MITRE ATT&CK @attack.mitre.org · Feb 27

Let’s look at Account Manipulation: Device Registration (attack.mitre.org/techniques/T...). This is important but it's also an easy one for defenders to overlook. Recent reporting shows how APT29 is registering their own devices as new devices on cloud tenants in order to gain access to networks.

1 likes 1 replies

?

Replies

MITRE ATT&CK · Feb 27

Using techniques like MFA bombing (attack.mitre.org/techniques/T...), the actor got around MFA requirements to register their own devices.