MITRE ATT&CK Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.

1. Exfiltration Over Physical Medium
2. Obtain Capabilities
3. Search Open Websites/Domains: Search Engines
4. Execution Guardrails: Environmental Keying
5. Valid Accounts: Cloud Accounts
6. Indicator Removal: Clear Persistence
7. Boot or Logon Autostart Execution: Winlogon Helper DLL
8. System Time Discovery
9. Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol
10. Hide Artifacts: NTFS File Attributes
11. Stage Capabilities
12. Inter-Process Communication
13. BITS Jobs
14. Valid Accounts: Local Accounts
15. Gather Victim Org Information: Determine Physical Locations
16. Gather Victim Host Information: Client Configurations
17. Browser Extensions
18. Defacement
19. Acquire Infrastructure: DNS Server
20. Server Software Component: IIS Components
21. Remote Services: Distributed Component Object Model
22. Acquire Infrastructure: Server
23. Server Software Component: Terminal Services DLL
24. System Binary Proxy Execution: Verclsid
25. Phishing for Information: Spearphishing Attachment
26. Native API
27. Data Transfer Size Limits
28. Power Settings
29. Brute Force: Password Guessing
30. Group Policy Discovery
31. Hijack Execution Flow: Services File Permissions Weakness
32. Hijack Execution Flow: Services Registry Permissions Weakness
33. Hide Artifacts: Run Virtual Instance
34. Weaken Encryption: Disable Crypto Hardware
35. Deploy Container
36. Shared Modules
37. Hijack Execution Flow
38. System Binary Proxy Execution
39. Hijack Execution Flow: KernelCallbackTable
40. Exploitation for Privilege Escalation
41. Process Injection: Process Doppelgänging
42. File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification
43. Indicator Removal: Clear Windows Event Logs
44. Boot or Logon Autostart Execution: Authentication Package
45. Hide Artifacts: Hidden File System
46. Debugger Evasion
47. Credentials from Password Stores: Cloud Secrets Management Stores
48. Event Triggered Execution: Unix Shell Configuration Modification
49. Traffic Signaling: Port Knocking
50. Masquerading: Break Process Trees
51. Exploitation for Credential Access
52. System Binary Proxy Execution: Control Panel
53. Search Open Technical Databases
54. Modify Cloud Compute Infrastructure: Create Snapshot
55. Scheduled Task/Job
56. Data from Configuration Repository
57. Event Triggered Execution: Component Object Model Hijacking
58. Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access
59. Acquire Infrastructure: Virtual Private Server
60. Hardware Additions
61. System Services: Service Execution
62. Event Triggered Execution: Emond
63. Drive-by Compromise
64. Steal Application Access Token
65. Dynamic Resolution: Fast Flux DNS
66. Hijack Execution Flow: Path Interception by Unquoted Path
67. Obfuscated Files or Information: Stripped Payloads
68. Data Obfuscation: Protocol or Service Impersonation
69. Gather Victim Identity Information: Credentials
70. Non-Standard Port
71. Modify Authentication Process: Network Provider DLL
72. Use Alternate Authentication Material: Web Session Cookie
73. Scheduled Task/Job: Systemd Timers
74. Proxy
75. Boot or Logon Autostart Execution
76. Abuse Elevation Control Mechanism: Elevated Execution with Prompt
77. Masquerading: Masquerade Task or Service
78. Process Injection: Asynchronous Procedure Call
79. Create or Modify System Process: Windows Service
80. Indicator Removal: Clear Linux or Mac System Logs
81. Active Scanning: Vulnerability Scanning
82. Server Software Component: SQL Stored Procedures
83. Office Application Startup: Outlook Home Page
84. Template Injection
85. Boot or Logon Autostart Execution: Security Support Provider
86. Remote System Discovery
87. Modify System Image
88. Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth
89. Hijack Execution Flow: Dynamic Linker Hijacking
90. Office Application Startup
91. Gather Victim Org Information: Business Relationships
92. System Binary Proxy Execution: Odbcconf
93. Remote Service Session Hijacking: SSH Hijacking
94. Steal or Forge Kerberos Tickets: Ccache Files
