MITRE ATT&CK Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.

1. Compromise Infrastructure: Virtual Private Server
2. Gather Victim Identity Information: Employee Names
3. Masquerading: Rename System Utilities
4. Data Manipulation: Runtime Data Manipulation
5. Acquire Infrastructure: Domains
6. Inhibit System Recovery
7. OS Credential Dumping: LSASS Memory
8. Fallback Channels
9. Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol
10. Process Injection: Extra Window Memory Injection
11. Application Window Discovery
12. Process Injection: VDSO Hijacking
13. Endpoint Denial of Service: Application or System Exploitation
14. Event Triggered Execution: Unix Shell Configuration Modification
15. Hijack Execution Flow: COR_PROFILER
16. Use Alternate Authentication Material: Pass the Ticket
17. Event Triggered Execution
18. Impair Defenses: Impair Command History Logging
19. Search Open Technical Databases: CDNs
20. System Binary Proxy Execution: Electron Applications
21. OS Credential Dumping: NTDS
22. Obfuscated Files or Information: Binary Padding
23. File and Directory Discovery
24. Inter-Process Communication: XPC Services
25. Command and Scripting Interpreter: Windows Command Shell
26. OS Credential Dumping: DCSync
27. Account Manipulation: Additional Cloud Roles
28. Browser Information Discovery
29. Modify Authentication Process: Hybrid Identity
30. Application Layer Protocol: Publish/Subscribe Protocols
31. Create Account: Local Account
32. Valid Accounts: Cloud Accounts
33. File and Directory Permissions Modification: Windows File and Directory Permissions Modification
34. Unsecured Credentials: Credentials in Registry
35. Steal Web Session Cookie
36. Event Triggered Execution: Screensaver
37. Modify Cloud Resource Hierarchy
38. Data from Cloud Storage
39. Gather Victim Identity Information
40. Indicator Removal: Clear Persistence
41. Boot or Logon Autostart Execution: Re-opened Applications
42. Boot or Logon Autostart Execution: Winlogon Helper DLL
43. Impair Defenses: Spoof Security Alerting
44. Compromise Host Software Binary
45. Active Scanning
46. System Binary Proxy Execution: Compiled HTML File
47. Encrypted Channel: Symmetric Cryptography
48. Valid Accounts: Domain Accounts
49. Data Obfuscation: Steganography
50. Data Transfer Size Limits
51. Boot or Logon Autostart Execution: Port Monitors
52. Phishing for Information: Spearphishing Service
53. Compromise Infrastructure: Web Services
54. System Binary Proxy Execution: MMC
55. Impair Defenses: Disable or Modify Linux Audit System
56. Build Image on Host
57. Process Discovery
58. Defacement: Internal Defacement
59. Search Closed Sources
60. Command and Scripting Interpreter: Python
61. Pre-OS Boot: Bootkit
62. Phishing
63. Account Manipulation: Additional Cloud Credentials
64. Data Obfuscation
65. Steal or Forge Authentication Certificates
66. Remote Services: Cloud Services
67. System Network Configuration Discovery: Wi-Fi Discovery
68. Hijack Execution Flow: Path Interception by Search Order Hijacking
69. Event Triggered Execution: Trap
70. Indicator Removal: File Deletion
71. Archive Collected Data: Archive via Custom Method
72. Software Discovery: Security Software Discovery
73. Stage Capabilities: Upload Tool
74. Dynamic Resolution: Fast Flux DNS
75. File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification
76. Abuse Elevation Control Mechanism
77. Process Injection
78. Create Account: Domain Account
79. Inter-Process Communication: Component Object Model
80. Data Manipulation: Stored Data Manipulation
81. Process Injection: Ptrace System Calls
82. Event Triggered Execution: AppInit DLLs
83. Encrypted Channel: Asymmetric Cryptography
84. Trusted Developer Utilities Proxy Execution
85. Modify Authentication Process: Multi-Factor Authentication
86. Web Service: Bidirectional Communication
87. Access Token Manipulation: Parent PID Spoofing
88. Pre-OS Boot
89. Exfiltration Over C2 Channel
90. Pre-OS Boot: TFTP Boot
91. Indicator Removal: Clear Network Connection History and Configurations
92. Defacement: External Defacement
