HISTCONTROL, Query Registry, Data from Network Shared Drive, Standard Cryptographic Protocol, Brute Force, Change Default File Association, System Service Discovery, Startup Items, Custom Command and Control Protocol, Keychain, Exploitation for Privilege Escalation, System Network Connections Discovery, NTFS File Attributes, Process Hollowing, SID- History Injection, Setuid and Setgid, Modify Existing Service, Remote Desktop Protocol, Exfiltration Over Command and Control Channel, Gatekeeper Bypass, Spearphishing Attachment, Data Encoding, Credentials in Files, DLL Search Order Hijacking, Security Support Provider, Security Software Discovery, SIP and Trust Provider Hijacking, Input Prompt, Audio Capture, Authentication Package, Scripting, Data Compressed, Bash History, Indicator Removal on Host, Spearphishing Link, Custom Cryptographic Protocol, Trusted Developer Utilities, Remote Services, SSH Hijacking, Sudo Caching, Time Providers, Replication Through Removable Media, Hidden Files and Directories, BITS Jobs, Dynamic Data Exchange, Create Account, Launchctl, System Firmware, Network Service Scanning, Process Discovery, Process Injection, PowerShell, Rundll32, InstallUtil, Kernel Modules and Extensions, Web Service, Dylib Hijacking, File System Permissions Weakness, External Remote Services, Source, Two-Factor Authentication Interception, Exploitation of Remote Services, Peripheral Device Discovery, Disabling Security Tools, User Execution, Screen Capture, Extra Window Memory Injection, Domain Fronting, Local Job Scheduling, Indirect Command Execution, Execution through API, Process Doppelgänging, Launch Agent, Exfiltration Over Physical Medium, Signed Script Proxy Execution, Multi- hop Proxy, Video Capture, File Deletion, Graphical User Interface, Plist Modification, Regsvcs/Regasm, Launch Daemon, System Information Discovery, Pass the Ticket, Multilayer Encryption, Hidden Window, Service Registry Permissions Weakness, Communication Through Removable Media, Windows Management Instrumentation Event Subscription, Email Collection, Input Capture, CMSTP, AppInit DLLs, Permission Groups Discovery, Exploitation for Defense Evasion, Valid Accounts, Deobfuscate/Decode Files or Information, Port Knocking, Install Root Certificate, Hooking, File and Directory Discovery, Obfuscated Files or Information, Account Manipulation, Connection Proxy, Exploit Public- Facing Application, Sudo, Credential Dumping, Taint Shared Content, Application Window Discovery, Remote System Discovery, Redundant Access, Data Encrypted, Indicator Blocking, LC_MAIN Hijacking, Login Item, Network Share Connection Removal, Commonly Used Port, Data from Information Repositories, Automated Collection, Multi- Stage Channels, Mshta, Signed Binary Proxy Execution, DLL Side- Loading, System Network Configuration Discovery, Securityd Memory, Scheduled Transfer, Netsh Helper DLL, Remote Access Tools, Regsvr32, Data Obfuscation, LSASS Driver, Code Signing, Re-opened Applications, Application Deployment Software, Browser Bookmark Discovery, Fallback Channels, Browser Extensions, Private Keys, Man in the Browser, Bootkit, Scheduled Task, LLMNR/NBT- NS Poisoning, Component Firmware, AppCert DLLs, Network Share Discovery, Standard Application Layer Protocol, Component Object Model Hijacking, Supply Chain Compromise, Access Token Manipulation, Trap, Masquerading, Logon Scripts, Exploitation for Credential Access, Command- Line Interface, Accessibility Features, File System Logical Offsets, Network Sniffing, Service Execution, Path Interception, Distributed Component Object Model, Third- party Software, Screensaver, Application Shimming, Timestomp, Clipboard Data, Data