RaqibCTI — MENA Cyber Threat Intelligence

ATT&CK coverage · MENA subset

163 techniques · 15 tactics

Detection-gap map across the tracked MENA actor subset — every technique an ingested actor is observed using, colored by Sigma detection status. Red cells are gaps: techniques in use with no matching rule — where detection engineering should go next.

79%

Techniques covered

129

Covered

19

Partial

15

Detection gaps

163

Techniques in use

reconnaissance4

T1590.004Gather Victim Network Information: Network Topology T1598.003Phishing for Information: Spearphishing Link T1598Phishing for Information T1598.002Phishing for Information: Spearphishing Attachment

resource development17

T1583.001Acquire Infrastructure: Domains T1583.006Acquire Infrastructure: Web Services T1585.003Establish Accounts: Cloud Accounts T1583Acquire Infrastructure T1583.002Acquire Infrastructure: DNS Server T1583.003Acquire Infrastructure: Virtual Private Server T1584.004Compromise Infrastructure: Server T1586.002Compromise Accounts: Email Accounts T1588.003Obtain Capabilities: Code Signing Certificates T1608.001Stage Capabilities: Upload Malware T1584.002Compromise Infrastructure: DNS Server T1588.004Obtain Capabilities: Digital Certificates T1588.002Obtain Capabilities: Tool T1587.001Develop Capabilities: Malware T1588.001Obtain Capabilities: Malware T1102Web Service T1608.003Stage Capabilities: Install Digital Certificate

initial access13

T1660Phishing T1566.003Phishing: Spearphishing via Service T1566.001Phishing: Spearphishing Attachment T1566.002Phishing: Spearphishing Link T1566Phishing T1190Exploit Public-Facing Application T1078Valid Accounts T1133External Remote Services T1195Supply Chain Compromise T1078.002Valid Accounts: Domain Accounts T1078.004Valid Accounts: Cloud Accounts T1195.002Supply Chain Compromise: Compromise Software Software Supply Chain (trojanized VPN apps)T1199Trusted Relationship

execution17

T1204.002User Execution: Malicious File T1059.001Command and Scripting Interpreter: PowerShell T1059.005Command and Scripting Interpreter: Visual Basic T1203Exploitation for Client Execution T1204.001User Execution: Malicious Link T1053.005Scheduled Task/Job: Scheduled Task T1059.003Command and Scripting Interpreter: Windows Command Shell T1059.007Command and Scripting Interpreter: JavaScript T1574.001Hijack Execution Flow: DLL / DLL Search Order Hijacking T1047Windows Management Instrumentation T1559.002Inter-Process Communication: Dynamic Data Exchange T1059Command and Scripting Interpreter T1059.006Command and Scripting Interpreter: Python T1201Password Policy Discovery T1204.004User Execution: Malicious Copy and Paste T1559.001Inter-Process Communication: Component Object Model T1059.004Command and Scripting Interpreter: Unix Shell

persistence8

T1137.001Office Application Startup: Office Template Macros T1137.004Office Application Startup: Outlook Home Page T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1505.003Server Software Component: Web Shell T1543.003Create or Modify System Process: Windows Service T1112Modify Registry T1546.003Event Triggered Execution: Windows Management Instrumentation Event Subscription T1556.002Modify Authentication Process: Password Filter DLL

privilege escalation3

T1055Process Injection T1068Exploitation for Privilege Escalation T1548.002Abuse Elevation Control Mechanism: Bypass User Account Control

defense evasion13

T1562.002Impair Defenses: Disable Windows Event Logging T1655.001Masquerading: Match Legitimate Name or Location T1665Hide Infrastructure T1027.015Obfuscated Files or Information: Compression T1564.011Hide Artifacts: Ignore Process Interrupts T1027Obfuscated Files or Information T1036.002Masquerading: Right-to-Left Override T1036.007Masquerading: Double File Extension T1078.003Valid Accounts: Local Accounts T1218.007System Binary Proxy Execution: Msiexec T1564.001Hide Artifacts: Hidden Files and Directories T1685.006Disable or Modify Tools: Clear Linux or Mac System Logs T1690Prevent Command History Logging

