Advanced Breach Detection

Advanced Breach Detection is a default RocketCyber app that uses proprietary technology to monitor Windows, macOS, and Linux devices for signs of compromise. It leverages the MITRE ATT&CK® framework to collect activity data on each device and forward it to the SOC, where it is triaged and analyzed. Because it is a default app, it is automatically enabled and cannot be disabled.

MITRE ATT&CK® framework

The MITRE ATT&CK® framework is a globally recognized knowledge base of adversary tactics and techniques. Tactics represent the reason an adversary performs an action, the goal they are trying to achieve. Techniques represent how they attempt to achieve that goal. Advanced Breach Detection maps its detections to this framework, giving the SOC and partners a common language for identifying and investigating threats.

How Advanced Breach Detection works

The RocketCyber agent continuously collects activity data on each monitored device and forwards it to the SOC. The SOC triages and analyzes the data against the enabled MITRE ATT&CK® techniques for that device's operating system. When a technique match is detected, an event is generated and surfaced in the RocketCyber dashboard for SOC review.

Configuration is applied at three levels (provider, organization, or device) and settings inherit downward. A configuration made at the provider level applies to all organizations and devices beneath it, but can be overridden at a lower level. For example, a technique enabled at the provider level can be disabled for a specific organization or device without affecting others.

For instructions on enabling or disabling techniques and setting up exclusions, see Configure Advanced Breach Detection.

Monitored techniques

The following techniques are monitored by default. All toggles are enabled at the provider level unless modified. Techniques vary by operating system.

Windows

Tactic	Technique ID	Technique name
Discovery	T1007	System Service Discovery
Discovery	T1012	Query Registry
Discovery	T1016	System Network Configuration Discovery
Discovery	T1018	Remote System Discovery
Discovery	T1033	System Owner/User Discovery
Discovery	T1049	System Network Connection Discovery
Discovery	T1057	Process Discovery
Discovery	T1069	Permission Groups Discovery
Discovery	T1082	System Information Discovery
Discovery	T1087	Account Discovery
Discovery	T1124	System Time Discovery
Discovery	T1135	Network Share Discovery
Discovery	T1201	Password Policy Discovery
Persistence	T1004	Winlogon Helper DLL
Persistence	T1031	Modify Existing Service
Persistence	T1060	Registry Run Keys / Start Folder
Persistence	T1101	Security Support Provider
Persistence	T1128	Netsh Helper DLLs
Persistence	T1131	Authentication Package
Persistence	T1136	Create Account
Persistence	T1137	Office Application Startup
Persistence	T1180	Screensaver
Persistence	T1209	Time Providers
Defense Evasion, Execution	T1085	Rundll32
Defense Evasion, Execution	T1117	Regsvr32
Defense Evasion, Execution	T1118	InstallUtil
Defense Evasion, Execution	T1121	Regsvcs/Regasm
Defense Evasion, Execution	T1127	Trusted Developer Utilities
Defense Evasion, Execution	T1170	Mshta
Defense Evasion, Execution	T1216	Signed Script Proxy Execution
Defense Evasion, Execution	T1218	Signed Binary Proxy Execution
Defense Evasion	T1036	Masquerading
Defense Evasion	T1070	Indicator Removal on Host
Defense Evasion	T1089	Disabling Security Tools
Defense Evasion	T1107	File Deletion
Defense Evasion	T1116	Code Signing
Defense Evasion	T1126	Network Share Connection and Removal
Defense Evasion	T1140	Deobfuscate/Decode Files or Information
Defense Evasion	T1202	Indirect Command Execution
Execution	T1035	Service Execution
Execution	T1047	Windows Management Instrumentation
Execution	T1059	Command Line Interface
Execution	T1086	PowerShell
Execution	T1173	Dynamic Data Exchange
Credential Access	T1003	Credential Dumping
Credential Access	T1081	Credentials In Files
Credential Access	T1098	Account Manipulation
Credential Access	T1174	Password Filter DLL
Credential Access	T1214	Credentials in Registry
Persistence, Privilege Escalation	T1013	Port Monitors
Persistence, Privilege Escalation	T1050	New Service
Persistence, Privilege Escalation	T1103	AppInit DLLs
Persistence, Privilege Escalation	T1182	AppCert DLLs
Lateral Movement	T1076	Remote Desktop Protocol
Lateral Movement	T1077	Windows Admin Shares
Impact	T1490	Inhibit System Recovery
Command and Control, Lateral Movement	T1105	Remote File Copy
Execution, Lateral Movement	T1028	Windows Remote Management
Defense Evasion, Execution	T1191	CMSTP
Defense Evasion, Persistence	T1158	Hidden Files and Directories
Execution, Persistence, Privilege Escalation	T1053	Scheduled Task
Defense Evasion, Persistence	T1198	SIP and Trust Provider Hijacking
Defense Evasion, Privilege Escalation	T1088	Bypass User Account Control
Defense Evasion, Persistence, Privilege Escalation	T1183	Image File Execution Options Injection

macOS

Tactic	Technique ID	Technique name
Discovery	T1016	System Network Configuration Discovery
Discovery	T1018	Remote System Discovery
Discovery	T1033	System Owner/User Discovery
Discovery	T1049	System Network Connection Discovery
Discovery	T1057	Process Discovery
Discovery	T1069	Permission Groups Discovery
Discovery	T1082	System Information Discovery
Discovery	T1087	Account Discovery
Discovery	T1135	Network Share Discovery
Discovery	T1201	Password Policy Discovery
Defense Evasion	T1070	Indicator Removal on Host
Defense Evasion	T1144	Gatekeeper Bypass
Defense Evasion	T1146	Clear Command History
Collection	T1113	Screen Capture
Collection	T1115	Clipboard Data
Execution, Lateral Movement	T1155	AppleScript
Lateral Movement	T1021	Remote Services
Privilege Escalation, Persistence	T1166	Setuid and Setgid
Command and Control	T1104	Multi-Stage Channels
Defense Evasion, Execution, Persistence	T1152	Launchctl

Linux

Tactic	Technique ID	Technique name
Discovery	T1007	System Service Discovery
Discovery	T1016	System Network Configuration Discovery
Discovery	T1033	System Owner/User Discovery
Discovery	T1049	System Network Connection Discovery
Discovery	T1057	Process Discovery
Discovery	T1082	System Information Discovery
Discovery	T1201	Password Policy Discovery
Defense Evasion	T1070-002	Indicator Removal: Clear Linux or Mac System Logs
Defense Evasion	T1562-003	Impair Defenses: Impair Command History Logging
Command and Control	T1071-002	Application Layer Protocol: File Transfer Protocols
Privilege Escalation, Defense Evasion	T1548-001	Abuse Elevation Control Mechanism: Setuid and Setgid

Related articles

• Configure Advanced Breach Detection

• Overview of default apps