Uptime Hamster: 15d 21h 23mDeploy: 14 Jul 2026 21:26Updated: 2026-07-21

ClickFix Threat Intelligence

Panel TTP Matrix

Classic Brechas Mapa Actores TTP Matrix Analitica Alertas CyberNews Arsenal Exploits KillChain Origen SSLBL RansomLook Ransomwhere

MITRE ATT&CK TTP Matrix

350 grupos · 12 tácticas MITRE ATT&CK

Matrix MITRE Blueprint Por Actor

TA0001

Initial Access

T1078 27Valid Accounts T1190 25Exploit Public-Facing Application T1566 14Phishing T1566.001 14Phishing: Spearphishing Attachment T1133 8External Remote Services T1566.003 5Phishing: Spearphishing Voice (Vishing)T1189 4Drive-by Compromise T1078.002 3Valid Accounts: Domain Accounts T1566.002 3Phishing: Spear phishing Link T1091 2Replication Through Removable Media T1078.003 2Valid Accounts: Local Accounts T1199 2Trusted Relationship T1021.001 1Remote Services: Remote Desktop Protocol T1078.004 1Valid Accounts: Cloud Accounts T1210 1Exploitation of Remote Services T1110 1Brute Force T1566.004 1Phishing: Spearphishing Voice T1195 1Supply Chain Compromise T1548.002 1Abusing Elevation Control Mechanism: Bypass User Account Control T1552.004 1Unsecured Credentials: Private Keys

TA0002

Execution

T1059.001 26Command and Scripting Interpreter: PowerShell T1059 16Command and Scripting Interpreter T1047 14Windows Management Instrumentation T1059.003 12Command and Scripting Interpreter: Windows Command Shell T1204.002 10User Execution: Malicious File T1106 9Native API T1129 6Shared Modules T1053.005 6Scheduled Task/Job: Scheduled Task T1203 6Exploitation for Client Execution T1569.002 5System Services: Service Execution T1072 4Windows Management Instrumentation T1204 3User Execution T1059.005 3Command and Scripting Interpreter: Visual Basic T1053 2Scheduled Task/Job T1059.004 2Command and Scripting Interpreter: Unix Shell T1059.006 2Command and Scripting Interpreter: Python T1204.001 2User Execution: Malicious Link T1059.002 1System Services: Service Execution T1064 1Scripting T1204.004 1User Execution: Malicious Copy and Paste T1569 1System Services T1218.007 1Signed Binary Proxy Execution: Msiexec

TA0003

Persistence

T1547.001 14Boot or Logon Autostart Execution: Registry Run Keys T1547 9Boot or Logon Autostart Execution T1543.003 8Create or Modify System Process: Windows Service T1136 7Create Account T1053 6Scheduled Task/Job T1098 5Account Manipulation T1053.005 4Scheduled Task/Job: Scheduled Task T1136.001 3Create Account: Local Account T1136.002 3Create Account: Domain Account T1078 3Valid Accounts T1574.001 3Hijack Execution Flow: DLL Search Order Hijacking T1505.004 2Server Software Component: IIS Components T1542.003 2Pre-OS Boot: Bootkit T1547.009 2Boot or Logon Autostart Execution: Shortcut Modification T1098.003 1Account Manipulation: Additional Cloud Credentials T1037 1Boot or Logon Initialization Scripts T1098.004 1Account Manipulation: SSH Authorized Keys T1133 1External Remote Services T1547.004 1Boot or Logon Autostart Execution: Winlogon Helper DLL T1053.003 1Scheduled Task/Job: Cron T1505.003 1Server Software Component: Web Shell T1543 1Create or Modify System Process

TA0004

Privilege Escalation

T1068 12Exploitation for privilege escalation T1548.002 6Abuse Elevation Control Mechanism: Bypass User Account Control T1134.004 3Parent PID Spoofing T1078.002 3Valid Accounts: Domain Accounts T1078 3Valid Accounts T1134.002 3Access Token Manipulation: Create Process with Token T1547.001 2Registry Run Keys/Startup Files T1484.001 2Domain Policy Modification: Group Policy Modification T1543.003 2Create or Modify System Process: Windows Service T1543 2Create or Modify System Process T1136 1Create Account: Cloud Account T1053 1Scheduled Task/Job T1134.001 1Token Impersonation/Theft T1547 1Boot or Logon Autostart Execution TA0004 1Privilege Escalation T1574.001 1Hijack Execution Flow: DLL Search Order Hijacking T1574 1Hijack execution flow T1548 1Abuse Elevation Control Mechanism T1055 1Process Injection T1055.003 1Thread Execution Hijacking T1134 1Access Token Manipulation T1187 1Forced Authentication T1557 1Adversary-in-the-Middle

