MITRE ATT&CK Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.

1. Disk Wipe: Disk Structure Wipe
2. Masquerading: Double File Extension
3. Process Injection: VDSO Hijacking
4. Stage Capabilities: Link Target
5. Weaken Encryption
6. Container and Resource Discovery
7. Command and Scripting Interpreter: Visual Basic
8. Establish Accounts
9. Steal or Forge Kerberos Tickets: Kerberoasting
10. Data Manipulation: Transmitted Data Manipulation
11. Office Application Startup: Outlook Home Page
12. Search Open Technical Databases: Scan Databases
13. Stage Capabilities
14. Command and Scripting Interpreter: AppleScript
15. Escape to Host
16. Active Scanning: Wordlist Scanning
17. Abuse Elevation Control Mechanism: Bypass User Account Control
18. Subvert Trust Controls
19. System Script Proxy Execution: SyncAppvPublishingServer
20. Impair Defenses: Disable or Modify System Firewall
21. System Script Proxy Execution
22. Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations
23. Peripheral Device Discovery
24. Account Discovery: Cloud Account
25. Use Alternate Authentication Material
26. System Binary Proxy Execution
27. Impair Defenses: Disable or Modify Cloud Firewall
28. Hijack Execution Flow: Dylib Hijacking
29. Acquire Infrastructure: Virtual Private Server
30. Masquerading: Masquerade File Type
31. Obtain Capabilities
32. Input Capture
33. Implant Internal Image
34. Firmware Corruption
35. Modify Cloud Compute Infrastructure: Delete Cloud Instance
36. Hide Artifacts
37. Modify Authentication Process: Hybrid Identity
38. Access Token Manipulation: SID-History Injection
39. Modify Authentication Process: Multi-Factor Authentication
40. Resource Hijacking: Bandwidth Hijacking
41. Server Software Component
42. Unsecured Credentials: Cloud Instance Metadata API
43. Steal or Forge Kerberos Tickets: Golden Ticket
44. Execution Guardrails: Mutual Exclusion
45. Weaken Encryption: Reduce Key Space
46. Scheduled Task/Job: Cron
47. Group Policy Discovery
48. OS Credential Dumping: NTDS
49. Hide Artifacts: Hidden Files and Directories
50. Active Scanning
51. System Services: Launchctl
52. Process Injection: Thread Execution Hijacking
53. Event Triggered Execution: Installer Packages
54. Hijack Execution Flow: DLL Side-Loading
55. Phishing for Information
56. Automated Exfiltration
57. System Location Discovery
58. Credentials from Password Stores: Windows Credential Manager
59. Traffic Signaling: Port Knocking
60. Data from Information Repositories: Sharepoint
61. Process Injection: Thread Local Storage
62. Native API
63. Exfiltration Over Web Service: Exfiltration to Text Storage Sites
64. Scheduled Transfer
65. Compromise Infrastructure: Network Devices
66. Boot or Logon Initialization Scripts
67. Hardware Additions
68. Content Injection
69. Unsecured Credentials: Group Policy Preferences
70. Boot or Logon Autostart Execution: Port Monitors
71. Valid Accounts: Local Accounts
72. Obtain Capabilities: Malware
73. Serverless Execution
74. Brute Force: Password Guessing
75. Forced Authentication
76. Obfuscated Files or Information: Command Obfuscation
77. Modify Cloud Compute Infrastructure: Create Snapshot
78. Data Encrypted for Impact
79. Data Encoding: Non-Standard Encoding
80. Hide Artifacts: Resource Forking
81. System Binary Proxy Execution: Msiexec
82. Encrypted Channel: Symmetric Cryptography
83. Search Closed Sources: Threat Intel Vendors
84. Proxy
85. Application Layer Protocol: Web Protocols
86. Resource Hijacking: SMS Pumping
87. Hide Artifacts: Hidden Users
88. Boot or Logon Initialization Scripts: Login Hook
89. Indicator Removal: Clear Linux or Mac System Logs
90. Indicator Removal: File Deletion
91. Log Enumeration
92. Web Service: One-Way Communication
93. Non-Standard Port
94. Impair Defenses: Safe Mode Boot
95. Gather Victim Host Information: Client Configurations
96. Search Open Technical Databases: CDNs
97. Account Discovery: Domain Account
98. Obtain Capabilities: Exploits
99. Ingress Tool Transfer
100. Create or Modify System Process: Launch Daemon
101. Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol
102. Gather Victim Network Information: IP Addresses
103. Indicator Removal
104. Proxy: Internal Proxy
105. Account Manipulation: Device Registration
106. Boot or Logon Initialization Scripts: Network Logon Script
107. Data Staged: Local Data Staging
108. Gather Victim Network Information: Domain Properties
109. Taint Shared Content
110. Masquerading: Rename System Utilities
111. Data Obfuscation: Junk Data
112. Boot or Logon Autostart Execution: Winlogon Helper DLL
113. Drive-by Compromise
114. Multi-Factor Authentication Interception
115. Hide Artifacts: Run Virtual Instance
116. Compromise Infrastructure: Virtual Private Server
117. Remote Service Session Hijacking
118. Data Encoding
119. Weaken Encryption: Disable Crypto Hardware
120. Modify Authentication Process: Pluggable Authentication Modules
121. Remote Services: VNC
122. Data from Information Repositories: Confluence
123. Permission Groups Discovery
124. OS Credential Dumping: LSASS Memory
125. Exploitation for Credential Access
126. Compromise Infrastructure: Server
127. Command and Scripting Interpreter: Cloud API
128. Gather Victim Org Information: Identify Roles
129. Modify Registry
130. Obfuscated Files or Information: Binary Padding
131. Archive Collected Data
132. Hide Artifacts: File/Path Exclusions
133. Office Application Startup: Office Test
134. System Information Discovery
135. Access Token Manipulation
136. Boot or Logon Autostart Execution: Active Setup
137. Stage Capabilities: Drive-by Target
138. Event Triggered Execution: Accessibility Features
139. Office Application Startup: Add-ins
140. Phishing: Spearphishing via Service
141. Obfuscated Files or Information: Indicator Removal from Tools
142. Office Application Startup: Outlook Rules
143. Account Manipulation: Additional Container Cluster Roles
144. Inter-Process Communication: Component Object Model
145. Server Software Component: Web Shell
146. Indirect Command Execution
147. Masquerading: Invalid Code Signature
148. Automated Collection
149. Browser Extensions
150. Compromise Infrastructure: Serverless
151. Rootkit
152. Email Collection: Local Email Collection
153. Account Manipulation
154. Indicator Removal: Timestomp
155. Process Injection
156. Abuse Elevation Control Mechanism
157. Obfuscated Files or Information: Polymorphic Code
158. Remote Services: Windows Remote Management
159. Modify Authentication Process: Reversible Encryption
160. Search Open Technical Databases
161. System Binary Proxy Execution: MMC
162. Application Layer Protocol: Publish/Subscribe Protocols
163. Supply Chain Compromise: Compromise Software Dependencies and Development Tools
164. Gather Victim Network Information
165. System Location Discovery: System Language Discovery
166. Domain or Tenant Policy Modification: Group Policy Modification
167. Network Denial of Service
168. Search Open Technical Databases: Digital Certificates
169. Network Boundary Bridging
170. Data from Information Repositories: Code Repositories
171. Brute Force: Credential Stuffing
172. Hide Artifacts: Ignore Process Interrupts
173. Domain or Tenant Policy Modification: Trust Modification
174. Gather Victim Network Information: Network Trust Dependencies
175. Container Administration Command
176. Hijack Execution Flow: Path Interception by Search Order Hijacking
177. Abuse Elevation Control Mechanism: Sudo and Sudo Caching
178. Supply Chain Compromise: Compromise Hardware Supply Chain
179. Account Access Removal
180. Hide Artifacts: Hidden File System
181. Server Software Component: Terminal Services DLL
182. System Binary Proxy Execution: InstallUtil
183. Modify System Image: Downgrade System Image
184. System Binary Proxy Execution: Electron Applications
185. Boot or Logon Autostart Execution: Time Providers
186. Inter-Process Communication: XPC Services
187. Endpoint Denial of Service: Service Exhaustion Flood
188. Account Discovery: Email Account
189. Multi-Stage Channels
190. Permission Groups Discovery: Domain Groups
191. Proxy: Domain Fronting
192. Phishing for Information: Spearphishing Link
