MITRE ATT&CK Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.

1. Automated Collection
2. Exfiltration Over Web Service
3. Obfuscated Files or Information: Encrypted/Encoded File
4. Remote Service Session Hijacking: SSH Hijacking
5. Remote Services: Windows Remote Management
6. Pre-OS Boot: Bootkit
7. Boot or Logon Initialization Scripts
8. Masquerading: Space after Filename
9. Command and Scripting Interpreter: PowerShell
10. Hide Artifacts: Resource Forking
11. Scheduled Transfer
12. Hide Artifacts: Hidden Users
13. Process Injection: Portable Executable Injection
14. Gather Victim Host Information: Software
15. Modify System Image: Patch System Image
16. Container Administration Command
17. Web Service
18. Obfuscated Files or Information: Steganography
19. Compromise Infrastructure: Serverless
20. Modify Authentication Process: Multi-Factor Authentication
21. Boot or Logon Autostart Execution: Print Processors
22. Obtain Capabilities: Malware
23. Boot or Logon Autostart Execution: Active Setup
24. Steal or Forge Kerberos Tickets: AS-REP Roasting
25. Boot or Logon Autostart Execution: Login Items
26. Compromise Accounts: Cloud Accounts
27. Gather Victim Identity Information: Employee Names
28. Account Manipulation: Additional Cloud Roles
29. System Network Connections Discovery
30. Establish Accounts: Cloud Accounts
31. Hijack Execution Flow: Dynamic Linker Hijacking
32. Firmware Corruption
33. User Execution: Malicious Image
34. Template Injection
35. Archive Collected Data: Archive via Custom Method
36. Impersonation
37. System Location Discovery
38. Network Boundary Bridging: Network Address Translation Traversal
39. Endpoint Denial of Service: Application Exhaustion Flood
40. Steal Web Session Cookie
41. Direct Volume Access
42. Compromise Infrastructure: Virtual Private Server
43. System Shutdown/Reboot
44. Content Injection
45. Office Application Startup: Add-ins
46. Weaken Encryption: Reduce Key Space
47. Command and Scripting Interpreter: JavaScript
48. Office Application Startup: Outlook Home Page
49. Taint Shared Content
50. Access Token Manipulation
51. Remote Service Session Hijacking
52. Process Injection: VDSO Hijacking
53. Escape to Host
54. Input Capture: Web Portal Capture
55. Command and Scripting Interpreter: AppleScript
56. Audio Capture
57. Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol
58. Virtualization/Sandbox Evasion
59. Masquerading: Match Legitimate Name or Location
60. Impair Defenses: Disable Windows Event Logging
61. Command and Scripting Interpreter: Windows Command Shell
62. Phishing: Spearphishing Link
63. Application Layer Protocol
64. System Service Discovery
65. Data Staged: Remote Data Staging
66. Indicator Removal: Clear Mailbox Data
67. Pre-OS Boot: TFTP Boot
68. Adversary-in-the-Middle
69. Exfiltration Over Web Service: Exfiltration to Code Repository
70. Boot or Logon Initialization Scripts: Startup Items
71. Boot or Logon Autostart Execution: Re-opened Applications
72. Event Triggered Execution: Accessibility Features
73. System Script Proxy Execution
74. Unsecured Credentials: Private Keys
75. Process Injection: Dynamic-link Library Injection
76. Phishing for Information: Spearphishing Attachment
77. Obfuscated Files or Information: Polymorphic Code
78. Data Manipulation: Transmitted Data Manipulation
79. Hardware Additions
80. Compromise Infrastructure: Web Services
81. System Binary Proxy Execution: Verclsid
82. Indicator Removal: Network Share Connection Removal
83. Web Service: Dead Drop Resolver
84. Acquire Infrastructure: Serverless
85. Obfuscated Files or Information: Stripped Payloads
86. Resource Hijacking: SMS Pumping
87. Data from Information Repositories: Sharepoint
88. Modify Cloud Compute Infrastructure
89. Office Application Startup: Office Template Macros
90. Network Denial of Service: Reflection Amplification
91. Network Denial of Service
92. System Binary Proxy Execution: Odbcconf
93. Impair Defenses: Spoof Security Alerting
94. Hijack Execution Flow: KernelCallbackTable
95. External Remote Services
96. Brute Force: Password Cracking
