MITRE ATT&CK Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.

1. Valid Accounts: Local Accounts
2. Server Software Component: SQL Stored Procedures
3. File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification
4. Forced Authentication
5. Inter-Process Communication: XPC Services
6. Compromise Infrastructure: DNS Server
7. Impair Defenses: Spoof Security Alerting
8. Credentials from Password Stores: Credentials from Web Browsers
9. Transfer Data to Cloud Account
10. Event Triggered Execution: Trap
11. Modify Authentication Process: Password Filter DLL
12. Data Transfer Size Limits
13. Abuse Elevation Control Mechanism: Elevated Execution with Prompt
14. Boot or Logon Autostart Execution: Print Processors
15. Network Denial of Service: Reflection Amplification
16. Endpoint Denial of Service: Application Exhaustion Flood
17. Process Injection: Proc Memory
18. Account Discovery: Email Account
19. Network Share Discovery
20. Obfuscated Files or Information: Encrypted/Encoded File
21. Input Capture: GUI Input Capture
22. Valid Accounts: Default Accounts
23. OS Credential Dumping: LSASS Memory
24. Permission Groups Discovery: Cloud Groups
25. Boot or Logon Initialization Scripts: Startup Items
26. Unsecured Credentials: Credentials in Registry
27. Data from Local System
28. Data Encoding: Standard Encoding
29. Trusted Developer Utilities Proxy Execution: MSBuild
30. Pre-OS Boot: System Firmware
31. Network Service Discovery
32. Event Triggered Execution: LC_LOAD_DYLIB Addition
33. Establish Accounts
34. System Services: Service Execution
35. Subvert Trust Controls: Install Root Certificate
36. Data Destruction: Lifecycle-Triggered Deletion
37. Template Injection
38. Virtualization/Sandbox Evasion: User Activity Based Checks
39. Office Application Startup: Outlook Forms
40. Data from Configuration Repository
41. Stage Capabilities
42. Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol
43. Resource Hijacking: Compute Hijacking
44. Obfuscated Files or Information: Stripped Payloads
45. Permission Groups Discovery: Domain Groups
46. Event Triggered Execution: AppCert DLLs
47. Resource Hijacking: Bandwidth Hijacking
48. Gather Victim Network Information
49. Proxy
50. Communication Through Removable Media
51. Encrypted Channel
52. Credentials from Password Stores: Cloud Secrets Management Stores
53. Subvert Trust Controls: Code Signing Policy Modification
54. Data Encoding: Non-Standard Encoding
55. Automated Collection
56. Hide Artifacts: Resource Forking
57. Credentials from Password Stores
58. Weaken Encryption: Reduce Key Space
59. name
60. Process Injection: Portable Executable Injection
61. Search Open Websites/Domains: Social Media
62. Hide Artifacts
63. Acquire Infrastructure: DNS Server
64. Firmware Corruption
65. Unsecured Credentials: Group Policy Preferences
66. Account Access Removal
67. Obfuscated Files or Information: Dynamic API Resolution
68. Account Discovery: Local Account
69. Clipboard Data
70. System Binary Proxy Execution: MMC
71. Input Capture: Web Portal Capture
72. Exfiltration Over Web Service: Exfiltration to Code Repository
73. Hide Artifacts: Run Virtual Instance
74. Use Alternate Authentication Material: Pass the Hash
75. System Binary Proxy Execution: Control Panel
76. Account Manipulation: Device Registration
77. Obfuscated Files or Information: HTML Smuggling
78. Scheduled Task/Job: At
79. System Information Discovery
80. Exfiltration Over C2 Channel
81. Exfiltration Over Physical Medium
82. Hide Artifacts: File/Path Exclusions
83. Proxy: Internal Proxy
84. Internal Spearphishing
85. Execution Guardrails
86. Windows Management Instrumentation
87. Hijack Execution Flow: Path Interception by Search Order Hijacking
88. Hijack Execution Flow: Path Interception by Unquoted Path
89. Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
90. System Shutdown/Reboot
91. Serverless Execution
92. Debugger Evasion
93. Phishing: Spearphishing Voice
94. Pre-OS Boot: TFTP Boot
95. Traffic Signaling: Socket Filters
96. System Binary Proxy Execution: CMSTP
97. Disk Wipe: Disk Structure Wipe
