MITRE ATT&CK Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.

1. Account Access Removal
2. Create or Modify System Process: Systemd Service
3. Hijack Execution Flow: AppDomainManager
4. Command and Scripting Interpreter: PowerShell
5. Exfiltration Over Web Service: Exfiltration to Cloud Storage
6. Rogue Domain Controller
7. Use Alternate Authentication Material: Web Session Cookie
8. System Network Configuration Discovery: Internet Connection Discovery
9. Endpoint Denial of Service: Application Exhaustion Flood
10. Obfuscated Files or Information: Polymorphic Code
11. Gather Victim Network Information: DNS
12. Search Open Technical Databases: CDNs
13. Content Injection
14. Data from Configuration Repository: Network Device Configuration Dump
15. Adversary-in-the-Middle: ARP Cache Poisoning
16. Modify Cloud Resource Hierarchy
17. Search Closed Sources: Threat Intel Vendors
18. Query Registry
19. Communication Through Removable Media
20. Unsecured Credentials: Container API
21. Gather Victim Host Information
22. Scheduled Task/Job: Systemd Timers
23. Hijack Execution Flow: Dynamic Linker Hijacking
24. Server Software Component: Terminal Services DLL
25. Browser Extensions
26. Cloud Infrastructure Discovery
27. Masquerading: Right-to-Left Override
28. Adversary-in-the-Middle: Evil Twin
29. Application Layer Protocol: Publish/Subscribe Protocols
30. Forge Web Credentials: SAML Tokens
31. Financial Theft
32. Office Application Startup: Add-ins
33. Account Manipulation: Additional Email Delegate Permissions
34. Compromise Accounts: Social Media Accounts
35. Credentials from Password Stores: Password Managers
36. Pre-OS Boot: ROMMONkit
37. Create or Modify System Process: Launch Agent
38. Steal or Forge Kerberos Tickets: Kerberoasting
39. Modify Authentication Process: Pluggable Authentication Modules
40. Subvert Trust Controls: SIP and Trust Provider Hijacking
41. File and Directory Permissions Modification
42. System Binary Proxy Execution: Msiexec
43. Data Obfuscation: Steganography
44. Unused/Unsupported Cloud Regions
45. Access Token Manipulation: Token Impersonation/Theft
46. Process Injection: Process Hollowing
47. Data Transfer Size Limits
48. OS Credential Dumping: LSA Secrets
49. Server Software Component: SQL Stored Procedures
50. Transfer Data to Cloud Account
51. Valid Accounts: Domain Accounts
52. Impair Defenses: Disable or Modify Tools
53. Modify Authentication Process: Multi-Factor Authentication
54. Modify Authentication Process: Password Filter DLL
55. Remote Services: Windows Remote Management
56. Password Policy Discovery
57. Compromise Infrastructure: Web Services
58. Permission Groups Discovery: Domain Groups
59. Group Policy Discovery
60. Gather Victim Org Information: Determine Physical Locations
61. Boot or Logon Autostart Execution: Winlogon Helper DLL
62. Masquerading: Double File Extension
63. Boot or Logon Autostart Execution
64. Exfiltration Over Web Service: Exfiltration to Text Storage Sites
65. Obfuscated Files or Information: Compile After Delivery
66. Remote Services
67. Command and Scripting Interpreter: Network Device CLI
68. Gather Victim Host Information: Firmware
69. Email Collection: Email Forwarding Rule
70. System Binary Proxy Execution: Mavinject
71. System Shutdown/Reboot
72. Obfuscated Files or Information: Dynamic API Resolution
73. Trusted Developer Utilities Proxy Execution: MSBuild
74. Build Image on Host
75. Data from Removable Media
76. Event Triggered Execution: Emond
77. System Services: Service Execution
78. Compromise Infrastructure: Server
79. System Binary Proxy Execution: Regsvr32
80. User Execution: Malicious Image
81. Event Triggered Execution: Netsh Helper DLL
82. Web Service: One-Way Communication
83. Scheduled Task/Job
84. Impair Defenses
85. Scheduled Task/Job: At
86. Unsecured Credentials: Group Policy Preferences
87. Command and Scripting Interpreter
88. Office Application Startup: Outlook Home Page
89. Compromise Infrastructure: Virtual Private Server
90. Data Obfuscation
91. Use Alternate Authentication Material