97. Exfiltration Over C2 Channel
98. Communication Through Removable Media
99. System Binary Proxy Execution: InstallUtil
100. Proxy: Multi-hop Proxy
101. Account Access Removal
102. User Execution: Malicious Link
103. Remote Services: Remote Desktop Protocol
104. Hijack Execution Flow: DLL Side-Loading
105. Create Account: Cloud Account
106. Domain Trust Discovery
107. Shared Modules
108. Serverless Execution
109. Modify Cloud Compute Infrastructure: Create Snapshot
110. Boot or Logon Initialization Scripts: Logon Script (Windows)
111. Virtualization/Sandbox Evasion: System Checks
112. Account Discovery: Email Account
113. Active Scanning: Vulnerability Scanning
114. Plist File Modification
115. Acquire Infrastructure: DNS Server
116. Boot or Logon Autostart Execution: Authentication Package
117. Modify Authentication Process: Conditional Access Policies
118. Obtain Capabilities
119. Exfiltration Over Web Service: Exfiltration to Cloud Storage
120. Compromise Infrastructure: DNS Server
121. Search Open Technical Databases
122. Scheduled Task/Job
123. Data from Removable Media
124. Process Injection: Thread Local Storage
125. Resource Hijacking: Compute Hijacking
126. Hide Artifacts: Hidden File System
127. File and Directory Permissions Modification
128. Search Open Websites/Domains
129. OS Credential Dumping: NTDS
130. Scheduled Task/Job: Cron
131. Boot or Logon Initialization Scripts: Login Hook
132. Account Manipulation
133. Application Layer Protocol: File Transfer Protocols
134. Event Triggered Execution: Change Default File Association
135. Subvert Trust Controls: SIP and Trust Provider Hijacking
136. Data Encoding: Non-Standard Encoding
137. BITS Jobs
138. Obtain Capabilities: Artificial Intelligence
139. Gather Victim Org Information
140. Input Capture
141. Establish Accounts: Email Accounts
142. Automated Exfiltration
143. XSL Script Processing
144. Resource Hijacking: Bandwidth Hijacking
145. Valid Accounts: Domain Accounts
146. Acquire Infrastructure: Domains
147. Event Triggered Execution: LC_LOAD_DYLIB Addition
148. Email Collection: Remote Email Collection
149. Execution Guardrails
150. Proxy: Domain Fronting
151. Phishing
152. Pre-OS Boot
153. Office Application Startup: Outlook Rules
154. Exploitation of Remote Services
155. Weaken Encryption
156. Exfiltration Over Physical Medium: Exfiltration over USB
157. Gather Victim Network Information: Network Trust Dependencies
158. Event Triggered Execution: Windows Management Instrumentation Event Subscription
159. Unused/Unsupported Cloud Regions
160. Obfuscated Files or Information: Compile After Delivery
161. Scheduled Task/Job: Container Orchestration Job
162. Gather Victim Network Information: Domain Properties
163. Network Service Discovery
164. Software Discovery
165. Data Obfuscation: Steganography
166. Server Software Component: Transport Agent
167. Email Collection
168. Adversary-in-the-Middle: DHCP Spoofing
169. Server Software Component: IIS Components
170. Impair Defenses: Disable or Modify Linux Audit System
171. Implant Internal Image
172. Scheduled Task/Job: At
173. Multi-Factor Authentication Interception
174. Stage Capabilities: SEO Poisoning
175. System Binary Proxy Execution: Regsvr32
176. Process Injection
177. Defacement: Internal Defacement
178. System Location Discovery: System Language Discovery
179. Phishing: Spearphishing Voice
180. Search Victim-Owned Websites
181. Event Triggered Execution: Udev Rules
182. Data from Configuration Repository: Network Device Configuration Dump
183. Compromise Infrastructure: Server
184. Credentials from Password Stores: Password Managers
185. Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access
186. Data Manipulation
187. File and Directory Permissions Modification: Windows File and Directory Permissions Modification
188. Stage Capabilities: Upload Malware
189. Data from Information Repositories: Customer Relationship Management Software
190. System Binary Proxy Execution: Mshta
191. Proxy: Internal Proxy
192. Remote Services: Distributed Component Object Model
