Skip to content

Commit 9dcc0f0

Browse files
cyber-cyrilcyber-cyril
authored
Merge pull request #33 from tommy2gone/v2025-update
Kill-chain-update-TB-2025
2 parents 878269c + 995dbc9 commit 9dcc0f0

8 files changed

Lines changed: 16 additions & 16 deletions

‎_kill-chains/gift-card-bot.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
title: Gift Card Cracking Bot
33
layout: kill-chain
44
phases: [Resource Development, Reconnaissance, Defence Bypass, Attack Execution, Actions on the Objective, Post-Attack]
5-
tactics: [Payment Detail Acquisition, Infrastructure Acquisition, Tool Development, Specific Target, Loose Target, Mitigation Bypass, Human Emulation, Proxying, Smokescreening, Payment Detail Abuse, Fake Interaction, Stock Purchase, Exfiltration, Sale]
6-
techniques: [Data Dumps, Malware, Person in the Middle, Social Engineering, Botnet, Command & Control, Proxies, Supply Chain Compromise, Development of Tools, Testing of Tools, Campaign Reuse, Technical Reconnaissance, CAPTCHA Farm, Automated CAPTCHA Bypass, MFA Bypass, Token Bypass, Cookie Abuse, Credential Pinning, User Agent Spoofing, Device Fingerprint Emulation, IP Rotation, Volumetric Traffic Disguise, Target Diversification, Gift Card Abuse, Overlay Attack, Automated Purchase, Payment Detail Dumping, Automated Advertisement of Stock, Automated Sale, Manual Sale]
5+
tactics: [Payment Detail Acquisition, Infrastructure Acquisition, Tool Development, Specific Target Scraping, Loose Target Scraping, CAPTCHA Bypass, Human Emulation, Proxying, Smokescreening, Payment Detail Abuse, Fake Interaction, Purchase, Data Extraction, Sale]
6+
techniques: [Data Dumps, Infostealer, Person in the Middle, Social Engineering, Botnet, Proxies, Trusted Infrastructure, Development of Tools, Testing of Tools, Campaign Reuse, CAPTCHA Farm, Automated CAPTCHA Bypass, MFA Bypass, Token Bypass, Cookie Abuse, Credential Pinning, User Agent Spoofing, Device Configuration Emulation, IP Rotation, Volumetric Traffic Disguise, Target Diversification, Gift Card Abuse, Automated Purchase, Payment Detail Dumping, Inventory Information Release, Automated Sale, Manual Sale]
77
short-desc: A gift carding bot is used by adversaries to validate stolen gift cards or enumerate gift card codes for subsequent use or sale.
88
---
99

‎_kill-chains/inventory-hoarding-bot.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Inventory Hoarding Bot
33
layout: kill-chain
44
phases: [Resource Development, Reconnaissance, Defence Bypass, Attack Execution, Actions on the Objective, Post-Attack]
5-
tactics: [Credential Acquisition, Infrastructure Acquisition, Tool Development, Specific Target, Loose Target, Mitigation Bypass, Human Emulation, Proxying, Spinning, Exfiltration, Sale]
6-
techniques: [Valid Accounts, Botnet, Command & Control, Proxies, Development of Tools, Testing of Tools, Campaign Reuse, Continual Content Scraping, Periodic Content Scraping, CAPTCHA Farm, Automated CAPTCHA Bypass, Fake Credibility Generation, User Agent Spoofing, IP Rotation, Automated Add to Cart, Inventory Hoarding, Transfer of Cart, Automated Purchase, Automated Advertisement of Stock, Automated Sale]
5+
tactics: [Credential Acquisition, Infrastructure Acquisition, Tool Development, Specific Target Scraping, Loose Target Scraping, CAPTCHA Bypass, Human Emulation, Proxying, Data Extraction, Sale]
6+
techniques: [Valid Accounts, Botnet, Proxies, Development of Tools, Testing of Tools, Campaign Reuse, Continual Content Scraping, Periodic Content Scraping, CAPTCHA Farm, Automated CAPTCHA Bypass, User Agent Spoofing, IP Rotation, Automated Add to Cart, Inventory Hoarding, Transfer of Cart, Automated Purchase, Inventory Information Release, Automated Sale]
77
short-desc: An inventory hoarding bot (also known as a spinner bot) is an automated tool that adds items to a basket and holds them there held until the bot operator decides to complete the checkout process. Some inventory hoarding bots will automatically relist the item on a third party reselling platform and only complete the checkout process once their relisting is sold.
88
---

