← Back to Actors
Salt Typhoon
Salt Typhoon
[Salt Typhoon](https://attack.mitre.org/groups/G1045) is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP). [Salt Typhoon](https://attack.mitre.org/groups/G1045) has targeted and leveraged public facing network edge devices to gain access to victim environments. [Salt Typhoon](https://attack.mitre.org/groups/G1045) has been publicly associated with activities resembling other security industry reported activity grou...
60
Techniques
50
Covered
10
Gaps
83%
Coverage
Coverage50/60
GAPS (10)
COVERED (50)
T1005Data from Local System51 det.T1016System Network Configuration Discovery41 det.T1018Remote System Discovery52 det.T1020.001Traffic Duplication1 det.T1021.001Remote Desktop Protocol55 det.T1021.004SSH38 det.T1027.010Command Obfuscation42 det.T1040Network Sniffing15 det.T1046Network Service Discovery53 det.T1048.003Exfiltration Over Unencrypted Non-C2 Protocol23 det.T1059.004Unix Shell177 det.T1059.006Python55 det.T1059.013Container CLI/API1 det.T1070.002Clear Linux or Mac System Logs9 det.T1070.003Clear Command History15 det.T1071.001Web Protocols83 det.T1071.002File Transfer Protocols1 det.T1072Software Deployment Tools13 det.T1078Valid Accounts320 det.T1082System Information Discovery91 det.T1090Proxy50 det.T1090.003Multi-hop Proxy9 det.T1095Non-Application Layer Protocol26 det.T1098.004SSH Authorized Keys14 det.T1105Ingress Tool Transfer199 det.T1110.001Password Guessing42 det.T1110.002Password Cracking2 det.T1132.001Standard Encoding5 det.T1136Create Account40 det.T1136.001Local Account46 det.T1190Exploit Public-Facing Application240 det.T1199Trusted Relationship6 det.T1543.005Container Service2 det.T1548.003Sudo and Sudo Caching54 det.T1552.001Credentials In Files62 det.T1556Modify Authentication Process82 det.T1562.004Disable or Modify System Firewall50 det.T1569System Services16 det.T1571Non-Standard Port17 det.T1572Protocol Tunneling62 det.T1587Develop Capabilities4 det.T1587.001Malware10 det.T1588.002Tool13 det.T1595Active Scanning30 det.T1602.002Network Device Configuration Dump1 det.T1610Deploy Container25 det.T1685Disable or Modify Tools281 det.T1685.006Clear Linux or Mac System Logs4 det.T1686Disable or Modify System Firewall19 det.T1686.002Network Device Firewall2 det.