MITRE ATT&CK Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.

1. Account Manipulation: Device Registration
2. Data Obfuscation
3. Create or Modify System Process: Launch Agent
4. Web Service
5. Password Policy Discovery
6. Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol
7. System Owner/User Discovery
8. Acquire Infrastructure: Server
9. System Time Discovery
10. Credentials from Password Stores: Cloud Secrets Management Stores
11. Process Injection: Thread Local Storage
12. Hijack Execution Flow: COR_PROFILER
13. Create Account
14. System Services
15. Serverless Execution
16. Phishing for Information: Spearphishing Attachment
17. Permission Groups Discovery: Domain Groups
18. Acquire Infrastructure: Web Services
19. Develop Capabilities: Code Signing Certificates
20. Rootkit
21. Gather Victim Identity Information: Email Addresses
22. Dynamic Resolution: Domain Generation Algorithms
23. Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access
24. Obfuscated Files or Information: LNK Icon Smuggling
25. Event Triggered Execution: Component Object Model Hijacking
26. Hijack Execution Flow: Services File Permissions Weakness
27. Indicator Removal: Clear Command History
28. Supply Chain Compromise: Compromise Software Supply Chain
29. Modify Authentication Process: Multi-Factor Authentication
30. Hardware Additions
31. Create or Modify System Process: Container Service
32. Compromise Accounts: Cloud Accounts
33. Obfuscated Files or Information: Polymorphic Code
34. Permission Groups Discovery: Cloud Groups
35. Search Open Technical Databases: Scan Databases
36. Obfuscated Files or Information: Fileless Storage
37. Proxy: Domain Fronting
38. Develop Capabilities: Digital Certificates
39. Network Share Discovery
40. Weaken Encryption: Reduce Key Space
41. Hide Artifacts: NTFS File Attributes
42. Boot or Logon Initialization Scripts
43. Proxy
44. System Binary Proxy Execution: Regsvcs/Regasm
45. Account Discovery: Cloud Account
46. Valid Accounts: Local Accounts
47. Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations
48. Search Open Websites/Domains: Code Repositories
49. Remote Access Software
50. Permission Groups Discovery
51. Establish Accounts: Social Media Accounts
52. Log Enumeration
53. Boot or Logon Initialization Scripts: Logon Script (Windows)
54. Modify Authentication Process: Network Device Authentication
55. Credentials from Password Stores: Keychain
56. Application Layer Protocol: File Transfer Protocols
57. Abuse Elevation Control Mechanism: Sudo and Sudo Caching
58. Valid Accounts: Domain Accounts
59. Command and Scripting Interpreter: AppleScript
60. Masquerading: Break Process Trees
61. Account Manipulation
62. Command and Scripting Interpreter: Lua
63. Remote Service Session Hijacking: SSH Hijacking
64. Search Closed Sources
65. System Binary Proxy Execution: Rundll32
66. Obfuscated Files or Information: Indicator Removal from Tools
67. Office Application Startup: Outlook Home Page
68. Unsecured Credentials: Cloud Instance Metadata API
69. Stage Capabilities: Install Digital Certificate
70. Gather Victim Host Information: Software
71. Data from Network Shared Drive
72. System Information Discovery
73. Remote Services: Direct Cloud VM Connections
74. Create or Modify System Process: Windows Service
75. Content Injection
76. Command and Scripting Interpreter: Python
77. Email Collection: Local Email Collection
78. Unsecured Credentials: Container API
79. Execution Guardrails
80. Data Staged: Local Data Staging
81. Server Software Component: Terminal Services DLL
82. Event Triggered Execution: PowerShell Profile
83. Office Application Startup: Outlook Rules
84. Steal or Forge Kerberos Tickets: Silver Ticket
85. Impair Defenses: Disable Windows Event Logging
86. Search Victim-Owned Websites
87. Resource Hijacking
88. Obfuscated Files or Information: Command Obfuscation
89. Obfuscated Files or Information: Encrypted/Encoded File
90. Modify Authentication Process: Pluggable Authentication Modules
91. Lateral Tool Transfer
92. Obtain Capabilities: Tool
93. Hide Artifacts: Hidden Users
