Common Attack Patterns

A defender's map of how intrusions actually unfold — the ATT&CK tactics, the endpoint kill chain, and the M365 / Entra identity attacks — each with its tell and where to look. Click any pattern to copy it.

Start here

How to read this

Attacks move through stages — get in, run code, stick around, climb, hide, steal creds, look around, spread, call home, take the data, cause damage. You rarely see the whole chain; you see one event and infer the stage. This sheet lists the common technique under each stage, the tell that gives it away, and the sheet that helps you confirm it. The identity section covers the M365 / Entra attacks that dominate MSP/MSSP alerting. None of this is offensive instruction — it's pattern recognition for the blue team.

Think in stages, not eventsA single alert is one link. Ask "what stage is this, and what comes before/after?" — a 4698 (new task) implies execution before it and persistence as the goal.
Pattern → tell → confirmEach row below: the technique, the signal it leaves, and where to verify. Pivot from the tell to the tool sheet.
Know normal, find evilMost detections are deviations from a baseline — the Core Processes idea applied everywhere. Baseline first.
Living off the land (LOLBins)Modern intrusions prefer built-in tools (PowerShell, wmic, sc, rundll32) over malware — the binary is signed and trusted, so judge by behavior, not the name.

Framework

The 14 ATT&CK tactics at a glance

The MITRE ATT&CK tactics in order — the "why" behind a technique. Map every alert to one.

Reconnaissance (TA0043)Pre-intrusion target research — scanning, OSINT, harvesting emails. Mostly off your hosts.
Resource Development (TA0042)Attacker builds infrastructure — domains, accounts, malware, bought access.
Initial Access (TA0001)The way in — phishing, valid accounts, exploiting a public-facing app.
Execution (TA0002)Running attacker code — scripts, scheduled tasks, service exec.
Persistence (TA0003)Surviving reboots and logoffs — Run keys, services, tasks, OAuth grants.
Privilege Escalation (TA0004)Gaining higher rights — token theft, UAC bypass, weak service ACLs.
Defense Evasion (TA0005)Avoiding detection — clearing logs, disabling AV, obfuscation, injection.
Credential Access (TA0006)Stealing secrets — LSASS dump, Kerberoasting, cached creds.
Discovery (TA0007)Looking around — users, groups, shares, domain, network.
Lateral Movement (TA0008)Moving host to host — PsExec, RDP, WMI, pass-the-hash.
Collection (TA0009)Gathering target data — files, email, screen, keystrokes.
Command & Control (TA0011)Talking to the attacker — HTTP(S) beacons, DNS tunneling.
Exfiltration (TA0010)Getting data out — over C2, to cloud storage, DNS.
Impact (TA0040)The payoff — ransomware, wiping, account/service takeover.

Stage 1-2

Initial access & execution

How they get in and get code running.

Phishing (T1566)The #1 way in — malicious link, attachment, or OAuth consent. Work it with the Phishing SOP and Email Headers sheets.
Valid accounts (T1078)Stolen creds used to log in legitimately — no malware, just a sign-in. The hardest to spot; see the M365 section. Pairs with impossible-travel / risky sign-in alerts.
Exploit public-facing app (T1190)A vuln in an internet-facing server (VPN, Exchange, web app). Tell: odd child processes under w3wp/web service, webshells in web roots.
Malicious macro / ISO / LNK (T1204)User opens an attachment that runs code. Tell: winword/excel → powershell/cmd/mshta — the parent-child chain in Sysmon 1 / 4688.
PowerShell execution (T1059.001)Encoded / downloaded scripts. Tell: -enc, -nop, IEX (New-Object Net.WebClient) in 4104 / Sysmon 1. See PowerShell.
LOLBin abuse (T1218)rundll32, regsvr32, mshta, certutil running remote/encoded content — signed binaries doing un-signed-binary things. Check the DLLs sheet for the module tells.
Scheduled task / service exec (T1053 / T1569)Code launched via a task or service. Confirm with schtasks (4698) and sc (7045).

Stage 3-4

Persistence & privilege escalation

Sticking around, then climbing.