93. Escape to Host
94. Data from Information Repositories: Code Repositories
95. Modify Authentication Process: Pluggable Authentication Modules
96. File and Directory Permissions Modification
97. Exploitation for Client Execution
98. OS Credential Dumping
99. Subvert Trust Controls: Mark-of-the-Web Bypass
100. Boot or Logon Autostart Execution: Print Processors
101. System Owner/User Discovery
102. Non-Application Layer Protocol
103. Deploy Container
104. Obfuscated Files or Information
105. Search Open Websites/Domains: Search Engines
106. Application Layer Protocol
107. Impair Defenses: Disable or Modify Cloud Logs
108. Subvert Trust Controls: Install Root Certificate
109. Exfiltration Over Other Network Medium
110. Dynamic Resolution: DNS Calculation
111. Abuse Elevation Control Mechanism: Elevated Execution with Prompt
112. Phishing: Spearphishing Attachment
113. Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
114. Obfuscated Files or Information: Command Obfuscation
115. Cloud Service Discovery
116. Impair Defenses: Indicator Blocking
117. System Binary Proxy Execution: Control Panel
118. Stage Capabilities: Install Digital Certificate
119. Access Token Manipulation: Token Impersonation/Theft
120. Exfiltration Over Web Service
121. Peripheral Device Discovery
122. Debugger Evasion
123. Virtualization/Sandbox Evasion: User Activity Based Checks
124. Data Manipulation: Transmitted Data Manipulation
125. Valid Accounts: Local Accounts
126. Data Manipulation
127. Multi-Factor Authentication Request Generation
128. Input Capture: Web Portal Capture
129. Windows Management Instrumentation
130. Pre-OS Boot: ROMMONkit
131. Proxy: Multi-hop Proxy
132. Account Discovery: Cloud Account
133. Command and Scripting Interpreter
134. Data from Local System
135. Data from Information Repositories: Messaging Applications
136. Impair Defenses: Disable or Modify System Firewall
137. Event Triggered Execution: Application Shimming
138. Server Software Component
139. Stage Capabilities: Drive-by Target
140. Modify Authentication Process: Network Device Authentication
141. Disk Wipe: Disk Content Wipe
142. Command and Scripting Interpreter: PowerShell
143. Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
144. Container and Resource Discovery
145. System Service Discovery
146. Access Token Manipulation: Create Process with Token
147. Event Triggered Execution: Udev Rules
148. Log Enumeration
149. Permission Groups Discovery
150. Brute Force: Password Guessing
151. Execution Guardrails
152. Account Discovery: Email Account
153. Command and Scripting Interpreter: Cloud API
154. System Script Proxy Execution: SyncAppvPublishingServer
155. Search Victim-Owned Websites
156. Data from Information Repositories: Confluence
157. Automated Exfiltration: Traffic Duplication
158. Network Boundary Bridging
159. Software Discovery
160. Screen Capture
161. Search Open Technical Databases
162. Stage Capabilities: Link Target
163. Gather Victim Network Information: Network Security Appliances
164. Clipboard Data
165. Event Triggered Execution: Netsh Helper DLL
166. Data from Information Repositories
167. Event Triggered Execution: Emond
168. Obfuscated Files or Information: Indicator Removal from Tools
169. Data from Information Repositories: Sharepoint
170. Office Application Startup: Outlook Rules
171. Supply Chain Compromise: Compromise Software Supply Chain
172. Adversary-in-the-Middle: Evil Twin
173. Exploitation for Privilege Escalation
174. Access Token Manipulation: Make and Impersonate Token
175. Execution Guardrails: Mutual Exclusion
176. Permission Groups Discovery: Local Groups
177. Automated Exfiltration
178. Virtualization/Sandbox Evasion: System Checks
179. Command and Scripting Interpreter: JavaScript
180. Boot or Logon Autostart Execution
181. Data from Network Shared Drive
182. Modify Authentication Process: Reversible Encryption
183. Resource Hijacking: SMS Pumping
184. Permission Groups Discovery: Domain Groups
185. Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
