Redundant Access, NTFS File Attributes, Pass the Hash, Extra Window Memory Injection, Communication Through Removable Media, Remote File Copy, Taint Shared Content, Hypervisor, Indicator Blocking, System Service Discovery, Scheduled Task, Scripting, Kernel Modules and Extensions, Bootkit, Create Account, Exfiltration Over Command and Control Channel, InstallUtil, Network Share Connection Removal, Custom Cryptographic Protocol, Access Token Manipulation, Exploitation for Privilege Escalation, Remote Desktop Protocol, Trusted Developer Utilities, Drive-by Compromise, Setuid and Setgid, Code Signing, Web Service, Deobfuscate/Decode Files or Information, File System Permissions Weakness, Third- party Software, Path Interception, File System Logical Offsets, Port Knocking, Process Discovery, Clipboard Data, Pass the Ticket, Connection Proxy, Authentication Package, Graphical User Interface, Brute Force, Masquerading, New Service, System Owner/User Discovery, Exfiltration Over Other Network Medium, Uncommonly Used Port, Remote Access Tools, SID- History Injection, Port Monitors, Modify Existing Service, Two-Factor Authentication Interception, Account Discovery, CMSTP, Browser Bookmark Discovery, Hooking, Standard Application Layer Protocol, Signed Binary Proxy Execution, Gatekeeper Bypass, Clear Command History, Disabling Security Tools, BITS Jobs, Fallback Channels, SSH Hijacking, Service Registry Permissions Weakness, Rootkit, Local Job Scheduling, Bash History, Hidden Window, DLL Search Order Hijacking, AppCert DLLs, Windows Management Instrumentation Event Subscription, DCShadow, Data Compressed, Execution through Module Load, Account Manipulation, Credentials in Files, Exploitation for Credential Access, Dynamic Data Exchange, Data Encrypted, Application Deployment Software, Component Firmware, Bypass User Account Control, Plist Modification, Launch Daemon, Input Prompt, Trap, Password Policy Discovery, Binary Padding, Exploit Public- Facing Application, Data from Network Shared Drive, Credentials in Registry, Netsh Helper DLL, Hardware Additions, Automated Collection, Scheduled Transfer, Multiband Communication, Control Panel Items, Keychain, Spearphishing Attachment, Supply Chain Compromise, Launchctl, Video Capture, File Deletion, Network Share Discovery, Valid Accounts, Query Registry, Sudo, Security Support Provider, Application Window Discovery, Obfuscated Files or Information, Permission Groups Discovery, Exploitation for Client Execution, Automated Exfiltration, SIP and Trust Provider Hijacking, Application Shimming, Securityd Memory, Shortcut Modification, Data Transfer Size Limits, Email Collection, Security Software Discovery, LC_LOAD_DYLIB Addition, User Execution, Rundll32, Hidden Files and Directories, Windows Remote Management, Peripheral Device Discovery, Distributed Component Object Model, Windows Admin Shares, Execution through API, Input Capture, .bash_profile and .bashrc, Sudo Caching, Launch Agent, Exploitation of Remote Services, Browser Extensions, DLL Side- Loading, Dylib Hijacking, Web Shell, Remote Services, Remote System Discovery, LC_MAIN Hijacking, Data Encoding, Commonly Used Port, Shared Webroot, Process Hollowing, Hidden Users, Command- Line Interface, Install Root Certificate, Time Providers, Rc.common, Startup Items, System Network Configuration Discovery, Indicator Removal on Host, System Firmware, Indicator Removal from Tools, Timestomp, Custom Command and Control Protocol, Forced Authentication, System Information Discovery, Mshta, Service Execution, Man in the Browser, AppInit DLLs, Password Filter DLL, Network Sniffing, Multi- hop Proxy, Windows Management Instrumentation, Screen