193. Forge Web Credentials: Web Cookies
194. Abuse Elevation Control Mechanism: Bypass User Account Control
195. Phishing for Information: Spearphishing Link
196. Hide Artifacts: Hidden Files and Directories
197. Log Enumeration
198. Data Staged
199. Hide Artifacts: Email Hiding Rules
200. Valid Accounts: Local Accounts
201. Trusted Relationship
202. System Binary Proxy Execution
203. Input Capture: Credential API Hooking
204. Use Alternate Authentication Material: Web Session Cookie
205. Obtain Capabilities: Vulnerabilities
206. System Information Discovery
207. Stage Capabilities: Link Target
208. Valid Accounts: Cloud Accounts
209. Use Alternate Authentication Material: Pass the Hash
210. Cloud Service Discovery
211. Gather Victim Network Information
212. Steal or Forge Kerberos Tickets
213. Permission Groups Discovery: Domain Groups
214. Abuse Elevation Control Mechanism
215. Gather Victim Host Information: Client Configurations
216. Hide Artifacts: Process Argument Spoofing
217. Exfiltration Over Alternative Protocol
218. Financial Theft
219. Establish Accounts
220. Account Discovery
221. System Binary Proxy Execution: Compiled HTML File
222. OS Credential Dumping: /etc/passwd and /etc/shadow
223. Modify Registry
224. Modify Authentication Process: Network Provider DLL
225. Unsecured Credentials: Bash History
226. Gather Victim Org Information: Business Relationships
227. Dynamic Resolution: DNS Calculation
228. Remote System Discovery
229. Command and Scripting Interpreter: Python
230. Account Discovery: Domain Account
231. Phishing for Information
232. Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
233. Compromise Infrastructure: Domains
234. Credentials from Password Stores: Cloud Secrets Management Stores
235. Brute Force: Password Guessing
236. Endpoint Denial of Service: Application or System Exploitation
237. Compromise Accounts
238. Input Capture: Keylogging
239. Stage Capabilities
240. Phishing for Information: Spearphishing Service
241. System Network Configuration Discovery: Internet Connection Discovery
242. Encrypted Channel
243. Brute Force: Password Spraying
244. Unsecured Credentials: Chat Messages
245. Data Obfuscation: Junk Data
246. Impair Defenses: Impair Command History Logging
247. Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth
248. Exfiltration Over Physical Medium
249. Web Service: One-Way Communication
250. Non-Standard Port
251. Office Application Startup
252. Modify Authentication Process: Pluggable Authentication Modules
253. Boot or Logon Autostart Execution: Time Providers
254. Masquerading
255. Cloud Administration Command
256. Remote Services: SMB/Windows Admin Shares
257. Subvert Trust Controls: Code Signing
258. Encrypted Channel: Asymmetric Cryptography
259. Clipboard Data
260. System Network Configuration Discovery
261. Data from Local System
262. Abuse Elevation Control Mechanism: Sudo and Sudo Caching
263. Access Token Manipulation: Make and Impersonate Token
264. Gather Victim Host Information
265. Stage Capabilities: Upload Tool
266. Permission Groups Discovery
267. Impair Defenses: Disable or Modify Cloud Firewall
268. Execution Guardrails: Mutual Exclusion
269. Gather Victim Network Information: Network Security Appliances
270. Browser Session Hijacking
271. Event Triggered Execution
272. Resource Hijacking: Cloud Service Hijacking
273. Boot or Logon Autostart Execution: Kernel Modules and Extensions
274. Hijack Execution Flow: Path Interception by Search Order Hijacking
275. Event Triggered Execution: AppInit DLLs
276. Modify Authentication Process: Hybrid Identity
277. System Services: Service Execution
278. Obtain Capabilities: Exploits
279. Impair Defenses: Downgrade Attack
280. Impair Defenses: Indicator Blocking
281. Use Alternate Authentication Material: Application Access Token
282. Obfuscated Files or Information
283. Indirect Command Execution
284. Credentials from Password Stores
285. Browser Extensions
286. Process Injection: Extra Window Memory Injection
287. Domain or Tenant Policy Modification
288. Search Open Technical Databases: WHOIS