Transfer Size Limits, Password Policy Discovery, Exfiltration Over Other Network Medium, DCShadow, Trusted Relationship, Data from Removable Media, LC_LOAD_DYLIB Addition, Kerberoasting, Drive-by Compromise, Forced Authentication, Modify Registry, Credentials in Registry, Spearphishing via Service, Uncommonly Used Port, New Service, Windows Admin Shares, Office Application Startup, Software Packing, Port Monitors, Windows Management Instrumentation, Bypass User Account Control, Shortcut Modification, Password Filter DLL, Data Staged, System Time Discovery, Remote File Copy, Space after Filename, Windows Remote Management, Winlogon Helper DLL, Hypervisor, Hidden Users, Hardware Additions, Binary Padding, Rootkit, Execution through Module Load, Automated Exfiltration, AppleScript, Web Shell, Shared Webroot, Exploitation for Client Execution, Pass the Hash, Indicator Removal from Tools, Registry Run Keys / Start Folder, Standard Non- Application Layer Protocol, Control Panel Items, Image File Execution Options Injection, Exfiltration Over Alternative Protocol, Multiband Communication, .bash_profile and .bashrc, Data from Local System, Clear Command History, System Owner/User Discovery, Rc.common, Account Discovery, HISTCONTROL, Query Registry, Data from Network Shared Drive, Standard Cryptographic Protocol, Brute Force, Change Default File Association, System Service Discovery, Startup Items, Custom Command and Control Protocol, Keychain, Exploitation for Privilege Escalation, System Network Connections Discovery, NTFS File Attributes, Process Hollowing, SID- History Injection, Setuid and Setgid, Modify Existing Service, Remote Desktop Protocol, Exfiltration Over Command and Control Channel, Gatekeeper Bypass, Spearphishing Attachment, Data Encoding, Credentials in Files, DLL Search Order Hijacking, Security Support Provider, Security Software Discovery, SIP and Trust Provider Hijacking, Input Prompt, Audio Capture, Authentication Package, Scripting, Data Compressed, Bash History, Indicator Removal on Host, Spearphishing Link, Custom Cryptographic Protocol, Trusted Developer Utilities, Remote Services, SSH Hijacking, Sudo Caching, Time Providers, Replication Through Removable Media, Hidden Files and Directories, BITS Jobs, Dynamic Data Exchange, Create Account, Launchctl, System Firmware, Network Service Scanning, Process Discovery, Process Injection, PowerShell, Rundll32, InstallUtil, Kernel Modules and Extensions, Web Service, Dylib Hijacking, File System Permissions Weakness, External Remote Services, Source, Two-Factor Authentication Interception, Exploitation of Remote Services, Peripheral Device Discovery, Disabling Security Tools, User Execution, Screen Capture, Extra Window Memory Injection, Domain Fronting, Local Job Scheduling, Indirect Command Execution, Execution through API, Process Doppelgänging, Launch Agent, Exfiltration Over Physical Medium, Signed Script Proxy Execution, Multi- hop Proxy, Video Capture, File Deletion, Graphical User Interface, Plist Modification, Regsvcs/Regasm, Launch Daemon, System Information Discovery, Pass the Ticket, Multilayer Encryption, Hidden Window, Service Registry Permissions Weakness, Communication Through Removable Media, Windows Management Instrumentation Event Subscription, Email Collection, Input Capture, CMSTP, AppInit DLLs, Permission Groups Discovery, Exploitation for Defense Evasion, Valid Accounts, Deobfuscate/Decode Files or Information, Port Knocking, Install Root Certificate, Hooking, File and Directory Discovery, Obfuscated Files or Information, Account Manipulation, Connection Proxy, Exploit Public- Facing Application, Sudo, Credential Dumping, Taint Shared