stealth17

T1684.001Social Engineering for Impact: Impersonation T1027.013Obfuscated Files or Information: Encrypted/Encoded File T1036.005Masquerading: Match Legitimate Resource Name or Location T1140Deobfuscate/Decode Files or Information T1036Masquerading T1027.004Obfuscated Files or Information: Compile After Delivery T1027.010Obfuscated Files or Information: Command Obfuscation T1218.005System Binary Proxy Execution: Mshta T1027.003Obfuscated Files or Information: Steganography T1218.001System Binary Proxy Execution: Compiled HTML File T1218.003System Binary Proxy Execution: CMSTP T1218.011System Binary Proxy Execution: Rundll32 T1497.001Virtualization/Sandbox Evasion: System Checks T1014Rootkit T1027.002Obfuscated Files or Information: Software Packing T1027.005Obfuscated Files or Information: Indicator Removal from Tools T1070.004Indicator Removal: File Deletion

defense impairment3

T1553.002Subvert Trust Controls: Code Signing T1685Disable or Modify Tools T1686.003Disable or Modify System Firewall: Windows Host Firewall

credential access12

T1110.003Brute Force: Password Spraying T1555.003Credentials from Password Stores: Credentials from Web Browsers T1003.001OS Credential Dumping: LSASS Memory T1003.004OS Credential Dumping: LSA Secrets T1003.005OS Credential Dumping: Cached Domain Credentials T1552.001Unsecured Credentials: Credentials In Files T1555Credentials from Password Stores T1056.001Input Capture: Keylogging T1110Brute Force T1552.006Unsecured Credentials: Group Policy Preferences T1555.004Credentials from Password Stores: Windows Credential Manager T1040Network Sniffing

discovery19

T1422System Network Configuration Discovery T1057Process Discovery T1082System Information Discovery T1518Software Discovery T1016System Network Configuration Discovery T1033System Owner/User Discovery T1083File and Directory Discovery T1049System Network Connections Discovery T1087.002Account Discovery: Domain Account T1518.001Software Discovery: Security Software Discovery T1087.001Account Discovery: Local Account T1120Peripheral Device Discovery T1217Browser Information Discovery T1007System Service Discovery T1012Query Registry T1046Network Service Discovery T1069.001Permission Groups Discovery: Local Groups T1069.002Permission Groups Discovery: Domain Groups T1124System Time Discovery

lateral movement4

T1534Internal Spearphishing T1210Exploitation of Remote Services T1021.001Remote Services: Remote Desktop Protocol T1021.004Remote Services: SSH

collection13

T1025Data from Removable Media T1074.002Data Staged: Remote Data Staging T1213.006Data from Information Repositories: Databases T1113Screen Capture T1119Automated Collection T1074.001Data Staged: Local Data Staging T1560.001Archive Collected Data: Archive via Utility T1115Clipboard Data T1005Data from Local System T1114.001Email Collection: Local Email Collection T1123Audio Capture T1557Adversary-in-the-Middle T1560Archive Collected Data

command and control16

T1104Multi-Stage Channels T1573.001Encrypted Channel: Symmetric Cryptography T1573.002Encrypted Channel: Asymmetric Cryptography T1071.001Application Layer Protocol: Web Protocols T1105Ingress Tool Transfer T1132.001Data Encoding: Standard Encoding T1090Proxy T1090.002Proxy: External Proxy T1571Non-Standard Port T1572Protocol Tunneling T1071.004Application Layer Protocol: DNS T1102.002Web Service: Bidirectional Communication T1219Remote Access Tools T1219.002Remote Access Software: Remote Desktop Software T1008Fallback Channels T1095Non-Application Layer Protocol

exfiltration4

T1041Exfiltration Over C2 Channel T1048.003Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage T1020Automated Exfiltration

covered · brighter = more actors partial gap — no detectionhover a cell for technique detail

ksa-apt 84.4% (108/128)egypt-apt 78.9% (90/114)