98. Develop Capabilities
99. Remote Access Software
100. Password Policy Discovery
101. BITS Jobs
102. Remote Services: Windows Remote Management
103. Remote Services: Distributed Component Object Model
104. Endpoint Denial of Service
105. Unsecured Credentials: Credentials In Files
106. System Script Proxy Execution
107. Account Manipulation: Additional Container Cluster Roles
108. System Binary Proxy Execution: Odbcconf
109. Impair Defenses: Disable or Modify Cloud Logs
110. Compromise Accounts: Social Media Accounts
111. Search Open Technical Databases
112. Search Open Technical Databases: Scan Databases
113. Gather Victim Network Information: DNS
114. Account Manipulation: Additional Local or Domain Groups
115. Permission Groups Discovery
116. Establish Accounts: Cloud Accounts
117. Scheduled Task/Job: Systemd Timers
118. System Binary Proxy Execution: Verclsid
119. System Network Connections Discovery
120. Scheduled Task/Job: Container Orchestration Job
121. Web Service: Dead Drop Resolver
122. Weaken Encryption: Disable Crypto Hardware
123. Modify System Image
124. Hijack Execution Flow
125. Search Open Technical Databases: Digital Certificates
126. Subvert Trust Controls: Code Signing
127. System Binary Proxy Execution: Compiled HTML File
128. Modify Authentication Process: Pluggable Authentication Modules
129. Account Manipulation: Additional Cloud Roles
130. Process Discovery
131. Power Settings
132. Account Manipulation: Additional Cloud Credentials
133. Acquire Infrastructure: Web Services
134. Gather Victim Identity Information: Employee Names
135. Application Layer Protocol
136. Domain Trust Discovery
137. Phishing for Information: Spearphishing Voice
138. Data Manipulation
139. Obtain Capabilities: Tool
140. Acquire Infrastructure: Domains
141. Gather Victim Host Information: Firmware
142. Obfuscated Files or Information: Embedded Payloads
143. Remote Services
144. Data from Network Shared Drive
145. Steal or Forge Authentication Certificates
146. Event Triggered Execution: Udev Rules
147. Masquerading: Masquerade File Type
148. Dynamic Resolution: DNS Calculation
149. Acquire Access
150. Inter-Process Communication: Component Object Model
151. Shared Modules
152. Hijack Execution Flow: AppDomainManager
153. Gather Victim Identity Information: Email Addresses
154. OS Credential Dumping: LSA Secrets
155. Access Token Manipulation: Make and Impersonate Token
156. Traffic Signaling
157. Search Open Technical Databases: WHOIS
158. Email Collection: Remote Email Collection
159. Modify Cloud Compute Infrastructure: Delete Cloud Instance
160. Impair Defenses: Disable Windows Event Logging
161. Brute Force: Password Guessing
162. Boot or Logon Autostart Execution: Shortcut Modification
163. Gather Victim Org Information: Identify Business Tempo
164. Exploitation of Remote Services
165. Input Capture: Credential API Hooking
166. Weaken Encryption
167. Phishing for Information: Spearphishing Link
168. Modify Cloud Resource Hierarchy
169. Data Staged: Remote Data Staging
170. Proxy: Multi-hop Proxy
171. Establish Accounts: Social Media Accounts
172. Boot or Logon Autostart Execution: XDG Autostart Entries
173. Defacement
174. Inter-Process Communication: Dynamic Data Exchange
175. Adversary-in-the-Middle: Evil Twin
176. Gather Victim Network Information: Network Topology
177. Exploit Public-Facing Application
178. Event Triggered Execution: AppInit DLLs
179. File and Directory Permissions Modification: Windows File and Directory Permissions Modification
180. Indirect Command Execution
181. Brute Force: Credential Stuffing
182. Container and Resource Discovery
183. Process Injection: Process Hollowing
184. Event Triggered Execution: Netsh Helper DLL
185. Resource Hijacking: SMS Pumping
186. Gather Victim Identity Information: Credentials
187. Financial Theft
188. Taint Shared Content
189. Boot or Logon Autostart Execution: LSASS Driver
190. Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
191. Phishing for Information: Spearphishing Service
192. Steal or Forge Kerberos Tickets: Golden Ticket