186. Account Manipulation: Additional Email Delegate Permissions
187. name
188. Forced Authentication
189. Masquerading: Invalid Code Signature
190. Credentials from Password Stores: Credentials from Web Browsers
191. Data Encoding
192. Brute Force
193. Proxy
194. External Remote Services
195. Hide Artifacts: File/Path Exclusions
196. Trusted Developer Utilities Proxy Execution: MSBuild
197. Archive Collected Data
198. Brute Force: Password Cracking
199. Gather Victim Network Information: IP Addresses
200. Command and Scripting Interpreter: AppleScript
201. Remote Service Session Hijacking: RDP Hijacking
202. Phishing: Spearphishing Link
203. Forge Web Credentials: SAML Tokens
204. Cloud Storage Object Discovery
205. Non-Standard Port
206. Obtain Capabilities: Exploits
207. Create Account
208. Steal or Forge Kerberos Tickets: Kerberoasting
209. Command and Scripting Interpreter: AutoHotKey & AutoIT
210. Impair Defenses: Disable or Modify Tools
211. Modify Cloud Compute Infrastructure: Create Snapshot
212. Develop Capabilities: Code Signing Certificates
213. Office Application Startup: Add-ins
214. Domain or Tenant Policy Modification
215. System Script Proxy Execution
216. Exfiltration Over Web Service: Exfiltration to Cloud Storage
217. Email Collection: Remote Email Collection
218. System Script Proxy Execution: PubPrn
219. Boot or Logon Autostart Execution: Kernel Modules and Extensions
220. Impair Defenses: Disable or Modify Cloud Firewall
221. Gather Victim Org Information: Business Relationships
222. Forge Web Credentials: Web Cookies
223. Data Encrypted for Impact
224. Adversary-in-the-Middle: DHCP Spoofing
225. Modify Authentication Process: Conditional Access Policies
226. Modify Authentication Process: Password Filter DLL
227. Develop Capabilities
228. Search Closed Sources: Threat Intel Vendors
229. Protocol Tunneling
230. Supply Chain Compromise: Compromise Hardware Supply Chain
231. Process Injection: Thread Execution Hijacking
232. Remote Services: Distributed Component Object Model
233. Create Account: Cloud Account
234. Supply Chain Compromise
235. Input Capture: GUI Input Capture
236. Trusted Relationship
237. Gather Victim Host Information: Hardware
238. Lateral Tool Transfer
239. Compromise Infrastructure: Serverless
240. Application Layer Protocol: Web Protocols
241. Phishing for Information: Spearphishing Link
242. Active Scanning: Vulnerability Scanning
243. Resource Hijacking: Bandwidth Hijacking
244. Active Scanning: Scanning IP Blocks
245. Application Layer Protocol: DNS
246. Hide Artifacts: Ignore Process Interrupts
247. Container Administration Command
248. Gather Victim Org Information: Identify Roles
249. Gather Victim Host Information: Client Configurations
250. System Binary Proxy Execution: Verclsid
251. Shared Modules
252. Financial Theft
253. Plist File Modification
254. Exfiltration Over Web Service: Exfiltration Over Webhook
255. Hide Artifacts: Hidden Window
256. Obtain Capabilities: Artificial Intelligence
257. Modify Authentication Process
258. Email Collection: Email Forwarding Rule
259. Subvert Trust Controls: SIP and Trust Provider Hijacking
260. Unused/Unsupported Cloud Regions
261. Hide Artifacts
262. Phishing for Information
263. Hijack Execution Flow: KernelCallbackTable
264. Data Staged: Remote Data Staging
265. Obtain Capabilities: Digital Certificates
266. Remote Services: VNC
267. OS Credential Dumping: Security Account Manager
268. Firmware Corruption
269. Endpoint Denial of Service
270. Boot or Logon Autostart Execution: LSASS Driver
271. Office Application Startup: Office Template Macros
272. Gather Victim Org Information: Identify Business Tempo
273. Subvert Trust Controls: Code Signing
274. Subvert Trust Controls
275. Process Injection: Proc Memory
276. Remote Services
277. Search Open Websites/Domains: Social Media
278. Gather Victim Identity Information: Credentials
279. Data Staged: Local Data Staging
280. Process Injection: Process Doppelgänging
281. Proxy: External Proxy
282. Gather Victim Host Information: Software
283. Boot or Logon Autostart Execution: Login Items