‎_kill-chains/loyalty-points-bot.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
title: Loyalty Points Bot
33
layout: kill-chain
44
phases: [Resource Development, Reconnaissance, Defence Bypass, Attack Execution, Actions on the Objective, Post-Attack]
5-
tactics: [Payment Detail Acquisition, Credential Acquisition, Infrastructure Acquisition, Tool Development, Specific Target, Loose Target, Mitigation Bypass, Human Emulation, Proxying, Smokescreening, Payment Detail Abuse, Fake Interaction, Stock Purchase, Exfiltration, Sale]
6-
techniques: [Data Dumps, Person in the Middle, Social Engineering, Valid Accounts, Botnet, Command & Control, Proxies, Supply Chain Compromise, Development of Tools, Testing of Tools, Campaign Reuse, Technical Reconnaissance, CAPTCHA Farm, Automated CAPTCHA Bypass, MFA Bypass, Token Bypass, Cookie Abuse, Credential Pinning, User Agent Spoofing, Device Fingerprint Emulation, IP Rotation, Volumetric Traffic Disguise, Target Diversification, Loyalty Points Abuse, Overlay Attack, Automated Purchase, Payment Detail Dumping, Automated Advertisement of Stock, Information Brokerage, Automated Sale, Manual Sale]
5+
tactics: [Payment Detail Acquisition, Credential Acquisition, Infrastructure Acquisition, Tool Development, Specific Target Scraping, Loose Target Scraping, CAPTCHA Bypass, Human Emulation, Proxying, Smokescreening, Payment Detail Abuse, Fake Interaction, Purchase, Data Extraction, Sale]
6+
techniques: [Data Dumps, Person in the Middle, Social Engineering, Valid Accounts, Botnet, Proxies, Trusted Infrastructure, Development of Tools, Testing of Tools, Campaign Reuse, CAPTCHA Farm, Automated CAPTCHA Bypass, MFA Bypass, Token Bypass, Cookie Abuse, Credential Pinning, User Agent Spoofing, Device Configuration Emulation, IP Rotation, Volumetric Traffic Disguise, Target Diversification, Loyalty Points Abuse, Automated Purchase, Payment Detail Dumping, Inventory Information Release, Information Brokerage, Automated Sale, Manual Sale]
77
short-desc: A loyalty points bot is used by adversaries to steal loyalty points from user accounts. These are used to purchase goods and services either on the issuing site or downstream on third party sites that accept the loyalty points.
88
---
99