193. Search Open Websites/Domains
194. Impair Defenses: Downgrade Attack
195. Process Discovery
196. Search Open Technical Databases: WHOIS
197. Phishing
198. Web Service
199. Endpoint Denial of Service: OS Exhaustion Flood
200. Unsecured Credentials: Container API
201. name
202. Resource Hijacking: Cloud Service Hijacking
203. OS Credential Dumping: DCSync
204. Archive Collected Data: Archive via Library
205. Application Layer Protocol: File Transfer Protocols
206. Modify Authentication Process
207. Valid Accounts: Domain Accounts
208. Establish Accounts: Social Media Accounts
209. System Script Proxy Execution: PubPrn
210. Acquire Infrastructure: Serverless
211. Acquire Infrastructure: Server
212. Inter-Process Communication: Dynamic Data Exchange
213. Encrypted Channel: Asymmetric Cryptography
214. Trusted Developer Utilities Proxy Execution: MSBuild
215. Search Victim-Owned Websites
216. Forge Web Credentials: SAML Tokens
217. Unsecured Credentials: Credentials in Registry
218. Hijack Execution Flow: Services File Permissions Weakness
219. Gather Victim Host Information: Firmware
220. Dynamic Resolution: Domain Generation Algorithms
221. Boot or Logon Initialization Scripts: RC Scripts
222. Event Triggered Execution: Udev Rules
223. Hijack Execution Flow: Executable Installer File Permissions Weakness
224. Data Destruction: Lifecycle-Triggered Deletion
225. Exfiltration Over Web Service: Exfiltration to Code Repository
226. Data from Configuration Repository: Network Device Configuration Dump
227. Access Token Manipulation: Make and Impersonate Token
228. Boot or Logon Autostart Execution: LSASS Driver
229. Data Manipulation
230. Resource Hijacking: Compute Hijacking
231. Masquerading: Masquerade Account Name
232. Network Service Discovery
233. File and Directory Discovery
234. Indicator Removal: Clear Persistence
235. Gather Victim Host Information: Hardware
236. Financial Theft
237. Gather Victim Identity Information: Employee Names
238. Process Injection: Extra Window Memory Injection
239. Process Injection: Ptrace System Calls
240. Permission Groups Discovery: Local Groups
241. User Execution: Malicious Image
242. Virtualization/Sandbox Evasion: System Checks
243. Indicator Removal: Network Share Connection Removal
244. Server Software Component: Transport Agent
245. Automated Exfiltration: Traffic Duplication
246. System Binary Proxy Execution: Mavinject
247. System Binary Proxy Execution: Regsvr32
248. Browser Information Discovery
249. Masquerading: Right-to-Left Override
250. Service Stop
251. Unsecured Credentials: Credentials In Files
252. Data Encoding: Standard Encoding
253. Lateral Tool Transfer
254. Cloud Storage Object Discovery
255. Compromise Infrastructure: DNS Server
256. Inter-Process Communication
257. Dynamic Resolution: DNS Calculation
258. Masquerading: Masquerade Task or Service
259. Remote Services: Distributed Component Object Model
260. Hijack Execution Flow: Path Interception by PATH Environment Variable
261. Account Manipulation: Additional Email Delegate Permissions
262. Develop Capabilities: Digital Certificates
263. Hide Infrastructure
264. Event Triggered Execution: Trap
265. Application Layer Protocol
266. Hide Artifacts: Process Argument Spoofing
267. Data Obfuscation
268. Obfuscated Files or Information
269. Defacement: Internal Defacement
270. Impair Defenses: Indicator Blocking
271. System Network Configuration Discovery
272. Data Staged: Remote Data Staging
273. Data Obfuscation: Steganography
274. Boot or Logon Autostart Execution: Authentication Package
275. Clipboard Data
276. Acquire Infrastructure: Botnet
277. Compromise Infrastructure: Web Services
278. Software Discovery
279. Phishing: Spearphishing Attachment
280. Compromise Accounts: Cloud Accounts
281. Software Discovery: Security Software Discovery
282. Credentials from Password Stores: Credentials from Web Browsers
283. Virtualization/Sandbox Evasion: User Activity Based Checks
284. Non-Application Layer Protocol
285. Hijack Execution Flow: Dynamic Linker Hijacking
