MITRE ATT&CK Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.

1. Native API
2. Process Injection: Thread Execution Hijacking
3. Non-Application Layer Protocol
4. Command and Scripting Interpreter: Cloud API
5. Resource Hijacking: SMS Pumping
6. Data Staged: Local Data Staging
7. Event Triggered Execution: Netsh Helper DLL
8. Impair Defenses: Disable or Modify Linux Audit System
9. Obfuscated Files or Information: Indicator Removal from Tools
10. Direct Volume Access
11. Password Policy Discovery
12. Event Triggered Execution: Udev Rules
13. Indicator Removal: Clear Linux or Mac System Logs
14. Compromise Accounts: Social Media Accounts
15. Proxy: Multi-hop Proxy
16. Phishing: Spearphishing Voice
17. Virtualization/Sandbox Evasion
18. Supply Chain Compromise: Compromise Software Dependencies and Development Tools
19. Remote Services: SSH
20. Execution Guardrails
21. Stage Capabilities: Install Digital Certificate
22. Event Triggered Execution: Emond
23. Compromise Infrastructure: Web Services
24. Impersonation
25. Automated Exfiltration
26. Brute Force
27. Deobfuscate/Decode Files or Information
28. Obtain Capabilities: Digital Certificates
29. Phishing for Information: Spearphishing Attachment
30. Scheduled Task/Job: Container Orchestration Job
31. Template Injection
32. Cloud Storage Object Discovery
33. Boot or Logon Autostart Execution: Time Providers
34. Unused/Unsupported Cloud Regions
35. Impair Defenses: Safe Mode Boot
36. Pre-OS Boot: Bootkit
37. Credentials from Password Stores: Password Managers
38. Office Application Startup: Outlook Home Page
39. Abuse Elevation Control Mechanism: Elevated Execution with Prompt
40. Hijack Execution Flow: Path Interception by Unquoted Path
41. Input Capture: GUI Input Capture
42. OS Credential Dumping: Security Account Manager
43. Group Policy Discovery
44. Hide Artifacts: File/Path Exclusions
45. Reflective Code Loading
46. Establish Accounts: Email Accounts
47. System Services: Service Execution
48. Gather Victim Network Information: Network Topology
49. Impair Defenses
50. Masquerading: Masquerade File Type
51. Data from Cloud Storage
52. Scheduled Task/Job: At
53. Acquire Infrastructure: Malvertising
54. Command and Scripting Interpreter: Visual Basic
55. Command and Scripting Interpreter: Network Device CLI
56. Active Scanning: Vulnerability Scanning
57. System Location Discovery: System Language Discovery
58. Boot or Logon Initialization Scripts
59. Search Open Technical Databases: CDNs
60. Data Encoding: Standard Encoding
61. Data Encrypted for Impact
62. Hide Artifacts: Process Argument Spoofing
63. Phishing for Information: Spearphishing Voice
64. Gather Victim Network Information: Network Security Appliances
65. Obfuscated Files or Information: Compile After Delivery
66. Indicator Removal: Clear Mailbox Data
67. Steal or Forge Kerberos Tickets: Golden Ticket
68. Masquerading: Rename System Utilities
69. Virtualization/Sandbox Evasion: System Checks
70. Valid Accounts: Default Accounts
71. Peripheral Device Discovery
72. Brute Force: Password Guessing
73. System Network Configuration Discovery: Wi-Fi Discovery
74. Gather Victim Network Information: Domain Properties
75. Server Software Component: SQL Stored Procedures
76. Communication Through Removable Media
77. OS Credential Dumping
78. Event Triggered Execution
79. Email Collection: Remote Email Collection
80. Develop Capabilities: Code Signing Certificates
81. Use Alternate Authentication Material
82. Taint Shared Content
83. Subvert Trust Controls: Code Signing Policy Modification
84. Boot or Logon Autostart Execution: LSASS Driver
85. Trusted Developer Utilities Proxy Execution: ClickOnce
86. Search Closed Sources: Threat Intel Vendors
87. Transfer Data to Cloud Account
88. OS Credential Dumping: NTDS
89. Defacement: Internal Defacement
90. Modify System Image: Downgrade System Image
91. Traffic Signaling
92. Develop Capabilities: Digital Certificates
93. Defacement
94. Software Discovery: Security Software Discovery
95. Boot or Logon Autostart Execution: Kernel Modules and Extensions