193. Modify Cloud Compute Infrastructure
194. System Binary Proxy Execution: Mavinject
195. Boot or Logon Initialization Scripts: Network Logon Script
196. Cloud Service Discovery
197. Modify System Image: Patch System Image
198. Indicator Removal: Clear Mailbox Data
199. Boot or Logon Autostart Execution
200. Inter-Process Communication
201. Cloud Administration Command
202. Event Triggered Execution: Image File Execution Options Injection
203. Event Triggered Execution: Component Object Model Hijacking
204. Obtain Capabilities: Code Signing Certificates
205. Obtain Capabilities: Artificial Intelligence
206. Rogue Domain Controller
207. Hijack Execution Flow: DLL Side-Loading
208. Gather Victim Org Information
209. Office Application Startup: Outlook Home Page
210. Deploy Container
211. Email Collection: Email Forwarding Rule
212. System Binary Proxy Execution: Regsvr32
213. Gather Victim Host Information
214. Permission Groups Discovery: Local Groups
215. Cloud Storage Object Discovery
216. Hijack Execution Flow: Dynamic Linker Hijacking
217. Ingress Tool Transfer
218. Escape to Host
219. Event Triggered Execution: Screensaver
220. Office Application Startup: Office Template Macros
221. Create Account
222. Impair Defenses: Disable or Modify Cloud Firewall
223. Adversary-in-the-Middle
224. Scheduled Task/Job: Scheduled Task
225. Event Triggered Execution: Accessibility Features
226. Video Capture
227. Unsecured Credentials: Chat Messages
228. Acquire Infrastructure: Serverless
229. Service Stop
230. Obfuscated Files or Information: Steganography
231. Remote Services: Remote Desktop Protocol
232. Execution Guardrails: Environmental Keying
233. Data Destruction
234. Hide Artifacts: Hidden File System
235. Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol
236. Exfiltration Over Web Service: Exfiltration to Text Storage Sites
237. OS Credential Dumping: Security Account Manager
238. OS Credential Dumping: /etc/passwd and /etc/shadow
239. Unsecured Credentials
240. System Location Discovery
241. Modify Registry
242. Data from Configuration Repository: Network Device Configuration Dump
243. Modify Cloud Compute Infrastructure: Revert Cloud Instance
244. Data from Cloud Storage
245. Create or Modify System Process: Container Service
246. Input Capture
247. Subvert Trust Controls
248. Data Obfuscation: Junk Data
249. Masquerading: Space after Filename
250. OS Credential Dumping
251. Masquerading: Invalid Code Signature
252. Plist File Modification
253. Boot or Logon Initialization Scripts: Logon Script (Windows)
254. Archive Collected Data
255. Server Software Component
256. Acquire Infrastructure
257. Abuse Elevation Control Mechanism: Setuid and Setgid
258. Reflective Code Loading
259. Pre-OS Boot
260. Hide Artifacts: Hidden Users
261. Hide Artifacts: Hidden Files and Directories
262. Search Closed Sources: Threat Intel Vendors
263. Abuse Elevation Control Mechanism: TCC Manipulation
264. Stage Capabilities: SEO Poisoning
265. Network Boundary Bridging
266. Masquerading: Break Process Trees
267. Command and Scripting Interpreter: PowerShell
268. Automated Exfiltration: Traffic Duplication
269. Steal or Forge Kerberos Tickets
270. Search Open Websites/Domains
271. Credentials from Password Stores: Securityd Memory
272. Resource Hijacking: Cloud Service Hijacking
273. Modify Authentication Process
274. Phishing for Information: Spearphishing Attachment
275. Create Account: Local Account
276. Trusted Relationship
277. Create or Modify System Process: Systemd Service
278. Command and Scripting Interpreter: Windows Command Shell
279. Create Account: Domain Account
280. Create or Modify System Process: Launch Daemon
281. Boot or Logon Autostart Execution: Login Items
282. Use Alternate Authentication Material: Application Access Token
283. Drive-by Compromise
284. Encrypted Channel: Asymmetric Cryptography
285. Acquire Infrastructure: Virtual Private Server
286. Abuse Elevation Control Mechanism
287. Access Token Manipulation: Create Process with Token
288. External Remote Services