94. Exploitation for Client Execution
95. Command and Scripting Interpreter: Visual Basic
96. Boot or Logon Autostart Execution: Time Providers
97. Adversary-in-the-Middle: ARP Cache Poisoning
98. Video Capture
99. Gather Victim Host Information: Client Configurations
100. Impersonation
101. Acquire Infrastructure: Botnet
102. Modify Cloud Compute Infrastructure: Delete Cloud Instance
103. Exfiltration Over Web Service
104. Defacement
105. Impair Defenses: Disable or Modify Cloud Logs
106. Masquerading: Invalid Code Signature
107. Remote Services: Windows Remote Management
108. Unsecured Credentials: Bash History
109. Impair Defenses: Indicator Blocking
110. Compromise Accounts
111. Brute Force: Password Spraying
112. Shared Modules
113. Indicator Removal
114. Phishing for Information: Spearphishing Voice
115. BITS Jobs
116. Virtualization/Sandbox Evasion: System Checks
117. Event Triggered Execution: Trap
118. Event Triggered Execution: Netsh Helper DLL
119. Transfer Data to Cloud Account
120. Data Transfer Size Limits
121. Steal or Forge Kerberos Tickets: Golden Ticket
122. Application Layer Protocol: Web Protocols
123. Hide Artifacts: Ignore Process Interrupts
124. Process Injection: Ptrace System Calls
125. Command and Scripting Interpreter: Unix Shell
126. Disk Wipe: Disk Structure Wipe
127. Data Staged: Remote Data Staging
128. Gather Victim Network Information: IP Addresses
129. Reflective Code Loading
130. System Binary Proxy Execution: Mavinject
131. Domain or Tenant Policy Modification: Group Policy Modification
132. Encrypted Channel: Symmetric Cryptography
133. Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
134. Create Account: Local Account
135. Brute Force: Credential Stuffing
136. Boot or Logon Autostart Execution: Print Processors
137. Peripheral Device Discovery
138. Domain Trust Discovery
139. Remote Services: VNC
140. Remote Services: Remote Desktop Protocol
141. Build Image on Host
142. Unsecured Credentials: Credentials in Registry
143. Obfuscated Files or Information
144. Stage Capabilities: Upload Tool
145. Cloud Storage Object Discovery
146. Access Token Manipulation: Make and Impersonate Token
147. Obfuscated Files or Information: Dynamic API Resolution
148. Hide Artifacts: VBA Stomping
149. Exploit Public-Facing Application
150. Steal or Forge Kerberos Tickets
151. Establish Accounts: Email Accounts
152. Escape to Host
153. Boot or Logon Autostart Execution
154. Access Token Manipulation
155. Obfuscated Files or Information: Embedded Payloads
156. Steal or Forge Kerberos Tickets: AS-REP Roasting
157. Obtain Capabilities: Digital Certificates
158. User Execution: Malicious Image
159. Indicator Removal: Clear Mailbox Data
160. Indicator Removal: Network Share Connection Removal
161. Office Application Startup
162. Internal Spearphishing
163. Gather Victim Identity Information
164. Gather Victim Identity Information: Credentials
165. Obtain Capabilities: Artificial Intelligence
166. Masquerading: Masquerade File Type
167. Create or Modify System Process: Launch Daemon
168. Account Manipulation: Additional Local or Domain Groups
169. Email Collection: Email Forwarding Rule
170. Stage Capabilities: Link Target
171. Data Encoding: Non-Standard Encoding
172. Process Injection: Proc Memory
173. Hide Artifacts: Resource Forking
174. Encrypted Channel: Asymmetric Cryptography
175. Endpoint Denial of Service: OS Exhaustion Flood
176. Inter-Process Communication
177. Hijack Execution Flow: Dynamic Linker Hijacking
178. Acquire Infrastructure: Serverless
179. Search Open Technical Databases: CDNs
180. Search Closed Sources: Threat Intel Vendors
181. Process Injection: Dynamic-link Library Injection
182. Data Obfuscation: Steganography
183. Remote Service Session Hijacking
184. Abuse Elevation Control Mechanism: Setuid and Setgid
185. Screen Capture
186. OS Credential Dumping: LSASS Memory
187. Indicator Removal: Timestomp
188. Exfiltration Over Web Service: Exfiltration to Cloud Storage
189. Rogue Domain Controller
190. Search Open Websites/Domains