96. Event Triggered Execution: Unix Shell Configuration Modification
97. Automated Collection
98. Create or Modify System Process
99. Subvert Trust Controls: Gatekeeper Bypass
100. Endpoint Denial of Service
101. OS Credential Dumping: DCSync
102. Impair Defenses: Disable or Modify Cloud Firewall
103. Active Scanning: Scanning IP Blocks
104. Credentials from Password Stores: Securityd Memory
105. Abuse Elevation Control Mechanism: Bypass User Account Control
106. Hide Artifacts: Resource Forking
107. Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol
108. Pre-OS Boot
109. Gather Victim Org Information: Identify Business Tempo
110. Pre-OS Boot: TFTP Boot
111. Use Alternate Authentication Material: Pass the Hash
112. Remote Services: Remote Desktop Protocol
113. File and Directory Permissions Modification: Windows File and Directory Permissions Modification
114. Data Obfuscation: Protocol or Service Impersonation
115. Gather Victim Network Information: IP Addresses
116. Web Service: One-Way Communication
117. Modify Authentication Process
118. Gather Victim Network Information
119. Modify Cloud Compute Infrastructure: Create Snapshot
120. Resource Hijacking
121. Acquire Infrastructure
122. Search Open Websites/Domains: Search Engines
123. Create or Modify System Process: Windows Service
124. Modify Cloud Compute Infrastructure: Revert Cloud Instance
125. System Binary Proxy Execution: Regsvcs/Regasm
126. Abuse Elevation Control Mechanism
127. Cloud Infrastructure Discovery
128. Unsecured Credentials: Container API
129. Hijack Execution Flow: DLL Search Order Hijacking
130. Hijack Execution Flow
131. Gather Victim Host Information: Client Configurations
132. Software Deployment Tools
133. Boot or Logon Autostart Execution: Active Setup
134. Data from Information Repositories: Confluence
135. Inter-Process Communication
136. Audio Capture
137. Acquire Infrastructure: DNS Server
138. Multi-Factor Authentication Request Generation
139. Search Open Technical Databases: Scan Databases
140. Inter-Process Communication: Dynamic Data Exchange
141. Obtain Capabilities: Artificial Intelligence
142. Remote Service Session Hijacking: RDP Hijacking
143. Phishing
144. Automated Exfiltration: Traffic Duplication
145. Event Triggered Execution: Windows Management Instrumentation Event Subscription
146. Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
147. Obtain Capabilities: Tool
148. Exfiltration Over Web Service: Exfiltration to Cloud Storage
149. Indicator Removal: Network Share Connection Removal
150. Gather Victim Identity Information: Credentials
151. Brute Force: Credential Stuffing
152. Event Triggered Execution: LC_LOAD_DYLIB Addition
153. Build Image on Host
154. File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification
155. Content Injection
156. Gather Victim Network Information: Network Trust Dependencies
157. Brute Force: Password Cracking
158. Boot or Logon Autostart Execution: Print Processors
159. Process Injection: Asynchronous Procedure Call
160. Obfuscated Files or Information: Polymorphic Code
161. Permission Groups Discovery
162. Windows Management Instrumentation
163. Account Manipulation: Device Registration
164. BITS Jobs
165. Command and Scripting Interpreter: Python
166. Domain or Tenant Policy Modification: Group Policy Modification
167. Boot or Logon Initialization Scripts: Logon Script (Windows)
168. Access Token Manipulation: Token Impersonation/Theft
169. Hijack Execution Flow: AppDomainManager
170. System Network Connections Discovery
171. Boot or Logon Autostart Execution: Authentication Package
172. Valid Accounts: Local Accounts
173. Search Open Websites/Domains: Social Media
174. Browser Extensions
175. Non-Standard Port
176. name
177. XSL Script Processing
178. System Script Proxy Execution: PubPrn
179. Process Injection: Process Doppelgänging
180. Service Stop
181. Process Injection: Dynamic-link Library Injection
182. Boot or Logon Initialization Scripts: Startup Items
183. Compromise Accounts: Email Accounts
184. Gather Victim Org Information: Identify Roles
