Space after Filename, Dylib Hijacking, Third- party Software, Standard Non- Application Layer Protocol, Execution through API, HISTCONTROL, Exploit Public- Facing Application, Component Firmware, Shared Webroot, Hooking, New Service, Disabling Security Tools, File and Directory Discovery, Create Account, Access Token Manipulation, Data Compressed, Redundant Access, DLL Search Order Hijacking, System Information Discovery, Change Default File Association, Component Object Model Hijacking, Indicator Blocking, Exploitation for Client Execution, Code Signing, Remote Access Tools, Plist Modification, Regsvcs/Regasm, Time Providers, Standard Cryptographic Protocol, Security Support Provider, Bootkit, Data Obfuscation, System Owner/User Discovery, Input Prompt, CMSTP, Video Capture, File Deletion, Remote Desktop Protocol, Drive-by Compromise, Software Packing, Permission Groups Discovery, Masquerading, Rc.common, Launch Daemon, Scheduled Transfer, Private Keys, User Execution, Obfuscated Files or Information, Sudo Caching, LSASS Driver, NTFS File Attributes, Pass the Hash, Hardware Additions, Regsvr32, Pass the Ticket, Exploitation for Credential Access, Accessibility Features, Security Software Discovery, Clipboard Data, Extra Window Memory Injection, Re-opened Applications, Rundll32, Peripheral Device Discovery, SIP and Trust Provider Hijacking, Multiband Communication, Automated Collection, Hidden Files and Directories, Securityd Memory, Exfiltration Over Alternative Protocol, Launch Agent, Data from Local System, AppleScript, Account Discovery, Standard Application Layer Protocol, Password Filter DLL, Exploitation for Privilege Escalation, Two-Factor Authentication Interception, Windows Admin Shares, Setuid and Setgid, Brute Force, Exploitation of Remote Services, Windows Remote Management, DLL Side- Loading, Execution through Module Load, System Firmware, Signed Binary Proxy Execution, Data Encoding, Hidden Window, Browser Bookmark Discovery, Kernel Modules and Extensions, Timestomp, Replication Through Removable Media, Keychain, LLMNR/NBT- NS Poisoning, .bash_profile and .bashrc, Startup Items, Commonly Used Port, Clear Command History, Screensaver, Deobfuscate/Decode Files or Information, System Time Discovery, Supply Chain Compromise, File System Permissions Weakness, Windows Management Instrumentation Event Subscription, Credentials in Registry, Process Doppelgänging, Image File Execution Options Injection, LC_LOAD_DYLIB Addition, Domain Fronting, Valid Accounts, Scripting, Local Job Scheduling, Remote File Copy, Screen Capture, Data Transfer Size Limits, Spearphishing Attachment, Network Share Discovery, SSH Hijacking, Data from Network Shared Drive, Password Policy Discovery, Credential Dumping, Exfiltration Over Physical Medium, Indicator Removal on Host, Install Root Certificate, Modify Registry, Custom Cryptographic Protocol, Trusted Relationship, Hypervisor, Data from Information Repositories, Multi- Stage Channels, Exfiltration Over Other Network Medium, Web Shell, Login Item, Network Share Connection Removal, Path Interception, Rootkit, Application Shimming, Winlogon Helper DLL, Exfiltration Over Command and Control Channel, Email Collection, Gatekeeper Bypass, System Service Discovery, Indirect Command Execution, Command- Line Interface, Taint Shared Content, Automated Exfiltration, AppCert DLLs, Audio Capture, Bash History, Scheduled Task, Network Sniffing, Netsh Helper DLL, Dynamic Data Exchange, Bypass User Account Control, Spearphishing via Service, Account Manipulation, Logon Scripts, Browser Extensions, Indicator Removal from Tools, External Remote Services, Service Registry Permissions Weakness, Port