Capture, Multi- Stage Channels, Private Keys, LSASS Driver, Office Application Startup, Spearphishing via Service, Image File Execution Options Injection, File and Directory Discovery, Accessibility Features, Multilayer Encryption, Data Staged, Regsvr32, Modify Registry, Kerberoasting, Audio Capture, Process Doppelgänging, Re-opened Applications, Standard Non- Application Layer Protocol, Network Service Scanning, Data from Removable Media, Source, Logon Scripts, PowerShell, Data from Information Repositories, Screensaver, Winlogon Helper DLL, Standard Cryptographic Protocol, Replication Through Removable Media, Indirect Command Execution, System Time Discovery, Exfiltration Over Physical Medium, Software Packing, Data Obfuscation, Regsvcs/Regasm, Component Object Model Hijacking, Signed Script Proxy Execution, AppleScript, LLMNR/NBT- NS Poisoning, Exploitation for Defense Evasion, Registry Run Keys / Start Folder, Spearphishing Link, Space after Filename, Change Default File Association, Domain Fronting, System Network Connections Discovery, Credential Dumping, Trusted Relationship, External Remote Services, Data from Local System, Login Item, Exfiltration Over Alternative Protocol, HISTCONTROL, Process Injection, Redundant Access, NTFS File Attributes, Pass the Hash, Extra Window Memory Injection, Communication Through Removable Media, Remote File Copy, Taint Shared Content, Hypervisor, Indicator Blocking, System Service Discovery, Scheduled Task, Scripting, Kernel Modules and Extensions, Bootkit, Create Account, Exfiltration Over Command and Control Channel, InstallUtil, Network Share Connection Removal, Custom Cryptographic Protocol, Access Token Manipulation, Exploitation for Privilege Escalation, Remote Desktop Protocol, Trusted Developer Utilities, Drive-by Compromise, Setuid and Setgid, Code Signing, Web Service, Deobfuscate/Decode Files or Information, File System Permissions Weakness, Third- party Software, Path Interception, File System Logical Offsets, Port Knocking, Process Discovery, Clipboard Data, Pass the Ticket, Connection Proxy, Authentication Package, Graphical User Interface, Brute Force, Masquerading, New Service, System Owner/User Discovery, Exfiltration Over Other Network Medium, Uncommonly Used Port, Remote Access Tools, SID- History Injection, Port Monitors, Modify Existing Service, Two-Factor Authentication Interception, Account Discovery, CMSTP, Browser Bookmark Discovery, Hooking, Standard Application Layer Protocol, Signed Binary Proxy Execution, Gatekeeper Bypass, Clear Command History, Disabling Security Tools, BITS Jobs, Fallback Channels, SSH Hijacking, Service Registry Permissions Weakness, Rootkit, Local Job Scheduling, Bash History, Hidden Window, DLL Search Order Hijacking, AppCert DLLs, Windows Management Instrumentation Event Subscription, DCShadow, Data Compressed, Execution through Module Load, Account Manipulation, Credentials in Files, Exploitation for Credential Access, Dynamic Data Exchange, Data Encrypted, Application Deployment Software, Component Firmware, Bypass User Account Control, Plist Modification, Launch Daemon, Input Prompt, Trap, Password Policy Discovery, Binary Padding, Exploit Public- Facing Application, Data from Network Shared Drive, Credentials in Registry, Netsh Helper DLL, Hardware Additions, Automated Collection, Scheduled Transfer, Multiband Communication, Control Panel Items, Keychain, Spearphishing Attachment, Supply Chain Compromise, Launchctl, Video Capture, File Deletion, Network Share Discovery, Valid Accounts, Query Registry, Sudo, Security Support Provider, Application Window Discovery, Obfuscated Files or Information, Permission Groups Discovery, Exploitation