92. OS Credential Dumping: Proc Filesystem
93. System Services: Launchctl
94. System Time Discovery
95. Network Boundary Bridging
96. Modify Authentication Process: Network Provider DLL
97. Gather Victim Network Information: IP Addresses
98. Server Software Component
99. Obfuscated Files or Information: Embedded Payloads
100. Proxy
101. User Execution: Malicious Link
102. Input Capture: Web Portal Capture
103. Endpoint Denial of Service
104. Event Triggered Execution: Change Default File Association
105. Process Injection: Thread Execution Hijacking
106. Virtualization/Sandbox Evasion: Time Based Evasion
107. Exploit Public-Facing Application
108. Use Alternate Authentication Material: Pass the Hash
109. Hide Artifacts
110. System Binary Proxy Execution: Rundll32
111. Pre-OS Boot: Bootkit
112. Use Alternate Authentication Material: Pass the Ticket
113. Impair Defenses: Downgrade Attack
114. Search Open Technical Databases: Digital Certificates
115. System Owner/User Discovery
116. Active Scanning: Vulnerability Scanning
117. Cloud Service Dashboard
118. Boot or Logon Autostart Execution: Kernel Modules and Extensions
119. Access Token Manipulation: Create Process with Token
120. Scheduled Task/Job: Cron
121. Acquire Infrastructure: Virtual Private Server
122. Stage Capabilities: Upload Tool
123. Boot or Logon Initialization Scripts: RC Scripts
124. Develop Capabilities: Malware
125. Remote Services: SMB/Windows Admin Shares
126. Compromise Accounts
127. System Binary Proxy Execution
128. Hijack Execution Flow: Services File Permissions Weakness
129. Rootkit
130. Web Service: Bidirectional Communication
131. Dynamic Resolution
132. Active Scanning: Scanning IP Blocks
133. Steal or Forge Kerberos Tickets: AS-REP Roasting
134. Modify System Image: Patch System Image
135. Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol
136. OS Credential Dumping: /etc/passwd and /etc/shadow
137. Data Manipulation: Stored Data Manipulation
138. Hide Infrastructure
139. Browser Information Discovery
140. Acquire Access
141. System Service Discovery
142. Obfuscated Files or Information: Indicator Removal from Tools
143. Create Account
144. Compromise Infrastructure: Botnet
145. Establish Accounts
146. Modify Authentication Process: Network Device Authentication
147. Search Open Technical Databases: DNS/Passive DNS
148. System Binary Proxy Execution: Odbcconf
149. Hide Artifacts: NTFS File Attributes
150. Adversary-in-the-Middle
151. Hide Artifacts: Hidden Window
152. Gather Victim Identity Information: Credentials
153. Event Triggered Execution: Windows Management Instrumentation Event Subscription
154. Gather Victim Identity Information: Employee Names
155. Steal Application Access Token
156. Weaken Encryption
157. Hijack Execution Flow: Path Interception by PATH Environment Variable
158. Hide Artifacts: Hidden Users
159. System Binary Proxy Execution: Mshta
160. Gather Victim Network Information
161. Data from Cloud Storage
162. Gather Victim Host Information: Software
163. Process Injection: VDSO Hijacking
164. Domain or Tenant Policy Modification: Group Policy Modification
165. Event Triggered Execution
166. Obfuscated Files or Information: Stripped Payloads
167. System Binary Proxy Execution: Electron Applications
168. Clipboard Data
169. Abuse Elevation Control Mechanism: Setuid and Setgid
170. Office Application Startup: Office Template Macros
171. Hijack Execution Flow: Executable Installer File Permissions Weakness
172. Supply Chain Compromise: Compromise Software Dependencies and Development Tools
173. Develop Capabilities: Digital Certificates
174. Server Software Component: Web Shell
175. Compromise Infrastructure: Domains
176. Modify Authentication Process: Reversible Encryption
177. Process Injection: Thread Local Storage
178. Inter-Process Communication: XPC Services
179. Cloud Storage Object Discovery
180. Phishing for Information: Spearphishing Voice
181. Create or Modify System Process
182. Log Enumeration
183. Event Triggered Execution: Component Object Model Hijacking
184. Phishing: Spearphishing Attachment
