Home/ATT&CK Technique/Vulnerabilities
ATT&CK Technique

Vulnerabilities

T1588.006 · resource-development

Adversaries may acquire information about vulnerabilities that can be used during targeting. A vulnerability is a weakness in computer hardware or software that can, potentially, be exploited by an adversary to cause unintended or unanticipated behavior to occur. Adversaries may find vulnerability information by searching open databases or gaining access to closed vulnerability databases.

An adversary may monitor vulnerability disclosures/databases to understand the state of existing, as well as newly discovered, vulnerabilities. There is usually a delay between when a vulnerability is discovered and when it is made public. An adversary may target the systems of those known to conduct vulnerability research (including commercial vendors).

Knowledge of a vulnerability may cause an adversary to search for an existing exploit (i.e. Exploits) or to attempt to develop one themselves (i.e. Exploits).

PRE
◆

Actors Using This

14
north_koreaAndariel
unknown_likely_russia_alignedAnubis Ransomware
chinaAPT17
chinaAPT31
north_koreaAPT37
chinaAPT3
china_state_sponsored_mandiant_canonical_microsoft_mulberry_typhoonAPT5 (UNC2630 / UNC2717 / Mulberry Typhoon)
iran_linked_dragos_tracked_ics_activity_group_cyberav3ngers_persona_2024_disclosedBAUXITE
unknown_likely_russia_aligned_eldorado_lineageBlackLock Ransomware
ransomware_raas_independent_emergenceCactus
russiaCadet Blizzard
russia_consistent_state_actor_per_mandiant_dragos_high_confidence_no_specific_nation_attributionCHERNOVITE (PIPEDREAM / INCONTROLLER)
unknown_likely_russia_aligned_alphv_lineageCicada3301
north_koreaCitrine Sleet
◈

Likely Attack Path

Techniques the same actors pair with this one distinctively - those showing up among actors who use this technique noticeably more than across all actors (lift > 1.15), grouped by kill-chain phase. The × is that lift multiplier; the shared-actor count is in the tooltip. A near-universal technique pairs with everything at baseline, so its list is short by design.
initial-access later
T0865 · Spearphishing Attachment ×4.76T0822 · External Remote Services ×3.70T0866 · Exploitation of Remote Services ×3.17T0883 · Internet Accessible Device ×3.03
persistence later
T0859 · Valid Accounts ×3.17T1543.002 · Systemd Service ×2.78
credential-access later
T1003.008 · /etc/passwd and /etc/shadow ×2.93
discovery later
T0846 · Remote System Discovery ×3.70T1046 · Network Service Discovery ×2.46
lateral-movement later
T1550.003 · Pass the Ticket ×3.57
collection later
T0801 · Monitor Process State ×4.76
impact later
T0813 · Denial of Control ×3.57T1531 · Account Access Removal ×2.64
other same
T1562.003 · Impair Command History Logging ×4.76T1070.002 · Clear Linux or Mac System Logs ×3.17
▣

Mitigations

1
MITRE ATT&CK mitigations - vendor-agnostic guidance for reducing exposure to this technique.
M1056Pre-compromise

Pre-compromise mitigations involve proactive measures and defenses implemented to prevent adversaries from successfully identifying and exploiting weaknesses during the Reconnaissance and Resource Development phases of an attack. These activities focus on reducing an organization's attack surface, identify adversarial preparation efforts, and increase the difficulty for attackers to conduct successful operations.

Limit Information Exposure
  • Regularly audit and sanitize publicly available data, including job posts, websites, and social media.
  • Use tools like OSINT monitoring platforms (e.g., SpiderFoot, Recon-ng) to identify leaked information.
Protect Domain and DNS Infrastructure
  • Enable DNSSEC and use WHOIS privacy protection.
  • Monitor for domain hijacking or lookalike domains using services like RiskIQ or DomainTools.
External Monitoring
  • Use tools like Shodan, Censys to monitor your external attack surface.
  • Deploy external vulnerability scanners to proactively address weaknesses.
Threat Intelligence
  • Leverage platforms like MISP, Recorded Future, or Anomali to track adversarial infrastructure, tools, and activity.
Content and Email Protections
  • Use email security solutions like Proofpoint, Microsoft Defender for Office 365, or Mimecast.
  • Enforce SPF/DKIM/DMARC policies to protect against email spoofing.
Training and Awareness
  • Educate employees on identifying phishing attempts, securing their social media, and avoiding information leaks.
◈

Detection Coverage

0/6 layers
Coverage across standard detection surfaces. Rows marked none have no rule of that type mapped. Some are real blind spots worth closing; others are simply not applicable to this technique (e.g. YARA matches malware files, not network behaviour).
Behavioral / log (Sigma) none
Analytics (MITRE CAR) none
Runtime / container (Falco) none
File / malware (YARA) none
Network (Suricata/Snort) none
Vuln scan (Nuclei) none
Intelligence Graph · click any node to traverse
CVETechnique ActorTool Family
drag to reposition · click any node to traverse · button top-right enlarges
External lookups - second-class, for what we don’t hold ourselves
MITRE ATT&CKAtomic Red Teamcar (MITRE)
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin