LOCAL DEFENDER FIELD MANUALSTATIC HTML EDITION
Learn the attack.
Name the signal.
A local field guide to cyberattacks—organized into one-page notes connecting attacker behavior to evidence, detection, and mitigation.
LOCAL_KNOWLEDGE_BASE.STATUSREADY
170ATTACK NOTES
FAMILIES08
DEEP DIVES07
SERVERNOT REQUIRED
01UNDERSTAND
02TRACE
03OBSERVE
04DETECT
05HARDEN
COVERAGE REVIEW / JULY 2026170 attack notes across 8 families
The catalog now includes major ATT&CK behaviors plus common web, network, physical, fraud, supply-chain, and AI-security attack names. Cyberattack terminology keeps evolving, so this is a reviewed learning catalog rather than a claim that history has a final, finite list.
ATTACK LIBRARY
Find your next study note.
Search by name, platform, ATT&CK ID, or attack family. Every note follows the same evidence-first structure.
170 RESULTS
ID
Credentials & Identity
36
01
Account ManipulationExisting accounts are altered to preserve or increase access.
↗
02
Adversary-in-the-Middle PhishingA reverse proxy captures credentials, MFA exchanges, and session cookies in real time.
↗
03
Application Access Token TheftOAuth or API access tokens are stolen and used without the original sign-in.
↗
04
AS-REP RoastingKerberos responses for accounts without pre-authentication are captured for offline cracking.
↗
05
Brute ForceRepeated password or key guesses discover valid authentication material online or offline.
↗
06
Cached Domain Credential TheftCached domain logon verifiers are extracted for offline cracking.
↗
07
Cloud Secrets Store TheftSecrets are requested from a cloud vault or secrets-management service.
↗
08
Credential StuffingUsername and password pairs stolen elsewhere are replayed against a new service.
↗
09
DCShadowA rogue domain controller pushes malicious directory changes.
↗
10
DCSyncDirectory replication rights are abused to request domain password data.
↗
11
Default Account AbuseBuilt-in or vendor-default accounts are used for unauthorized access.
↗
12
Golden SAMLA stolen federation signing key is used to forge trusted SAML assertions.
↗
13
Golden TicketA forged Kerberos ticket-granting ticket is created with the domain KRBTGT secret.
↗
14
Group Policy Preferences Credential TheftLegacy credentials embedded in Group Policy Preferences are recovered.
↗
15
KerberoastingKerberos service tickets are obtained and cracked offline to recover service-account passwords.
↗
16
Kerberos Delegation AbuseUnconstrained, constrained, or resource-based delegation is abused to impersonate users to services.
↗
17
LSASS Credential DumpingCredential material is extracted from the Windows security process.
↗
18
MFA FatigueRepeated push prompts pressure a user into approving an attacker login.
↗
19
MFA InterceptionOne-time codes or other authentication factors are intercepted and replayed.
↗
20
NTDS.dit TheftThe Active Directory database is copied to obtain domain hashes.
↗
21
OAuth Consent PhishingA user grants a malicious app access to cloud data.
↗
22
Pass-the-HashA stolen password hash is used directly for authentication without recovering the plaintext.
↗
23
Pass-the-TicketA stolen Kerberos ticket is reused to access resources without the account password.
↗
24
Password CrackingStolen password hashes are tested offline against candidate passwords.
↗
25
Password GuessingCommon or targeted passwords are tested against one account.
↗
26
Password Reset PoisoningAccount recovery or reset workflows are manipulated to take control of an identity.
↗
27
Password SprayingA small set of common passwords is tried across many accounts to avoid per-user lockout thresholds.
↗
28
Private Key TheftPrivate authentication keys and certificates are discovered and stolen.
↗
29
SAM Database DumpingLocal account hashes are recovered from the Windows SAM.
↗
30
Session Cookie TheftAuthenticated browser cookies are stolen and replayed.
↗
31
Shadow CredentialsKey-based authentication data is added to a directory object to impersonate the account.
↗
32
Silver TicketA Kerberos service ticket is forged with a stolen service-account key.
↗
33
SIM SwappingA victim mobile number is transferred to intercept recovery or MFA messages.
↗
34
Skeleton KeyDomain-controller authentication is modified to accept a master password.