Run keys / startup (T1547.001)The classic autostart. Confirm in the Registry sheet (Run/RunOnce, Winlogon) and via Sysmon 13.
Scheduled task (T1053.005)Runs at logon/boot/interval. schtasks — watch 4698 and the hidden-task (SD-delete) trick.
New or hijacked service (T1543.003)Auto-start service running an odd binary, or a re-pointed binPath. sc — Event 7045 / 4697.
WMI event subscription (T1546.003)Fileless persistence via a WMI filter+consumer+binding. Tell: Sysmon 19/20/21 together.
IFEO / accessibility hijack (T1546)A Debugger value, or sethc.exe/utilman.exe swapped for cmd — runs at the logon screen as SYSTEM. In the Registry sheet.
Token manipulation (T1134)Stealing/impersonating a token to act as another (often higher) user. Tell: 4624/4672 with odd logon types; SeDebugPrivilege use.
UAC bypass (T1548.002)Auto-elevating LOLBins (fodhelper, eventvwr) to jump medium→high integrity. Tell: those binaries spawning cmd/powershell.
Weak service / path perms (T1574)Unquoted service paths, writable service binaries, DLL search-order. Find them with accesschk on the Sysinternals sheet.

Stage 5-6

Defense evasion & credential access

Going dark, then stealing the keys.

Clear / disable logs (T1070 / T1562)Wiping tracks. Tell: Security 1102, System 104, Sysmon 4/16, or wevtutil cl / sl …/e:false. See wevtutil.
Disable AV / EDR (T1562.001)Stopping Defender/EDR services or adding exclusions. Tell: sc stop/config on security services; Defender tamper events.
Process injection (T1055)Running code inside a trusted process (hollowing, CreateRemoteThread). Tell: Sysmon 8 / 10 / 25, odd memory regions in VMMap.
DLL side-loading (T1574.002)A signed EXE loading a malicious DLL from its own folder. Tell: unsigned/out-of-place DLL in Sysmon 7 — see the DLLs sheet.
LSASS dump (T1003.001)Credential theft from memory (Mimikatz, procdump -ma lsass, comsvcs MiniDump). Tell: Sysmon 10 GrantedAccess 0x1010/0x1410 to lsass. Top-priority alert.
Kerberoasting (T1558.003)Requesting service tickets to crack offline. Tell: a burst of 4769 with RC4 (0x17) encryption from one account.
DCSync (T1003.006)Impersonating a DC to pull password hashes. Tell: 4662 with the DS-Replication GUID from a non-DC account. High-severity.
Credentials in files / registry (T1552)Hunting passwords in scripts, GPP, the registry. Tell: reg query … /f password /s, mass file reads of config files.

Stage 7-8

Discovery & lateral movement

Mapping the network, then spreading.

Account / domain discovery (T1087 / T1482)Enumerating users, groups, trusts. Tell: net user/group, nltest, bulk LDAP — see net and AdExplorer/AdInsight on Sysinternals.
Network / share discovery (T1046 / T1135)Scanning and finding shares to spread to. Tell: net view, port sweeps, ShareEnum. Ports on the Ports sheet.
PsExec / service exec (T1021.002 / T1569)The lateral-movement staple — a service created on a remote host. Tell: PSEXESVC, remote 7045, Sysmon 17/18 pipe. See sc.
Remote WMI / WinRM (T1021.006 / T1047)Remote exec over WMI or PowerShell Remoting. Tell: wmic /node: process call create; 4688 from WmiPrvSE/wsmprovhost. See wmic.
RDP (T1021.001)Interactive remote logon. Tell: 4624 LogonType 10, TerminalServices logs, new RDP connection history in the Registry.
Pass-the-hash / -ticket (T1550)Authenticating with a stolen hash or Kerberos ticket instead of a password. Tell: 4624 LogonType 3 / 9, NTLM where Kerberos is expected, mismatched ticket lifetimes.
Admin shares (T1021.002)Copying tools via C$/ADMIN$. Tell: 5140 share access to admin shares, files dropped in \Windows\Temp remotely.

Stage 9-11

C2, exfiltration & impact

Calling home, stealing data, and the payoff.