185. Debugger Evasion
186. Valid Accounts: Domain Accounts
187. Compromise Infrastructure
188. Obfuscated Files or Information: Software Packing
189. Data Manipulation
190. Impair Defenses: Indicator Blocking
191. System Binary Proxy Execution: Control Panel
192. Acquire Infrastructure: Serverless
193. Trusted Developer Utilities Proxy Execution: MSBuild
194. Proxy
195. Remote System Discovery
196. Pre-OS Boot: System Firmware
197. Masquerading: Invalid Code Signature
198. Domain or Tenant Policy Modification: Trust Modification
199. Modify Cloud Resource Hierarchy
200. Credentials from Password Stores: Keychain
201. Gather Victim Identity Information
202. Gather Victim Host Information: Hardware
203. Event Triggered Execution: Application Shimming
204. Data Manipulation: Runtime Data Manipulation
205. Server Software Component: Transport Agent
206. Access Token Manipulation: Make and Impersonate Token
207. Subvert Trust Controls: SIP and Trust Provider Hijacking
208. Phishing for Information: Spearphishing Service
209. Use Alternate Authentication Material: Application Access Token
210. System Binary Proxy Execution: Odbcconf
211. Trusted Developer Utilities Proxy Execution
212. Data Obfuscation
213. Process Injection: Process Hollowing
214. Search Victim-Owned Websites
215. Disk Wipe
216. Brute Force: Password Spraying
217. Data Destruction: Lifecycle-Triggered Deletion
218. Hide Infrastructure
219. Boot or Logon Initialization Scripts: Network Logon Script
220. Input Capture: Web Portal Capture
221. Supply Chain Compromise
222. Boot or Logon Autostart Execution: Port Monitors
223. Data Staged
224. Inhibit System Recovery
225. Disk Wipe: Disk Content Wipe
226. Hide Artifacts: VBA Stomping
227. Log Enumeration
228. Proxy: Internal Proxy
229. System Binary Proxy Execution: CMSTP
230. Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations
231. Stage Capabilities
232. Rootkit
233. Input Capture: Keylogging
234. Search Open Technical Databases: WHOIS
235. System Location Discovery
236. Video Capture
237. Account Manipulation: Additional Container Cluster Roles
238. Archive Collected Data
239. Archive Collected Data: Archive via Utility
240. Abuse Elevation Control Mechanism: Setuid and Setgid
241. Access Token Manipulation: Create Process with Token
242. Modify Authentication Process: Password Filter DLL
243. Adversary-in-the-Middle: ARP Cache Poisoning
244. Unsecured Credentials: Credentials in Registry
245. System Information Discovery
246. Modify Registry
247. Indirect Command Execution
248. Application Layer Protocol: Web Protocols
249. Create or Modify System Process: Launch Agent
250. Steal Web Session Cookie
251. Resource Hijacking: Bandwidth Hijacking
252. Data Obfuscation: Steganography
253. Data from Network Shared Drive
254. Fallback Channels
255. Data Transfer Size Limits
256. Account Discovery: Domain Account
257. Scheduled Task/Job: Cron
258. Steal or Forge Authentication Certificates
259. Search Open Websites/Domains
260. Boot or Logon Initialization Scripts: Login Hook
261. Adversary-in-the-Middle
262. Event Triggered Execution: AppCert DLLs
263. Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
264. Obfuscated Files or Information: Binary Padding
265. Credentials from Password Stores: Credentials from Web Browsers
266. Adversary-in-the-Middle: Evil Twin
267. Masquerading: Right-to-Left Override
268. Process Injection: VDSO Hijacking
269. Indicator Removal
270. System Time Discovery
271. Exploitation of Remote Services
272. Impair Defenses: Impair Command History Logging
273. Indicator Removal: Timestomp
274. Command and Scripting Interpreter: AppleScript
275. Exfiltration Over Physical Medium
276. Compromise Infrastructure: DNS Server
277. Encrypted Channel: Symmetric Cryptography
278. Power Settings
279. Masquerading
280. Obfuscated Files or Information: Encrypted/Encoded File
281. Domain or Tenant Policy Modification
282. Indicator Removal: Clear Persistence
283. Stage Capabilities: Link Target
284. Remote Services
285. Office Application Startup: Office Test