289. Server Software Component: IIS Components
290. Masquerading: Right-to-Left Override
291. System Services
292. Indicator Removal: Timestomp
293. Phishing: Spearphishing via Service
294. Stage Capabilities: Upload Malware
295. Credentials from Password Stores: Windows Credential Manager
296. Cloud Service Dashboard
297. Hide Artifacts: NTFS File Attributes
298. Automated Exfiltration
299. Data Staged: Local Data Staging
300. Data Encrypted for Impact
301. Steal Application Access Token
302. Gather Victim Org Information: Determine Physical Locations
303. Credentials from Password Stores: Password Managers
304. Search Open Websites/Domains: Search Engines
305. Indicator Removal: Clear Linux or Mac System Logs
306. Command and Scripting Interpreter: AppleScript
307. Brute Force
308. Subvert Trust Controls: SIP and Trust Provider Hijacking
309. Impair Defenses: Impair Command History Logging
310. Group Policy Discovery
311. Gather Victim Network Information: Network Trust Dependencies
312. Develop Capabilities: Digital Certificates
313. Obfuscated Files or Information
314. Log Enumeration
315. Gather Victim Org Information: Business Relationships
316. Archive Collected Data: Archive via Custom Method
317. Compromise Infrastructure: Virtual Private Server
318. Command and Scripting Interpreter: Unix Shell
319. Obtain Capabilities: Malware
320. Query Registry
321. Command and Scripting Interpreter: AutoHotKey & AutoIT
322. System Binary Proxy Execution: Electron Applications
323. Exfiltration Over Other Network Medium
324. Dynamic Resolution: Domain Generation Algorithms
325. Unsecured Credentials: Cloud Instance Metadata API
326. Defacement: External Defacement
327. Hijack Execution Flow: Path Interception by PATH Environment Variable
328. Input Capture: Keylogging
329. Gather Victim Host Information: Software
330. System Network Configuration Discovery
331. Process Injection: VDSO Hijacking
332. Exfiltration Over Web Service
333. Create or Modify System Process
334. Hide Artifacts: Hidden Window
335. Search Victim-Owned Websites
336. Impair Defenses: Disable or Modify Tools
337. Network Sniffing
338. Encrypted Channel: Symmetric Cryptography
339. Modify System Image: Downgrade System Image
340. System Script Proxy Execution: SyncAppvPublishingServer
341. Process Injection: Process Doppelgänging
342. Command and Scripting Interpreter: Lua
343. Rootkit
344. Email Collection: Local Email Collection
345. Endpoint Denial of Service: Service Exhaustion Flood
346. Event Triggered Execution: Emond
347. System Binary Proxy Execution
348. Credentials from Password Stores: Keychain
349. Steal or Forge Kerberos Tickets: AS-REP Roasting
350. Boot or Logon Initialization Scripts: Login Hook
351. Application Layer Protocol: Web Protocols
352. Impair Defenses: Disable or Modify Linux Audit System
353. Hijack Execution Flow: Services Registry Permissions Weakness
354. Web Service: Bidirectional Communication
355. Scheduled Task/Job: Cron
356. Application Layer Protocol: File Transfer Protocols
357. Forge Web Credentials: Web Cookies
358. Data Obfuscation: Protocol or Service Impersonation
359. Hide Artifacts: Process Argument Spoofing
360. Command and Scripting Interpreter: Cloud API
361. Trusted Developer Utilities Proxy Execution
362. Indicator Removal: Clear Windows Event Logs
363. Office Application Startup
364. Remote Services: Direct Cloud VM Connections
365. Traffic Signaling: Port Knocking
366. Stage Capabilities: Install Digital Certificate
367. Server Software Component: Web Shell
368. Virtualization/Sandbox Evasion: System Checks
369. System Binary Proxy Execution: InstallUtil
370. Build Image on Host
371. Compromise Accounts: Email Accounts
372. Supply Chain Compromise: Compromise Software Dependencies and Development Tools
373. Software Deployment Tools
374. Boot or Logon Autostart Execution: Winlogon Helper DLL
375. Screen Capture
376. Domain or Tenant Policy Modification: Group Policy Modification
377. Application Window Discovery
378. Data from Information Repositories
379. Impair Defenses: Disable or Modify System Firewall