HTTP(S) beaconing (T1071.001)Regular check-ins to a C2 server. Tell: periodic connections (jittered), odd user-agents, a non-browser process on 80/443. Sysmon 3; enrich IPs with the tools on the home page.
DNS tunneling (T1071.004)C2 or exfil hidden in DNS queries. Tell: high volume of long/encoded TXT lookups to one domain — Sysmon 22.
Standard ports, odd use (T1571)C2 on 443 that isn't TLS, or on 4444/8080. Flagged ports are on the Ports sheet; inspect with tcpdump.
Exfil to cloud / over C2 (T1567 / T1041)Data out to paste sites, cloud storage, or down the C2 channel. Tell: large outbound transfers, uploads to consumer cloud from a server.
Archive before exfil (T1560)Staging data in a .zip/.rar/.7z first. Tell: rar.exe a, large archives appearing in a temp/staging dir — Sysmon 11.
Ransomware (T1486)Mass file encryption. Tell: rapid file renames/writes, shadow-copy deletion (vssadmin delete shadows, wbadmin), ransom notes. The bcrypt/ncrypt burst on the DLLs sheet.
Inhibit recovery (T1490)Deleting backups/shadow copies before encrypting. Tell: vssadmin, wbadmin delete, bcdedit recovery tampering — high-signal precursor to ransomware.

Identity

M365 / Entra ID attacks

The cloud-identity patterns that dominate MSP/MSSP alerting — mostly "valid account" abuse, so you hunt sign-ins and audit logs, not hosts. Pull and filter the JSON with jq and the PowerShell/Graph checks.

Password spray (T1110.003)One common password against many accounts. Tell: many 4625 / Entra sign-in failures (error 50126) across users from one IP/ASN in a short window.
MFA fatigue / push bombing (T1621)Spamming MFA prompts until the user approves. Tell: repeated MFA challenges then a success; Entra "multiple failed MFA then satisfied."
AiTM / token theft (T1539)Phishing proxy steals the session token, bypassing MFA. Tell: sign-in from a new IP/device reusing a token, impossible travel, same session from two geos. The modern BEC entry.
Illicit OAuth consent (T1528)User consents to a malicious app that then reads mail/files via Graph — no password needed, survives password resets. Tell: new service principal / app consent grant with Mail.Read, offline_access. Hunt with jq over the OAuth export.
Malicious inbox rules (T1564.008)Post-compromise BEC — rules that auto-delete/forward/move replies to hide the attacker's thread. Tell: New-InboxRule in the audit log moving mail to RSS/Archive or marking read. A top BEC indicator.
Auto-forwarding / exfil (T1114.003)Mailbox forwarded externally to siphon mail. Tell: Set-Mailbox ForwardingSMTPAddress, transport rules to an external domain.
Entra persistence (T1098)Adding a secret/cert to an app, a new global admin, or a federated trust (so the attacker stays). Tell: "Add service principal credentials," new privileged role assignment, domain federation change in the audit log.
Mailbox / eDiscovery collection (T1114)Bulk-reading or exporting mail. Tell: new eDiscovery search/export, unusual MailItemsAccessed volume for one mailbox.

The BEC chain to recognize: phish → AiTM token theft (MFA bypassed) → sign-in from new IP → inbox rule to hide replies → OAuth app or forwarding for durable access → fraud. Catch it at the inbox rule or the consent grant if you miss the sign-in.

If you watch nothing else

The high-signal short list

The patterns with the best signal-to-noise — tune and alert on these first.

LSASS accessSysmon 10 to lsass with dump-grade access — credential theft in progress.
Security log clearedSecurity 1102 / System 104 — almost never legitimate, hard to suppress.
Office → script interpreterwinword/excel/outlook → powershell/cmd/mshta/wscript — macro-maldoc execution.
Remote service created7045 from a remote source / PSEXESVC — lateral movement.
Shadow copies deletedvssadmin/wbadmin delete — the ransomware precursor.
New OAuth app with mail scopesIllicit consent — durable mailbox access that survives a password reset.
New inbox rule hiding mailThe BEC tell — auto-delete/move of replies.
Impossible travel + token reuseAiTM session theft — the MFA-bypass entry point.
Password spray burstMany 4625 / 50126 across users from one source — the opening move.
New global admin / app credentialEntra persistence — the attacker locking in access.

Tie it back: every row here links to a tool sheet that confirms it — this page is the map, the others are how you dig. Start from the alert, name the stage, pivot to the sheet.