286. Remote Services: Direct Cloud VM Connections
287. Web Service
288. Input Capture
289. Modify Cloud Compute Infrastructure: Create Cloud Instance
290. Hide Artifacts: Hidden Users
291. Remote Services: Windows Remote Management
292. Data from Local System
293. Obtain Capabilities: Exploits
294. Phishing for Information: Spearphishing Link
295. Forge Web Credentials: Web Cookies
296. System Network Configuration Discovery: Internet Connection Discovery
297. Archive Collected Data: Archive via Custom Method
298. Account Discovery: Cloud Account
299. Indicator Removal: File Deletion
300. Event Triggered Execution: Component Object Model Hijacking
301. System Shutdown/Reboot
302. Hide Artifacts: Hidden Window
303. Establish Accounts
304. Cloud Service Discovery
305. Acquire Infrastructure: Web Services
306. Adversary-in-the-Middle: DHCP Spoofing
307. Weaken Encryption: Disable Crypto Hardware
308. Archive Collected Data: Archive via Library
309. Hijack Execution Flow: Path Interception by Search Order Hijacking
310. Container Administration Command
311. Forge Web Credentials: SAML Tokens
312. Data Destruction
313. System Services: Launchctl
314. Command and Scripting Interpreter: AutoHotKey & AutoIT
315. Account Manipulation: Additional Cloud Credentials
316. Server Software Component: IIS Components
317. Unsecured Credentials: Chat Messages
318. Gather Victim Identity Information: Employee Names
319. Event Triggered Execution: Screensaver
320. Data Staged: Remote Data Staging
321. Compromise Host Software Binary
322. Encrypted Channel: Asymmetric Cryptography
323. Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth
324. Internal Spearphishing
325. System Binary Proxy Execution: Regsvr32
326. Gather Victim Identity Information: Email Addresses
327. Data from Information Repositories: Messaging Applications
328. Compromise Infrastructure: Serverless
329. Gather Victim Org Information: Business Relationships
330. Resource Hijacking: Cloud Service Hijacking
331. Traffic Signaling: Port Knocking
332. Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
333. System Binary Proxy Execution: Verclsid
334. Obfuscated Files or Information
335. Subvert Trust Controls: Mark-of-the-Web Bypass
336. Indicator Removal: Relocate Malware
337. Lateral Tool Transfer
338. Browser Session Hijacking
339. Obtain Capabilities: Code Signing Certificates
340. Exfiltration Over C2 Channel
341. Trusted Relationship
342. User Execution: Malicious Link
343. Exfiltration Over Web Service
344. Remote Services: VNC
345. Steal or Forge Kerberos Tickets: Kerberoasting
346. Escape to Host
347. Implant Internal Image
348. System Service Discovery
349. Masquerading: Masquerade Account Name
350. Command and Scripting Interpreter: PowerShell
351. Active Scanning: Wordlist Scanning
352. Stage Capabilities: Upload Tool
353. Account Discovery: Email Account
354. Modify System Image
355. Unsecured Credentials: Cloud Instance Metadata API
356. Data from Configuration Repository: Network Device Configuration Dump
357. Process Injection: Thread Local Storage
358. Credentials from Password Stores: Windows Credential Manager
359. Obfuscated Files or Information: Stripped Payloads
360. Exfiltration Over Web Service: Exfiltration Over Webhook
361. Boot or Logon Initialization Scripts: RC Scripts
362. Dynamic Resolution: Domain Generation Algorithms
363. Account Manipulation: Additional Local or Domain Groups
364. Remote Service Session Hijacking: SSH Hijacking
365. Supply Chain Compromise: Compromise Hardware Supply Chain
366. Unsecured Credentials: Credentials In Files
367. Virtualization/Sandbox Evasion: Time Based Evasion
368. Dynamic Resolution
369. Obfuscated Files or Information: Dynamic API Resolution
370. Phishing: Spearphishing via Service
371. Access Token Manipulation
372. User Execution
373. Resource Hijacking: Compute Hijacking
374. Hijack Execution Flow: KernelCallbackTable
375. Create Account: Local Account
376. System Binary Proxy Execution: InstallUtil
377. Hijack Execution Flow: COR_PROFILER
378. Hardware Additions