95. Search Closed Sources
96. Boot or Logon Autostart Execution: Time Providers
97. Modify Cloud Compute Infrastructure: Delete Cloud Instance
98. Virtualization/Sandbox Evasion
99. Server Software Component: Transport Agent
100. Access Token Manipulation: SID-History Injection
101. Automated Exfiltration
102. Use Alternate Authentication Material: Pass the Hash
103. Windows Management Instrumentation
104. Data from Network Shared Drive
105. Event Triggered Execution: LC_LOAD_DYLIB Addition
106. Unsecured Credentials: Group Policy Preferences
107. Cloud Storage Object Discovery
108. Supply Chain Compromise: Compromise Software Supply Chain
109. Stage Capabilities: SEO Poisoning
110. Permission Groups Discovery: Cloud Groups
111. System Binary Proxy Execution: Compiled HTML File
112. Acquire Infrastructure
113. File and Directory Permissions Modification
114. Escape to Host
115. Compromise Infrastructure: Web Services
116. Account Discovery
117. Cloud Service Dashboard
118. Establish Accounts: Social Media Accounts
119. Account Discovery: Cloud Account
120. Proxy: External Proxy
121. System Shutdown/Reboot
122. Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
123. Office Application Startup: Office Template Macros
124. OS Credential Dumping: LSA Secrets
125. Proxy: Internal Proxy
126. Compromise Infrastructure: DNS Server
127. Modify Authentication Process: Reversible Encryption
128. Remote Services: Remote Desktop Protocol
129. Remote Services: Cloud Services
130. Implant Internal Image
131. Indicator Removal: Clear Command History
132. Subvert Trust Controls: Mark-of-the-Web Bypass
133. Process Discovery
134. Event Triggered Execution: Trap
135. Email Collection
136. Unsecured Credentials: Credentials in Registry
137. System Service Discovery
138. User Execution: Malicious Image
139. Protocol Tunneling
140. OS Credential Dumping: Cached Domain Credentials
141. Network Denial of Service: Direct Network Flood
142. Event Triggered Execution: Change Default File Association
143. Traffic Signaling
144. Pre-OS Boot: ROMMONkit
145. Hide Artifacts: File/Path Exclusions
146. Abuse Elevation Control Mechanism
147. Hide Artifacts: VBA Stomping
148. Obtain Capabilities: Vulnerabilities
149. Application Window Discovery
150. Encrypted Channel: Symmetric Cryptography
151. Obfuscated Files or Information: Binary Padding
152. Network Sniffing
153. System Services
154. Email Collection: Remote Email Collection
155. Supply Chain Compromise: Compromise Software Dependencies and Development Tools
156. Virtualization/Sandbox Evasion: System Checks
157. Trusted Relationship
158. Application Layer Protocol: Mail Protocols
159. Command and Scripting Interpreter: PowerShell
160. Video Capture
161. Valid Accounts: Default Accounts
162. System Network Configuration Discovery
163. Valid Accounts: Domain Accounts
164. Ingress Tool Transfer
165. Event Triggered Execution: Accessibility Features
166. Pre-OS Boot: Bootkit
167. Pre-OS Boot: TFTP Boot
168. Access Token Manipulation: Create Process with Token
169. Boot or Logon Initialization Scripts: Login Hook
170. Boot or Logon Autostart Execution: Print Processors
171. Permission Groups Discovery
172. Office Application Startup: Outlook Rules
173. Brute Force: Password Cracking
174. Transfer Data to Cloud Account
175. Scheduled Task/Job: Scheduled Task
176. Boot or Logon Autostart Execution: XDG Autostart Entries
177. Modify Registry
178. Virtualization/Sandbox Evasion: Time Based Evasion
179. Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
180. Exfiltration Over Web Service: Exfiltration to Cloud Storage
181. Firmware Corruption
182. Phishing for Information
183. Resource Hijacking
184. Exfiltration Over Web Service: Exfiltration to Code Repository
185. Exfiltration Over Web Service
186. File and Directory Discovery
187. Supply Chain Compromise: Compromise Hardware Supply Chain
188. Execution Guardrails: Mutual Exclusion
189. Supply Chain Compromise
190. Gather Victim Identity Information
191. Data from Information Repositories
192. Stage Capabilities: Install Digital Certificate