TA0005

Defense Evasion

T1562.001 34Impair Defenses: Disable or Modify Tools T1027 24Obfuscated Files or Information T1036 12Masquerading T1070 11Indicator Removal T1070.001 11Indicator Removal: Clear Windows Event Logs T1070.004 9File Deletion T1140 8Deobfuscate/Decode Files or Information T1112 8Modify Registry T1027.002 6Software Packing T1497 6Virtualization/Sandbox Evasion T1562 6Impair Defenses T1055 5Process Injection T1564 5Hidden Artifacts T1036.005 5Masquerading: Match Legitimate Name or Location T1218 5System Binary Proxy Execution T1027.013 5Obfuscated Files or Information: Encrypted/Encoded File T1622 4Debugger Evasion T1202 4Indirect Command Execution T1484.001 4Domain Policy Modification: Group Policy Modification T1055.001 4Process injection: DLL injection T1218.011 4Signed Binary Proxy Execution: Rundll32 T1027.009 4Embedded Payloads T1480 4Execution Guardrails T1497.001 4Virtualization/Sandbox Evasion: System Checks T1562.004 4Impair Defenses: Disable or Modify System Firewall T1620 4Reflective DLL Injection T1564.001 3Hidden Files and Directories T1070.006 3Indicator Removal: Timestomp T1027.005 3Indicator Removal from Tools T1222 3File and Directory Permissions Modification T1564.003 3Hidden Window T1027.007 3Obfuscated Files or Information: Dynamic API Resolution T1553.002 3Subvert Trust Controls: Code Signing T1218.005 3System Binary Proxy Execution: Mshta T1497.003 3Virtualization/Sandbox Evasion: Time Based Checks T1014 2Rootkit T1036.001 2Masquerading: invalid code signature T1548 2Abuse Elevation Control Mechanism T1036.003 2Masquerading: Rename Legitimate Utilities T1036.004 2Masquerading: Masquerade Task or Service T1036.008 2Masquerading: Masquerade File Type T1070.003 2Indicator Removal: Clear Command History T1218.010 2System Binary Proxy Execution: Regsvr32 T1220 2XSL Script Processing T1221 2Template Injection T1574.013 2Hijack Execution Flow: KernelCallbackTable T1672 1Email Spoofing T1678 1Delay Execution T1531 1Account Access Removal T1021.001 1Remote Services: Remote Desktop Protocol T1119 1Automated Collection T1068 1Exploitation for Privilege Escalation T1064 1Scripting T1078.003 1Valid Accounts: Local Accounts T1562.009 1Safe Mode Boot T1484 1Domain or Tenant Policy Modification T1134.004 1Access Token Manipulation: Parent PID Spoofing T1211 1Exploitation for Defense Evasion T1055.012 1Process Injection: Process Hollowing T1134 1Access Token Manipulation T1134.001 1Access Token Manipulation: Token Impersonation/Theft T1222.001 1File and Directory Permissions Modification: Windows Permissions T1055.003 1Thread Execution Hijacking T1564.004 1NTFS File Attributes T1027.006 1Obfuscated Files or Information: HTML Smuggling T1078.002 1Domain Accounts T1027.016 1Obfuscated Files or Information: Junk Code Insertion T1036.007 1Masquerading: Double File Extension T1218.004 1System Binary Proxy Execution: InstallUtil T1218.007 1System Binary Proxy Execution: Msiexec T1218.014 1System Binary Proxy Execution: MMC T1574 1Hijack Execution Flow T1550.001 1Use Alternate Authentication Material: Application Access Token T1027.011 1Obfuscated Files or Information: Fileless Storage T1090 1Proxy

TA0006

Credential Access

T1003.001 17OS Credential Dumping: LSASS Memory T1003 13OS Credential Dumping T1003.003 6OS Credential Dumping: NTDS T1552 5Unsecured Credentials T1110 5Brute Force T1555 4Credentials from Password Stores T1056 4Input Capture T1555.003 3Credentials from Web Browsers T1056.001 3Input Capture: Keylogging T1110.003 3Brute Force: Password Spraying T1557.001 2Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning T1021.002 1Remote Services: External Remote Services T1212 1Exploitation for Credential Access T1040 1Network Sniffing T1110.002 1Brute Force: Password Cracking T1003.008 1OS Credential Dumping: /etc/passwd and /etc/shadow T1555.005 1Credentials from Password Stores: Password Managers T1539 1Steal Web Session Cookie T1552.001 1Unsecured Credentials: Credentials In Files