286. Hide Artifacts: Hidden Window
287. Email Collection: Email Forwarding Rule
288. Deploy Container
289. Search Open Technical Databases: DNS/Passive DNS
290. Stage Capabilities: Upload Malware
291. Impair Defenses
292. Create or Modify System Process
293. Steal or Forge Kerberos Tickets
294. Execution Guardrails: Environmental Keying
295. Search Closed Sources
296. Compromise Accounts: Social Media Accounts
297. Event Triggered Execution: PowerShell Profile
298. Input Capture: Web Portal Capture
299. Defacement
300. Command and Scripting Interpreter: Python
301. Obtain Capabilities: Code Signing Certificates
302. Acquire Infrastructure: Malvertising
303. Data Destruction
304. Cloud Service Dashboard
305. Input Capture: GUI Input Capture
306. Scheduled Task/Job: Systemd Timers
307. Subvert Trust Controls: SIP and Trust Provider Hijacking
308. Obfuscated Files or Information: LNK Icon Smuggling
309. Encrypted Channel
310. Traffic Signaling: Socket Filters
311. Supply Chain Compromise
312. Trusted Developer Utilities Proxy Execution
313. Cloud Infrastructure Discovery
314. Search Open Websites/Domains: Social Media
315. Indicator Removal: Relocate Malware
316. Valid Accounts
317. Adversary-in-the-Middle: DHCP Spoofing
318. Process Injection: Process Doppelgänging
319. Stage Capabilities: Install Digital Certificate
320. Develop Capabilities
321. Server Software Component: IIS Components
322. Cloud Service Discovery
323. Permission Groups Discovery: Cloud Groups
324. Hijack Execution Flow
325. Event Triggered Execution: Unix Shell Configuration Modification
326. Inhibit System Recovery
327. Fallback Channels
328. XSL Script Processing
329. Boot or Logon Initialization Scripts: Logon Script (Windows)
330. Account Manipulation: Additional Cloud Credentials
331. Subvert Trust Controls: Code Signing
332. Unsecured Credentials: Bash History
333. Data Staged
334. Query Registry
335. Reflective Code Loading
336. Develop Capabilities: Malware
337. Template Injection
338. Defacement: External Defacement
339. Event Triggered Execution: Screensaver
340. Remote Services: SMB/Windows Admin Shares
341. Virtualization/Sandbox Evasion: Time Based Evasion
342. Hijack Execution Flow: KernelCallbackTable
343. Command and Scripting Interpreter: PowerShell
344. Create Account: Domain Account
345. System Time Discovery
346. System Binary Proxy Execution: Rundll32
347. Masquerading: Match Legitimate Name or Location
348. Develop Capabilities: Code Signing Certificates
349. Dynamic Resolution: Fast Flux DNS
350. Rogue Domain Controller
351. Boot or Logon Autostart Execution: XDG Autostart Entries
352. Command and Scripting Interpreter: AutoHotKey & AutoIT
353. Credentials from Password Stores: Keychain
354. System Binary Proxy Execution: Regsvcs/Regasm
355. Email Collection
356. Process Injection: Dynamic-link Library Injection
357. Pre-OS Boot: System Firmware
358. Command and Scripting Interpreter: Unix Shell
359. Acquire Infrastructure: Web Services
360. Create or Modify System Process: Container Service
361. Modify Authentication Process: Password Filter DLL
362. Remote Services: Remote Desktop Protocol
363. Modify Authentication Process: Conditional Access Policies
364. Phishing: Spearphishing Link
365. Exfiltration Over C2 Channel
366. Cloud Administration Command
367. Create Account: Local Account
368. Steal or Forge Kerberos Tickets: AS-REP Roasting
369. Data from Cloud Storage
370. Data from Information Repositories
371. Event Triggered Execution: AppInit DLLs
372. Boot or Logon Autostart Execution: Re-opened Applications
373. Active Scanning: Vulnerability Scanning
374. OS Credential Dumping: Security Account Manager
375. Remote Services: Direct Cloud VM Connections
376. Modify Authentication Process: Network Provider DLL
377. System Binary Proxy Execution: Odbcconf
378. Data from Network Shared Drive
379. Data Transfer Size Limits
380. Virtualization/Sandbox Evasion
381. OS Credential Dumping: Proc Filesystem
382. Search Open Websites/Domains: Code Repositories
383. Impair Defenses: Disable or Modify Tools
384. Exfiltration Over Physical Medium