193. Hijack Execution Flow: Path Interception by PATH Environment Variable
194. Cloud Administration Command
195. Remote Services: Direct Cloud VM Connections
196. Query Registry
197. Command and Scripting Interpreter: Windows Command Shell
198. Command and Scripting Interpreter: JavaScript
199. Access Token Manipulation: Make and Impersonate Token
200. Unsecured Credentials: Credentials In Files
201. Data from Cloud Storage
202. Forced Authentication
203. Web Service: Dead Drop Resolver
204. Account Manipulation: Additional Email Delegate Permissions
205. Adversary-in-the-Middle: Evil Twin
206. Weaken Encryption: Reduce Key Space
207. Steal or Forge Kerberos Tickets: Silver Ticket
208. OS Credential Dumping: Proc Filesystem
209. Event Triggered Execution: Installer Packages
210. Obfuscated Files or Information: Software Packing
211. Indicator Removal: Network Share Connection Removal
212. Resource Hijacking: Cloud Service Hijacking
213. Impair Defenses
214. Audio Capture
215. System Owner/User Discovery
216. System Network Connections Discovery
217. Boot or Logon Autostart Execution: Re-opened Applications
218. Endpoint Denial of Service
219. Fallback Channels
220. Automated Exfiltration: Traffic Duplication
221. Screen Capture
222. Access Token Manipulation
223. Create Account
224. Gather Victim Identity Information: Email Addresses
225. Masquerading: Match Legitimate Name or Location
226. Command and Scripting Interpreter: Unix Shell
227. Browser Information Discovery
228. Inter-Process Communication: XPC Services
229. Stage Capabilities: Link Target
230. Remote Access Software
231. Account Manipulation: Additional Local or Domain Groups
232. Account Discovery: Domain Account
233. Network Service Discovery
234. Input Capture: Credential API Hooking
235. Search Open Websites/Domains: Social Media
236. Data from Information Repositories: Sharepoint
237. Forge Web Credentials: SAML Tokens
238. Search Closed Sources: Threat Intel Vendors
239. Process Injection: Thread Local Storage
240. Boot or Logon Autostart Execution: LSASS Driver
241. Proxy: Domain Fronting
242. Data Encrypted for Impact
243. Indicator Removal
244. Account Manipulation: Device Registration
245. Phishing for Information: Spearphishing Link
246. Exfiltration Over Physical Medium: Exfiltration over USB
247. Remote Service Session Hijacking
248. Data Obfuscation: Steganography
249. Cloud Infrastructure Discovery
250. Hide Artifacts: Hidden Files and Directories
251. Command and Scripting Interpreter: Cloud API
252. Application Layer Protocol: DNS
253. Hijack Execution Flow: COR_PROFILER
254. Data Manipulation: Runtime Data Manipulation
255. System Script Proxy Execution: PubPrn
256. Process Injection: Thread Execution Hijacking
257. Inter-Process Communication: Dynamic Data Exchange
258. Pre-OS Boot: System Firmware
259. Modify Authentication Process: Domain Controller Authentication
260. Establish Accounts: Cloud Accounts
261. Container Administration Command
262. Impair Defenses: Disable or Modify Linux Audit System
263. Permission Groups Discovery: Domain Groups
264. Archive Collected Data
265. Process Injection: Process Hollowing
266. Impair Defenses: Disable or Modify Cloud Logs
267. Obtain Capabilities: Malware
268. Unsecured Credentials: Cloud Instance Metadata API
269. Create or Modify System Process: Launch Daemon
270. Indicator Removal: Relocate Malware
271. Obfuscated Files or Information: Compile After Delivery
272. Application Layer Protocol
273. Search Open Technical Databases: Scan Databases
274. Boot or Logon Autostart Execution: Port Monitors
275. Acquire Access
276. Hide Infrastructure
277. Inhibit System Recovery
278. Impair Defenses: Spoof Security Alerting
279. OS Credential Dumping: Security Account Manager
280. Gather Victim Org Information
281. Develop Capabilities: Code Signing Certificates
282. Account Manipulation: Additional Cloud Credentials
283. Software Discovery
284. Exfiltration Over Other Network Medium
285. Encrypted Channel
286. Gather Victim Network Information: IP Addresses