284. Remote System Discovery
285. Impair Defenses: Disable Windows Event Logging
286. Obfuscated Files or Information: Compile After Delivery
287. Gather Victim Network Information: Domain Properties
288. Hide Artifacts: Hidden Files and Directories
289. Network Boundary Bridging: Network Address Translation Traversal
290. Scheduled Task/Job: At
291. Scheduled Task/Job: Scheduled Task
292. Establish Accounts: Email Accounts
293. Remote Services: Windows Remote Management
294. Data Encoding: Standard Encoding
295. System Binary Proxy Execution: Regsvcs/Regasm
296. Stage Capabilities
297. Weaken Encryption
298. Password Policy Discovery
299. Compromise Accounts: Social Media Accounts
300. Steal or Forge Kerberos Tickets: AS-REP Roasting
301. Resource Hijacking: Cloud Service Hijacking
302. Credentials from Password Stores: Securityd Memory
303. Network Sniffing
304. Process Injection: Process Hollowing
305. Data Obfuscation: Junk Data
306. Event Triggered Execution: Windows Management Instrumentation Event Subscription
307. Use Alternate Authentication Material: Web Session Cookie
308. Indicator Removal: Clear Mailbox Data
309. Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth
310. Resource Hijacking: Compute Hijacking
311. Access Token Manipulation
312. Native API
313. System Network Configuration Discovery
314. Query Registry
315. Data from Configuration Repository: SNMP (MIB Dump)
316. Scheduled Task/Job: Container Orchestration Job
317. Data Staged
318. Active Scanning: Wordlist Scanning
319. Command and Scripting Interpreter: Visual Basic
320. Hijack Execution Flow: AppDomainManager
321. Data Destruction: Lifecycle-Triggered Deletion
322. Execution Guardrails: Environmental Keying
323. Event Triggered Execution: Installer Packages
324. Supply Chain Compromise: Compromise Software Dependencies and Development Tools
325. Compromise Accounts: Email Accounts
326. Obtain Capabilities: Tool
327. Search Closed Sources: Purchase Technical Data
328. System Shutdown/Reboot
329. Unsecured Credentials: Credentials In Files
330. Command and Scripting Interpreter: Network Device CLI
331. Account Manipulation: Device Registration
332. Acquire Infrastructure: Web Services
333. Hide Artifacts: Hidden File System
334. Steal or Forge Kerberos Tickets: Ccache Files
335. Gather Victim Network Information: Network Topology
336. Phishing: Spearphishing Voice
337. Deobfuscate/Decode Files or Information
338. Indirect Command Execution
339. System Information Discovery
340. Data from Configuration Repository
341. Hijack Execution Flow: Services File Permissions Weakness
342. Hijack Execution Flow: DLL Search Order Hijacking
343. Obfuscated Files or Information: Polymorphic Code
344. Obtain Capabilities: Malware
345. Obfuscated Files or Information: Fileless Storage
346. Use Alternate Authentication Material
347. Remote Services: Direct Cloud VM Connections
348. Proxy: Internal Proxy
349. System Binary Proxy Execution
350. Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access
351. Search Open Websites/Domains: Code Repositories
352. Gather Victim Network Information: DNS
353. Boot or Logon Initialization Scripts: Logon Script (Windows)
354. Credentials from Password Stores: Windows Credential Manager
355. Process Injection: Dynamic-link Library Injection
356. System Network Configuration Discovery: Internet Connection Discovery
357. Gather Victim Org Information: Determine Physical Locations
358. Masquerading: Double File Extension
359. Server Software Component: Web Shell
360. System Binary Proxy Execution: Rundll32
361. System Services
362. Traffic Signaling
363. User Execution
364. Office Application Startup: Outlook Home Page
365. User Execution: Malicious Image
366. Impersonation
367. Input Capture: Credential API Hooking
368. Hijack Execution Flow: Dynamic Linker Hijacking
369. Exploitation for Defense Evasion
370. Masquerading: Masquerade File Type
371. Valid Accounts
372. Device Driver Discovery
373. Develop Capabilities: Exploits
374. Video Capture
375. Create or Modify System Process: Container Service