380. Search Closed Sources: Purchase Technical Data
381. Compromise Accounts: Cloud Accounts
382. Steal or Forge Kerberos Tickets: Kerberoasting
383. Masquerading: Match Legitimate Name or Location
384. Pre-OS Boot: Component Firmware
385. Data Manipulation: Transmitted Data Manipulation
386. Peripheral Device Discovery
387. Hijack Execution Flow: Dylib Hijacking
388. Modify Authentication Process: Conditional Access Policies
389. Phishing for Information
390. Resource Hijacking
391. Boot or Logon Initialization Scripts
392. Account Manipulation: SSH Authorized Keys
393. Modify Authentication Process: Network Device Authentication
394. Office Application Startup: Outlook Rules
395. Data Obfuscation: Steganography
396. Gather Victim Network Information: Domain Properties
397. Protocol Tunneling
398. Stage Capabilities: Drive-by Target
399. Process Injection: Thread Local Storage
400. Compromise Infrastructure: Web Services
401. Office Application Startup: Add-ins
402. File and Directory Permissions Modification
403. Dynamic Resolution: Fast Flux DNS
404. Proxy: External Proxy
405. Hide Artifacts: Email Hiding Rules
406. Modify Authentication Process: Hybrid Identity
407. Direct Volume Access
408. Content Injection
409. Boot or Logon Autostart Execution: Active Setup
410. Remote Services: SSH
411. Network Denial of Service: Direct Network Flood
412. Masquerading: Masquerade Task or Service
413. Acquire Infrastructure: Server
414. Execution Guardrails: Mutual Exclusion
415. Search Open Websites/Domains: Code Repositories
416. Search Closed Sources
417. Obfuscated Files or Information: Binary Padding
418. Inhibit System Recovery
419. Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth
420. Indicator Removal: Clear Network Connection History and Configurations
421. Process Injection: Extra Window Memory Injection
422. Boot or Logon Autostart Execution: Kernel Modules and Extensions
423. Web Service: One-Way Communication
424. Non-Application Layer Protocol
425. Multi-Stage Channels
426. Modify Authentication Process: Multi-Factor Authentication
427. Access Token Manipulation: SID-History Injection
428. Non-Standard Port
429. Exploitation for Privilege Escalation
430. Data from Configuration Repository: SNMP (MIB Dump)
431. Dynamic Resolution
432. System Binary Proxy Execution: Mshta
433. Process Injection: Asynchronous Procedure Call
434. Subvert Trust Controls: Gatekeeper Bypass
435. Masquerading: Rename System Utilities
436. Command and Scripting Interpreter: Visual Basic
437. Indicator Removal: Clear Persistence
438. Unsecured Credentials: Private Keys
439. Compromise Infrastructure: Domains
440. Application Layer Protocol: Publish/Subscribe Protocols
441. Modify Cloud Compute Infrastructure: Create Snapshot
442. Hide Infrastructure
443. Obfuscated Files or Information: Fileless Storage
444. Domain or Tenant Policy Modification
445. Active Scanning: Scanning IP Blocks
446. Remote Services: Cloud Services
447. Proxy: Domain Fronting
448. System Time Discovery
449. Gather Victim Org Information: Identify Roles
450. Command and Scripting Interpreter: JavaScript
451. Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
452. System Binary Proxy Execution: Msiexec
453. Data Staged
454. Valid Accounts: Cloud Accounts
455. Gather Victim Network Information: Network Security Appliances
456. Hardware Additions
457. Establish Accounts: Email Accounts
458. Obfuscated Files or Information: LNK Icon Smuggling
459. Hijack Execution Flow: KernelCallbackTable
460. Unsecured Credentials: Bash History
461. Masquerading: Masquerade Account Name
462. Unsecured Credentials: Container API
463. Data from Information Repositories: Code Repositories
464. Server Software Component: Transport Agent
465. Compromise Infrastructure: Server
466. Pre-OS Boot: Bootkit
467. Data from Removable Media
468. System Binary Proxy Execution: Regsvcs/Regasm
469. Modify Cloud Compute Infrastructure: Create Cloud Instance
470. Disk Wipe: Disk Content Wipe
471. Boot or Logon Autostart Execution: Authentication Package