379. Event Triggered Execution: Installer Packages
380. System Script Proxy Execution: SyncAppvPublishingServer
381. Acquire Infrastructure: Virtual Private Server
382. Acquire Infrastructure: Server
383. Email Collection: Email Forwarding Rule
384. Acquire Infrastructure: Botnet
385. Use Alternate Authentication Material: Web Session Cookie
386. Modify Authentication Process: Network Device Authentication
387. Server Software Component: Web Shell
388. Event Triggered Execution: Image File Execution Options Injection
389. Obfuscated Files or Information: Fileless Storage
390. Develop Capabilities
391. Disk Wipe: Disk Structure Wipe
392. Modify Authentication Process: Multi-Factor Authentication
393. Application Layer Protocol: DNS
394. Endpoint Denial of Service: OS Exhaustion Flood
395. Modify Authentication Process: Conditional Access Policies
396. Phishing: Spearphishing Attachment
397. Compromise Accounts: Cloud Accounts
398. Multi-Factor Authentication Interception
399. Gather Victim Host Information: Firmware
400. OS Credential Dumping: Cached Domain Credentials
401. Clipboard Data
402. Establish Accounts: Cloud Accounts
403. Proxy: Domain Fronting
404. Command and Scripting Interpreter: Unix Shell
405. Input Capture: Credential API Hooking
406. Boot or Logon Autostart Execution: Winlogon Helper DLL
407. Search Open Websites/Domains: Code Repositories
408. Establish Accounts: Social Media Accounts
409. Search Open Technical Databases
410. Web Service: Bidirectional Communication
411. Exploitation for Privilege Escalation
412. Event Triggered Execution: Accessibility Features
413. Process Injection: Proc Memory
414. Process Injection: Portable Executable Injection
415. User Execution: Malicious Image
416. Inter-Process Communication: XPC Services
417. Proxy: External Proxy
418. Remote Service Session Hijacking
419. Process Injection: Ptrace System Calls
420. System Binary Proxy Execution: Mshta
421. Scheduled Task/Job: Scheduled Task
422. Hijack Execution Flow: Dynamic Linker Hijacking
423. Weaken Encryption: Reduce Key Space
424. File and Directory Permissions Modification
425. Account Manipulation
426. Hide Artifacts: Email Hiding Rules
427. Boot or Logon Autostart Execution
428. Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol
429. Endpoint Denial of Service: Application or System Exploitation
430. Exfiltration Over Alternative Protocol
431. Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access
432. Subvert Trust Controls: Code Signing
433. Data Encoding
434. Application Layer Protocol: Mail Protocols
435. Credentials from Password Stores: Cloud Secrets Management Stores
436. Boot or Logon Autostart Execution: Login Items
437. Remote Services: Cloud Services
438. Hide Artifacts: Hidden File System
439. Hijack Execution Flow: Executable Installer File Permissions Weakness
440. Network Sniffing
441. Account Manipulation: Additional Email Delegate Permissions
442. Modify System Image: Patch System Image
443. Data Encoding: Non-Standard Encoding
444. Boot or Logon Autostart Execution: XDG Autostart Entries
445. Impair Defenses: Disable or Modify System Firewall
446. Application Layer Protocol: File Transfer Protocols
447. Network Boundary Bridging
448. Plist File Modification
449. Search Open Technical Databases: Digital Certificates
450. Data from Removable Media
451. Search Closed Sources: Purchase Technical Data
452. Replication Through Removable Media
453. Steal or Forge Kerberos Tickets: Ccache Files
454. Dynamic Resolution: Fast Flux DNS
455. Application Layer Protocol: Publish/Subscribe Protocols
456. Modify Authentication Process: Reversible Encryption
457. Acquire Infrastructure: Domains
458. Exfiltration Over Physical Medium: Exfiltration over USB
459. Email Collection: Local Email Collection
460. Serverless Execution
461. Data Obfuscation: Junk Data
462. Modify Authentication Process: Pluggable Authentication Modules
463. Unsecured Credentials: Group Policy Preferences
464. Exfiltration Over Web Service: Exfiltration to Code Repository
465. Data from Configuration Repository: SNMP (MIB Dump)