185. Disk Wipe: Disk Content Wipe
186. Brute Force: Password Spraying
187. Execution Guardrails
188. Application Layer Protocol
189. Acquire Infrastructure: Serverless
190. External Remote Services
191. Modify Registry
192. Cloud Service Discovery
193. Office Application Startup: Outlook Forms
194. Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
195. Indicator Removal: Relocate Malware
196. Phishing: Spearphishing Voice
197. Dynamic Resolution: Fast Flux DNS
198. Gather Victim Host Information: Hardware
199. Deobfuscate/Decode Files or Information
200. Establish Accounts: Cloud Accounts
201. Indirect Command Execution
202. Modify Authentication Process: Domain Controller Authentication
203. Encrypted Channel: Symmetric Cryptography
204. System Services
205. Forge Web Credentials
206. Steal or Forge Authentication Certificates
207. Data Manipulation: Runtime Data Manipulation
208. Exploitation for Defense Evasion
209. Steal or Forge Kerberos Tickets: Golden Ticket
210. Non-Standard Port
211. Masquerading: Masquerade Task or Service
212. Audio Capture
213. Proxy: External Proxy
214. Boot or Logon Initialization Scripts: Network Logon Script
215. Account Manipulation: SSH Authorized Keys
216. Impair Defenses: Disable or Modify System Firewall
217. Search Open Technical Databases
218. Supply Chain Compromise: Compromise Software Supply Chain
219. Scheduled Task/Job: Scheduled Task
220. Subvert Trust Controls: Code Signing
221. Input Capture
222. Acquire Infrastructure: DNS Server
223. Account Discovery: Local Account
224. Unsecured Credentials
225. Modify Cloud Compute Infrastructure: Create Snapshot
226. Masquerading: Space after Filename
227. Indicator Removal: Timestomp
228. Gather Victim Org Information
229. Masquerading: Match Legitimate Name or Location
230. Defacement: External Defacement
231. Event Triggered Execution: Unix Shell Configuration Modification
232. Adversary-in-the-Middle: DHCP Spoofing
233. Peripheral Device Discovery
234. Masquerading: Masquerade File Type
235. Create or Modify System Process: Container Service
236. Modify Authentication Process: Conditional Access Policies
237. Phishing for Information: Spearphishing Attachment
238. Compromise Infrastructure: Network Devices
239. OS Credential Dumping: DCSync
240. Server Software Component: IIS Components
241. Data Obfuscation: Junk Data
242. System Binary Proxy Execution: CMSTP
243. Create or Modify System Process: Launch Daemon
244. Supply Chain Compromise
245. Event Triggered Execution: Screensaver
246. Archive Collected Data
247. Data Staged: Local Data Staging
248. Modify Authentication Process
249. Boot or Logon Autostart Execution: XDG Autostart Entries
250. Command and Scripting Interpreter: Lua
251. Gather Victim Org Information: Business Relationships
252. Weaken Encryption: Disable Crypto Hardware
253. Permission Groups Discovery
254. Abuse Elevation Control Mechanism: TCC Manipulation
255. Service Stop
256. Obtain Capabilities: Digital Certificates
257. Exfiltration Over C2 Channel
258. Remote Services: Remote Desktop Protocol
259. Endpoint Denial of Service: Application or System Exploitation
260. Search Closed Sources: Purchase Technical Data
261. Input Capture: Keylogging
262. Inter-Process Communication: Component Object Model
263. Boot or Logon Autostart Execution: Re-opened Applications
264. Masquerading: Invalid Code Signature
265. Boot or Logon Initialization Scripts: Logon Script (Windows)
266. Boot or Logon Autostart Execution: LSASS Driver
267. System Script Proxy Execution
268. Phishing
269. OS Credential Dumping: Cached Domain Credentials
270. Multi-Factor Authentication Request Generation
271. Archive Collected Data: Archive via Custom Method
272. Event Triggered Execution: AppCert DLLs
273. Abuse Elevation Control Mechanism: Sudo and Sudo Caching
274. Compromise Host Software Binary
275. Valid Accounts: Default Accounts
276. Process Injection: Proc Memory
277. Drive-by Compromise
278. Hide Artifacts: VBA Stomping
279. Process Injection: Extra Window Memory Injection
280. Hijack Execution Flow: DLL Side-Loading