289. Reflective Code Loading
290. Obtain Capabilities: Digital Certificates
291. Event Triggered Execution: Component Object Model Hijacking
292. File and Directory Discovery
293. Search Open Websites/Domains: Social Media
294. Server Software Component: Web Shell
295. Event Triggered Execution: Installer Packages
296. Execution Guardrails: Environmental Keying
297. Access Token Manipulation: Parent PID Spoofing
298. Develop Capabilities: Exploits
299. Impair Defenses: Disable or Modify Cloud Logs
300. System Script Proxy Execution: PubPrn
301. Remote Services: VNC
302. Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol
303. Debugger Evasion
304. File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification
305. Masquerading: Double File Extension
306. Protocol Tunneling
307. Create Account: Local Account
308. OS Credential Dumping: LSASS Memory
309. Masquerading: Break Process Trees
310. Compromise Accounts: Email Accounts
311. System Binary Proxy Execution: Control Panel
312. Endpoint Denial of Service: Service Exhaustion Flood
313. System Script Proxy Execution: SyncAppvPublishingServer
314. Data Encrypted for Impact
315. Resource Hijacking
316. Defacement: External Defacement
317. Command and Scripting Interpreter: AutoHotKey & AutoIT
318. Masquerading: Rename System Utilities
319. Rogue Domain Controller
320. Pre-OS Boot: ROMMONkit
321. Domain or Tenant Policy Modification: Trust Modification
322. Exploitation for Defense Evasion
323. Unsecured Credentials: Group Policy Preferences
324. Acquire Infrastructure
325. Acquire Infrastructure: Botnet
326. Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations
327. Modify System Image
328. User Execution: Malicious File
329. Obfuscated Files or Information: Software Packing
330. Exfiltration Over Other Network Medium
331. Cloud Service Dashboard
332. Event Triggered Execution: Emond
333. Event Triggered Execution: Screensaver
334. Stage Capabilities: Drive-by Target
335. Command and Scripting Interpreter: Visual Basic
336. Obfuscated Files or Information: Binary Padding
337. System Binary Proxy Execution: Regsvcs/Regasm
338. Web Service: Bidirectional Communication
339. Hide Artifacts: Hidden Window
340. Search Open Technical Databases: Scan Databases
341. Acquire Infrastructure: Server
342. Masquerading: Masquerade File Type
343. Weaken Encryption: Disable Crypto Hardware
344. Archive Collected Data: Archive via Library
345. Boot or Logon Autostart Execution
346. Impair Defenses: Disable or Modify Tools
347. Password Policy Discovery
348. Hide Artifacts
349. Network Share Discovery
350. Gather Victim Identity Information: Credentials
351. Hijack Execution Flow
352. Use Alternate Authentication Material
353. Network Boundary Bridging
354. Steal or Forge Kerberos Tickets: Golden Ticket
355. Multi-Factor Authentication Request Generation
356. Transfer Data to Cloud Account
357. Account Manipulation: Additional Email Delegate Permissions
358. Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
359. Proxy: External Proxy
360. Unsecured Credentials: Container API
361. Subvert Trust Controls: Code Signing Policy Modification
362. Command and Scripting Interpreter: Cloud API
363. Compromise Infrastructure: Botnet
364. Proxy
365. Unsecured Credentials: Credentials in Registry
366. Create Account: Domain Account
367. Traffic Signaling: Socket Filters
368. Phishing: Spearphishing via Service
369. Video Capture
370. Modify Cloud Compute Infrastructure: Create Cloud Instance
371. Process Injection: ListPlanting
372. Credentials from Password Stores: Credentials from Web Browsers
373. Process Injection: Proc Memory
374. Build Image on Host
375. Email Collection: Email Forwarding Rule
376. Modify Authentication Process
377. Power Settings
378. Active Scanning: Wordlist Scanning
379. Network Sniffing
380. Hijack Execution Flow: Path Interception by PATH Environment Variable
381. Boot or Logon Autostart Execution: Security Support Provider
382. Develop Capabilities: Code Signing Certificates
383. Traffic Signaling: Port Knocking