↗
35
Token ImpersonationA Windows access token is duplicated or used as another principal.
↗
36
Web Cookie ForgeryApplication signing material is abused to create a trusted authentication cookie.
↗
SE
Phishing & Social Engineering
16
01
Business Email CompromiseA trusted business identity is impersonated or hijacked to redirect money or data.
↗
02
ClickFix Social EngineeringA fake error or verification prompt instructs the user to paste and run attacker-supplied commands.
↗
03
Clone PhishingA legitimate message is copied and resent with malicious content.
↗
04
Consent and Approval ManipulationA user or administrator is persuaded to approve a malicious access, payment, or configuration request.
↗
05
Drive-by CompromiseBrowsing a compromised site triggers exploitation or malicious delivery.
↗
06
Help Desk ImpersonationAn attacker impersonates a user or technician to obtain resets, enrollment, or remote access.
↗
07
PharmingName resolution or local configuration redirects users to a fraudulent site without a deceptive message.
↗
08
PretextingA fabricated scenario persuades a target to disclose information or act.
↗
09
QuishingA QR code moves a victim from a trusted context to a malicious destination.
↗
10
SmishingSMS or mobile messages deliver a malicious link, request, or callback lure.
↗
11
Spearphishing AttachmentA targeted message delivers a malicious attachment.
↗
12
Spearphishing LinkA targeted message links to credential theft or malware delivery.
↗
13
Spearphishing via ServiceChat, social media, or another service delivers a targeted lure.
↗
14
VishingVoice calls manipulate victims into revealing secrets or taking unsafe actions.
↗
15
Watering HoleA site used by a target group is compromised to deliver exploits or tracking.
↗
16
WhalingExecutives and other high-value people receive tailored social engineering.
↗
WA
Web Application
28
01
API Broken Object AuthorizationObject identifiers are changed to access another user records.
↗
02
API Mass AssignmentUnexpected object properties are submitted to change protected fields.
↗
03
Authentication BypassA logic or implementation flaw allows protected functionality without valid authentication.
↗
04
Command InjectionUntrusted input reaches an operating-system command interpreter.
↗
05
Cross-Site Request ForgeryA logged-in browser sends an unwanted state-changing request.
↗
06
Cross-Site ScriptingAttacker-controlled script executes in another user browser.
↗
07
Exploitation of Public-Facing ApplicationA vulnerability in an internet-facing service is exploited for initial access.
↗
08
File InclusionAn application loads an attacker-selected local or remote file.
↗
09
GraphQL AbuseIntrospection, batching, nested queries, or authorization gaps expose data or exhaust resources.
↗
10
Host Header InjectionA manipulated Host header influences links, routing, caches, or password-reset URLs.
↗
11
HTTP Request SmugglingFront-end and back-end servers disagree about request boundaries.
↗
12
HTTP Response SplittingInjected delimiters create attacker-controlled headers or responses.
↗
13
Insecure DeserializationUntrusted serialized data triggers object manipulation or execution.
↗
14
JWT Token AttackToken validation, algorithms, keys, or claims are abused to impersonate identities.
↗
15
LDAP InjectionInput modifies an LDAP search filter or directory operation.
↗
16
NoSQL InjectionUntrusted input changes a NoSQL query, operator, or document structure.
↗
17
Open RedirectA trusted application redirects to an attacker-selected destination.
↗
18
Path TraversalPath manipulation escapes an intended directory.
↗
19
Prototype PollutionAttacker-controlled properties modify object prototypes and application behavior.
↗
20
Race Condition AttackConcurrent requests exploit a gap between validation and state change.
↗
21
Server-Side Request ForgeryA server is manipulated into requesting internal or restricted destinations.
↗
22
SQL InjectionUntrusted input changes the structure of a database query.
↗
23
Template InjectionAttacker input is evaluated as a template expression.
↗
24
Unrestricted File UploadA file upload accepts content that becomes executable or dangerous.
↗
25
Web Cache DeceptionA victim private response is made cacheable and later retrieved.
↗
26
Web Cache PoisoningA malicious response is stored and served by a shared cache.
↗
27
Web ShellA server-side script provides persistent remote command execution.