287. Reflective Code Loading
288. Multi-Factor Authentication Interception
289. Gather Victim Network Information: Domain Properties
290. Masquerading: Rename System Utilities
291. Indicator Removal: Timestomp
292. Obfuscated Files or Information: Embedded Payloads
293. Event Triggered Execution: AppCert DLLs
294. Gather Victim Org Information: Identify Roles
295. Subvert Trust Controls: SIP and Trust Provider Hijacking
296. Non-Application Layer Protocol
297. Peripheral Device Discovery
298. Gather Victim Network Information: Network Trust Dependencies
299. Network Denial of Service: Reflection Amplification
300. Encrypted Channel: Asymmetric Cryptography
301. Application Layer Protocol: Web Protocols
302. Unused/Unsupported Cloud Regions
303. Remote Services: SSH
304. Adversary-in-the-Middle: DHCP Spoofing
305. Event Triggered Execution: Udev Rules
306. Masquerading
307. Exfiltration Over Web Service: Exfiltration Over Webhook
308. Server Software Component
309. Search Open Technical Databases: Digital Certificates
310. Subvert Trust Controls: Install Root Certificate
311. Credentials from Password Stores: Credentials from Web Browsers
312. Develop Capabilities: Digital Certificates
313. Data Manipulation: Transmitted Data Manipulation
314. Dynamic Resolution
315. Hijack Execution Flow: DLL Side-Loading
316. Office Application Startup: Office Test
317. Obfuscated Files or Information: Encrypted/Encoded File
318. Remote Services
319. Input Capture: GUI Input Capture
320. Account Manipulation: Additional Cloud Roles
321. Office Application Startup: Add-ins
322. Proxy: Multi-hop Proxy
323. Phishing for Information: Spearphishing Voice
324. Compromise Infrastructure: Serverless
325. Trusted Developer Utilities Proxy Execution: ClickOnce
326. Process Injection: Proc Memory
327. Web Service: Bidirectional Communication
328. Indirect Command Execution
329. Gather Victim Host Information
330. Data Staged: Local Data Staging
331. Forge Web Credentials: Web Cookies
332. Hide Artifacts: Hidden Window
333. Input Capture
334. Domain or Tenant Policy Modification: Trust Modification
335. Lateral Tool Transfer
336. System Binary Proxy Execution: CMSTP
337. Search Open Websites/Domains
338. Data from Information Repositories: Confluence
339. Event Triggered Execution: Windows Management Instrumentation Event Subscription
340. Obtain Capabilities: Code Signing Certificates
341. Deobfuscate/Decode Files or Information
342. Boot or Logon Initialization Scripts: Network Logon Script
343. Gather Victim Org Information: Identify Business Tempo
344. Compromise Host Software Binary
345. Gather Victim Identity Information: Employee Names
346. System Binary Proxy Execution: Msiexec
347. Data Manipulation
348. Indicator Removal: File Deletion
349. Event Triggered Execution: Netsh Helper DLL
350. Account Discovery: Local Account
351. Develop Capabilities
352. Impair Defenses: Disable or Modify Cloud Firewall
353. Dynamic Resolution: DNS Calculation
354. Exploitation for Defense Evasion
355. Exploit Public-Facing Application
356. Data Obfuscation: Junk Data
357. Acquire Infrastructure: Web Services
358. System Network Configuration Discovery: Wi-Fi Discovery
359. Boot or Logon Initialization Scripts
360. Data from Configuration Repository: SNMP (MIB Dump)
361. Endpoint Denial of Service: Application or System Exploitation
362. Modify Cloud Compute Infrastructure: Revert Cloud Instance
363. Command and Scripting Interpreter: Network Device CLI
364. Modify Authentication Process: Network Device Authentication
365. Data from Configuration Repository: Network Device Configuration Dump
366. Subvert Trust Controls: Code Signing Policy Modification
367. Phishing: Spearphishing via Service
368. Data Destruction: Lifecycle-Triggered Deletion
369. Stage Capabilities: Drive-by Target
370. OS Credential Dumping: NTDS
371. OS Credential Dumping: LSASS Memory
372. Steal or Forge Kerberos Tickets
373. Steal or Forge Kerberos Tickets: AS-REP Roasting
374. Hide Artifacts: Ignore Process Interrupts
375. Unsecured Credentials