466. System Binary Proxy Execution: Mavinject
467. Permission Groups Discovery: Domain Groups
468. Search Closed Sources
469. Process Discovery
470. OS Credential Dumping: Proc Filesystem
471. Hijack Execution Flow: Dylib Hijacking
472. Masquerading: Space after Filename
473. Steal Application Access Token
474. Network Service Discovery
475. Permission Groups Discovery: Local Groups
476. Remote Access Software
477. Access Token Manipulation: Parent PID Spoofing
478. Steal or Forge Kerberos Tickets
479. Phishing for Information
480. Inter-Process Communication: Component Object Model
481. Permission Groups Discovery: Cloud Groups
482. Indicator Removal: Clear Network Connection History and Configurations
483. Unsecured Credentials: Private Keys
484. Hide Artifacts: Ignore Process Interrupts
485. Server Software Component
486. Process Injection
487. Search Open Technical Databases: DNS/Passive DNS
488. Account Manipulation: Additional Cloud Roles
489. Defacement: External Defacement
490. Application Window Discovery
491. Acquire Access
492. Masquerading: Break Process Trees
493. Server Software Component: Terminal Services DLL
494. Exploitation for Credential Access
495. System Network Configuration Discovery
496. Data Manipulation: Stored Data Manipulation
497. Valid Accounts
498. Boot or Logon Autostart Execution: Shortcut Modification
499. Process Injection: ListPlanting
500. Modify Authentication Process: Domain Controller Authentication
501. Network Denial of Service: Direct Network Flood
502. Rogue Domain Controller
503. Indicator Removal: Clear Windows Event Logs
504. Data from Information Repositories
505. Application Layer Protocol
506. Abuse Elevation Control Mechanism: Sudo and Sudo Caching
507. Dynamic Resolution: DNS Calculation
508. Data from Information Repositories: Customer Relationship Management Software
509. Supply Chain Compromise: Compromise Software Supply Chain
510. Gather Victim Org Information
511. Create Account
512. Command and Scripting Interpreter
513. Account Manipulation: SSH Authorized Keys
514. Modify Cloud Compute Infrastructure: Delete Cloud Instance
515. External Remote Services
516. Credentials from Password Stores
517. Office Application Startup: Add-ins
518. Network Denial of Service
519. Modify Authentication Process: Network Provider DLL
520. Exploitation for Client Execution
521. System Binary Proxy Execution: Msiexec
522. Account Access Removal
523. Hijack Execution Flow: DLL Side-Loading
524. Forced Authentication
525. User Execution: Malicious File
526. Event Triggered Execution: Change Default File Association
527. Firmware Corruption
528. Obfuscated Files or Information: Embedded Payloads
529. Compromise Infrastructure: Network Devices
530. Obfuscated Files or Information: HTML Smuggling
531. Scheduled Task/Job: Systemd Timers
532. Hide Artifacts: NTFS File Attributes
533. Create or Modify System Process: Launch Daemon
534. Create Account: Cloud Account
535. System Services
536. Office Application Startup: Office Template Macros
537. Compromise Infrastructure: Botnet
538. Stage Capabilities: Upload Malware
539. Gather Victim Network Information: DNS
540. Subvert Trust Controls
541. Create Account: Domain Account
542. File and Directory Discovery
543. Query Registry
544. Event Triggered Execution: Trap
545. Unsecured Credentials: Bash History
546. Screen Capture
547. Modify Cloud Compute Infrastructure
548. Domain Trust Discovery
549. OS Credential Dumping: LSA Secrets
550. System Binary Proxy Execution: Compiled HTML File
551. Pre-OS Boot: ROMMONkit
552. Gather Victim Org Information: Determine Physical Locations
553. Cloud Service Dashboard
554. Cloud Administration Command
555. Office Application Startup
556. Event Triggered Execution: PowerShell Profile
557. Scheduled Transfer
558. Use Alternate Authentication Material: Pass the Ticket
559. Hijack Execution Flow: Path Interception by PATH Environment Variable
560. Valid Accounts: Cloud Accounts
561. Data from Information Repositories: Sharepoint
562. Endpoint Denial of Service: Application Exhaustion Flood