376. Masquerading: Right-to-Left Override
377. Account Manipulation: SSH Authorized Keys
378. Exploitation of Remote Services
379. Obtain Capabilities: Vulnerabilities
380. System Binary Proxy Execution: Odbcconf
381. Compromise Infrastructure: Server
382. Disk Wipe: Disk Structure Wipe
383. Virtualization/Sandbox Evasion
384. Gather Victim Network Information: Network Trust Dependencies
385. Account Discovery: Local Account
386. Network Denial of Service
387. Boot or Logon Autostart Execution: Time Providers
388. Event Triggered Execution: Image File Execution Options Injection
389. System Binary Proxy Execution: Mshta
390. Hide Infrastructure
391. Impair Defenses: Downgrade Attack
392. Abuse Elevation Control Mechanism: TCC Manipulation
393. Masquerading: Masquerade Task or Service
394. Hide Artifacts: NTFS File Attributes
395. Boot or Logon Initialization Scripts: Login Hook
396. Office Application Startup: Outlook Forms
397. Impair Defenses
398. Data from Information Repositories: Customer Relationship Management Software
399. Develop Capabilities: Digital Certificates
400. Boot or Logon Initialization Scripts
401. Modify System Image: Downgrade System Image
402. Service Stop
403. Credentials from Password Stores: Cloud Secrets Management Stores
404. Forge Web Credentials
405. Search Open Technical Databases: Scan Databases
406. Brute Force: Credential Stuffing
407. Cloud Infrastructure Discovery
408. Compromise Accounts: Cloud Accounts
409. Steal or Forge Kerberos Tickets: Golden Ticket
410. Establish Accounts: Cloud Accounts
411. Remote Services: SSH
412. Server Software Component: SQL Stored Procedures
413. User Execution: Malicious File
414. Browser Extensions
415. Unsecured Credentials: Chat Messages
416. Web Service
417. System Location Discovery
418. Domain or Tenant Policy Modification: Group Policy Modification
419. Obfuscated Files or Information: Embedded Payloads
420. Implant Internal Image
421. Remote Access Software
422. Modify Cloud Compute Infrastructure
423. Endpoint Denial of Service: Service Exhaustion Flood
424. Create or Modify System Process
425. Weaken Encryption: Reduce Key Space
426. Process Injection: ListPlanting
427. OS Credential Dumping: /etc/passwd and /etc/shadow
428. Remote Services: SMB/Windows Admin Shares
429. Establish Accounts: Social Media Accounts
430. Scheduled Task/Job: Systemd Timers
431. Create or Modify System Process: Windows Service
432. Indicator Removal: Relocate Malware
433. Obfuscated Files or Information: Steganography
434. Data Obfuscation: Protocol or Service Impersonation
435. System Binary Proxy Execution: Regsvr32
436. Modify System Image: Patch System Image
437. Hide Artifacts: Process Argument Spoofing
438. Ingress Tool Transfer
439. Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations
440. Gather Victim Org Information
441. Gather Victim Identity Information: Email Addresses
442. Hide Artifacts: Email Hiding Rules
443. Defacement
444. OS Credential Dumping: Cached Domain Credentials
445. Remote Service Session Hijacking
446. Indicator Removal
447. Remote Service Session Hijacking: SSH Hijacking
448. Modify Registry
449. Hijack Execution Flow
450. Impair Defenses: Safe Mode Boot
451. Obfuscated Files or Information: Dynamic API Resolution
452. XSL Script Processing
453. Domain Trust Discovery
454. Unsecured Credentials
455. Hide Artifacts: Hidden Users
456. Masquerading
457. Brute Force: Password Spraying
458. Account Access Removal
459. Communication Through Removable Media
460. Access Token Manipulation: SID-History Injection
461. Inter-Process Communication
462. Cloud Administration Command
463. Hijack Execution Flow: Services Registry Permissions Weakness
464. Web Service: Dead Drop Resolver
465. Software Deployment Tools
466. Credentials from Password Stores: Password Managers
467. Hijack Execution Flow: Path Interception by Unquoted Path
468. Archive Collected Data: Archive via Utility
469. Virtualization/Sandbox Evasion: Time Based Evasion
470. Compromise Infrastructure: DNS Server
471. Boot or Logon Autostart Execution: Active Setup