191. Dynamic Resolution: DNS Calculation
192. Resource Hijacking: SMS Pumping
193. Software Deployment Tools
194. Defacement: Internal Defacement
195. Software Discovery
196. Masquerading: Rename System Utilities
197. Pre-OS Boot: TFTP Boot
198. Obtain Capabilities
199. Financial Theft
200. Masquerading: Masquerade Account Name
201. System Network Configuration Discovery
202. Obtain Capabilities: Exploits
203. Boot or Logon Autostart Execution: Kernel Modules and Extensions
204. Domain or Tenant Policy Modification
205. Gather Victim Identity Information: Employee Names
206. Data from Configuration Repository
207. Endpoint Denial of Service: Application Exhaustion Flood
208. Endpoint Denial of Service: Application or System Exploitation
209. Impair Defenses: Downgrade Attack
210. Steal Application Access Token
211. Modify Authentication Process: Reversible Encryption
212. Process Discovery
213. Obfuscated Files or Information: Stripped Payloads
214. Permission Groups Discovery: Local Groups
215. Acquire Infrastructure: DNS Server
216. Service Stop
217. Obfuscated Files or Information: HTML Smuggling
218. Disk Wipe
219. Proxy: Multi-hop Proxy
220. Modify Authentication Process
221. Automated Exfiltration: Traffic Duplication
222. Software Discovery: Security Software Discovery
223. System Binary Proxy Execution: Msiexec
224. Boot or Logon Autostart Execution: Security Support Provider
225. Compromise Infrastructure: Server
226. Pre-OS Boot: ROMMONkit
227. Application Window Discovery
228. Browser Extensions
229. Process Injection: Process Doppelgänging
230. Hijack Execution Flow: KernelCallbackTable
231. OS Credential Dumping: LSA Secrets
232. Hijack Execution Flow: Path Interception by Search Order Hijacking
233. Defacement: External Defacement
234. Automated Collection
235. Gather Victim Org Information: Determine Physical Locations
236. Unsecured Credentials: Private Keys
237. Command and Scripting Interpreter: PowerShell
238. Cloud Infrastructure Discovery
239. Application Layer Protocol: Mail Protocols
240. Dynamic Resolution
241. Event Triggered Execution: Change Default File Association
242. Resource Hijacking: Bandwidth Hijacking
243. Scheduled Task/Job: Container Orchestration Job
244. Hijack Execution Flow: Executable Installer File Permissions Weakness
245. User Execution: Malicious Link
246. Phishing for Information
247. Compromise Infrastructure: Web Services
248. Account Discovery: Local Account
249. Exfiltration Over Physical Medium
250. Exploitation for Defense Evasion
251. Obtain Capabilities: Malware
252. Boot or Logon Initialization Scripts: Network Logon Script
253. System Binary Proxy Execution: Odbcconf
254. Modify Authentication Process: Network Provider DLL
255. Input Capture: Web Portal Capture
256. Data Manipulation: Runtime Data Manipulation
257. Forge Web Credentials
258. Non-Standard Port
259. Modify Authentication Process: Conditional Access Policies
260. Use Alternate Authentication Material
261. Communication Through Removable Media
262. Subvert Trust Controls: Code Signing
263. Acquire Access
264. Virtualization/Sandbox Evasion
265. Exploitation of Remote Services
266. System Binary Proxy Execution: InstallUtil
267. Supply Chain Compromise: Compromise Software Dependencies and Development Tools
268. Process Injection: ListPlanting
269. Data Manipulation: Transmitted Data Manipulation
270. Traffic Signaling: Socket Filters
271. Phishing: Spearphishing Voice
272. Adversary-in-the-Middle
273. Search Open Websites/Domains: Social Media
274. Archive Collected Data: Archive via Utility
275. Boot or Logon Autostart Execution: Port Monitors
276. Credentials from Password Stores: Password Managers
277. File and Directory Permissions Modification
278. Gather Victim Org Information: Business Relationships
279. Compromise Host Software Binary
280. Valid Accounts
281. Multi-Stage Channels
282. Modify Authentication Process: Password Filter DLL
283. Command and Scripting Interpreter: AutoHotKey & AutoIT
284. Hijack Execution Flow: Path Interception by Unquoted Path
285. Ingress Tool Transfer