376. Archive Collected Data: Archive via Utility
377. Hijack Execution Flow: Path Interception by Search Order Hijacking
378. Data Manipulation: Stored Data Manipulation
379. Obfuscated Files or Information
380. Obtain Capabilities: Artificial Intelligence
381. Brute Force
382. Create Account: Cloud Account
383. Masquerading: Invalid Code Signature
384. Unsecured Credentials: Chat Messages
385. Hijack Execution Flow: Dylib Hijacking
386. Active Scanning: Scanning IP Blocks
387. Active Scanning
388. Subvert Trust Controls
389. Data Encoding: Standard Encoding
390. Browser Session Hijacking
391. Valid Accounts
392. Compromise Infrastructure
393. Hijack Execution Flow: DLL Search Order Hijacking
394. Adversary-in-the-Middle
395. Compromise Infrastructure: Botnet
396. Search Open Technical Databases: DNS/Passive DNS
397. Compromise Accounts: Email Accounts
398. Process Injection
399. Search Closed Sources: Purchase Technical Data
400. Exploitation for Client Execution
401. Process Injection: VDSO Hijacking
402. Hide Artifacts: Process Argument Spoofing
403. Masquerading: Right-to-Left Override
404. Indicator Removal: Clear Mailbox Data
405. Subvert Trust Controls: Gatekeeper Bypass
406. Obfuscated Files or Information: LNK Icon Smuggling
407. Defacement: Internal Defacement
408. Resource Hijacking: SMS Pumping
409. Credentials from Password Stores: Windows Credential Manager
410. Data from Local System
411. File and Directory Permissions Modification: Windows File and Directory Permissions Modification
412. Phishing
413. Abuse Elevation Control Mechanism: Setuid and Setgid
414. Email Collection: Email Forwarding Rule
415. Modify Authentication Process: Pluggable Authentication Modules
416. System Binary Proxy Execution: Regsvcs/Regasm
417. Hide Artifacts
418. Disk Wipe
419. Compromise Accounts
420. Software Discovery: Security Software Discovery
421. Data Staged: Remote Data Staging
422. Obfuscated Files or Information: Command Obfuscation
423. Remote Service Session Hijacking: RDP Hijacking
424. Masquerading: Masquerade Account Name
425. Dynamic Resolution: Domain Generation Algorithms
426. System Location Discovery
427. Office Application Startup: Outlook Forms
428. Masquerading: Masquerade File Type
429. Obfuscated Files or Information: Indicator Removal from Tools
430. Masquerading: Space after Filename
431. User Execution
432. Direct Volume Access
433. Application Layer Protocol: File Transfer Protocols
434. Data from Information Repositories: Code Repositories
435. Multi-Stage Channels
436. Archive Collected Data: Archive via Library
437. Gather Victim Network Information: Network Security Appliances
438. Scheduled Transfer
439. Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations
440. Credentials from Password Stores: Keychain
441. Compromise Infrastructure: Network Devices
442. Adversary-in-the-Middle: ARP Cache Poisoning
443. Input Capture: Web Portal Capture
444. Steal Web Session Cookie
445. Resource Hijacking: Compute Hijacking
446. Boot or Logon Autostart Execution: Shortcut Modification
447. Acquire Infrastructure: Malvertising
448. Trusted Developer Utilities Proxy Execution: MSBuild
449. Indicator Removal: Clear Network Connection History and Configurations
450. Abuse Elevation Control Mechanism: Sudo and Sudo Caching
451. Traffic Signaling: Socket Filters
452. Steal or Forge Kerberos Tickets: Kerberoasting
453. Credentials from Password Stores: Securityd Memory
454. Cloud Service Discovery
455. Obfuscated Files or Information: Polymorphic Code
456. Application Layer Protocol: Publish/Subscribe Protocols
457. Account Discovery: Email Account
458. Search Victim-Owned Websites
459. Event Triggered Execution: Application Shimming
460. Modify Cloud Compute Infrastructure: Create Cloud Instance
461. Use Alternate Authentication Material
462. Create or Modify System Process: Launch Agent
463. Obfuscated Files or Information: HTML Smuggling
464. Use Alternate Authentication Material: Pass the Ticket
465. Execution Guardrails
466. Obfuscated Files or Information: Dynamic API Resolution