281. Application Layer Protocol: DNS
282. Obfuscated Files or Information: Software Packing
283. Data from Information Repositories: Customer Relationship Management Software
284. Modify Authentication Process: Hybrid Identity
285. Permission Groups Discovery: Cloud Groups
286. Abuse Elevation Control Mechanism: Elevated Execution with Prompt
287. Hijack Execution Flow: DLL Search Order Hijacking
288. Remote Access Software
289. Obfuscated Files or Information: LNK Icon Smuggling
290. System Script Proxy Execution: SyncAppvPublishingServer
291. Impair Defenses: Disable or Modify Cloud Firewall
292. Account Manipulation: Additional Cloud Roles
293. Inter-Process Communication
294. Unsecured Credentials: Cloud Instance Metadata API
295. Implant Internal Image
296. Resource Hijacking: Cloud Service Hijacking
297. Automated Collection
298. Boot or Logon Autostart Execution: Print Processors
299. Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
300. Command and Scripting Interpreter: Cloud API
301. Search Open Websites/Domains: Social Media
302. Indicator Removal: Network Share Connection Removal
303. Supply Chain Compromise: Compromise Hardware Supply Chain
304. Automated Exfiltration
305. Subvert Trust Controls: Gatekeeper Bypass
306. File and Directory Discovery
307. Event Triggered Execution: Udev Rules
308. Domain or Tenant Policy Modification
309. Subvert Trust Controls: Code Signing Policy Modification
310. Indicator Removal: Clear Linux or Mac System Logs
311. Steal or Forge Kerberos Tickets: Ccache Files
312. Acquire Infrastructure
313. Network Boundary Bridging: Network Address Translation Traversal
314. Encrypted Channel
315. Credentials from Password Stores: Keychain
316. Obfuscated Files or Information: Fileless Storage
317. Trusted Developer Utilities Proxy Execution: ClickOnce
318. Data Encrypted for Impact
319. Non-Application Layer Protocol
320. Stage Capabilities: Install Digital Certificate
321. OS Credential Dumping: Security Account Manager
322. Exploitation for Privilege Escalation
323. Use Alternate Authentication Material: Application Access Token
324. Trusted Developer Utilities Proxy Execution
325. Event Triggered Execution: Application Shimming
326. Resource Hijacking: Compute Hijacking
327. OS Credential Dumping: NTDS
328. Obfuscated Files or Information: Encrypted/Encoded File
329. Power Settings
330. Data Destruction: Lifecycle-Triggered Deletion
331. Inter-Process Communication: Dynamic Data Exchange
332. Device Driver Discovery
333. Web Service
334. Event Triggered Execution: Installer Packages
335. Masquerading: Masquerade Account Name
336. Dynamic Resolution: Domain Generation Algorithms
337. Impair Defenses: Safe Mode Boot
338. Data from Information Repositories
339. Modify Cloud Compute Infrastructure
340. Execution Guardrails: Mutual Exclusion
341. Exfiltration Over Web Service
342. Search Open Technical Databases: Scan Databases
343. Network Denial of Service: Reflection Amplification
344. Direct Volume Access
345. Subvert Trust Controls
346. Obtain Capabilities: Tool
347. Event Triggered Execution: LC_LOAD_DYLIB Addition
348. Automated Exfiltration: Traffic Duplication
349. Indicator Removal: Clear Command History
350. Obtain Capabilities: Code Signing Certificates
351. Gather Victim Host Information: Client Configurations
352. Impair Defenses: Indicator Blocking
353. Resource Hijacking: Bandwidth Hijacking
354. Impersonation
355. Account Discovery: Email Account
356. Boot or Logon Autostart Execution: Time Providers
357. Search Open Websites/Domains: Code Repositories
358. Reflective Code Loading
359. Account Manipulation
360. Hijack Execution Flow: Path Interception by Search Order Hijacking
361. Network Service Discovery
362. Command and Scripting Interpreter: Windows Command Shell
363. Application Layer Protocol: File Transfer Protocols
364. Indicator Removal: File Deletion
365. Search Closed Sources
366. Resource Hijacking
367. Search Open Technical Databases: WHOIS
368. Obfuscated Files or Information: Command Obfuscation