Content, Application Window Discovery, Remote System Discovery, Redundant Access, Data Encrypted, Indicator Blocking, LC_MAIN Hijacking, Login Item, Network Share Connection Removal, Commonly Used Port, Data from Information Repositories, Automated Collection, Multi- Stage Channels, Mshta, Signed Binary Proxy Execution, DLL Side- Loading, System Network Configuration Discovery, Securityd Memory, Scheduled Transfer, Netsh Helper DLL, Remote Access Tools, Regsvr32, Data Obfuscation, LSASS Driver, Code Signing, Re-opened Applications, Application Deployment Software, Browser Bookmark Discovery, Fallback Channels, Browser Extensions, Private Keys, Man in the Browser, Bootkit, Scheduled Task, LLMNR/NBT- NS Poisoning, Component Firmware, AppCert DLLs, Network Share Discovery, Standard Application Layer Protocol, Component Object Model Hijacking, Supply Chain Compromise, Access Token Manipulation, Trap, Masquerading, Logon Scripts, Exploitation for Credential Access, Command- Line Interface, Accessibility Features, File System Logical Offsets, Network Sniffing, Service Execution, Path Interception, Distributed Component Object Model, Third- party Software, Screensaver, Application Shimming, Timestomp, Clipboard Data, Data Transfer Size Limits, Password Policy Discovery, Exfiltration Over Other Network Medium, DCShadow, Trusted Relationship, Data from Removable Media, LC_LOAD_DYLIB Addition, Kerberoasting, Drive-by Compromise, Forced Authentication, Modify Registry, Credentials in Registry, Spearphishing via Service, Uncommonly Used Port, New Service, Windows Admin Shares, Office Application Startup, Software Packing, Port Monitors, Windows Management Instrumentation, Bypass User Account Control, Shortcut Modification, Password Filter DLL, Data Staged, System Time Discovery, Remote File Copy, Space after Filename, Windows Remote Management, Winlogon Helper DLL, Hypervisor, Hidden Users, Hardware Additions, Binary Padding, Rootkit, Execution through Module Load, Automated Exfiltration, AppleScript, Web Shell, Shared Webroot, Exploitation for Client Execution, Pass the Hash, Indicator Removal from Tools, Registry Run Keys / Start Folder, Standard Non- Application Layer Protocol, Control Panel Items, Image File Execution Options Injection, Exfiltration Over Alternative Protocol, Multiband Communication, .bash_profile and .bashrc, Data from Local System, Clear Command History, System Owner/User Discovery, Rc.common, Account Discovery,
(Print)
HISTCONTROL,
Query Registry,
Data from Network Shared Drive,
Standard Cryptographic Protocol,
Brute Force,
Change Default File Association,
System Service Discovery,
Startup Items,
Custom Command and Control Protocol,
Keychain,
Exploitation for Privilege Escalation,
System Network Connections Discovery,
NTFS File Attributes,
Process Hollowing,
SID-History Injection,
Setuid and Setgid,
Modify Existing Service,
Remote Desktop Protocol,
Exfiltration Over Command and Control Channel,
Gatekeeper Bypass,
Spearphishing Attachment,
Data Encoding,
Credentials in Files,
DLL Search Order Hijacking,
Security Support Provider,
Security Software Discovery,
SIP and Trust Provider Hijacking,
Input Prompt,
Audio Capture,
Authentication Package,
Scripting,
Data Compressed,
Bash History,
Indicator Removal on Host,
Spearphishing Link,
Custom Cryptographic Protocol,
Trusted Developer Utilities,
Remote Services,
SSH Hijacking,
Sudo Caching,
Time Providers,
Replication Through Removable Media,
Hidden Files and Directories,
BITS Jobs,
Dynamic Data Exchange,
Create Account,
Launchctl,
System Firmware,
Network Service Scanning,
Process Discovery,
Process Injection,
PowerShell,
Rundll32,
InstallUtil,
Kernel Modules and Extensions,