‎_kill-chains/scalper-bot.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Scalper Bot
33
layout: kill-chain
44
phases: [Resource Development, Reconnaissance, Defence Bypass, Attack Execution, Post-Attack]
5-
tactics: [Credential Acquisition, Infrastructure Acquisition, Tool Development, Specific Target, Loose Target, Mitigation Bypass, Human Emulation, Proxying, Smokescreening, Stock Purchase, Invoice Abuse, Delivery Redirect, Sale]
6-
techniques: [Valid Accounts, Botnet, Command & Control, Proxies, Development of Tools, Testing of Tools, Campaign Reuse, Continual Content Scraping, Periodic Content Scraping, CAPTCHA Farm, Automated CAPTCHA Bypass, Fake Credibility Generation, User Agent Spoofing, IP Rotation, Target Diversification, Automated Add to Cart, Automated Purchase, Limitation Policy Bypass, PO Box Obfuscation, Jigging, Fake Identity, Driver Intercept, Automated Sale, Manual Sale]
5+
tactics: [Credential Acquisition, Infrastructure Acquisition, Tool Development, Specific Target Scraping, Loose Target Scraping, CAPTCHA Bypass, Human Emulation, Proxying, Smokescreening, Purchase, Invoice Abuse, Delivery Redirect, Sale]
6+
techniques: [Valid Accounts, Botnet, Proxies, Development of Tools, Testing of Tools, Campaign Reuse, Continual Content Scraping, Periodic Content Scraping, CAPTCHA Farm, Automated CAPTCHA Bypass, User Agent Spoofing, IP Rotation, Target Diversification, Automated Add to Cart, Automated Purchase, Limitation Policy Bypass, PO Box Obfuscation, Address Manipulation, Fake Identity, Driver Redirect, Automated Sale, Manual Sale]
77
short-desc: Scalper bots (or scalping bots) use automated methods to purchase limited or high demand goods, such as event tickets. They are capable of buying many items at the same time and can complete the checkout process in a fraction of the time it would take any legitimate user.
88
---

‎_kill-chains/scraper-bot.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
title: Scraper Bot
33
layout: kill-chain
44
phases: [Resource Development, Reconnaissance, Defence Bypass, Attack Execution, Actions on the Objective, Post-Attack]
5-
tactics: [Credential Acquisition, Infrastructure Acquisition, Tool Development, Specific Target, Loose Target, Mitigation Bypass, Human Emulation, Proxying, Fake Interaction, Exfiltration, Sale]
6-
techniques: [Valid Accounts, Botnet, Command & Control, Proxies, Development of Tools, Testing of Tools, Campaign Reuse, Continual Content Scraping, Periodic Content Scraping, CAPTCHA FArm, Automated CAPTCHA Bypass, Cookie Abuse, Credential Pinning, Mouse Usage, User Agent Spoofing, Device Fingerprint Emulation, IP Rotation, Form Filling, Automated Advertisement of Stock, Content Dumping, Information Brokerage]
5+
tactics: [Credential Acquisition, Infrastructure Acquisition, Tool Development, Specific Target Scraping, Loose Target Scraping, CAPTCHA Bypass, Human Emulation, Proxying, Fake Interaction, Data Extraction, Sale]
6+
techniques: [Valid Accounts, Botnet, Proxies, Development of Tools, Testing of Tools, Campaign Reuse, Continual Content Scraping, Periodic Content Scraping, CAPTCHA Farm, Automated CAPTCHA Bypass, Cookie Abuse, Credential Pinning, Mouse Usage, User Agent Spoofing, Device Configuration Emulation, IP Rotation, Form Submission, Inventory Information Release, Intellectual Property Leak, Information Brokerage]
77
short-desc: Web scraping is the use of bots to gather content or data from websites. Some scraper bots are beneficial to and welcomed by website administrators. However, some scraper bots, such as content and pricing scraper bots, can have malicious intentions and cause serious harm to businesses and their customers. A scraper bot could also be used to clone an entire website for use in a phishing campaign.
88
---
99