472. Process Injection: Dynamic-link Library Injection
473. Application Layer Protocol: DNS
474. Obfuscated Files or Information: Polymorphic Code
475. Event Triggered Execution: Installer Packages
476. Compromise Infrastructure
477. OS Credential Dumping: NTDS
478. Trusted Developer Utilities Proxy Execution: ClickOnce
479. Create or Modify System Process: Launch Agent
480. Browser Information Discovery
481. Impair Defenses
482. Obfuscated Files or Information: Command Obfuscation
483. Scheduled Transfer
484. Data from Information Repositories: Sharepoint
485. XSL Script Processing
486. Compromise Infrastructure: Serverless
487. Remote Services: SMB/Windows Admin Shares
488. Develop Capabilities: Code Signing Certificates
489. Obfuscated Files or Information: Indicator Removal from Tools
490. Obtain Capabilities: Digital Certificates
491. Use Alternate Authentication Material: Web Session Cookie
492. Remote Service Session Hijacking: SSH Hijacking
493. Data Manipulation: Runtime Data Manipulation
494. Subvert Trust Controls: Mark-of-the-Web Bypass
495. Process Injection: Thread Execution Hijacking
496. Container Administration Command
497. Adversary-in-the-Middle: ARP Cache Poisoning
498. Multi-Factor Authentication Interception
499. User Execution: Malicious Image
500. Hijack Execution Flow: COR_PROFILER
501. Browser Extensions
502. Access Token Manipulation
503. Steal Web Session Cookie
504. Acquire Infrastructure: Botnet
505. Exfiltration Over Physical Medium: Exfiltration over USB
506. Software Discovery
507. Compromise Infrastructure: Botnet
508. Masquerading: Double File Extension
509. Domain or Tenant Policy Modification: Trust Modification
510. Native API
511. Active Scanning
512. Lateral Tool Transfer
513. User Execution: Malicious Link
514. Data from Information Repositories: Messaging Applications
515. Account Discovery: Cloud Account
516. Valid Accounts
517. Indicator Removal: File Deletion
518. Exfiltration Over Web Service: Exfiltration Over Webhook
519. Exploitation for Client Execution
520. Forge Web Credentials
521. Impair Defenses: Downgrade Attack
522. Abuse Elevation Control Mechanism: Sudo and Sudo Caching
523. Brute Force: Password Cracking
524. Indicator Removal: Clear Command History
525. Obtain Capabilities: Exploits
526. Brute Force: Password Spraying
527. Replication Through Removable Media
528. Unused/Unsupported Cloud Regions
529. Event Triggered Execution: Unix Shell Configuration Modification
530. Archive Collected Data: Archive via Library
531. Command and Scripting Interpreter: Network Device CLI
532. Modify Authentication Process: Domain Controller Authentication
533. Network Denial of Service
534. Hijack Execution Flow: DLL Search Order Hijacking
535. Process Injection: Ptrace System Calls
536. Compromise Host Software Binary
537. Indicator Removal: Relocate Malware
538. Exfiltration Over Alternative Protocol
539. Email Collection
540. Boot or Logon Autostart Execution: Port Monitors
541. Search Open Technical Databases: CDNs
542. OS Credential Dumping: Proc Filesystem
543. Supply Chain Compromise: Compromise Hardware Supply Chain
544. Gather Victim Identity Information
545. Process Injection
546. System Binary Proxy Execution: Rundll32
547. Boot or Logon Initialization Scripts: RC Scripts
548. Command and Scripting Interpreter: Python
549. Supply Chain Compromise
550. Phishing: Spearphishing Attachment
551. Application Layer Protocol: Mail Protocols
552. Endpoint Denial of Service: Application or System Exploitation
553. Endpoint Denial of Service: OS Exhaustion Flood
554. System Owner/User Discovery
555. Obtain Capabilities: Vulnerabilities
556. Account Discovery
557. Develop Capabilities: Malware
558. Impersonation
559. System Network Configuration Discovery: Internet Connection Discovery
560. Device Driver Discovery
561. Boot or Logon Autostart Execution: Re-opened Applications
562. Access Token Manipulation: Parent PID Spoofing
563. Indicator Removal: Network Share Connection Removal
564. Data from Information Repositories: Confluence
