MITRE ATT&CK Bingo

This bingo card has a free space and 657 words: name, Abuse Elevation Control Mechanism, Abuse Elevation Control Mechanism: Bypass User Account Control, Abuse Elevation Control Mechanism: Elevated Execution with Prompt, Abuse Elevation Control Mechanism: Setuid and Setgid, Abuse Elevation Control Mechanism: Sudo and Sudo Caching, Abuse Elevation Control Mechanism: TCC Manipulation, Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access, Access Token Manipulation, Access Token Manipulation: Create Process with Token, Access Token Manipulation: Make and Impersonate Token, Access Token Manipulation: Parent PID Spoofing, Access Token Manipulation: SID-History Injection, Access Token Manipulation: Token Impersonation/Theft, Account Access Removal, Account Discovery, Account Discovery: Cloud Account, Account Discovery: Domain Account, Account Discovery: Email Account, Account Discovery: Local Account, Account Manipulation, Account Manipulation: Additional Cloud Credentials, Account Manipulation: Additional Cloud Roles, Account Manipulation: Additional Container Cluster Roles, Account Manipulation: Additional Email Delegate Permissions, Account Manipulation: Additional Local or Domain Groups, Account Manipulation: Device Registration, Account Manipulation: SSH Authorized Keys, Acquire Access, Acquire Infrastructure, Acquire Infrastructure: Botnet, Acquire Infrastructure: DNS Server, Acquire Infrastructure: Domains, Acquire Infrastructure: Malvertising, Acquire Infrastructure: Server, Acquire Infrastructure: Serverless, Acquire Infrastructure: Virtual Private Server, Acquire Infrastructure: Web Services, Active Scanning, Active Scanning: Scanning IP Blocks, Active Scanning: Vulnerability Scanning, Active Scanning: Wordlist Scanning, Adversary-in-the-Middle, Adversary-in-the-Middle: ARP Cache Poisoning, Adversary-in-the-Middle: DHCP Spoofing, Adversary-in-the-Middle: Evil Twin, Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay, Application Layer Protocol, Application Layer Protocol: DNS, Application Layer Protocol: File Transfer Protocols, Application Layer Protocol: Mail Protocols, Application Layer Protocol: Publish/Subscribe Protocols, Application Layer Protocol: Web Protocols, Application Window Discovery, Archive Collected Data, Archive Collected Data: Archive via Custom Method, Archive Collected Data: Archive via Library, Archive Collected Data: Archive via Utility, Audio Capture, Automated Collection, Automated Exfiltration, Automated Exfiltration: Traffic Duplication, BITS Jobs, Boot or Logon Autostart Execution, Boot or Logon Autostart Execution: Active Setup, Boot or Logon Autostart Execution: Authentication Package, Boot or Logon Autostart Execution: Kernel Modules and Extensions, Boot or Logon Autostart Execution: LSASS Driver, Boot or Logon Autostart Execution: Login Items, Boot or Logon Autostart Execution: Port Monitors, Boot or Logon Autostart Execution: Print Processors, Boot or Logon Autostart Execution: Re-opened Applications, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution: Security Support Provider, Boot or Logon Autostart Execution: Shortcut Modification, Boot or Logon Autostart Execution: Time Providers, Boot or Logon Autostart Execution: Winlogon Helper DLL, Boot or Logon Autostart Execution: XDG Autostart Entries, Boot or Logon Initialization Scripts, Boot or Logon Initialization Scripts: Login Hook, Boot or Logon Initialization Scripts: Logon Script (Windows), Boot or Logon Initialization Scripts: Network Logon Script, Boot or Logon Initialization Scripts: RC Scripts, Boot or Logon Initialization Scripts: Startup Items, Browser Extensions, Browser Information Discovery, Browser Session Hijacking, Brute Force, Brute Force: Credential Stuffing, Brute Force: Password Cracking, Brute Force: Password Guessing, Brute Force: Password Spraying, Build Image on Host, Clipboard Data, Cloud Administration Command, Cloud Infrastructure Discovery, Cloud Service Dashboard, Cloud Service Discovery, Cloud Storage Object Discovery, Command and Scripting Interpreter, Command and Scripting Interpreter: AppleScript, Command and Scripting Interpreter: AutoHotKey & AutoIT, Command and Scripting Interpreter: Cloud API, Command and Scripting Interpreter: JavaScript, Command and Scripting Interpreter: Lua, Command and Scripting