385. Stage Capabilities: Upload Tool
386. Process Injection: Process Hollowing
387. Credentials from Password Stores: Password Managers
388. Create or Modify System Process: Systemd Service
389. Abuse Elevation Control Mechanism: Setuid and Setgid
390. Compromise Accounts
391. Input Capture: Credential API Hooking
392. Exploitation for Defense Evasion
393. Network Boundary Bridging: Network Address Translation Traversal
394. System Shutdown/Reboot
395. Supply Chain Compromise: Compromise Software Supply Chain
396. Boot or Logon Autostart Execution: Login Items
397. Abuse Elevation Control Mechanism: TCC Manipulation
398. Deobfuscate/Decode Files or Information
399. Remote Service Session Hijacking: SSH Hijacking
400. System Binary Proxy Execution: Mshta
401. Data from Information Repositories: Customer Relationship Management Software
402. Exploit Public-Facing Application
403. Pre-OS Boot: ROMMONkit
404. Obfuscated Files or Information: Fileless Storage
405. Account Discovery: Local Account
406. Phishing: Spearphishing Voice
407. Subvert Trust Controls: Code Signing Policy Modification
408. Traffic Signaling
409. External Remote Services
410. Hijack Execution Flow: Services Registry Permissions Weakness
411. Acquire Access
412. Event Triggered Execution: Image File Execution Options Injection
413. System Services: Service Execution
414. Account Manipulation: Additional Cloud Roles
415. Process Injection: Proc Memory
416. Gather Victim Org Information: Determine Physical Locations
417. Exfiltration Over Physical Medium: Exfiltration over USB
418. Device Driver Discovery
419. Compromise Infrastructure: Botnet
420. Obtain Capabilities: Digital Certificates
421. Data from Configuration Repository
422. Office Application Startup: Outlook Forms
423. Remote Services: Cloud Services
424. Indicator Removal: Clear Network Connection History and Configurations
425. Establish Accounts: Email Accounts
426. Data Manipulation: Stored Data Manipulation
427. Abuse Elevation Control Mechanism: Elevated Execution with Prompt
428. Gather Victim Identity Information: Email Addresses
429. Masquerading: Space after Filename
430. Network Sniffing
431. Subvert Trust Controls: Install Root Certificate
432. Obtain Capabilities: Tool
433. Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth
434. Protocol Tunneling
435. Access Token Manipulation: Token Impersonation/Theft
436. User Execution: Malicious Link
437. Brute Force
438. Modify Cloud Compute Infrastructure: Create Cloud Instance
439. Subvert Trust Controls: Mark-of-the-Web Bypass
440. Adversary-in-the-Middle
441. Event Triggered Execution
442. Input Capture: Keylogging
443. Endpoint Denial of Service
444. Hide Artifacts: Email Hiding Rules
445. Event Triggered Execution: Application Shimming
446. Domain or Tenant Policy Modification
447. Compromise Infrastructure: Domains
448. Impair Defenses: Disable or Modify Cloud Logs
449. Data from Configuration Repository: SNMP (MIB Dump)
450. File and Directory Permissions Modification
451. OS Credential Dumping
452. Process Injection: Portable Executable Injection
453. Indicator Removal: Clear Mailbox Data
454. Shared Modules
455. Exploitation of Remote Services
456. Masquerading: Break Process Trees
457. System Network Configuration Discovery: Internet Connection Discovery
458. Account Manipulation: Additional Local or Domain Groups
459. Event Triggered Execution: Change Default File Association
460. Obtain Capabilities: Vulnerabilities
461. Steal or Forge Kerberos Tickets: Ccache Files
462. Modify Cloud Resource Hierarchy
463. Use Alternate Authentication Material: Pass the Hash
464. Boot or Logon Autostart Execution: Kernel Modules and Extensions
465. Credentials from Password Stores: Cloud Secrets Management Stores
466. Exploitation for Privilege Escalation
467. OS Credential Dumping: /etc/passwd and /etc/shadow
468. Gather Victim Identity Information
469. Debugger Evasion
470. Server Software Component: SQL Stored Procedures
471. Obfuscated Files or Information: Dynamic API Resolution
472. Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
473. Archive Collected Data: Archive via Utility
474. Trusted Relationship
475. Gather Victim Host Information
476. Search Open Websites/Domains: Search Engines
477. Video Capture
478. Brute Force: Password Spraying
479. Compromise Accounts: Email Accounts
480. Data from Local System
481. Create or Modify System Process: Launch Agent
482. Email Collection: Remote Email Collection
483. Event Triggered Execution: Emond
484. Account Discovery
485. Use Alternate Authentication Material: Application Access Token
486. OS Credential Dumping: LSA Secrets
487. File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification
488. Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
489. Pre-OS Boot: TFTP Boot
490. Network Share Discovery
491. Command and Scripting Interpreter
492. System Service Discovery
493. Establish Accounts: Cloud Accounts
494. Data from Removable Media
495. Data from Information Repositories: Messaging Applications
496. Exfiltration Over Web Service: Exfiltration to Cloud Storage
497. Remote System Discovery
498. System Network Connections Discovery
499. Data Manipulation: Runtime Data Manipulation
500. Gather Victim Network Information: Network Topology
501. Use Alternate Authentication Material: Pass the Ticket
502. Command and Scripting Interpreter: Network Device CLI
503. Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access
504. Endpoint Denial of Service: Application or System Exploitation
505. Unsecured Credentials: Chat Messages
506. Obfuscated Files or Information: HTML Smuggling
507. Steal Application Access Token
508. Steal Web Session Cookie
509. User Execution: Malicious File
510. Remote Service Session Hijacking: RDP Hijacking
511. Stage Capabilities: SEO Poisoning
512. Proxy: External Proxy
513. System Binary Proxy Execution: CMSTP
514. Boot or Logon Autostart Execution: Print Processors
515. Scheduled Task/Job: Container Orchestration Job
516. Password Policy Discovery
517. Obtain Capabilities: Artificial Intelligence
518. Hijack Execution Flow: Path Interception by Unquoted Path
519. Event Triggered Execution: AppCert DLLs
520. Gather Victim Org Information: Identify Business Tempo
521. Web Service: Bidirectional Communication
522. Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
523. Disk Wipe: Disk Content Wipe
524. Software Deployment Tools
525. Forge Web Credentials
526. Use Alternate Authentication Material: Web Session Cookie
527. Build Image on Host
528. Indicator Removal: Clear Windows Event Logs
529. Valid Accounts: Default Accounts
530. Credentials from Password Stores: Securityd Memory
531. File and Directory Permissions Modification: Windows File and Directory Permissions Modification
532. Impair Defenses: Disable or Modify Linux Audit System
533. Access Token Manipulation: Parent PID Spoofing
534. System Owner/User Discovery
535. Develop Capabilities: Exploits
536. Steal or Forge Kerberos Tickets: Silver Ticket
537. Network Denial of Service: Direct Network Flood
538. Scheduled Task/Job: At
539. Office Application Startup
540. Unsecured Credentials: Private Keys
541. Phishing for Information: Spearphishing Voice
542. Compromise Host Software Binary
543. Create or Modify System Process: Windows Service
544. Phishing for Information: Spearphishing Attachment
545. Proxy: Multi-hop Proxy
546. Data Obfuscation: Protocol or Service Impersonation
547. Scheduled Task/Job
548. Gather Victim Host Information: Software
549. Archive Collected Data: Archive via Custom Method
550. Pre-OS Boot
551. Impair Defenses: Disable Windows Event Logging
552. Compromise Infrastructure
553. Browser Session Hijacking
554. Hijack Execution Flow: AppDomainManager
555. Windows Management Instrumentation
556. Process Injection: Asynchronous Procedure Call
557. Unsecured Credentials
558. Domain Trust Discovery
559. Command and Scripting Interpreter: JavaScript
560. Endpoint Denial of Service: Application Exhaustion Flood
561. Power Settings
562. Acquire Infrastructure: DNS Server
563. Command and Scripting Interpreter: Lua