286. Acquire Infrastructure
287. Subvert Trust Controls: Install Root Certificate
288. Account Manipulation: Additional Cloud Credentials
289. Boot or Logon Autostart Execution: Authentication Package
290. Container and Resource Discovery
291. Exfiltration Over Alternative Protocol
292. Subvert Trust Controls: SIP and Trust Provider Hijacking
293. Data Encoding
294. Archive Collected Data
295. Abuse Elevation Control Mechanism: TCC Manipulation
296. Command and Scripting Interpreter: Network Device CLI
297. OS Credential Dumping: DCSync
298. Office Application Startup: Office Template Macros
299. Process Injection: Extra Window Memory Injection
300. Account Manipulation: Additional Email Delegate Permissions
301. Event Triggered Execution
302. Impair Defenses
303. Search Open Technical Databases
304. Unsecured Credentials: Credentials In Files
305. Access Token Manipulation: Create Process with Token
306. Forge Web Credentials: Web Cookies
307. Develop Capabilities: Exploits
308. Gather Victim Network Information: Network Topology
309. Abuse Elevation Control Mechanism: Elevated Execution with Prompt
310. Trusted Developer Utilities Proxy Execution: ClickOnce
311. Search Open Technical Databases: Digital Certificates
312. Scheduled Task/Job: Systemd Timers
313. Process Injection: Asynchronous Procedure Call
314. Application Layer Protocol: DNS
315. Proxy: Internal Proxy
316. Data Destruction
317. Command and Scripting Interpreter: Windows Command Shell
318. Active Scanning: Vulnerability Scanning
319. Impair Defenses: Spoof Security Alerting
320. Audio Capture
321. Indicator Removal: Clear Persistence
322. Phishing: Spearphishing via Service
323. Adversary-in-the-Middle: DHCP Spoofing
324. Pre-OS Boot: Component Firmware
325. Native API
326. Process Injection
327. Modify System Image
328. Event Triggered Execution: Udev Rules
329. Data Staged
330. System Binary Proxy Execution: Compiled HTML File
331. Gather Victim Network Information: DNS
332. Application Layer Protocol
333. Query Registry
334. Account Discovery
335. Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
336. Compromise Accounts: Social Media Accounts
337. Data from Information Repositories
338. Impair Defenses: Disable or Modify Cloud Firewall
339. Impair Defenses: Disable or Modify System Firewall
340. User Execution
341. Boot or Logon Autostart Execution: LSASS Driver
342. Office Application Startup: Office Test
343. XSL Script Processing
344. Credentials from Password Stores
345. Network Service Discovery
346. System Binary Proxy Execution: MMC
347. Trusted Relationship
348. Traffic Signaling
349. System Location Discovery: System Language Discovery
350. Valid Accounts: Default Accounts
351. File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification
352. Disk Wipe: Disk Content Wipe
353. Process Injection: Process Hollowing
354. Multi-Factor Authentication Request Generation
355. Access Token Manipulation: Token Impersonation/Theft
356. Network Boundary Bridging
357. Inhibit System Recovery
358. System Network Connections Discovery
359. Impair Defenses: Safe Mode Boot
360. Web Service: Dead Drop Resolver
361. Unsecured Credentials
362. Domain or Tenant Policy Modification: Trust Modification
363. Input Capture: Credential API Hooking
364. Account Manipulation: Additional Container Cluster Roles
365. Event Triggered Execution: Accessibility Features
366. Clipboard Data
367. User Execution: Malicious File
368. Hijack Execution Flow
369. System Service Discovery
370. Data Encrypted for Impact
371. Hide Artifacts: Hidden Window
372. Gather Victim Host Information
373. Steal or Forge Kerberos Tickets: Kerberoasting
374. Execution Guardrails: Mutual Exclusion
375. Account Manipulation: Additional Cloud Roles
376. Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
377. Trusted Developer Utilities Proxy Execution
378. Remote Services: SSH
379. Browser Session Hijacking
380. Taint Shared Content
381. Use Alternate Authentication Material: Application Access Token
382. Replication Through Removable Media