384. Server Software Component
385. Data from Information Repositories
386. Data from Configuration Repository
387. Develop Capabilities: Digital Certificates
388. Indicator Removal: Relocate Malware
389. Search Closed Sources: Purchase Technical Data
390. Remote Access Software
391. Endpoint Denial of Service: OS Exhaustion Flood
392. Create or Modify System Process: Systemd Service
393. Modify Cloud Compute Infrastructure: Delete Cloud Instance
394. Disk Wipe: Disk Content Wipe
395. Hijack Execution Flow: Services Registry Permissions Weakness
396. Indicator Removal: Clear Linux or Mac System Logs
397. Inter-Process Communication
398. Pre-OS Boot: System Firmware
399. Event Triggered Execution: Trap
400. Data Encoding: Standard Encoding
401. Exploitation for Credential Access
402. Event Triggered Execution: PowerShell Profile
403. Create Account
404. Adversary-in-the-Middle: ARP Cache Poisoning
405. Account Manipulation: SSH Authorized Keys
406. Compromise Accounts: Social Media Accounts
407. Defacement
408. Boot or Logon Autostart Execution: LSASS Driver
409. Adversary-in-the-Middle: Evil Twin
410. Unsecured Credentials: Credentials In Files
411. Data from Configuration Repository: SNMP (MIB Dump)
412. Traffic Signaling
413. Supply Chain Compromise: Compromise Software Supply Chain
414. Inter-Process Communication: Dynamic Data Exchange
415. System Time Discovery
416. Search Closed Sources: Threat Intel Vendors
417. Indicator Removal: Clear Command History
418. System Services: Launchctl
419. Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
420. System Binary Proxy Execution: CMSTP
421. Hijack Execution Flow: Services File Permissions Weakness
422. Data Staged: Local Data Staging
423. Active Scanning
424. Dynamic Resolution: Domain Generation Algorithms
425. Software Discovery: Security Software Discovery
426. Hijack Execution Flow: Path Interception by Unquoted Path
427. Obfuscated Files or Information: Fileless Storage
428. Exploitation for Privilege Escalation
429. Obfuscated Files or Information: LNK Icon Smuggling
430. name
431. Dynamic Resolution
432. Boot or Logon Autostart Execution: XDG Autostart Entries
433. Group Policy Discovery
434. Phishing for Information: Spearphishing Voice
435. Hijack Execution Flow: DLL Search Order Hijacking
436. Impair Defenses: Safe Mode Boot
437. Compromise Infrastructure
438. Hide Infrastructure
439. Use Alternate Authentication Material: Pass the Ticket
440. Modify Authentication Process: Domain Controller Authentication
441. Network Denial of Service: Direct Network Flood
442. Obfuscated Files or Information: Command Obfuscation
443. Gather Victim Host Information: Hardware
444. Masquerading: Right-to-Left Override
445. Native API
446. Compromise Host Software Binary
447. Boot or Logon Autostart Execution: Winlogon Helper DLL
448. Develop Capabilities: Malware
449. Obtain Capabilities: Code Signing Certificates
450. Account Manipulation: Additional Cloud Credentials
451. Hide Artifacts: File/Path Exclusions
452. Boot or Logon Initialization Scripts: RC Scripts
453. Data Destruction: Lifecycle-Triggered Deletion
454. Abuse Elevation Control Mechanism: TCC Manipulation
455. Hijack Execution Flow: AppDomainManager
456. Subvert Trust Controls: Install Root Certificate
457. System Binary Proxy Execution: Msiexec
458. Encrypted Channel: Symmetric Cryptography
459. Server Software Component: Terminal Services DLL
460. Screen Capture
461. Exfiltration Over Web Service: Exfiltration to Text Storage Sites
462. Process Injection: Process Doppelgänging
463. Dynamic Resolution: Fast Flux DNS
464. Account Manipulation: Device Registration
465. Scheduled Task/Job: Systemd Timers
466. Permission Groups Discovery: Cloud Groups
467. Cloud Storage Object Discovery
468. Masquerading: Invalid Code Signature
469. Obfuscated Files or Information: Indicator Removal from Tools
470. System Binary Proxy Execution: MMC
471. Lateral Tool Transfer
472. Deploy Container
473. Application Layer Protocol: DNS
474. Multi-Stage Channels
475. Domain or Tenant Policy Modification: Group Policy Modification