564. Boot or Logon Initialization Scripts: Startup Items
565. Unused/Unsupported Cloud Regions
566. Masquerading
567. Obfuscated Files or Information: Steganography
568. Scheduled Task/Job: Scheduled Task
569. Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol
570. Acquire Infrastructure
571. Impair Defenses: Spoof Security Alerting
572. Process Injection: ListPlanting
573. Obfuscated Files or Information: Software Packing
574. Modify Authentication Process: Network Device Authentication
575. Indicator Removal: Clear Command History
576. System Binary Proxy Execution: Verclsid
577. System Services
578. Hijack Execution Flow: COR_PROFILER
579. Replication Through Removable Media
580. Phishing for Information: Spearphishing Service
581. Credentials from Password Stores
582. Active Scanning: Scanning IP Blocks
583. Exfiltration Over Web Service
584. Event Triggered Execution: Component Object Model Hijacking
585. Trusted Developer Utilities Proxy Execution: ClickOnce
586. System Network Configuration Discovery: Wi-Fi Discovery
587. Dynamic Resolution
588. Command and Scripting Interpreter: Windows Command Shell
589. Multi-Factor Authentication Request Generation
590. Gather Victim Org Information: Business Relationships
591. Plist File Modification
592. Boot or Logon Autostart Execution: Shortcut Modification
593. Modify System Image
594. Obfuscated Files or Information: Embedded Payloads
595. Obfuscated Files or Information: Stripped Payloads
596. Steal or Forge Authentication Certificates
597. Transfer Data to Cloud Account
598. Gather Victim Identity Information: Credentials
599. Impersonation
600. Subvert Trust Controls: Gatekeeper Bypass
601. Gather Victim Org Information
602. Network Denial of Service: Reflection Amplification
603. Audio Capture
604. Screen Capture
605. Impair Defenses: Impair Command History Logging
606. Gather Victim Network Information: DNS
607. Direct Volume Access
608. Exfiltration Over Alternative Protocol
609. Forge Web Credentials: Web Cookies
610. Modify Authentication Process: Domain Controller Authentication
611. OS Credential Dumping: Cached Domain Credentials
612. Boot or Logon Autostart Execution
613. Remote Services: SSH
614. Event Triggered Execution: Windows Management Instrumentation Event Subscription
615. System Binary Proxy Execution: Control Panel
616. Application Window Discovery
617. Adversary-in-the-Middle: ARP Cache Poisoning
618. Valid Accounts: Cloud Accounts
619. Exfiltration Over Web Service: Exfiltration Over Webhook
620. Execution Guardrails
621. Modify System Image: Patch System Image
622. Search Closed Sources: Purchase Technical Data
623. Disk Wipe
624. Brute Force: Password Cracking
625. Communication Through Removable Media
626. Event Triggered Execution: LC_LOAD_DYLIB Addition
627. Gather Victim Network Information: Network Security Appliances
628. User Execution
629. Exfiltration Over Other Network Medium
630. Exploitation for Client Execution
631. System Binary Proxy Execution: Compiled HTML File
632. Pre-OS Boot: Bootkit
633. Account Manipulation: SSH Authorized Keys
634. Hide Artifacts: VBA Stomping
635. Access Token Manipulation: Create Process with Token
636. Obfuscated Files or Information: Encrypted/Encoded File
637. Acquire Infrastructure: Domains
638. Application Layer Protocol: Mail Protocols
639. Event Triggered Execution: Netsh Helper DLL
640. Hijack Execution Flow: DLL Search Order Hijacking
641. Web Service: Dead Drop Resolver
642. Office Application Startup: Office Template Macros
643. Remote Services
644. Internal Spearphishing
645. Create Account: Cloud Account
646. Create Account
647. Modify Cloud Compute Infrastructure: Revert Cloud Instance
648. Resource Hijacking
649. Boot or Logon Autostart Execution: Security Support Provider
650. Modify Cloud Compute Infrastructure
651. Application Layer Protocol: DNS
652. Adversary-in-the-Middle: Evil Twin
653. Pre-OS Boot: Component Firmware
654. BITS Jobs
655. Obfuscated Files or Information: Compile After Delivery
656. Hide Artifacts: NTFS File Attributes
657. Remote Access Software