Monitors, SID- History Injection, Man in the Browser, File System Logical Offsets, Application Deployment Software, Process Injection, Windows Management Instrumentation, Multi- hop Proxy, Registry Run Keys / Start Folder, Web Service, LC_MAIN Hijacking, Custom Command and Control Protocol, Mshta, Binary Padding, Data Encrypted, Remote System Discovery, Port Knocking, Graphical User Interface, BITS Jobs, DCShadow, Service Execution, Input Capture, Remote Services, Launchctl, Multilayer Encryption, Trap, Application Window Discovery, System Network Connections Discovery, Sudo, Data Staged, System Network Configuration Discovery, AppInit DLLs, Control Panel Items, Distributed Component Object Model, Data from Removable Media, Fallback Channels, InstallUtil, Authentication Package, Query Registry, Process Discovery, Trusted Developer Utilities, Forced Authentication, Shortcut Modification, Signed Script Proxy Execution, Exploitation for Defense Evasion, PowerShell, Connection Proxy, Kerberoasting, Network Service Scanning, Process Hollowing, Spearphishing Link, Hidden Users, Communication Through Removable Media, Office Application Startup, Source, Credentials in Files, Uncommonly Used Port, Modify Existing Service, Space after Filename, Dylib Hijacking, Third- party Software, Standard Non- Application Layer Protocol, Execution through API, HISTCONTROL, Exploit Public- Facing Application, Component Firmware, Shared Webroot, Hooking, New Service, Disabling Security Tools, File and Directory Discovery, Create Account, Access Token Manipulation, Data Compressed, Redundant Access, DLL Search Order Hijacking, System Information Discovery, Change Default File Association, Component Object Model Hijacking, Indicator Blocking, Exploitation for Client Execution, Code Signing, Remote Access Tools, Plist Modification, Regsvcs/Regasm, Time Providers, Standard Cryptographic Protocol, Security Support Provider, Bootkit, Data Obfuscation, System Owner/User Discovery, Input Prompt, CMSTP, Video Capture, File Deletion, Remote Desktop Protocol, Drive-by Compromise, Software Packing, Permission Groups Discovery, Masquerading, Rc.common, Launch Daemon, Scheduled Transfer, Private Keys, User Execution, Obfuscated Files or Information, Sudo Caching, LSASS Driver, NTFS File Attributes, Pass the Hash, Hardware Additions, Regsvr32, Pass the Ticket, Exploitation for Credential Access, Accessibility Features, Security Software Discovery, Clipboard Data, Extra Window Memory Injection, Re-opened Applications, Rundll32, Peripheral Device Discovery, SIP and Trust Provider Hijacking, Multiband Communication, Automated Collection, Hidden Files and Directories, Securityd Memory, Exfiltration Over Alternative Protocol, Launch Agent, Data from Local System, AppleScript, Account Discovery, Standard Application Layer Protocol, Password Filter DLL, Exploitation for Privilege Escalation, Two-Factor Authentication Interception, Windows Admin Shares, Setuid and Setgid, Brute Force, Exploitation of Remote Services, Windows Remote Management, DLL Side- Loading, Execution through Module Load, System Firmware, Signed Binary Proxy Execution, Data Encoding, Hidden Window, Browser Bookmark Discovery, Kernel Modules and Extensions, Timestomp, Replication Through Removable Media, Keychain, LLMNR/NBT- NS Poisoning, .bash_profile and .bashrc, Startup Items, Commonly Used Port, Clear Command History, Screensaver, Deobfuscate/Decode Files or Information, System Time Discovery, Supply Chain Compromise, File System Permissions Weakness, Windows Management Instrumentation Event Subscription, Credentials in Registry, Process Doppelgänging, Image File Execution Options Injection, LC_LOAD_DYLIB