369. Masquerading: Rename System Utilities
370. User Execution
371. Office Application Startup: Outlook Rules
372. Fallback Channels
373. Boot or Logon Autostart Execution: Port Monitors
374. Domain or Tenant Policy Modification: Trust Modification
375. Command and Scripting Interpreter: Visual Basic
376. Data from Configuration Repository
377. Obfuscated Files or Information: Binary Padding
378. Abuse Elevation Control Mechanism: Bypass User Account Control
379. Indicator Removal: Clear Persistence
380. Process Injection: Portable Executable Injection
381. Obfuscated Files or Information: HTML Smuggling
382. Valid Accounts: Local Accounts
383. Unsecured Credentials: Bash History
384. System Binary Proxy Execution: Regsvcs/Regasm
385. Weaken Encryption: Reduce Key Space
386. Obtain Capabilities: Vulnerabilities
387. Indicator Removal: Clear Network Connection History and Configurations
388. Command and Scripting Interpreter: Python
389. Hijack Execution Flow: COR_PROFILER
390. Search Open Websites/Domains: Search Engines
391. Command and Scripting Interpreter: AutoHotKey & AutoIT
392. Traffic Signaling: Socket Filters
393. Access Token Manipulation: SID-History Injection
394. Traffic Signaling
395. Data Staged: Remote Data Staging
396. Abuse Elevation Control Mechanism
397. Masquerading
398. Impair Defenses: Impair Command History Logging
399. Subvert Trust Controls: Mark-of-the-Web Bypass
400. Network Denial of Service: Direct Network Flood
401. Cloud Administration Command
402. Boot or Logon Autostart Execution: Authentication Package
403. Template Injection
404. User Execution: Malicious File
405. Trusted Relationship
406. Hijack Execution Flow: Services Registry Permissions Weakness
407. Browser Session Hijacking
408. Command and Scripting Interpreter: Unix Shell
409. Internal Spearphishing
410. Modify Cloud Compute Infrastructure: Create Cloud Instance
411. Hide Artifacts: Ignore Process Interrupts
412. Boot or Logon Autostart Execution: Login Items
413. Forge Web Credentials: Web Cookies
414. System Binary Proxy Execution: Compiled HTML File
415. Forced Authentication
416. Remote Services: VNC
417. Indicator Removal: Clear Mailbox Data
418. Permission Groups Discovery: Local Groups
419. Impair Defenses: Spoof Security Alerting
420. Acquire Infrastructure: Malvertising
421. Process Injection
422. Gather Victim Network Information: Network Trust Dependencies
423. Brute Force: Credential Stuffing
424. Create or Modify System Process: Windows Service
425. Escape to Host
426. Access Token Manipulation: Parent PID Spoofing
427. Hardware Additions
428. Server Software Component: Transport Agent
429. Event Triggered Execution: Accessibility Features
430. Gather Victim Org Information: Identify Business Tempo
431. XSL Script Processing
432. Compromise Accounts: Cloud Accounts
433. Steal or Forge Kerberos Tickets
434. Office Application Startup
435. Office Application Startup: Office Test
436. Input Capture: Credential API Hooking
437. Steal or Forge Kerberos Tickets: Silver Ticket
438. Scheduled Transfer
439. Domain Trust Discovery
440. Remote Service Session Hijacking: RDP Hijacking
441. Phishing for Information: Spearphishing Link
442. Account Manipulation: Additional Local or Domain Groups
443. Pre-OS Boot
444. Exploitation of Remote Services
445. Active Scanning: Wordlist Scanning
446. Virtualization/Sandbox Evasion: System Checks
447. Software Deployment Tools
448. System Network Connections Discovery
449. Obtain Capabilities: Artificial Intelligence
450. Brute Force
451. Indicator Removal
452. Modify System Image
453. Credentials from Password Stores: Credentials from Web Browsers
454. Taint Shared Content
455. System Network Configuration Discovery
456. Web Service: Dead Drop Resolver
457. Application Layer Protocol: Mail Protocols
458. Data Encoding: Standard Encoding
459. Hijack Execution Flow: KernelCallbackTable
460. Masquerading: Break Process Trees
461. Data Manipulation
462. Phishing: Spearphishing via Service
463. Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol
464. Hide Artifacts: Process Argument Spoofing