for Client Execution, Automated Exfiltration, SIP and Trust Provider Hijacking, Application Shimming, Securityd Memory, Shortcut Modification, Data Transfer Size Limits, Email Collection, Security Software Discovery, LC_LOAD_DYLIB Addition, User Execution, Rundll32, Hidden Files and Directories, Windows Remote Management, Peripheral Device Discovery, Distributed Component Object Model, Windows Admin Shares, Execution through API, Input Capture, .bash_profile and .bashrc, Sudo Caching, Launch Agent, Exploitation of Remote Services, Browser Extensions, DLL Side- Loading, Dylib Hijacking, Web Shell, Remote Services, Remote System Discovery, LC_MAIN Hijacking, Data Encoding, Commonly Used Port, Shared Webroot, Process Hollowing, Hidden Users, Command- Line Interface, Install Root Certificate, Time Providers, Rc.common, Startup Items, System Network Configuration Discovery, Indicator Removal on Host, System Firmware, Indicator Removal from Tools, Timestomp, Custom Command and Control Protocol, Forced Authentication, System Information Discovery, Mshta, Service Execution, Man in the Browser, AppInit DLLs, Password Filter DLL, Network Sniffing, Multi- hop Proxy, Windows Management Instrumentation, Screen Capture, Multi- Stage Channels, Private Keys, LSASS Driver, Office Application Startup, Spearphishing via Service, Image File Execution Options Injection, File and Directory Discovery, Accessibility Features, Multilayer Encryption, Data Staged, Regsvr32, Modify Registry, Kerberoasting, Audio Capture, Process Doppelgänging, Re-opened Applications, Standard Non- Application Layer Protocol, Network Service Scanning, Data from Removable Media, Source, Logon Scripts, PowerShell, Data from Information Repositories, Screensaver, Winlogon Helper DLL, Standard Cryptographic Protocol, Replication Through Removable Media, Indirect Command Execution, System Time Discovery, Exfiltration Over Physical Medium, Software Packing, Data Obfuscation, Regsvcs/Regasm, Component Object Model Hijacking, Signed Script Proxy Execution, AppleScript, LLMNR/NBT- NS Poisoning, Exploitation for Defense Evasion, Registry Run Keys / Start Folder, Spearphishing Link, Space after Filename, Change Default File Association, Domain Fronting, System Network Connections Discovery, Credential Dumping, Trusted Relationship, External Remote Services, Data from Local System, Login Item, Exfiltration Over Alternative Protocol, HISTCONTROL, Process Injection,
(Print)
Redundant Access,
NTFS File Attributes,
Pass the Hash,
Extra Window Memory Injection,
Communication Through Removable Media,
Remote File Copy,
Taint Shared Content,
Hypervisor,
Indicator Blocking,
System Service Discovery,
Scheduled Task,
Scripting,
Kernel Modules and Extensions,
Bootkit,
Create Account,
Exfiltration Over Command and Control Channel,
InstallUtil,
Network Share Connection Removal,
Custom Cryptographic Protocol,
Access Token Manipulation,
Exploitation for Privilege Escalation,
Remote Desktop Protocol,
Trusted Developer Utilities,
Drive-by Compromise,
Setuid and Setgid,
Code Signing,
Web Service,
Deobfuscate/Decode Files or Information,
File System Permissions Weakness,
Third-party Software,
Path Interception,
File System Logical Offsets,
Port Knocking,
Process Discovery,
Clipboard Data,
Pass the Ticket,
Connection Proxy,
Authentication Package,
Graphical User Interface,
Brute Force,
Masquerading,
New Service,
System Owner/User Discovery,
Exfiltration Over Other Network Medium,
Uncommonly Used Port,
Remote Access Tools,
SID-History Injection,
Port Monitors,
Modify Existing Service,
Two-Factor Authentication Interception,
Account Discovery,
CMSTP,
Browser Bookmark Discovery,
Hooking,