Web Service,
Dylib Hijacking,
File System Permissions Weakness,
External Remote Services,
Source,
Two-Factor Authentication Interception,
Exploitation of Remote Services,
Peripheral Device Discovery,
Disabling Security Tools,
User Execution,
Screen Capture,
Extra Window Memory Injection,
Domain Fronting,
Local Job Scheduling,
Indirect Command Execution,
Execution through API,
Process Doppelgänging,
Launch Agent,
Exfiltration Over Physical Medium,
Signed Script Proxy Execution,
Multi-hop Proxy,
Video Capture,
File Deletion,
Graphical User Interface,
Plist Modification,
Regsvcs/Regasm,
Launch Daemon,
System Information Discovery,
Pass the Ticket,
Multilayer Encryption,
Hidden Window,
Service Registry Permissions Weakness,
Communication Through Removable Media,
Windows Management Instrumentation Event Subscription,
Email Collection,
Input Capture,
CMSTP,
AppInit DLLs,
Permission Groups Discovery,
Exploitation for Defense Evasion,
Valid Accounts,
Deobfuscate/Decode Files or Information,
Port Knocking,
Install Root Certificate,
Hooking,
File and Directory Discovery,
Obfuscated Files or Information,
Account Manipulation,
Connection Proxy,
Exploit Public-Facing Application,
Sudo,
Credential Dumping,
Taint Shared Content,
Application Window Discovery,
Remote System Discovery,
Redundant Access,
Data Encrypted,
Indicator Blocking,
LC_MAIN Hijacking,
Login Item,
Network Share Connection Removal,
Commonly Used Port,
Data from Information Repositories,
Automated Collection,
Multi-Stage Channels,
Mshta,
Signed Binary Proxy Execution,
DLL Side-Loading,
System Network Configuration Discovery,
Securityd Memory,
Scheduled Transfer,
Netsh Helper DLL,
Remote Access Tools,
Regsvr32,
Data Obfuscation,
LSASS Driver,
Code Signing,
Re-opened Applications,
Application Deployment Software,
Browser Bookmark Discovery,
Fallback Channels,
Browser Extensions,
Private Keys,
Man in the Browser,
Bootkit,
Scheduled Task,
LLMNR/NBT-NS Poisoning,
Component Firmware,
AppCert DLLs,
Network Share Discovery,
Standard Application Layer Protocol,
Component Object Model Hijacking,
Supply Chain Compromise,
Access Token Manipulation,
Trap,
Masquerading,
Logon Scripts,
Exploitation for Credential Access,
Command-Line Interface,
Accessibility Features,
File System Logical Offsets,
Network Sniffing,
Service Execution,
Path Interception,
Distributed Component Object Model,
Third-party Software,
Screensaver,
Application Shimming,
Timestomp,
Clipboard Data,
Data Transfer Size Limits,
Password Policy Discovery,
Exfiltration Over Other Network Medium,
DCShadow,
Trusted Relationship,
Data from Removable Media,
LC_LOAD_DYLIB Addition,
Kerberoasting,
Drive-by Compromise,
Forced Authentication,
Modify Registry,
Credentials in Registry,
Spearphishing via Service,
Uncommonly Used Port,
New Service,
Windows Admin Shares,
Office Application Startup,
Software Packing,
Port Monitors,
Windows Management Instrumentation,
Bypass User Account Control,
Shortcut Modification,
Password Filter DLL,
Data Staged,
System Time Discovery,
Remote File Copy,
Space after Filename,
Windows Remote Management,
Winlogon Helper DLL,
Hypervisor,
Hidden Users,
Hardware Additions,
Binary Padding,
Rootkit,
Execution through Module Load,
Automated Exfiltration,
AppleScript,
Web Shell,
Shared Webroot,
Exploitation for Client Execution,
Pass the Hash,
Indicator Removal from Tools,
Registry Run Keys / Start Folder,
Standard Non-Application Layer Protocol,
Control Panel Items,
Image File Execution Options Injection,
Exfiltration Over Alternative Protocol,
Multiband Communication,
.bash_profile and .bashrc,
Data from Local System,
Clear Command History,
System Owner/User Discovery,
Rc.common,
Account Discovery,