383. Office Application Startup: Outlook Forms
384. Remote Services: Distributed Component Object Model
385. Obfuscated Files or Information: Steganography
386. Gather Victim Network Information: Network Security Appliances
387. Inter-Process Communication: Dynamic Data Exchange
388. Hijack Execution Flow: DLL Search Order Hijacking
389. Hijack Execution Flow: AppDomainManager
390. Data from Configuration Repository: SNMP (MIB Dump)
391. Network Sniffing
392. Pre-OS Boot
393. Masquerading: Masquerade Task or Service
394. Device Driver Discovery
395. Compromise Infrastructure: Serverless
396. Masquerading: Space after Filename
397. System Script Proxy Execution: PubPrn
398. Cloud Service Discovery
399. Pre-OS Boot: System Firmware
400. Phishing
401. Event Triggered Execution: AppInit DLLs
402. Abuse Elevation Control Mechanism
403. Server Software Component: SQL Stored Procedures
404. Account Discovery: Domain Account
405. Access Token Manipulation: Parent PID Spoofing
406. Impair Defenses: Disable or Modify Tools
407. External Remote Services
408. Exploitation for Privilege Escalation
409. System Shutdown/Reboot
410. Scheduled Task/Job: Scheduled Task
411. Event Triggered Execution: AppCert DLLs
412. Compromise Infrastructure: Virtual Private Server
413. Deploy Container
414. Obfuscated Files or Information: Binary Padding
415. Remote Service Session Hijacking: RDP Hijacking
416. Boot or Logon Autostart Execution: Shortcut Modification
417. Hijack Execution Flow: Path Interception by PATH Environment Variable
418. Event Triggered Execution: Emond
419. Proxy: External Proxy
420. Supply Chain Compromise: Compromise Hardware Supply Chain
421. Modify System Image: Patch System Image
422. Data from Configuration Repository: Network Device Configuration Dump
423. Obtain Capabilities: Code Signing Certificates
424. Scheduled Task/Job: Cron
425. Phishing: Spearphishing Attachment
426. Remote System Discovery
427. Hide Artifacts: Hidden Files and Directories
428. Process Injection: Thread Execution Hijacking
429. Data from Cloud Storage
430. Impair Defenses: Disable or Modify Linux Audit System
431. Server Software Component: Web Shell
432. Drive-by Compromise
433. Modify Cloud Compute Infrastructure: Create Cloud Instance
434. Develop Capabilities
435. Data from Information Repositories: Code Repositories
436. Gather Victim Org Information: Identify Roles
437. Plist File Modification
438. Virtualization/Sandbox Evasion: Time Based Evasion
439. Resource Hijacking: Compute Hijacking
440. Scheduled Transfer
441. Search Open Websites/Domains: Search Engines
442. Supply Chain Compromise
443. Scheduled Task/Job
444. System Script Proxy Execution: SyncAppvPublishingServer
445. Exfiltration Over C2 Channel
446. File and Directory Permissions Modification: Windows File and Directory Permissions Modification
447. Create Account: Cloud Account
448. OS Credential Dumping: NTDS
449. Acquire Infrastructure: Domains
450. Remote Services
451. Data Obfuscation: Protocol or Service Impersonation
452. Cloud Administration Command
453. Compromise Infrastructure: DNS Server
454. Hide Infrastructure
455. Hide Artifacts
456. Container Administration Command
457. Acquire Infrastructure: Virtual Private Server
458. Application Layer Protocol: Publish/Subscribe Protocols
459. Input Capture
460. Browser Information Discovery
461. System Binary Proxy Execution: Regsvr32
462. Boot or Logon Autostart Execution: Active Setup
463. OS Credential Dumping: Proc Filesystem
464. Modify Cloud Compute Infrastructure
465. System Binary Proxy Execution: Control Panel
466. Unsecured Credentials: Group Policy Preferences
467. Data from Information Repositories: Sharepoint
468. Inter-Process Communication: Component Object Model
469. Event Triggered Execution: LC_LOAD_DYLIB Addition
470. Modify Authentication Process: Domain Controller Authentication
471. Weaken Encryption: Disable Crypto Hardware
472. Brute Force: Password Guessing
473. Event Triggered Execution: Application Shimming
474. Resource Hijacking: Cloud Service Hijacking
475. Boot or Logon Autostart Execution: Re-opened Applications