563. Exfiltration Over Other Network Medium
564. Obfuscated Files or Information: LNK Icon Smuggling
565. Steal or Forge Kerberos Tickets: Silver Ticket
566. Masquerading: Double File Extension
567. Office Application Startup: Outlook Rules
568. Endpoint Denial of Service: Service Exhaustion Flood
569. Indicator Removal: Clear Command History
570. Impair Defenses: Spoof Security Alerting
571. System Binary Proxy Execution
572. Active Scanning
573. Exploit Public-Facing Application
574. Exfiltration Over Web Service: Exfiltration to Text Storage Sites
575. Protocol Tunneling
576. Drive-by Compromise
577. Stage Capabilities: Drive-by Target
578. Stage Capabilities: SEO Poisoning
579. Obtain Capabilities
580. Network Share Discovery
581. Traffic Signaling: Socket Filters
582. Compromise Infrastructure: Domains
583. Office Application Startup: Outlook Forms
584. Masquerading: Masquerade Task or Service
585. Hijack Execution Flow: Services File Permissions Weakness
586. Email Collection
587. System Owner/User Discovery
588. Impair Defenses: Disable or Modify Cloud Logs
589. Impair Defenses: Disable Windows Event Logging
590. Container and Resource Discovery
591. Device Driver Discovery
592. Network Denial of Service: Reflection Amplification
593. Software Discovery
594. Account Discovery
595. Command and Scripting Interpreter: Lua
596. Account Discovery: Local Account
597. Hijack Execution Flow: Services Registry Permissions Weakness
598. Command and Scripting Interpreter: Windows Command Shell
599. Obfuscated Files or Information: Steganography
600. Develop Capabilities: Malware
601. Compromise Infrastructure: Virtual Private Server
602. Compromise Accounts
603. Access Token Manipulation: SID-History Injection
604. Forge Web Credentials
605. Create or Modify System Process: Systemd Service
606. Data from Configuration Repository
607. Weaken Encryption
608. Encrypted Channel
609. Remote Services: SMB/Windows Admin Shares
610. Data from Information Repositories: Code Repositories
611. System Binary Proxy Execution: Electron Applications
612. Obtain Capabilities: Malware
613. Command and Scripting Interpreter: JavaScript
614. Shared Modules
615. Exploitation for Defense Evasion
616. Hide Artifacts: Hidden Files and Directories
617. Remote Services: Distributed Component Object Model
618. Event Triggered Execution: AppInit DLLs
619. Abuse Elevation Control Mechanism: TCC Manipulation
620. Develop Capabilities: Exploits
621. Boot or Logon Autostart Execution: Security Support Provider
622. System Binary Proxy Execution: Rundll32
623. System Binary Proxy Execution: MMC
624. Web Service: Dead Drop Resolver
625. Execution Guardrails: Environmental Keying
626. Masquerading: Match Legitimate Name or Location
627. Execution Guardrails: Mutual Exclusion
628. Scheduled Task/Job
629. Create or Modify System Process: Container Service
630. Unsecured Credentials
631. Network Boundary Bridging: Network Address Translation Traversal
632. Modify Authentication Process: Hybrid Identity
633. Pre-OS Boot: Component Firmware
634. Deploy Container
635. Compromise Infrastructure: Server
636. Browser Information Discovery
637. OS Credential Dumping: /etc/passwd and /etc/shadow
638. Gather Victim Host Information
639. Gather Victim Host Information: Software
640. Virtualization/Sandbox Evasion: User Activity Based Checks
641. Boot or Logon Autostart Execution: Re-opened Applications
642. Obtain Capabilities: Vulnerabilities
643. OS Credential Dumping: LSASS Memory
644. Obfuscated Files or Information: Command Obfuscation
645. Impair Defenses: Disable or Modify Tools
646. Multi-Stage Channels
647. Impair Defenses: Downgrade Attack
648. Data Manipulation: Transmitted Data Manipulation
649. System Script Proxy Execution
650. Financial Theft
651. Phishing: Spearphishing Link
652. Ingress Tool Transfer
653. Process Injection: Extra Window Memory Injection
654. Hide Artifacts
655. Steal or Forge Kerberos Tickets: AS-REP Roasting
656. Hide Artifacts: Run Virtual Instance
657. Subvert Trust Controls: Install Root Certificate