Addition, Domain Fronting, Valid Accounts, Scripting, Local Job Scheduling, Remote File Copy, Screen Capture, Data Transfer Size Limits, Spearphishing Attachment, Network Share Discovery, SSH Hijacking, Data from Network Shared Drive, Password Policy Discovery, Credential Dumping, Exfiltration Over Physical Medium, Indicator Removal on Host, Install Root Certificate, Modify Registry, Custom Cryptographic Protocol, Trusted Relationship, Hypervisor, Data from Information Repositories, Multi- Stage Channels, Exfiltration Over Other Network Medium, Web Shell, Login Item, Network Share Connection Removal, Path Interception, Rootkit, Application Shimming, Winlogon Helper DLL, Exfiltration Over Command and Control Channel, Email Collection, Gatekeeper Bypass, System Service Discovery, Indirect Command Execution, Command- Line Interface, Taint Shared Content, Automated Exfiltration, AppCert DLLs, Audio Capture, Bash History, Scheduled Task, Network Sniffing, Netsh Helper DLL, Dynamic Data Exchange, Bypass User Account Control, Spearphishing via Service, Account Manipulation, Logon Scripts, Browser Extensions, Indicator Removal from Tools, External Remote Services, Service Registry Permissions Weakness, Port Monitors, SID- History Injection, Man in the Browser, File System Logical Offsets, Application Deployment Software, Process Injection, Windows Management Instrumentation, Multi- hop Proxy, Registry Run Keys / Start Folder, Web Service, LC_MAIN Hijacking, Custom Command and Control Protocol, Mshta, Binary Padding, Data Encrypted, Remote System Discovery, Port Knocking, Graphical User Interface, BITS Jobs, DCShadow, Service Execution, Input Capture, Remote Services, Launchctl, Multilayer Encryption, Trap, Application Window Discovery, System Network Connections Discovery, Sudo, Data Staged, System Network Configuration Discovery, AppInit DLLs, Control Panel Items, Distributed Component Object Model, Data from Removable Media, Fallback Channels, InstallUtil, Authentication Package, Query Registry, Process Discovery, Trusted Developer Utilities, Forced Authentication, Shortcut Modification, Signed Script Proxy Execution, Exploitation for Defense Evasion, PowerShell, Connection Proxy, Kerberoasting, Network Service Scanning, Process Hollowing, Spearphishing Link, Hidden Users, Communication Through Removable Media, Office Application Startup, Source, Credentials in Files, Uncommonly Used Port, Modify Existing Service,
(Print)
Space after Filename,
Dylib Hijacking,
Third-party Software,
Standard Non-Application Layer Protocol,
Execution through API,
HISTCONTROL,
Exploit Public-Facing Application,
Component Firmware,
Shared Webroot,
Hooking,
New Service,
Disabling Security Tools,
File and Directory Discovery,
Create Account,
Access Token Manipulation,
Data Compressed,
Redundant Access,
DLL Search Order Hijacking,
System Information Discovery,
Change Default File Association,
Component Object Model Hijacking,
Indicator Blocking,
Exploitation for Client Execution,
Code Signing,
Remote Access Tools,
Plist Modification,
Regsvcs/Regasm,
Time Providers,
Standard Cryptographic Protocol,
Security Support Provider,
Bootkit,
Data Obfuscation,
System Owner/User Discovery,
Input Prompt,
CMSTP,
Video Capture,
File Deletion,
Remote Desktop Protocol,
Drive-by Compromise,
Software Packing,
Permission Groups Discovery,
Masquerading,
Rc.common,
Launch Daemon,
Scheduled Transfer,
Private Keys,
User Execution,
Obfuscated Files or Information,
Sudo Caching,
LSASS Driver,
NTFS File Attributes,
Pass the Hash,
Hardware Additions,
Regsvr32,
Pass the Ticket,
Exploitation for Credential Access,
Accessibility Features,
Security Software Discovery,
