow
T1555.005
3.7x
Password Managers
✓ detection content available
T1110.002
3.7x
Password Cracking
✓ detection content available
T1187
3.3x
Forced Authentication
✓ detection content available
T1555.004
3.2x
Windows Credential Manager
✓ detection content available
T1606
3.2x
Forge Web Credentials
✓ detection content available
Discovery
Lateral Movement
Collection
C2
·
Exfiltration
Impact
T1488
9.7x
Disk Content Wipe
T1496
6.6x
Resource Hijacking
✓ detection content available
T1495
6.1x
Firmware Corruption
✓ detection content available
T0813
5.8x
Denial of Control
T1499.004
5.7x
Application or System Exploitation
✓ detection content available
T1529
5.0x
System Shutdown/Reboot
✓ detection content available
T0831
4.8x
Manipulation of Control
T1499
4.6x
Endpoint Denial of Service
✓ detection content available
Want your real detection gaps for this chain?
Declare your detection stack - your rules, telemetry, and techniques - and we will show exactly which of these techniques you cannot see. We do not grade you against a public rule corpus, only against what you actually run.
Direct - an ATT&CK/nuclei source names this CVE
Inferred - derived via CWE/CAPEC (lower confidence, may be off)
Likely follow-on (shared-actor co-occurrence)
✓We hold public detection content
Lift = how strongly a follow-on co-occurs with this CVE across shared threat actors (1x expected, 5x highly distinctive).
Hunt package
All 55 techniques in this view - Sigma rules, Atomic tests, and coverage in one place.