Standard Application Layer Protocol,
Signed Binary Proxy Execution,
Gatekeeper Bypass,
Clear Command History,
Disabling Security Tools,
BITS Jobs,
Fallback Channels,
SSH Hijacking,
Service Registry Permissions Weakness,
Rootkit,
Local Job Scheduling,
Bash History,
Hidden Window,
DLL Search Order Hijacking,
AppCert DLLs,
Windows Management Instrumentation Event Subscription,
DCShadow,
Data Compressed,
Execution through Module Load,
Account Manipulation,
Credentials in Files,
Exploitation for Credential Access,
Dynamic Data Exchange,
Data Encrypted,
Application Deployment Software,
Component Firmware,
Bypass User Account Control,
Plist Modification,
Launch Daemon,
Input Prompt,
Trap,
Password Policy Discovery,
Binary Padding,
Exploit Public-Facing Application,
Data from Network Shared Drive,
Credentials in Registry,
Netsh Helper DLL,
Hardware Additions,
Automated Collection,
Scheduled Transfer,
Multiband Communication,
Control Panel Items,
Keychain,
Spearphishing Attachment,
Supply Chain Compromise,
Launchctl,
Video Capture,
File Deletion,
Network Share Discovery,
Valid Accounts,
Query Registry,
Sudo,
Security Support Provider,
Application Window Discovery,
Obfuscated Files or Information,
Permission Groups Discovery,
Exploitation for Client Execution,
Automated Exfiltration,
SIP and Trust Provider Hijacking,
Application Shimming,
Securityd Memory,
Shortcut Modification,
Data Transfer Size Limits,
Email Collection,
Security Software Discovery,
LC_LOAD_DYLIB Addition,
User Execution,
Rundll32,
Hidden Files and Directories,
Windows Remote Management,
Peripheral Device Discovery,
Distributed Component Object Model,
Windows Admin Shares,
Execution through API,
Input Capture,
.bash_profile and .bashrc,
Sudo Caching,
Launch Agent,
Exploitation of Remote Services,
Browser Extensions,
DLL Side-Loading,
Dylib Hijacking,
Web Shell,
Remote Services,
Remote System Discovery,
LC_MAIN Hijacking,
Data Encoding,
Commonly Used Port,
Shared Webroot,
Process Hollowing,
Hidden Users,
Command-Line Interface,
Install Root Certificate,
Time Providers,
Rc.common,
Startup Items,
System Network Configuration Discovery,
Indicator Removal on Host,
System Firmware,
Indicator Removal from Tools,
Timestomp,
Custom Command and Control Protocol,
Forced Authentication,
System Information Discovery,
Mshta,
Service Execution,
Man in the Browser,
AppInit DLLs,
Password Filter DLL,
Network Sniffing,
Multi-hop Proxy,
Windows Management Instrumentation,
Screen Capture,
Multi-Stage Channels,
Private Keys,
LSASS Driver,
Office Application Startup,
Spearphishing via Service,
Image File Execution Options Injection,
File and Directory Discovery,
Accessibility Features,
Multilayer Encryption,
Data Staged,
Regsvr32,
Modify Registry,
Kerberoasting,
Audio Capture,
Process Doppelgänging,
Re-opened Applications,
Standard Non-Application Layer Protocol,
Network Service Scanning,
Data from Removable Media,
Source,
Logon Scripts,
PowerShell,
Data from Information Repositories,
Screensaver,
Winlogon Helper DLL,
Standard Cryptographic Protocol,
Replication Through Removable Media,
Indirect Command Execution,
System Time Discovery,
Exfiltration Over Physical Medium,
Software Packing,
Data Obfuscation,
Regsvcs/Regasm,
Component Object Model Hijacking,
Signed Script Proxy Execution,
AppleScript,
LLMNR/NBT-NS Poisoning,
Exploitation for Defense Evasion,
Registry Run Keys / Start Folder,
Spearphishing Link,
Space after Filename,
Change Default File Association,
Domain Fronting,
System Network Connections Discovery,
Credential Dumping,
Trusted Relationship,
External Remote Services,
Data from Local System,
Login Item,
Exfiltration Over Alternative Protocol,
HISTCONTROL,
Process Injection,