↗
28
XML External Entity InjectionUnsafe XML entity processing exposes files or internal requests.
↗
NP
Network & Protocol
27
01
ARP SpoofingForged ARP messages redirect local traffic through an attacker.
↗
02
BGP HijackingFalse routing announcements divert or blackhole internet traffic.
↗
03
DHCP StarvationLarge numbers of forged requests exhaust the DHCP address pool.
↗
04
DNS AmplificationSpoofed DNS queries reflect amplified traffic at a victim.
↗
05
DNS Cache PoisoningFalse DNS data makes names resolve to attacker-selected addresses.
↗
06
DNS TunnelingData or command messages are encoded in DNS.
↗
07
ICMP FloodHigh-volume ICMP traffic consumes bandwidth or processing capacity.
↗
08
IP Fragmentation AttackOverlapping or abnormal fragments evade inspection or exhaust reassembly resources.
↗
09
LLMNR/NBT-NS PoisoningLocal name-resolution replies are spoofed to capture authentication.
↗
10
MAC FloodingA switch forwarding table is overwhelmed with forged source MAC addresses.
↗
11
Man-in-the-BrowserMalware inside a browser manipulates trusted transactions.
↗
12
Man-in-the-MiddleCommunications are intercepted and potentially altered.
↗
13
Network SniffingNetwork traffic is captured to collect credentials, sessions, or sensitive data.
↗
14
NTLM RelayCaptured NTLM authentication is forwarded to another service.
↗
15
NTP AmplificationSpoofed NTP requests reflect amplified traffic.
↗
16
Ping of DeathMalformed or oversized packet fragments target vulnerable network stacks.
↗
17
Port ScanningProbes identify hosts, ports, protocols, and services.
↗
18
RDP Session HijackingAn existing Remote Desktop session is taken over without the user password.
↗
19
Rogue DHCPAn unauthorized DHCP server supplies malicious network configuration.
↗
20
Session HijackingAn established application or remote-access session is taken over.
↗
21
SlowlorisSlow incomplete HTTP requests hold server connections open.
↗
22
SMB RelayRelayed Windows authentication is used against SMB.
↗
23
SSH Session HijackingAn existing SSH connection or agent is abused to reach additional systems.
↗
24
SSL StrippingA man-in-the-middle downgrades or replaces secure web navigation with an insecure connection.
↗
25
TCP SYN FloodIncomplete TCP handshakes exhaust connection state.
↗
26
UDP FloodHigh-volume UDP traffic consumes bandwidth or resources.
↗
27
VLAN HoppingSwitching behavior is abused to reach another virtual LAN.
↗
ME
Malware & Endpoint
27
01
BootkitBoot components run malicious code before the operating system.
↗
02
Clear Windows Event LogsSecurity or operational logs are cleared to remove evidence.
↗
03
Clipboard HijackingClipboard content is read or replaced.
↗
04
Computer WormMalware self-propagates between systems.
↗
05
Data Staging and ArchivingCollected data is gathered and compressed before exfiltration.
↗
06
DLL Search Order HijackingA malicious library loads before a legitimate one.
↗
07
DLL Side-LoadingA trusted executable loads an attacker-controlled library.
↗
08
Ingress Tool TransferTools or payloads are transferred into a compromised environment.
↗
09
KeyloggingKeystrokes are captured to steal secrets.
↗
10
Living off the LandTrusted system tools are abused for malicious actions.
↗
11
PowerShell AbusePowerShell performs execution, download, discovery, or automation.
↗
12
Process HollowingA legitimate process image is replaced in memory with malicious code.
↗
13
Process InjectionCode executes inside another process.
↗
14
Proxy and Multi-Hop C2Compromised systems or proxy services relay command-and-control traffic.
↗
15
RansomwareFiles or systems are encrypted or disrupted for extortion.
↗
16
Registry Run Key PersistenceStartup registry locations run code at logon or boot.
↗
17
Remote ServicesRDP, SMB, SSH, WinRM, VNC, or similar services are used to access remote systems.
↗
18
RootkitSystem components are modified to conceal malicious presence.
↗
19
Scheduled Task PersistenceA scheduled job executes malicious code later.
↗
20
Screen CaptureScreens or application windows are captured to collect information.