465. Account Discovery
466. Network Sniffing
467. Container and Resource Discovery
468. Exfiltration Over Web Service: Exfiltration to Code Repository
469. Event Triggered Execution: PowerShell Profile
470. Impair Defenses: Disable Windows Event Logging
471. Remote Services: SSH
472. name
473. Obfuscated Files or Information
474. Modify System Image: Downgrade System Image
475. Impair Defenses: Disable or Modify Cloud Logs
476. Gather Victim Network Information: Domain Properties
477. Process Injection: Process Doppelgänging
478. Serverless Execution
479. Exfiltration Over Physical Medium
480. Video Capture
481. Stage Capabilities: SEO Poisoning
482. Remote Service Session Hijacking: SSH Hijacking
483. Pre-OS Boot: Component Firmware
484. Process Injection: Dynamic-link Library Injection
485. Access Token Manipulation: Make and Impersonate Token
486. Search Victim-Owned Websites
487. Encrypted Channel: Asymmetric Cryptography
488. Disk Wipe
489. OS Credential Dumping
490. Defacement
491. Remote Services: Direct Cloud VM Connections
492. Gather Victim Identity Information: Email Addresses
493. Hijack Execution Flow
494. Data from Information Repositories: Code Repositories
495. Inhibit System Recovery
496. Data from Local System
497. Exfiltration Over Alternative Protocol
498. Steal Web Session Cookie
499. Resource Hijacking: SMS Pumping
500. System Binary Proxy Execution: MMC
501. Exploitation for Credential Access
502. Debugger Evasion
503. Hide Artifacts: File/Path Exclusions
504. System Binary Proxy Execution: Control Panel
505. System Script Proxy Execution: PubPrn
506. Deploy Container
507. Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth
508. Acquire Infrastructure: Web Services
509. Input Capture: GUI Input Capture
510. Modify Cloud Compute Infrastructure: Revert Cloud Instance
511. Compromise Infrastructure
512. Valid Accounts: Cloud Accounts
513. Establish Accounts: Social Media Accounts
514. Application Layer Protocol: Web Protocols
515. Software Discovery: Security Software Discovery
516. System Network Configuration Discovery: Wi-Fi Discovery
517. Unsecured Credentials: Chat Messages
518. Container Administration Command
519. Scheduled Task/Job: Container Orchestration Job
520. Boot or Logon Initialization Scripts: Startup Items
521. Windows Management Instrumentation
522. Gather Victim Network Information: Network Security Appliances
523. Ingress Tool Transfer
524. Dynamic Resolution: DNS Calculation
525. System Location Discovery: System Language Discovery
526. System Location Discovery
527. Account Manipulation: Additional Cloud Credentials
528. OS Credential Dumping: LSASS Memory
529. Plist File Modification
530. Account Manipulation: Additional Container Cluster Roles
531. Account Manipulation: Device Registration
532. Hijack Execution Flow: Dylib Hijacking
533. File and Directory Permissions Modification: Windows File and Directory Permissions Modification
534. Process Injection: Asynchronous Procedure Call
535. Remote System Discovery
536. Develop Capabilities
537. Data Destruction
538. Develop Capabilities: Code Signing Certificates
539. Remote Services: Distributed Component Object Model
540. Account Discovery: Domain Account
541. Exfiltration Over Other Network Medium
542. Replication Through Removable Media
543. Access Token Manipulation
544. Proxy: Domain Fronting
545. Brute Force: Password Guessing
546. Firmware Corruption
547. Stage Capabilities: Upload Malware
548. Compromise Accounts: Email Accounts
549. Acquire Infrastructure: Domains
550. Boot or Logon Autostart Execution: Active Setup
551. Boot or Logon Autostart Execution: Shortcut Modification
552. Archive Collected Data: Archive via Library
553. Process Discovery
554. Protocol Tunneling
555. Brute Force: Password Cracking
556. Stage Capabilities
557. Develop Capabilities: Exploits
558. Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access
559. Data Encoding: Non-Standard Encoding
560. Create Account: Local Account
561. Gather Victim Network Information: Network Topology
562. Data Encoding