476. Unused/Unsupported Cloud Regions
477. Server Software Component: IIS Components
478. Masquerading: Double File Extension
479. Data Destruction: Lifecycle-Triggered Deletion
480. Email Collection
481. Obfuscated Files or Information: Compile After Delivery
482. Steal Web Session Cookie
483. Modify Cloud Resource Hierarchy
484. Use Alternate Authentication Material: Pass the Ticket
485. Brute Force: Password Cracking
486. Server Software Component: Transport Agent
487. Develop Capabilities: Malware
488. Active Scanning
489. Gather Victim Network Information
490. Command and Scripting Interpreter
491. Masquerading
492. Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth
493. Data Manipulation
494. Create Account: Domain Account
495. Modify Registry
496. Pre-OS Boot: Bootkit
497. Remote Services: Cloud Services
498. Input Capture: GUI Input Capture
499. System Binary Proxy Execution: Mshta
500. System Binary Proxy Execution
501. name
502. Hide Artifacts: Hidden File System
503. Exfiltration Over Other Network Medium
504. Stage Capabilities: SEO Poisoning
505. Search Open Technical Databases: WHOIS
506. Data Encoding: Standard Encoding
507. Search Open Technical Databases: DNS/Passive DNS
508. Exfiltration Over Web Service: Exfiltration to Code Repository
509. Email Collection: Remote Email Collection
510. Hijack Execution Flow: DLL Side-Loading
511. Gather Victim Org Information: Identify Business Tempo
512. Hide Artifacts: Process Argument Spoofing
513. Boot or Logon Autostart Execution: Winlogon Helper DLL
514. System Network Configuration Discovery: Wi-Fi Discovery
515. Masquerading: Right-to-Left Override
516. Masquerading: Match Legitimate Name or Location
517. Establish Accounts: Cloud Accounts
518. Multi-Factor Authentication Interception
519. OS Credential Dumping: Cached Domain Credentials
520. Fallback Channels
521. Establish Accounts
522. Access Token Manipulation: SID-History Injection
523. Subvert Trust Controls
524. Process Injection: VDSO Hijacking
525. OS Credential Dumping
526. Phishing: Spearphishing Link
527. System Services: Service Execution
528. Indicator Removal: Clear Windows Event Logs
529. System Script Proxy Execution
530. Acquire Infrastructure: Malvertising
531. Account Discovery: Email Account
532. Data from Information Repositories: Confluence
533. Use Alternate Authentication Material: Web Session Cookie
534. Hijack Execution Flow: Dylib Hijacking
535. Firmware Corruption
536. Gather Victim Network Information: Domain Properties
537. Process Injection: Portable Executable Injection
538. Indicator Removal: File Deletion
539. Weaken Encryption
540. Account Access Removal
541. Windows Management Instrumentation
542. Boot or Logon Initialization Scripts: Login Hook
543. OS Credential Dumping: /etc/passwd and /etc/shadow
544. Hide Artifacts: Run Virtual Instance
545. Indicator Removal: Clear Linux or Mac System Logs
546. Active Scanning: Wordlist Scanning
547. System Binary Proxy Execution: CMSTP
548. Data Obfuscation: Junk Data
549. Exfiltration Over Web Service: Exfiltration to Text Storage Sites
550. Cloud Service Dashboard
551. Active Scanning: Scanning IP Blocks
552. Web Service: One-Way Communication
553. Office Application Startup: Add-ins
554. Steal or Forge Kerberos Tickets: Ccache Files
555. Data from Local System
556. Event Triggered Execution: Screensaver
557. Obtain Capabilities: Vulnerabilities
558. Event Triggered Execution: Windows Management Instrumentation Event Subscription
559. Steal or Forge Authentication Certificates
560. Command and Scripting Interpreter: JavaScript
561. Event Triggered Execution: Image File Execution Options Injection
562. Boot or Logon Autostart Execution: XDG Autostart Entries
563. Phishing for Information: Spearphishing Link
564. Subvert Trust Controls: Code Signing Policy Modification
565. Use Alternate Authentication Material: Pass the Hash
566. Hide Artifacts: Email Hiding Rules
567. System Binary Proxy Execution: Verclsid
568. Compromise Infrastructure: Domains