476. Drive-by Compromise
477. Steal or Forge Authentication Certificates
478. Supply Chain Compromise: Compromise Software Dependencies and Development Tools
479. Gather Victim Host Information: Firmware
480. Windows Management Instrumentation
481. Data Destruction
482. System Network Configuration Discovery: Wi-Fi Discovery
483. Search Open Technical Databases: Digital Certificates
484. Indicator Removal
485. Pre-OS Boot: Component Firmware
486. Data Manipulation: Runtime Data Manipulation
487. Valid Accounts
488. Account Manipulation: Additional Container Cluster Roles
489. Create or Modify System Process: Container Service
490. Gather Victim Identity Information: Email Addresses
491. Gather Victim Identity Information
492. Query Registry
493. Event Triggered Execution: AppCert DLLs
494. Search Open Websites/Domains: Code Repositories
495. Indicator Removal: Clear Persistence
496. OS Credential Dumping: Security Account Manager
497. Deobfuscate/Decode Files or Information
498. Establish Accounts: Social Media Accounts
499. Gather Victim Org Information: Identify Business Tempo
500. Boot or Logon Initialization Scripts: Network Logon Script
501. Hide Artifacts: Ignore Process Interrupts
502. Acquire Infrastructure: Web Services
503. Virtualization/Sandbox Evasion: Time Based Evasion
504. Unsecured Credentials
505. Boot or Logon Autostart Execution: Shortcut Modification
506. Steal or Forge Kerberos Tickets: Kerberoasting
507. Data from Information Repositories: Messaging Applications
508. Exploitation for Client Execution
509. Access Token Manipulation: SID-History Injection
510. Browser Information Discovery
511. Steal or Forge Kerberos Tickets: Ccache Files
512. Steal or Forge Kerberos Tickets: Silver Ticket
513. Indicator Removal: Timestomp
514. Modify Authentication Process: Reversible Encryption
515. Endpoint Denial of Service
516. Modify Authentication Process: Network Device Authentication
517. System Binary Proxy Execution: Mavinject
518. Event Triggered Execution: Unix Shell Configuration Modification
519. Supply Chain Compromise
520. Application Layer Protocol: Publish/Subscribe Protocols
521. Process Injection: Asynchronous Procedure Call
522. Scheduled Task/Job: Scheduled Task
523. Software Deployment Tools
524. Application Layer Protocol: Web Protocols
525. Impair Defenses: Disable or Modify System Firewall
526. Rootkit
527. System Owner/User Discovery
528. Brute Force: Credential Stuffing
529. OS Credential Dumping
530. Supply Chain Compromise: Compromise Hardware Supply Chain
531. Internal Spearphishing
532. Data from Information Repositories: Code Repositories
533. Exploit Public-Facing Application
534. Command and Scripting Interpreter
535. Archive Collected Data
536. Indicator Removal: File Deletion
537. Command and Scripting Interpreter: Network Device CLI
538. Service Stop
539. Command and Scripting Interpreter: Lua
540. User Execution
541. Create or Modify System Process: Launch Agent
542. Trusted Developer Utilities Proxy Execution: ClickOnce
543. Search Open Technical Databases: DNS/Passive DNS
544. Create or Modify System Process: Windows Service
545. Data Obfuscation
546. Search Closed Sources
547. Remote Services
548. Process Injection: Ptrace System Calls
549. Valid Accounts: Default Accounts
550. Brute Force
551. Subvert Trust Controls: Gatekeeper Bypass
552. Disk Wipe
553. Account Discovery: Cloud Account
554. Forge Web Credentials
555. Impair Defenses
556. System Services
557. Remote Services: Direct Cloud VM Connections
558. Remote Services: SSH
559. Data from Cloud Storage
560. Automated Exfiltration: Traffic Duplication
561. Command and Scripting Interpreter: Unix Shell
562. Modify Cloud Compute Infrastructure: Revert Cloud Instance
563. Disk Wipe: Disk Structure Wipe
564. Hijack Execution Flow: Executable Installer File Permissions Weakness
565. OS Credential Dumping: Proc Filesystem
566. Email Collection: Local Email Collection
567. Modify System Image: Downgrade System Image
568. Acquire Infrastructure: Malvertising
569. OS Credential Dumping: DCSync