Interpreter: Network Device CLI, Command and Scripting Interpreter: PowerShell, Command and Scripting Interpreter: Python, Command and Scripting Interpreter: Unix Shell, Command and Scripting Interpreter: Visual Basic, Command and Scripting Interpreter: Windows Command Shell, Communication Through Removable Media, Compromise Accounts, Compromise Accounts: Cloud Accounts, Compromise Accounts: Email Accounts, Compromise Accounts: Social Media Accounts, Compromise Host Software Binary, Compromise Infrastructure, Compromise Infrastructure: Botnet, Compromise Infrastructure: DNS Server, Compromise Infrastructure: Domains, Compromise Infrastructure: Network Devices, Compromise Infrastructure: Server, Compromise Infrastructure: Serverless, Compromise Infrastructure: Virtual Private Server, Compromise Infrastructure: Web Services, Container Administration Command, Container and Resource Discovery, Content Injection, Create Account, Create Account: Cloud Account, Create Account: Domain Account, Create Account: Local Account, Create or Modify System Process, Create or Modify System Process: Container Service, Create or Modify System Process: Launch Agent, Create or Modify System Process: Launch Daemon, Create or Modify System Process: Systemd Service, Create or Modify System Process: Windows Service, Credentials from Password Stores, Credentials from Password Stores: Cloud Secrets Management Stores, Credentials from Password Stores: Credentials from Web Browsers, Credentials from Password Stores: Keychain, Credentials from Password Stores: Password Managers, Credentials from Password Stores: Securityd Memory, Credentials from Password Stores: Windows Credential Manager, Data Destruction, Data Destruction: Lifecycle-Triggered Deletion, Data Encoding, Data Encoding: Non-Standard Encoding, Data Encoding: Standard Encoding, Data Encrypted for Impact, Data Manipulation, Data Manipulation: Runtime Data Manipulation, Data Manipulation: Stored Data Manipulation, Data Manipulation: Transmitted Data Manipulation, Data Obfuscation, Data Obfuscation: Junk Data, Data Obfuscation: Protocol or Service Impersonation, Data Obfuscation: Steganography, Data Staged, Data Staged: Local Data Staging, Data Staged: Remote Data Staging, Data Transfer Size Limits, Data from Cloud Storage, Data from Configuration Repository, Data from Configuration Repository: Network Device Configuration Dump, Data from Configuration Repository: SNMP (MIB Dump), Data from Information Repositories, Data from Information Repositories: Code Repositories, Data from Information Repositories: Confluence, Data from Information Repositories: Customer Relationship Management Software, Data from Information Repositories: Messaging Applications, Data from Information Repositories: Sharepoint, Data from Local System, Data from Network Shared Drive, Data from Removable Media, Debugger Evasion, Defacement, Defacement: External Defacement, Defacement: Internal Defacement, Deobfuscate/Decode Files or Information, Deploy Container, Develop Capabilities, Develop Capabilities: Code Signing Certificates, Develop Capabilities: Digital Certificates, Develop Capabilities: Exploits, Develop Capabilities: Malware, Device Driver Discovery, Direct Volume Access, Disk Wipe, Disk Wipe: Disk Content Wipe, Disk Wipe: Disk Structure Wipe, Domain Trust Discovery, Domain or Tenant Policy Modification, Domain or Tenant Policy Modification: Group Policy Modification, Domain or Tenant Policy Modification: Trust Modification, Drive-by Compromise, Dynamic Resolution, Dynamic Resolution: DNS Calculation, Dynamic Resolution: Domain Generation Algorithms, Dynamic Resolution: Fast Flux DNS, Email Collection, Email Collection: Email Forwarding Rule, Email Collection: Local Email Collection, Email Collection: Remote Email Collection, Encrypted Channel, Encrypted Channel: Asymmetric Cryptography, Encrypted Channel: Symmetric Cryptography, Endpoint Denial of Service, Endpoint Denial of Service: Application Exhaustion Flood, Endpoint Denial of Service: Application or System Exploitation, Endpoint Denial of Service: OS Exhaustion Flood, Endpoint Denial of Service: Service Exhaustion Flood, Escape to Host, Establish Accounts, Establish Accounts: Cloud Accounts, Establish Accounts: Email Accounts, Establish Accounts: Social Media Accounts, Event Triggered Execution, Event