467. Phishing: Spearphishing Voice
468. Data from Information Repositories: Customer Relationship Management Software
469. Obtain Capabilities: Digital Certificates
470. Exfiltration Over Web Service: Exfiltration to Text Storage Sites
471. Domain or Tenant Policy Modification
472. User Execution: Malicious File
473. Obtain Capabilities: Tool
474. Impair Defenses: Indicator Blocking
475. System Binary Proxy Execution: Regsvr32
476. Gather Victim Network Information
477. System Services: Launchctl
478. Abuse Elevation Control Mechanism: Bypass User Account Control
479. Command and Scripting Interpreter
480. Create or Modify System Process
481. Data Obfuscation
482. Command and Scripting Interpreter: AppleScript
483. Impair Defenses: Safe Mode Boot
484. Web Service
485. Gather Victim Network Information: DNS
486. Input Capture: Keylogging
487. Remote Services: Windows Remote Management
488. Obfuscated Files or Information: Fileless Storage
489. Modify Cloud Resource Hierarchy
490. Network Denial of Service
491. Create Account: Local Account
492. Plist File Modification
493. Subvert Trust Controls: Code Signing
494. Credentials from Password Stores: Password Managers
495. Obfuscated Files or Information: Steganography
496. System Location Discovery: System Language Discovery
497. OS Credential Dumping: /etc/passwd and /etc/shadow
498. Modify Authentication Process: Multi-Factor Authentication
499. Event Triggered Execution: PowerShell Profile
500. Scheduled Task/Job: At
501. Disk Wipe: Disk Structure Wipe
502. Data from Removable Media
503. Financial Theft
504. Boot or Logon Initialization Scripts: RC Scripts
505. Container and Resource Discovery
506. Remote Services: VNC
507. Account Access Removal
508. Access Token Manipulation: Parent PID Spoofing
509. Boot or Logon Autostart Execution: Login Items
510. Impair Defenses: Downgrade Attack
511. Automated Collection
512. Impersonation
513. Exfiltration Over Alternative Protocol
514. Phishing for Information: Spearphishing Service
515. Network Share Discovery
516. Modify Authentication Process: Hybrid Identity
517. Process Injection: Extra Window Memory Injection
518. User Execution: Malicious Link
519. Establish Accounts: Email Accounts
520. Communication Through Removable Media
521. Process Injection: Dynamic-link Library Injection
522. Stage Capabilities: Upload Malware
523. Steal or Forge Kerberos Tickets: Golden Ticket
524. name
525. Clipboard Data
526. Compromise Infrastructure: Domains
527. Create or Modify System Process: Container Service
528. Develop Capabilities: Malware
529. Permission Groups Discovery: Local Groups
530. Weaken Encryption
531. Exfiltration Over C2 Channel
532. Impair Defenses: Impair Command History Logging
533. Search Open Technical Databases: CDNs
534. Obtain Capabilities: Exploits
535. External Remote Services
536. Gather Victim Host Information: Firmware
537. Command and Scripting Interpreter: Lua
538. Command and Scripting Interpreter: AutoHotKey & AutoIT
539. Create Account: Domain Account
540. Server Software Component: Web Shell
541. Endpoint Denial of Service: OS Exhaustion Flood
542. Active Scanning: Wordlist Scanning
543. Boot or Logon Autostart Execution: Kernel Modules and Extensions
544. Disk Wipe: Disk Content Wipe
545. Establish Accounts
546. Compromise Infrastructure: Virtual Private Server
547. Endpoint Denial of Service: Service Exhaustion Flood
548. Create or Modify System Process: Systemd Service
549. Phishing: Spearphishing Link
550. Unsecured Credentials: Bash History
551. Use Alternate Authentication Material: Application Access Token
552. Command and Scripting Interpreter: Visual Basic
553. Credentials from Password Stores
554. Process Injection: ListPlanting
555. Domain Trust Discovery
556. Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
557. Virtualization/Sandbox Evasion: User Activity Based Checks
558. Rootkit
559. Account Manipulation: SSH Authorized Keys
560. Trusted Developer Utilities Proxy Execution
561. Acquire Infrastructure: Serverless
562. System Script Proxy Execution
563. Hijack Execution Flow: AppDomainManager