472. Taint Shared Content
473. Compromise Infrastructure: Domains
474. Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol
475. Phishing for Information: Spearphishing Attachment
476. BITS Jobs
477. Compromise Infrastructure: Botnet
478. Phishing for Information: Spearphishing Voice
479. OS Credential Dumping: LSA Secrets
480. Inter-Process Communication: Dynamic Data Exchange
481. Application Layer Protocol: Mail Protocols
482. Credentials from Password Stores: Keychain
483. Indicator Removal: Clear Command History
484. Modify Authentication Process: Domain Controller Authentication
485. Search Open Technical Databases: Digital Certificates
486. Process Injection: Portable Executable Injection
487. System Binary Proxy Execution: InstallUtil
488. Hijack Execution Flow: DLL Side-Loading
489. Steal or Forge Kerberos Tickets
490. Boot or Logon Autostart Execution: Shortcut Modification
491. Create or Modify System Process: Launch Daemon
492. Unsecured Credentials: Container API
493. Create or Modify System Process: Launch Agent
494. System Binary Proxy Execution: Msiexec
495. Compromise Infrastructure
496. Account Discovery
497. Template Injection
498. Traffic Signaling: Port Knocking
499. Hijack Execution Flow: Path Interception by PATH Environment Variable
500. Server Software Component: Transport Agent
501. Account Manipulation: Additional Container Cluster Roles
502. Acquire Infrastructure: Serverless
503. Subvert Trust Controls: Code Signing Policy Modification
504. Steal or Forge Kerberos Tickets: Silver Ticket
505. Group Policy Discovery
506. Obfuscated Files or Information: HTML Smuggling
507. Masquerading: Match Legitimate Name or Location
508. Content Injection
509. Endpoint Denial of Service: Application Exhaustion Flood
510. Use Alternate Authentication Material: Application Access Token
511. Audio Capture
512. Reflective Code Loading
513. Multi-Stage Channels
514. Dynamic Resolution: Domain Generation Algorithms
515. Acquire Infrastructure: Botnet
516. Process Injection: Asynchronous Procedure Call
517. Command and Scripting Interpreter: Lua
518. Obfuscated Files or Information: Stripped Payloads
519. Gather Victim Host Information
520. Browser Session Hijacking
521. Acquire Access
522. Abuse Elevation Control Mechanism: Setuid and Setgid
523. Traffic Signaling: Socket Filters
524. Serverless Execution
525. Exploit Public-Facing Application
526. Automated Collection
527. Boot or Logon Autostart Execution: XDG Autostart Entries
528. Unsecured Credentials: Cloud Instance Metadata API
529. Valid Accounts: Default Accounts
530. Resource Hijacking
531. Drive-by Compromise
532. Unsecured Credentials: Group Policy Preferences
533. Office Application Startup: Office Test
534. Server Software Component: Terminal Services DLL
535. Data Encoding: Non-Standard Encoding
536. System Binary Proxy Execution: Mavinject
537. Phishing: Spearphishing via Service
538. Endpoint Denial of Service: OS Exhaustion Flood
539. Web Service: One-Way Communication
540. Replication Through Removable Media
541. Data from Configuration Repository: Network Device Configuration Dump
542. Command and Scripting Interpreter: Unix Shell
543. Hijack Execution Flow: Executable Installer File Permissions Weakness
544. Indicator Removal: Clear Linux or Mac System Logs
545. Acquire Infrastructure: Server
546. Pre-OS Boot: Component Firmware
547. Hardware Additions
548. Network Denial of Service: Direct Network Flood
549. Rootkit
550. Weaken Encryption: Disable Crypto Hardware
551. Acquire Infrastructure
552. Data Destruction
553. Hijack Execution Flow: Dylib Hijacking
554. System Time Discovery
555. Search Open Websites/Domains
556. Exfiltration Over Web Service: Exfiltration to Text Storage Sites
557. System Services: Launchctl
558. Search Open Technical Databases: WHOIS
559. Internal Spearphishing
560. Obtain Capabilities: Code Signing Certificates
561. Event Triggered Execution: LC_LOAD_DYLIB Addition
562. Account Discovery: Domain Account
563. Boot or Logon Initialization Scripts: Startup Items