TA0007

Discovery

T1083 23File and Directory Discovery T1082 19System Information Discovery T1046 16Network Service Discovery T1135 14Network Share Discovery T1057 14Process Discovery T1018 13Remote System Discovery T1087.002 8Account Discovery: Domain Account T1482 7Domain Trust Discovery T1518.001 6Security Software Discovery T1012 6Query Registry T1087 5Account Discovery T1007 5System Service Discovery T1010 4Application Window Discovery T1016 4System Network Configuration Discovery T1614.001 4System Location Discovery: System Language Discovery T1033 4System Owner/User Discovery T1497 3Virtualization/Sandbox Evasion T1120 3Peripheral Device Discovery T1049 3System Network Connections Discovery T1124 3Time Discovery T1614 3System Location Discovery T1526 2Cloud Service Discovery T1016.001 2Network Configuration Discovery: Network Connection Enumeration T1518 2Software Discovery T1087.001 2Account Discovery: Local Account TA0007 1Discovery T1063 1Security software discovery T1538 1Cloud Service Dashboard T1119 1Automated Collection T1069 1Permission Groups Discovery T1615 1Group Policy Discovery

TA0008

Lateral Movement

T1021.001 24Remote Services: Remote Desktop Protocol T1021.002 21Remote Services: SMB/Windows Admin Shares T1570 8Lateral Tool Transfer T1021 7Remote Services T1021.004 6Remote Services: SSH T1091 2Replication Through Removable Media T1210 2Exploitation of Remote Services T1534 2Internal Spearphishing T1080 1Taint Shared Content T1333 1External Remote Services T1047 1Windows Management Instrumentation T1078.002 1Valid Accounts: Domain Accounts T1550.002 1Use Alternate Authentication Material: Pass the Hash T1563 1Remote Service Session Hijacking

TA0009

Collection

T1005 12Data from Local System T1560.001 9Archive Collected Data: Archive via Utility T1560 7Archive Collected Data T1074 7Data Staged T1119 6Automated Collection T1056 3Input Capture T1114 3Email Collection T1074.001 3Data Staged: Local Data Staging T1039 2Data from Network Shared Drive T1213 2Data from Information Repositories T1560.002 2Archive Collected Data: Archive via Library T1560.003 2Archive Collected Data: Archive via Custom Method T1602.002 1Network Device Configuration Dump

TA0010

Exfiltration

T1567.002 21Exfiltration Over Web Service: Exfiltration to Cloud Storage T1041 12Exfiltration Over C2 Channel T1567 9Exfiltration Over Web Service T1048 7Exfiltration Over Alternative Protocol T1048.003 5Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol T1020 3Automated Exfiltration; Exfiltration Over Web Service T1048.002 2Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol T1537 2Transfer Data to Cloud Account T1030 1Data Transfer Size Limits T1045 1Exfiltration Over C2 Channel T1567.004 1Exfiltration Over Webhook T1011 1Exfiltration Over Other Network Medium T1011.001 1Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth T1052.001 1Exfiltration Over Physical Medium: Exfiltration over USB T1048.001 1Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol

TA0011

Command & Control

T1071.001 21Application Layer Protocol: Web Protocols T1219 11Remote Access Software T1071 8Application Layer Protocol T1573 5Encrypted Channel T1105 4Ingress Tool Transfer T1572 3Protocol Tunneling T1090.003 3Multi-hop Proxy T1102.002 3Web Service: Bidirectional Communication T1573.001 3Encrypted Channel: Symmetric Cryptography T1090 2Proxy T1001.003 2Data Obfuscation: Protocol or Service Impersonation T1008 2Fallback Channels T1090.001 2Proxy: Internal Proxy T1090.002 2Proxy: External Proxy T1104 2Multi-Stage Channels T1132.001 2Data Encoding: Standard Encoding T1571 2Non-Standard Port T1229 1Remote Access Software T1071.004 1Application Layer Protocol: DNS T1001 1Data Obfuscation T1001.001 1Data Obfuscation: Junk Data T1095 1Non-Application Layer Protocol T1102 1Web Service T1219.002 1Remote Access Software: Remote Desktop Software

TA0040

Impact

T1486 46Data Encrypted for Impact T1490 35Inhibit System Recovery T1489 17Service Stop T1485 7Data Destruction T1561.001 4Disk Wipe: Disk Content Wipe T1529 4System Shutdown/Reboot T1657 2Financial Theft T1491 2Defacement T1561 2Disk Wipe T1491.001 2Defacement: Internal Defacement T1561.002 2Disk Wipe: Disk Structure Wipe T1498 1Network Denial of Service T1531 1Account Access Removal