565. Gather Victim Host Information: Client Configurations
566. Hijack Execution Flow: Services File Permissions Weakness
567. Supply Chain Compromise: Compromise Software Supply Chain
568. Compromise Accounts
569. Event Triggered Execution: Application Shimming
570. Event Triggered Execution
571. System Location Discovery: System Language Discovery
572. File and Directory Discovery
573. System Service Discovery
574. Account Manipulation: Additional Email Delegate Permissions
575. Fallback Channels
576. Data Encoding
577. Create or Modify System Process: Windows Service
578. Steal or Forge Kerberos Tickets: Ccache Files
579. Account Manipulation
580. Pre-OS Boot: ROMMONkit
581. Abuse Elevation Control Mechanism: Bypass User Account Control
582. User Execution
583. Remote Service Session Hijacking: RDP Hijacking
584. User Execution: Malicious File
585. System Services: Launchctl
586. Process Injection: ListPlanting
587. Remote Services: VNC
588. Forge Web Credentials: SAML Tokens
589. Data Obfuscation
590. Remote System Discovery
591. Multi-Factor Authentication Request Generation
592. Data from Information Repositories: Customer Relationship Management Software
593. Modify Authentication Process: Network Provider DLL
594. Audio Capture
595. Disk Wipe
596. Develop Capabilities: Exploits
597. Compromise Infrastructure: Network Devices
598. Acquire Infrastructure: Malvertising
599. Phishing: Spearphishing Link
600. Access Token Manipulation: Token Impersonation/Theft
601. Event Triggered Execution: PowerShell Profile
602. Search Open Technical Databases: DNS/Passive DNS
603. Scheduled Task/Job
604. Virtualization/Sandbox Evasion: Time Based Evasion
605. Network Boundary Bridging: Network Address Translation Traversal
606. Hijack Execution Flow: Executable Installer File Permissions Weakness
607. OS Credential Dumping: Cached Domain Credentials
608. Defacement: Internal Defacement
609. Boot or Logon Autostart Execution: Security Support Provider
610. Valid Accounts: Domain Accounts
611. Hide Artifacts: VBA Stomping
612. Software Discovery: Security Software Discovery
613. Obtain Capabilities
614. Use Alternate Authentication Material: Pass the Ticket
615. Browser Session Hijacking
616. Use Alternate Authentication Material
617. Event Triggered Execution: Change Default File Association
618. Web Service
619. Active Scanning: Vulnerability Scanning
620. Stage Capabilities: Link Target
621. Phishing
622. Account Discovery: Domain Account
623. Exfiltration Over Web Service: Exfiltration to Cloud Storage
624. Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations
625. Virtualization/Sandbox Evasion
626. Boot or Logon Autostart Execution: Time Providers
627. Server Software Component: Terminal Services DLL
628. Hide Artifacts: Ignore Process Interrupts
629. Gather Victim Host Information: Hardware
630. Command and Scripting Interpreter
631. OS Credential Dumping: DCSync
632. Remote Service Session Hijacking
633. Gather Victim Network Information: IP Addresses
634. Steal or Forge Kerberos Tickets: Silver Ticket
635. Exploitation for Credential Access
636. Indicator Removal
637. Implant Internal Image
638. Impair Defenses: Safe Mode Boot
639. Obfuscated Files or Information: Software Packing
640. Masquerading
641. Impair Defenses: Indicator Blocking
642. Adversary-in-the-Middle: DHCP Spoofing
643. Modify Authentication Process: Reversible Encryption
644. System Script Proxy Execution: PubPrn
645. Active Scanning: Wordlist Scanning
646. Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access
647. Obfuscated Files or Information: Compile After Delivery
648. Create Account: Cloud Account
649. Data Manipulation: Stored Data Manipulation
650. System Network Configuration Discovery: Wi-Fi Discovery
651. Stage Capabilities: Upload Tool
652. Deobfuscate/Decode Files or Information
653. Office Application Startup: Office Test
654. Exploitation for Defense Evasion
655. Cloud Infrastructure Discovery
656. Event Triggered Execution: Windows Management Instrumentation Event Subscription
657. Archive Collected Data: Archive via Utility