569. Hijack Execution Flow: Services Registry Permissions Weakness
570. Data from Removable Media
571. Modify Cloud Compute Infrastructure: Revert Cloud Instance
572. Inter-Process Communication: XPC Services
573. Subvert Trust Controls: Gatekeeper Bypass
574. Input Capture: Keylogging
575. Modify System Image: Downgrade System Image
576. Hide Artifacts: File/Path Exclusions
577. Data Manipulation: Stored Data Manipulation
578. Compromise Infrastructure: Network Devices
579. Trusted Developer Utilities Proxy Execution: MSBuild
580. System Services: Launchctl
581. Modify Authentication Process: Hybrid Identity
582. Obfuscated Files or Information: Software Packing
583. Implant Internal Image
584. Debugger Evasion
585. Stage Capabilities: Upload Malware
586. Stage Capabilities
587. Execution Guardrails: Environmental Keying
588. Indirect Command Execution
589. System Binary Proxy Execution: Electron Applications
590. Compromise Accounts: Email Accounts
591. Gather Victim Host Information: Hardware
592. Data from Information Repositories: Customer Relationship Management Software
593. Abuse Elevation Control Mechanism: Bypass User Account Control
594. Non-Application Layer Protocol
595. Indicator Removal: Clear Network Connection History and Configurations
596. OS Credential Dumping: Security Account Manager
597. Compromise Infrastructure: Botnet
598. Virtualization/Sandbox Evasion: User Activity Based Checks
599. Credentials from Password Stores: Securityd Memory
600. Network Denial of Service: Direct Network Flood
601. Brute Force
602. System Network Configuration Discovery: Internet Connection Discovery
603. Network Denial of Service: Reflection Amplification
604. Dynamic Resolution: Fast Flux DNS
605. Server Software Component
606. Modify Cloud Compute Infrastructure: Create Snapshot
607. Traffic Signaling: Port Knocking
608. Valid Accounts: Cloud Accounts
609. Credentials from Password Stores: Credentials from Web Browsers
610. Group Policy Discovery
611. Gather Victim Org Information
612. Encrypted Channel
613. Unsecured Credentials: Chat Messages
614. Adversary-in-the-Middle: Evil Twin
615. Event Triggered Execution: Installer Packages
616. Exfiltration Over Web Service: Exfiltration Over Webhook
617. Endpoint Denial of Service
618. Command and Scripting Interpreter: Cloud API
619. Phishing for Information: Spearphishing Service
620. Scheduled Task/Job: At
621. Web Service: Bidirectional Communication
622. Exfiltration Over Physical Medium: Exfiltration over USB
623. Remote Services: SMB/Windows Admin Shares
624. File and Directory Discovery
625. Direct Volume Access
626. Subvert Trust Controls: Mark-of-the-Web Bypass
627. Credentials from Password Stores: Windows Credential Manager
628. Archive Collected Data: Archive via Library
629. Endpoint Denial of Service: Service Exhaustion Flood
630. Network Boundary Bridging: Network Address Translation Traversal
631. Template Injection
632. Search Closed Sources: Purchase Technical Data
633. Create or Modify System Process: Systemd Service
634. Compromise Infrastructure
635. Archive Collected Data: Archive via Custom Method
636. Account Manipulation: SSH Authorized Keys
637. Gather Victim Host Information: Firmware
638. Boot or Logon Initialization Scripts: Startup Items
639. Boot or Logon Initialization Scripts: RC Scripts
640. Automated Exfiltration
641. Deobfuscate/Decode Files or Information
642. Forge Web Credentials: SAML Tokens
643. Forced Authentication
644. Stage Capabilities: Drive-by Target
645. Protocol Tunneling
646. Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol
647. Boot or Logon Autostart Execution: Login Items
648. System Location Discovery
649. Gather Victim Network Information: Network Trust Dependencies
650. Impair Defenses: Impair Command History Logging
651. Network Denial of Service
652. Indicator Removal: Relocate Malware
653. Exploitation for Credential Access
654. Create or Modify System Process
655. Power Settings
656. Event Triggered Execution: Unix Shell Configuration Modification
657. Data from Information Repositories: Messaging Applications