Clipboard Data,
Extra Window Memory Injection,
Re-opened Applications,
Rundll32,
Peripheral Device Discovery,
SIP and Trust Provider Hijacking,
Multiband Communication,
Automated Collection,
Hidden Files and Directories,
Securityd Memory,
Exfiltration Over Alternative Protocol,
Launch Agent,
Data from Local System,
AppleScript,
Account Discovery,
Standard Application Layer Protocol,
Password Filter DLL,
Exploitation for Privilege Escalation,
Two-Factor Authentication Interception,
Windows Admin Shares,
Setuid and Setgid,
Brute Force,
Exploitation of Remote Services,
Windows Remote Management,
DLL Side-Loading,
Execution through Module Load,
System Firmware,
Signed Binary Proxy Execution,
Data Encoding,
Hidden Window,
Browser Bookmark Discovery,
Kernel Modules and Extensions,
Timestomp,
Replication Through Removable Media,
Keychain,
LLMNR/NBT-NS Poisoning,
.bash_profile and .bashrc,
Startup Items,
Commonly Used Port,
Clear Command History,
Screensaver,
Deobfuscate/Decode Files or Information,
System Time Discovery,
Supply Chain Compromise,
File System Permissions Weakness,
Windows Management Instrumentation Event Subscription,
Credentials in Registry,
Process Doppelgänging,
Image File Execution Options Injection,
LC_LOAD_DYLIB Addition,
Domain Fronting,
Valid Accounts,
Scripting,
Local Job Scheduling,
Remote File Copy,
Screen Capture,
Data Transfer Size Limits,
Spearphishing Attachment,
Network Share Discovery,
SSH Hijacking,
Data from Network Shared Drive,
Password Policy Discovery,
Credential Dumping,
Exfiltration Over Physical Medium,
Indicator Removal on Host,
Install Root Certificate,
Modify Registry,
Custom Cryptographic Protocol,
Trusted Relationship,
Hypervisor,
Data from Information Repositories,
Multi-Stage Channels,
Exfiltration Over Other Network Medium,
Web Shell,
Login Item,
Network Share Connection Removal,
Path Interception,
Rootkit,
Application Shimming,
Winlogon Helper DLL,
Exfiltration Over Command and Control Channel,
Email Collection,
Gatekeeper Bypass,
System Service Discovery,
Indirect Command Execution,
Command-Line Interface,
Taint Shared Content,
Automated Exfiltration,
AppCert DLLs,
Audio Capture,
Bash History,
Scheduled Task,
Network Sniffing,
Netsh Helper DLL,
Dynamic Data Exchange,
Bypass User Account Control,
Spearphishing via Service,
Account Manipulation,
Logon Scripts,
Browser Extensions,
Indicator Removal from Tools,
External Remote Services,
Service Registry Permissions Weakness,
Port Monitors,
SID-History Injection,
Man in the Browser,
File System Logical Offsets,
Application Deployment Software,
Process Injection,
Windows Management Instrumentation,
Multi-hop Proxy,
Registry Run Keys / Start Folder,
Web Service,
LC_MAIN Hijacking,
Custom Command and Control Protocol,
Mshta,
Binary Padding,
Data Encrypted,
Remote System Discovery,
Port Knocking,
Graphical User Interface,
BITS Jobs,
DCShadow,
Service Execution,
Input Capture,
Remote Services,
Launchctl,
Multilayer Encryption,
Trap,
Application Window Discovery,
System Network Connections Discovery,
Sudo,
Data Staged,
System Network Configuration Discovery,
AppInit DLLs,
Control Panel Items,
Distributed Component Object Model,
Data from Removable Media,
Fallback Channels,
InstallUtil,
Authentication Package,
Query Registry,
Process Discovery,
Trusted Developer Utilities,
Forced Authentication,
Shortcut Modification,
Signed Script Proxy Execution,
Exploitation for Defense Evasion,
PowerShell,
Connection Proxy,
Kerberoasting,
Network Service Scanning,
Process Hollowing,
Spearphishing Link,
Hidden Users,
Communication Through Removable Media,
Office Application Startup,
Source,
Credentials in Files,
Uncommonly Used Port,
Modify Existing Service,