‎_kill-chains/sniper-bot.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Sniper Bot
33
layout: kill-chain
44
phases: [Resource Development, Reconnaissance, Defence Bypass, Attack Execution, Post-Attack]
5-
tactics: [Credential Acquisition, Infrastructure Acquisition, Specific Target, Loose Target, Mitigation Bypass, Human Emulation, Proxying, Sniping, Invoice Abuse, Delivery Redirect, Sale]
6-
techniques: [Valid Accounts, Botnet, Command & Control, Proxies, Development of Tools, Testing of Tools, Campaign Reuse, Continual Content Scraping, Periodic Content Scraping, CAPTCHA Farm, Automated CAPTCHA Bypass, User Agent Spoofing, IP Rotation, Automated Add to Cart, Automated Bid, Automated Purchase, Pre-Release Buying, Automated Sale, PO Box Obfuscation, Jigging, Fake Identity, Driver Intercept, Manual Sale]
5+
tactics: [Credential Acquisition, Infrastructure Acquisition, Specific Target Scraping, Loose Target Scraping, CAPTCHA Bypass, Human Emulation, Proxying, Invoice Abuse, Delivery Redirect, Sale, Tool Development]
6+
techniques: [Valid Accounts, Botnet, Proxies, Development of Tools, Testing of Tools, Campaign Reuse, Continual Content Scraping, Periodic Content Scraping, CAPTCHA Farm, Automated CAPTCHA Bypass, User Agent Spoofing, IP Rotation, Automated Add to Cart, Automated Bid, Automated Purchase, Automated Sale, PO Box Obfuscation, Address Manipulation, Fake Identity, Driver Intercept, Manual Sale]
77
short-desc: Sniper bots (or “snipe bots”) are automated tools that monitor time-based activity and submit information at the very last moment, removing the opportunity for other people to respond to that action. The most common use of sniper bots is for last-second bidding on online auction sites.
88
---

‎_kill-chains/social-media-bot.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Social Media Bot
33
layout: kill-chain
44
phases: [Resource Development, Reconnaissance, Defence Bypass, Attack Execution]
5-
tactics: [Credential Acquisition, Infrastructure Acquisition, Tool Development, Specific Target, Loose Target, Mitigation Bypass, Human Emulation, Proxying, Fake Interaction]
6-
techniques: [Valid Accounts, Botnet, Command & Control, Proxies, Development of Tools, Testing of Tools, Campaign Reuse, Continual Content Scraping, Periodic Content Scraping, Automated CAPTCHA Bypass, CAPTCHA Farm, Fake Credibility Generation, User Agent Spoofing, IP Rotation, Smurfing, Comment Flooding, Written Interaction, Click Interaction, Play Media]
5+
tactics: [Credential Acquisition, Infrastructure Acquisition, Tool Development, Specific Target Scraping, Loose Target Scraping, CAPTCHA Bypass, Human Emulation, Proxying, Fake Interaction]
6+
techniques: [Valid Accounts, Botnet, Proxies, Development of Tools, Testing of Tools, Campaign Reuse, Continual Content Scraping, Periodic Content Scraping, Automated CAPTCHA Bypass, CAPTCHA Farm, User Agent Spoofing, IP Rotation, Multi-Accounting, Content Posting, Click Interaction, Play Media]
77
short-desc: A social media bot is an automated program that performs interactions on social media for the adversary's benefit. This may involve following other accounts or liking posts to inflate relevancy scores and posting spam comments.
88
---

‎_kill-chains/video-watch-bot.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Video Watch Bot
33
layout: kill-chain
44
phases: [Resource Development, Reconnaissance, Defence Bypass, Attack Execution]
5-
tactics: [Infrastructure Acquisition, Specific Target, Loose Target, Mitigation Bypass, Human Emulation, Proxying, Fake Interaction]
6-
techniques: [Botnet, Proxies, Command & Control, Continual Content Scraping, Periodic Content Scraping, CAPTCHA Farm, Automated CAPTCHA Bypass, User Agent Spoofing, IP Rotation, Domain Fronting, Volumetric Traffic Disguise, Play Media]
5+
tactics: [Infrastructure Acquisition, Specific Target Scraping, Loose Target Scraping, CAPTCHA Bypass, Human Emulation, Proxying, Fake Interaction]
6+
techniques: [Botnet, Proxies, Continual Content Scraping, Periodic Content Scraping, CAPTCHA Farm, Automated CAPTCHA Bypass, User Agent Spoofing, IP Rotation, Domain Fronting, Volumetric Traffic Disguise, Play Media]
77
short-desc: Video watch bots are used to artificially inflate video view counts by automatically playing through video content.
88
---

0 commit comments

Comments
 (0)