Triggered Execution: Accessibility Features, Event Triggered Execution: AppCert DLLs, Event Triggered Execution: AppInit DLLs, Event Triggered Execution: Application Shimming, Event Triggered Execution: Change Default File Association, Event Triggered Execution: Component Object Model Hijacking, Event Triggered Execution: Emond, Event Triggered Execution: Image File Execution Options Injection, Event Triggered Execution: Installer Packages, Event Triggered Execution: LC_LOAD_DYLIB Addition, Event Triggered Execution: Netsh Helper DLL, Event Triggered Execution: PowerShell Profile, Event Triggered Execution: Screensaver, Event Triggered Execution: Trap, Event Triggered Execution: Udev Rules, Event Triggered Execution: Unix Shell Configuration Modification, Event Triggered Execution: Windows Management Instrumentation Event Subscription, Execution Guardrails, Execution Guardrails: Environmental Keying, Execution Guardrails: Mutual Exclusion, Exfiltration Over Alternative Protocol, Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol, Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol, Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol, Exfiltration Over C2 Channel, Exfiltration Over Other Network Medium, Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth, Exfiltration Over Physical Medium, Exfiltration Over Physical Medium: Exfiltration over USB, Exfiltration Over Web Service, Exfiltration Over Web Service: Exfiltration Over Webhook, Exfiltration Over Web Service: Exfiltration to Cloud Storage, Exfiltration Over Web Service: Exfiltration to Code Repository, Exfiltration Over Web Service: Exfiltration to Text Storage Sites, Exploit Public-Facing Application, Exploitation for Client Execution, Exploitation for Credential Access, Exploitation for Defense Evasion, Exploitation for Privilege Escalation, Exploitation of Remote Services, External Remote Services, Fallback Channels, File and Directory Discovery, File and Directory Permissions Modification, File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification, File and Directory Permissions Modification: Windows File and Directory Permissions Modification, Financial Theft, Firmware Corruption, Forced Authentication, Forge Web Credentials, Forge Web Credentials: SAML Tokens, Forge Web Credentials: Web Cookies, Gather Victim Host Information, Gather Victim Host Information: Client Configurations, Gather Victim Host Information: Firmware, Gather Victim Host Information: Hardware, Gather Victim Host Information: Software, Gather Victim Identity Information, Gather Victim Identity Information: Credentials, Gather Victim Identity Information: Email Addresses, Gather Victim Identity Information: Employee Names, Gather Victim Network Information, Gather Victim Network Information: DNS, Gather Victim Network Information: Domain Properties, Gather Victim Network Information: IP Addresses, Gather Victim Network Information: Network Security Appliances, Gather Victim Network Information: Network Topology, Gather Victim Network Information: Network Trust Dependencies, Gather Victim Org Information, Gather Victim Org Information: Business Relationships, Gather Victim Org Information: Determine Physical Locations, Gather Victim Org Information: Identify Business Tempo, Gather Victim Org Information: Identify Roles, Group Policy Discovery, Hardware Additions, Hide Artifacts, Hide Artifacts: Email Hiding Rules, Hide Artifacts: File/Path Exclusions, Hide Artifacts: Hidden File System, Hide Artifacts: Hidden Files and Directories, Hide Artifacts: Hidden Users, Hide Artifacts: Hidden Window, Hide Artifacts: Ignore Process Interrupts, Hide Artifacts: NTFS File Attributes, Hide Artifacts: Process Argument Spoofing, Hide Artifacts: Resource Forking, Hide Artifacts: Run Virtual Instance, Hide Artifacts: VBA Stomping, Hide Infrastructure, Hijack Execution Flow, Hijack Execution Flow: AppDomainManager, Hijack Execution Flow: COR_PROFILER, Hijack Execution Flow: DLL Search Order Hijacking, Hijack Execution Flow: DLL Side-Loading, Hijack Execution Flow: Dylib Hijacking, Hijack Execution Flow: Dynamic Linker Hijacking, Hijack Execution Flow: Executable Installer File Permissions Weakness, Hijack Execution Flow: KernelCallbackTable, Hijack Execution Flow: Path Interception by PATH Environment Variable, Hijack Execution Flow: Path Interception by Search Order Hijacking, Hijack Execution Flow: Path Interception by Unquoted Path, Hijack Execution Flow: Services File Permissions Weakness, Hijack Execution Flow: Services Registry Permissions Weakness, Impair Defenses, Impair Defenses: Disable Windows Event Logging, Impair Defenses: Disable or Modify Cloud Firewall, Impair Defenses: Disable or Modify Cloud Logs, Impair Defenses: Disable or Modify Linux Audit System, Impair Defenses: Disable or Modify System Firewall, Impair Defenses: Disable or Modify Tools, Impair Defenses: Downgrade Attack, Impair Defenses: Impair Command History Logging, Impair Defenses: Indicator Blocking, Impair Defenses: Safe Mode Boot, Impair Defenses: Spoof Security Alerting, Impersonation, Implant Internal Image, Indicator Removal, Indicator Removal: Clear Command History, Indicator Removal: Clear Linux or Mac System Logs, Indicator Removal: Clear Mailbox Data, Indicator Removal: Clear Network Connection History and Configurations, Indicator Removal: Clear Persistence, Indicator Removal: Clear Windows Event Logs, Indicator Removal: File Deletion, Indicator Removal: Network Share Connection Removal, Indicator Removal: Relocate Malware, Indicator Removal: Timestomp, Indirect Command Execution, Ingress Tool Transfer, Inhibit System Recovery, Input Capture, Input Capture: Credential API Hooking, Input Capture: GUI Input Capture, Input Capture: Keylogging, Input Capture: Web Portal Capture, Inter-Process Communication, Inter-Process Communication: Component Object Model, Inter-Process Communication: Dynamic Data Exchange, Inter-Process Communication: XPC Services, Internal Spearphishing, Lateral Tool Transfer, Log Enumeration, Masquerading, Masquerading: Break Process Trees, Masquerading: Double File Extension, Masquerading: Invalid Code Signature, Masquerading: Masquerade Account Name, Masquerading: Masquerade File Type, Masquerading: Masquerade Task or Service, Masquerading: Match Legitimate Name or Location, Masquerading: Rename System Utilities, Masquerading: Right-to-Left Override, Masquerading: Space after Filename, Modify Authentication Process, Modify Authentication Process: Conditional Access Policies, Modify Authentication Process: Domain Controller Authentication, Modify Authentication Process: Hybrid Identity, Modify Authentication Process: Multi-Factor Authentication, Modify Authentication Process: Network Device Authentication, Modify Authentication Process: Network Provider DLL, Modify Authentication Process: Password Filter DLL, Modify Authentication Process: Pluggable Authentication Modules, Modify Authentication Process: Reversible Encryption, Modify Cloud Compute Infrastructure, Modify Cloud Compute Infrastructure: Create Cloud Instance, Modify Cloud Compute Infrastructure: Create Snapshot, Modify Cloud Compute Infrastructure: Delete Cloud Instance, Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations, Modify Cloud Compute Infrastructure: Revert Cloud Instance, Modify Cloud Resource Hierarchy, Modify Registry, Modify System Image, Modify System Image: Downgrade System Image, Modify System Image: Patch System Image, Multi-Factor Authentication Interception, Multi-Factor Authentication Request Generation, Multi-Stage Channels, Native API, Network Boundary Bridging, Network Boundary Bridging: Network Address Translation Traversal, Network Denial of Service, Network Denial of Service: Direct Network Flood, Network Denial of Service: Reflection Amplification, Network Service Discovery, Network Share Discovery, Network Sniffing, Non-Application Layer Protocol, Non-Standard Port, OS Credential Dumping, OS Credential Dumping: /etc/passwd and /etc/shadow, OS Credential Dumping: Cached Domain Credentials, OS Credential Dumping: DCSync, OS Credential Dumping: LSA Secrets, OS Credential Dumping: LSASS Memory, OS Credential Dumping: NTDS, OS Credential Dumping: Proc Filesystem, OS Credential Dumping: Security Account Manager, Obfuscated Files or Information, Obfuscated Files or Information: Binary Padding, Obfuscated Files or Information: Command Obfuscation, Obfuscated Files or Information: Compile After Delivery, Obfuscated Files or Information: Dynamic API Resolution, Obfuscated Files or Information: Embedded Payloads, Obfuscated Files or Information: Encrypted/Encoded File, Obfuscated Files or Information: Fileless Storage, Obfuscated Files or Information: HTML Smuggling, Obfuscated Files or Information: Indicator Removal from Tools, Obfuscated Files or Information: LNK Icon Smuggling, Obfuscated Files or Information: Polymorphic Code, Obfuscated Files or Information: Software Packing, Obfuscated Files or Information: Steganography, Obfuscated Files or Information: Stripped Payloads, Obtain Capabilities, Obtain Capabilities: Artificial Intelligence, Obtain Capabilities: Code Signing Certificates, Obtain Capabilities: Digital Certificates, Obtain Capabilities: Exploits, Obtain Capabilities: Malware, Obtain Capabilities: Tool, Obtain Capabilities: Vulnerabilities, Office Application Startup, Office Application Startup: Add-ins, Office Application Startup: Office Template Macros, Office Application Startup: Office Test, Office Application Startup: Outlook Forms, Office Application Startup: Outlook Home Page, Office Application Startup: Outlook Rules, Password Policy Discovery, Peripheral Device Discovery, Permission Groups Discovery, Permission Groups Discovery: Cloud Groups, Permission Groups Discovery: Domain Groups, Permission Groups Discovery: Local Groups, Phishing, Phishing for Information, Phishing for Information: Spearphishing Attachment, Phishing for Information: Spearphishing Link, Phishing for Information: Spearphishing Service, Phishing for Information: Spearphishing Voice, Phishing: Spearphishing Attachment, Phishing: Spearphishing Link, Phishing: Spearphishing Voice, Phishing: Spearphishing via Service, Plist File Modification, Power Settings, Pre-OS Boot, Pre-OS Boot: Bootkit, Pre-OS Boot: Component Firmware, Pre-OS Boot: ROMMONkit, Pre-OS Boot: System Firmware, Pre-OS Boot: TFTP Boot, Process Discovery, Process Injection, Process Injection: Asynchronous Procedure Call, Process Injection: Dynamic-link Library Injection, Process Injection: Extra Window Memory Injection, Process Injection: ListPlanting, Process Injection: Portable Executable Injection, Process Injection: Proc Memory, Process Injection: Process Doppelgänging, Process Injection: Process Hollowing, Process Injection: Ptrace System Calls, Process Injection: Thread Execution Hijacking, Process Injection: Thread Local Storage, Process Injection: VDSO Hijacking, Protocol Tunneling, Proxy, Proxy: Domain Fronting, Proxy: External Proxy, Proxy: Internal Proxy, Proxy: Multi-hop Proxy, Query Registry, Reflective Code Loading, Remote Access Software, Remote Service Session Hijacking, Remote Service Session Hijacking: RDP Hijacking, Remote Service Session Hijacking: SSH Hijacking, Remote Services, Remote Services: Cloud Services, Remote Services: Direct Cloud VM Connections, Remote Services: Distributed Component Object Model, Remote Services: Remote Desktop Protocol, Remote Services: SMB/Windows Admin Shares, Remote Services: SSH, Remote Services: VNC, Remote Services: Windows Remote Management, Remote System Discovery, Replication Through Removable Media, Resource Hijacking, Resource Hijacking: Bandwidth Hijacking, Resource Hijacking: Cloud Service Hijacking, Resource Hijacking: Compute Hijacking, Resource Hijacking: SMS Pumping, Rogue Domain Controller, Rootkit, Scheduled Task/Job, Scheduled Task/Job: At, Scheduled Task/Job: Container Orchestration Job, Scheduled Task/Job: Cron, Scheduled Task/Job: Scheduled Task, Scheduled Task/Job: Systemd Timers, Scheduled Transfer, Screen Capture, Search Closed Sources, Search Closed Sources: Purchase Technical Data, Search Closed Sources: Threat Intel Vendors, Search Open Technical Databases, Search Open Technical Databases: CDNs, Search Open Technical Databases: DNS/Passive DNS, Search Open Technical Databases: Digital Certificates, Search Open Technical Databases: Scan Databases, Search Open Technical Databases: WHOIS, Search Open Websites/Domains, Search Open Websites/Domains: Code Repositories, Search Open Websites/Domains: Search Engines, Search Open Websites/Domains: Social Media, Search Victim-Owned Websites, Server Software Component, Server Software Component: IIS Components, Server Software Component: SQL Stored Procedures, Server Software Component: Terminal Services DLL, Server Software Component: Transport Agent, Server Software Component: Web Shell, Serverless Execution, Service Stop, Shared Modules, Software Deployment Tools, Software