564. Internal Spearphishing
565. Data from Information Repositories: Messaging Applications
566. Defacement: External Defacement
567. Masquerading: Double File Extension
568. Search Open Websites/Domains: Code Repositories
569. Event Triggered Execution: Screensaver
570. Gather Victim Host Information: Hardware
571. Endpoint Denial of Service: Application Exhaustion Flood
572. Develop Capabilities: Exploits
573. Gather Victim Host Information: Software
574. Access Token Manipulation: Token Impersonation/Theft
575. XSL Script Processing
576. Replication Through Removable Media
577. Data Encoding: Non-Standard Encoding
578. Boot or Logon Autostart Execution: Active Setup
579. Account Manipulation
580. Modify System Image: Downgrade System Image
581. System Binary Proxy Execution: Mshta
582. Impair Defenses: Disable Windows Event Logging
583. Compromise Infrastructure: Server
584. Impair Defenses: Disable or Modify System Firewall
585. Data Destruction
586. Acquire Infrastructure: Domains
587. Multi-Factor Authentication Request Generation
588. Hide Artifacts: Email Hiding Rules
589. Phishing: Spearphishing Attachment
590. Event Triggered Execution: AppInit DLLs
591. Hijack Execution Flow: Executable Installer File Permissions Weakness
592. Unsecured Credentials: Container API
593. Boot or Logon Initialization Scripts: Logon Script (Windows)
594. Gather Victim Network Information: Network Topology
595. System Script Proxy Execution: SyncAppvPublishingServer
596. Exploitation of Remote Services
597. Software Deployment Tools
598. Resource Hijacking: Bandwidth Hijacking
599. Data Encoding
600. Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol
601. Scheduled Task/Job: Container Orchestration Job
602. System Network Configuration Discovery: Internet Connection Discovery
603. Command and Scripting Interpreter: Python
604. Scheduled Task/Job: Cron
605. Password Policy Discovery
606. Remote Services: SMB/Windows Admin Shares
607. System Binary Proxy Execution: Electron Applications
608. Acquire Infrastructure: Botnet
609. Web Service: One-Way Communication
610. Serverless Execution
611. Pre-OS Boot: Component Firmware
612. OS Credential Dumping
613. Compromise Accounts: Cloud Accounts
614. Domain or Tenant Policy Modification: Group Policy Modification
615. Rogue Domain Controller
616. Account Manipulation: Additional Container Cluster Roles
617. Boot or Logon Initialization Scripts: Startup Items
618. Network Boundary Bridging
619. Service Stop
620. Network Boundary Bridging: Network Address Translation Traversal
621. Abuse Elevation Control Mechanism: TCC Manipulation
622. Data Staged
623. Process Injection: Ptrace System Calls
624. Archive Collected Data: Archive via Custom Method
625. Device Driver Discovery
626. Taint Shared Content
627. Process Injection: Portable Executable Injection
628. Modify Authentication Process: Password Filter DLL
629. Brute Force: Password Spraying
630. Hide Artifacts: Resource Forking
631. Compromise Accounts: Social Media Accounts
632. System Information Discovery
633. Modify Authentication Process
634. Log Enumeration
635. Event Triggered Execution
636. Build Image on Host
637. System Binary Proxy Execution: Rundll32
638. Hide Artifacts: Hidden Users
639. Event Triggered Execution: Image File Execution Options Injection
640. Search Open Technical Databases: WHOIS
641. Stage Capabilities: Upload Tool
642. Unsecured Credentials: Private Keys
643. OS Credential Dumping: DCSync
644. System Binary Proxy Execution: MMC
645. System Binary Proxy Execution: Mavinject
646. Forge Web Credentials
647. Brute Force: Credential Stuffing
648. Steal or Forge Authentication Certificates
649. Inter-Process Communication: Component Object Model
650. Content Injection
651. Modify Authentication Process: Conditional Access Policies
652. Impair Defenses: Disable or Modify Tools
653. Modify System Image: Patch System Image
654. Email Collection: Local Email Collection
655. System Binary Proxy Execution: InstallUtil
656. Modify Cloud Compute Infrastructure
657. Pre-OS Boot