563. Defacement: Internal Defacement
564. Impair Defenses: Disable or Modify Linux Audit System
565. Native API
566. Remote Service Session Hijacking
567. Obtain Capabilities
568. Pre-OS Boot: System Firmware
569. Email Collection: Local Email Collection
570. Hide Artifacts: Run Virtual Instance
571. Subvert Trust Controls: Install Root Certificate
572. Proxy: Multi-hop Proxy
573. BITS Jobs
574. Traffic Signaling: Port Knocking
575. Process Injection: Ptrace System Calls
576. Archive Collected Data: Archive via Utility
577. Obfuscated Files or Information: Steganography
578. Hide Artifacts: Hidden Files and Directories
579. Remote Services: Cloud Services
580. Create Account: Cloud Account
581. Data from Information Repositories: Sharepoint
582. System Binary Proxy Execution: InstallUtil
583. Compromise Infrastructure: Serverless
584. Active Scanning
585. Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
586. Endpoint Denial of Service: Service Exhaustion Flood
587. Shared Modules
588. Create Account: Domain Account
589. Hide Artifacts: Hidden File System
590. Boot or Logon Autostart Execution: Security Support Provider
591. Data Manipulation: Transmitted Data Manipulation
592. Credentials from Password Stores: Cloud Secrets Management Stores
593. Indicator Removal: Clear Windows Event Logs
594. Multi-Factor Authentication Interception
595. Disk Wipe: Disk Structure Wipe
596. Virtualization/Sandbox Evasion
597. Virtualization/Sandbox Evasion: User Activity Based Checks
598. Obtain Capabilities: Exploits
599. Phishing for Information
600. Gather Victim Identity Information
601. Hide Artifacts: Resource Forking
602. Hide Artifacts: Email Hiding Rules
603. Data from Information Repositories: Messaging Applications
604. Unsecured Credentials: Private Keys
605. Endpoint Denial of Service: OS Exhaustion Flood
606. Exfiltration Over Physical Medium: Exfiltration over USB
607. Search Open Websites/Domains
608. Email Collection: Remote Email Collection
609. Proxy: Internal Proxy
610. Credentials from Password Stores: Windows Credential Manager
611. System Information Discovery
612. Pre-OS Boot: TFTP Boot
613. Command and Scripting Interpreter: JavaScript
614. Acquire Infrastructure: Botnet
615. Establish Accounts: Email Accounts
616. Gather Victim Org Information: Identify Roles
617. File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification
618. Compromise Infrastructure: DNS Server
619. Event Triggered Execution: AppInit DLLs
620. Data from Information Repositories: Confluence
621. Phishing for Information: Spearphishing Service
622. Credentials from Password Stores: Securityd Memory
623. Event Triggered Execution: Image File Execution Options Injection
624. Lateral Tool Transfer
625. Exploitation for Client Execution
626. Stage Capabilities: Link Target
627. Boot or Logon Initialization Scripts
628. Unsecured Credentials: Credentials in Registry
629. Obtain Capabilities: Malware
630. Command and Scripting Interpreter: AppleScript
631. Acquire Infrastructure: Server
632. Application Window Discovery
633. Boot or Logon Initialization Scripts: Login Hook
634. Process Injection: ListPlanting
635. Screen Capture
636. Network Denial of Service
637. Account Discovery: Cloud Account
638. Valid Accounts
639. Hijack Execution Flow: Path Interception by Unquoted Path
640. Stage Capabilities: Drive-by Target
641. Unsecured Credentials: Credentials In Files
642. Data from Configuration Repository: SNMP (MIB Dump)
643. Execution Guardrails: Environmental Keying
644. Exfiltration Over Web Service: Exfiltration Over Webhook
645. Modify Cloud Compute Infrastructure: Delete Cloud Instance
646. Data Staged
647. Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations
648. Data from Network Shared Drive
649. Event Triggered Execution: Trap
650. Phishing: Spearphishing Link
651. Credentials from Password Stores
652. Software Discovery
653. Multi-Stage Channels
654. Data Obfuscation: Protocol or Service Impersonation
655. Email Collection
656. Network Share Discovery
657. System Binary Proxy Execution: Verclsid