570. Hide Artifacts: Run Virtual Instance
571. Gather Victim Network Information: Network Topology
572. Cloud Infrastructure Discovery
573. Obfuscated Files or Information: HTML Smuggling
574. Gather Victim Org Information: Determine Physical Locations
575. Masquerading: Masquerade Task or Service
576. Data Obfuscation: Protocol or Service Impersonation
577. Credentials from Password Stores: Keychain
578. Ingress Tool Transfer
579. Process Discovery
580. Event Triggered Execution: Image File Execution Options Injection
581. Steal Application Access Token
582. Indicator Removal: Clear Network Connection History and Configurations
583. Masquerading: Masquerade Account Name
584. Forced Authentication
585. Credentials from Password Stores: Windows Credential Manager
586. Container and Resource Discovery
587. Replication Through Removable Media
588. Application Window Discovery
589. Event Triggered Execution: Application Shimming
590. Inhibit System Recovery
591. Data from Information Repositories: Confluence
592. Virtualization/Sandbox Evasion: User Activity Based Checks
593. Gather Victim Network Information: IP Addresses
594. Stage Capabilities: Install Digital Certificate
595. Account Discovery: Local Account
596. Application Layer Protocol: Mail Protocols
597. Permission Groups Discovery: Local Groups
598. Hijack Execution Flow: Dylib Hijacking
599. Search Open Websites/Domains: Search Engines
600. Fallback Channels
601. Device Driver Discovery
602. Create or Modify System Process: Launch Daemon
603. Create or Modify System Process
604. System Binary Proxy Execution: Electron Applications
605. Remote Services: Cloud Services
606. Unsecured Credentials: Cloud Instance Metadata API
607. OS Credential Dumping: LSA Secrets
608. Data Encoding
609. Modify Authentication Process: Password Filter DLL
610. Active Scanning: Scanning IP Blocks
611. Indicator Removal: Clear Windows Event Logs
612. Obtain Capabilities: Tool
613. OS Credential Dumping: Cached Domain Credentials
614. Hide Artifacts: VBA Stomping
615. Forge Web Credentials: SAML Tokens
616. Input Capture: GUI Input Capture
617. Event Triggered Execution: Netsh Helper DLL
618. Process Injection: Process Hollowing
619. Inter-Process Communication: Component Object Model
620. Gather Victim Network Information: DNS
621. Develop Capabilities
622. Trusted Developer Utilities Proxy Execution: MSBuild
623. Gather Victim Org Information: Identify Roles
624. Subvert Trust Controls
625. Hijack Execution Flow: COR_PROFILER
626. Acquire Infrastructure: Virtual Private Server
627. Peripheral Device Discovery
628. Account Manipulation: Additional Local or Domain Groups
629. Data Manipulation: Stored Data Manipulation
630. Boot or Logon Autostart Execution: Port Monitors
631. Inter-Process Communication: XPC Services
632. Trusted Developer Utilities Proxy Execution
633. Remote Service Session Hijacking: RDP Hijacking
634. Modify Cloud Resource Hierarchy
635. Hide Artifacts: NTFS File Attributes
636. Server Software Component: SQL Stored Procedures
637. Access Token Manipulation: Token Impersonation/Theft
638. Phishing: Spearphishing Attachment
639. Credentials from Password Stores: Securityd Memory
640. Acquire Access
641. System Binary Proxy Execution: Rundll32
642. Non-Application Layer Protocol
643. Abuse Elevation Control Mechanism: Setuid and Setgid
644. Search Open Technical Databases: CDNs
645. Abuse Elevation Control Mechanism: Elevated Execution with Prompt
646. Obfuscated Files or Information: Embedded Payloads
647. Subvert Trust Controls: Mark-of-the-Web Bypass
648. Obfuscated Files or Information: Dynamic API Resolution
649. Exfiltration Over Web Service: Exfiltration Over Webhook
650. Compromise Infrastructure: Network Devices
651. Access Token Manipulation: Create Process with Token
652. Process Injection: Thread Execution Hijacking
653. Data from Network Shared Drive
654. Office Application Startup: Office Test
655. Archive Collected Data: Archive via Utility
656. Office Application Startup: Outlook Forms
657. Data Transfer Size Limits