564. Account Manipulation
565. Exfiltration Over Physical Medium: Exfiltration over USB
566. Boot or Logon Autostart Execution: Security Support Provider
567. Power Settings
568. Modify Cloud Compute Infrastructure: Delete Cloud Instance
569. Archive Collected Data: Archive via Library
570. Boot or Logon Initialization Scripts: RC Scripts
571. Input Capture: Keylogging
572. Trusted Developer Utilities Proxy Execution: ClickOnce
573. OS Credential Dumping: Proc Filesystem
574. Boot or Logon Autostart Execution: Authentication Package
575. Compromise Infrastructure: Network Devices
576. Exfiltration Over Web Service: Exfiltration to Code Repository
577. Hide Artifacts: Resource Forking
578. Unsecured Credentials: Private Keys
579. System Services: Service Execution
580. Event Triggered Execution: Component Object Model Hijacking
581. Proxy: Domain Fronting
582. Establish Accounts
583. System Binary Proxy Execution: CMSTP
584. Unsecured Credentials: Bash History
585. Data from Removable Media
586. Gather Victim Network Information
587. Stage Capabilities: Upload Malware
588. Boot or Logon Initialization Scripts: Network Logon Script
589. Obfuscated Files or Information: LNK Icon Smuggling
590. Indicator Removal: Network Share Connection Removal
591. Credentials from Password Stores
592. Compromise Accounts
593. System Network Connections Discovery
594. Steal Application Access Token
595. Network Share Discovery
596. Modify Authentication Process: Network Provider DLL
597. Office Application Startup
598. Stage Capabilities: SEO Poisoning
599. Adversary-in-the-Middle
600. Masquerading: Masquerade Account Name
601. Remote Services: Remote Desktop Protocol
602. Create or Modify System Process: Systemd Service
603. Account Manipulation: Additional Local or Domain Groups
604. Network Denial of Service: Reflection Amplification
605. Email Collection: Local Email Collection
606. Abuse Elevation Control Mechanism: Bypass User Account Control
607. Subvert Trust Controls: Gatekeeper Bypass
608. Gather Victim Host Information: Firmware
609. Application Layer Protocol: File Transfer Protocols
610. Multi-Factor Authentication Interception
611. Modify System Image
612. Adversary-in-the-Middle: ARP Cache Poisoning
613. Scheduled Task/Job: Cron
614. Disk Wipe
615. Acquire Infrastructure: Virtual Private Server
616. Masquerading: Space after Filename
617. Indicator Removal: Timestomp
618. Transfer Data to Cloud Account
619. Masquerading: Break Process Trees
620. Scheduled Task/Job
621. Pre-OS Boot: System Firmware
622. Event Triggered Execution: Change Default File Association
623. Obfuscated Files or Information: Encrypted/Encoded File
624. Dynamic Resolution
625. Use Alternate Authentication Material: Pass the Hash
626. Obtain Capabilities
627. Rogue Domain Controller
628. Permission Groups Discovery: Cloud Groups
629. Exfiltration Over Physical Medium
630. Event Triggered Execution: AppCert DLLs
631. Modify Cloud Compute Infrastructure: Create Cloud Instance
632. Server Software Component: IIS Components
633. Scheduled Transfer
634. Direct Volume Access
635. Network Service Discovery
636. Cloud Service Dashboard
637. Domain or Tenant Policy Modification: Trust Modification
638. Event Triggered Execution: Accessibility Features
639. System Location Discovery: System Language Discovery
640. Abuse Elevation Control Mechanism: Sudo and Sudo Caching
641. Acquire Infrastructure: DNS Server
642. Exploitation for Credential Access
643. Modify Cloud Compute Infrastructure: Revert Cloud Instance
644. Acquire Infrastructure: Malvertising
645. Input Capture
646. Indicator Removal: Clear Windows Event Logs
647. Search Open Technical Databases: DNS/Passive DNS
648. Hide Artifacts: VBA Stomping
649. Develop Capabilities: Malware
650. Exfiltration Over Alternative Protocol
651. Event Triggered Execution: PowerShell Profile
652. Process Injection: Thread Local Storage
653. Encrypted Channel
654. Obfuscated Files or Information: Software Packing
655. Hide Artifacts: Run Virtual Instance
656. Email Collection
657. User Execution: Malicious Link