↗
21
Security Tool TamperingDefensive products, logs, or configurations are disabled or changed.
↗
22
TimestompingFile timestamps are altered to hide activity or imitate legitimate files.
↗
23
Trojan HorseMalicious functionality is disguised as legitimate software.
↗
24
UAC BypassWindows elevation controls are bypassed to execute with higher integrity.
↗
25
Windows Service ExecutionA Windows service is created or modified to execute code.
↗
26
Wiper MalwareData and system structures are deliberately destroyed.
↗
27
WMI ExecutionWindows Management Instrumentation is used for local or remote execution.
↗
CC
Cloud & Containers
18
01
Additional Cloud Credential PersistenceNew keys, certificates, secrets, or credentials are added to a compromised cloud identity.
↗
02
Additional Cloud Role PersistenceRoles or permissions are added to preserve privileged cloud access.
↗
03
Cloud Access Key TheftLong-lived or temporary cloud API credentials are stolen and replayed.
↗
04
Cloud Account TakeoverStolen credentials, tokens, or recovery paths control a cloud identity.
↗
05
Cloud CryptojackingCompromised cloud resources perform unauthorized mining.
↗
06
Cloud IAM Privilege EscalationPermissions and role paths are abused for stronger privileges.
↗
07
Cloud Logging DisablementAudit trails, diagnostic settings, or security services are disabled or weakened.
↗
08
Cloud Metadata Service AbuseA workload metadata endpoint reveals temporary cloud credentials.
↗
09
Cloud Region EvasionResources are created in unused regions to evade normal monitoring.
↗
10
Cloud Snapshot TheftDisk, database, or machine snapshots are copied or shared to expose stored data.
↗
11
Container API ExposureAn exposed Docker or container management API is used to control workloads or hosts.
↗
12
Container EscapeA process breaks container isolation and reaches the host.
↗
13
Kubernetes Admission Controller AbuseAdmission webhooks or policies are modified to inject, allow, or persist malicious workloads.
↗
14
Kubernetes API AbuseTokens or exposed control planes manipulate cluster resources.
↗
15
Kubernetes Secrets TheftCluster secrets are read from APIs, etcd, volumes, or environments.
↗
16
Public Storage Bucket ExposureMisconfigured object storage exposes sensitive data.
↗
17
SaaS Data ExfiltrationLegitimate APIs or compromised accounts export cloud data.
↗
18
Serverless Function AbuseFunction code, triggers, or identities are manipulated.
↗
WP
Wireless & Physical
8
01
Bluetooth ExploitationBluetooth weaknesses expose data or device control.
↗
02
Evil Twin Wi-FiA rogue access point imitates a trusted wireless network.
↗
03
RFID CloningRFID data is copied to impersonate a badge or tag.
↗
04
Rogue Access PointAn unauthorized wireless device creates an uncontrolled network path.
↗
05
TailgatingAn unauthorized person follows someone into a restricted area.
↗
06
USB Drop AttackA malicious USB device is left for a target to connect.
↗
07
Wi-Fi DeauthenticationManagement frames disconnect wireless clients.
↗
08
WPA Handshake CaptureWireless authentication is captured for offline password testing.
↗
SC
Supply Chain & Emerging
10
01
Adversarial ExamplesModified inputs cause a machine-learning model to misclassify.
↗
02
CI/CD Pipeline CompromiseBuild identities, runners, secrets, or workflows alter software artifacts.
↗
03
Deepfake Social EngineeringSynthetic voice, video, or imagery impersonates a trusted person.
↗
04
Dependency ConfusionA package manager installs a malicious public package instead of an internal one.
↗
05
Firmware Supply Chain AttackMalicious changes enter device firmware or its update path.
↗
06
Model PoisoningTraining data or weights are changed to alter model behavior.
↗
07
Prompt InjectionContent instructions manipulate an AI system or its connected tools.
↗
08
Software Supply Chain CompromiseA trusted build, update, dependency, or distributor is compromised.
↗
09
Typosquatting PackageA malicious package imitates the name of a popular dependency.
↗
10
Zero-Day ExploitationAn unknown or unpatched vulnerability is exploited before defenses catch up.
↗
NO MATCH