Discovery, Software Discovery: Security Software Discovery, Stage Capabilities, Stage Capabilities: Drive-by Target, Stage Capabilities: Install Digital Certificate, Stage Capabilities: Link Target, Stage Capabilities: SEO Poisoning, Stage Capabilities: Upload Malware, Stage Capabilities: Upload Tool, Steal Application Access Token, Steal Web Session Cookie, Steal or Forge Authentication Certificates, Steal or Forge Kerberos Tickets, Steal or Forge Kerberos Tickets: AS-REP Roasting, Steal or Forge Kerberos Tickets: Ccache Files, Steal or Forge Kerberos Tickets: Golden Ticket, Steal or Forge Kerberos Tickets: Kerberoasting, Steal or Forge Kerberos Tickets: Silver Ticket, Subvert Trust Controls, Subvert Trust Controls: Code Signing, Subvert Trust Controls: Code Signing Policy Modification, Subvert Trust Controls: Gatekeeper Bypass, Subvert Trust Controls: Install Root Certificate, Subvert Trust Controls: Mark-of-the-Web Bypass, Subvert Trust Controls: SIP and Trust Provider Hijacking, Supply Chain Compromise, Supply Chain Compromise: Compromise Hardware Supply Chain, Supply Chain Compromise: Compromise Software Dependencies and Development Tools, Supply Chain Compromise: Compromise Software Supply Chain, System Binary Proxy Execution, System Binary Proxy Execution: CMSTP, System Binary Proxy Execution: Compiled HTML File, System Binary Proxy Execution: Control Panel, System Binary Proxy Execution: Electron Applications, System Binary Proxy Execution: InstallUtil, System Binary Proxy Execution: MMC, System Binary Proxy Execution: Mavinject, System Binary Proxy Execution: Mshta, System Binary Proxy Execution: Msiexec, System Binary Proxy Execution: Odbcconf, System Binary Proxy Execution: Regsvcs/Regasm, System Binary Proxy Execution: Regsvr32, System Binary Proxy Execution: Rundll32, System Binary Proxy Execution: Verclsid, System Information Discovery, System Location Discovery, System Location Discovery: System Language Discovery, System Network Configuration Discovery, System Network Configuration Discovery: Internet Connection Discovery, System Network Configuration Discovery: Wi-Fi Discovery, System Network Connections Discovery, System Owner/User Discovery, System Script Proxy Execution, System Script Proxy Execution: PubPrn, System Script Proxy Execution: SyncAppvPublishingServer, System Service Discovery, System Services, System Services: Launchctl, System Services: Service Execution, System Shutdown/Reboot, System Time Discovery, Taint Shared Content, Template Injection, Traffic Signaling, Traffic Signaling: Port Knocking, Traffic Signaling: Socket Filters, Transfer Data to Cloud Account, Trusted Developer Utilities Proxy Execution, Trusted Developer Utilities Proxy Execution: ClickOnce, Trusted Developer Utilities Proxy Execution: MSBuild, Trusted Relationship, Unsecured Credentials, Unsecured Credentials: Bash History, Unsecured Credentials: Chat Messages, Unsecured Credentials: Cloud Instance Metadata API, Unsecured Credentials: Container API, Unsecured Credentials: Credentials In Files, Unsecured Credentials: Credentials in Registry, Unsecured Credentials: Group Policy Preferences, Unsecured Credentials: Private Keys, Unused/Unsupported Cloud Regions, Use Alternate Authentication Material, Use Alternate Authentication Material: Application Access Token, Use Alternate Authentication Material: Pass the Hash, Use Alternate Authentication Material: Pass the Ticket, Use Alternate Authentication Material: Web Session Cookie, User Execution, User Execution: Malicious File, User Execution: Malicious Image, User Execution: Malicious Link, Valid Accounts, Valid Accounts: Cloud Accounts, Valid Accounts: Default Accounts, Valid Accounts: Domain Accounts, Valid Accounts: Local Accounts, Video Capture, Virtualization/Sandbox Evasion, Virtualization/Sandbox Evasion: System Checks, Virtualization/Sandbox Evasion: Time Based Evasion, Virtualization/Sandbox Evasion: User Activity Based Checks, Weaken Encryption, Weaken Encryption: Disable Crypto Hardware, Weaken Encryption: Reduce Key Space, Web Service, Web Service: Bidirectional Communication, Web Service: Dead Drop Resolver, Web Service: One-Way Communication, Windows Management Instrumentation and XSL Script Processing.

More like this:

It's Security BINGO | Cloud Security BINGO | Cyber Threats | Cyber Bingo | Cyber Bingo