MITRE ATT&CK Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.

1. Data Encoding: Non-Standard Encoding
2. Access Token Manipulation: SID-History Injection
3. Domain Trust Discovery
4. Forge Web Credentials
5. System Script Proxy Execution: SyncAppvPublishingServer
6. Obfuscated Files or Information: Fileless Storage
7. Data Encrypted for Impact
8. File and Directory Permissions Modification
9. Event Triggered Execution: Trap
10. Obfuscated Files or Information: Command Obfuscation
11. Event Triggered Execution: AppInit DLLs
12. Impair Defenses: Disable or Modify Cloud Firewall
13. Modify Authentication Process
14. Account Discovery: Domain Account
15. Unsecured Credentials: Credentials in Registry
16. Account Manipulation: SSH Authorized Keys
17. Adversary-in-the-Middle
18. Modify Authentication Process: Multi-Factor Authentication
19. Masquerading: Invalid Code Signature
20. Financial Theft
21. Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol
22. Gather Victim Network Information: Network Topology
23. Input Capture: Web Portal Capture
24. Obfuscated Files or Information: Stripped Payloads
25. Compromise Host Software Binary
26. Modify Authentication Process: Password Filter DLL
27. Build Image on Host
28. Exfiltration Over Physical Medium
29. Obtain Capabilities: Artificial Intelligence
30. Event Triggered Execution: AppCert DLLs
31. Network Denial of Service: Reflection Amplification
32. Access Token Manipulation: Create Process with Token
33. Phishing: Spearphishing via Service
34. Multi-Factor Authentication Request Generation
35. Archive Collected Data: Archive via Library
36. Search Closed Sources: Threat Intel Vendors
37. Network Boundary Bridging: Network Address Translation Traversal
38. Adversary-in-the-Middle: ARP Cache Poisoning
39. Exploitation of Remote Services
40. Exploit Public-Facing Application
41. Indicator Removal: Clear Command History
42. Weaken Encryption: Disable Crypto Hardware
43. Endpoint Denial of Service: Application or System Exploitation
44. Cloud Administration Command
45. Email Collection: Email Forwarding Rule
46. Data from Cloud Storage
47. Brute Force: Password Spraying
48. Execution Guardrails
49. Modify System Image: Downgrade System Image
50. Execution Guardrails: Environmental Keying
51. Traffic Signaling: Port Knocking
52. Exfiltration Over Web Service
53. Supply Chain Compromise: Compromise Hardware Supply Chain
54. System Script Proxy Execution
55. Impair Defenses: Disable or Modify Tools
56. Remote Services: SMB/Windows Admin Shares
57. Exfiltration Over Alternative Protocol
58. Remote Services
59. Credentials from Password Stores
60. Search Open Technical Databases: CDNs
61. Steal or Forge Kerberos Tickets: Ccache Files
62. Use Alternate Authentication Material: Application Access Token
63. Unused/Unsupported Cloud Regions
64. Data from Configuration Repository: Network Device Configuration Dump
65. Obtain Capabilities: Exploits
66. BITS Jobs
67. Software Discovery: Security Software Discovery
68. Browser Extensions
69. Trusted Developer Utilities Proxy Execution: MSBuild
70. Develop Capabilities: Digital Certificates
71. Search Open Websites/Domains
72. Pre-OS Boot: ROMMONkit
73. Server Software Component: Terminal Services DLL
74. Hijack Execution Flow: Executable Installer File Permissions Weakness
75. Account Discovery: Cloud Account
76. Hijack Execution Flow: AppDomainManager
77. Event Triggered Execution: Unix Shell Configuration Modification
78. Active Scanning: Wordlist Scanning
79. Create Account: Local Account
80. Create Account
81. Virtualization/Sandbox Evasion
82. Subvert Trust Controls: Code Signing
83. Access Token Manipulation
84. Obfuscated Files or Information: Compile After Delivery
85. Gather Victim Host Information
86. Create or Modify System Process: Launch Daemon
87. Exfiltration Over Web Service: Exfiltration to Text Storage Sites
88. Establish Accounts: Social Media Accounts
89. Office Application Startup: Office Template Macros
90. Event Triggered Execution: Screensaver
91. Account Discovery: Local Account
92. Gather Victim Network Information: DNS
93. Gather Victim Identity Information
94. Unsecured Credentials: Bash History
95. Data Encoding
96. Data Staged: Remote Data Staging
97. User Execution: Malicious Link
98. System Binary Proxy Execution: Mshta
99. File and Directory Discovery
100. Windows Management Instrumentation
101. Steal or Forge Kerberos Tickets: Golden Ticket
102. Compromise Infrastructure: Server
103. Command and Scripting Interpreter: Lua
104. Indicator Removal
105. System Time Discovery
106. Boot or Logon Autostart Execution: Security Support Provider
107. Unsecured Credentials: Group Policy Preferences
108. Use Alternate Authentication Material
109. Obtain Capabilities: Vulnerabilities
110. Gather Victim Network Information
111. Gather Victim Host Information: Software
112. Stage Capabilities: Upload Malware
113. Native API
114. Obfuscated Files or Information: LNK Icon Smuggling
115. Create or Modify System Process
116. Modify Authentication Process: Pluggable Authentication Modules
117. Peripheral Device Discovery
118. Modify Authentication Process: Network Provider DLL
119. Exploitation for Client Execution
120. Create or Modify System Process: Launch Agent
121. Password Policy Discovery
122. Develop Capabilities
123. Hijack Execution Flow: Dylib Hijacking
124. Obfuscated Files or Information: Indicator Removal from Tools
125. Software Deployment Tools
126. Indicator Removal: Clear Mailbox Data
127. Unsecured Credentials: Cloud Instance Metadata API
128. Account Manipulation: Additional Cloud Credentials
129. Exfiltration Over Web Service: Exfiltration Over Webhook
130. Impair Defenses: Safe Mode Boot
131. Application Layer Protocol: File Transfer Protocols
132. Subvert Trust Controls: Mark-of-the-Web Bypass
133. Indicator Removal: Clear Windows Event Logs
134. Network Denial of Service
135. Weaken Encryption: Reduce Key Space
136. Inter-Process Communication: Dynamic Data Exchange
137. System Binary Proxy Execution: Compiled HTML File
138. Server Software Component: SQL Stored Procedures
139. Virtualization/Sandbox Evasion: Time Based Evasion
140. Template Injection
141. Endpoint Denial of Service: Application Exhaustion Flood
142. Establish Accounts
143. Process Discovery
144. Service Stop
145. Query Registry
146. Scheduled Task/Job
147. Establish Accounts: Cloud Accounts
148. Archive Collected Data: Archive via Utility
149. Application Layer Protocol: DNS
150. Access Token Manipulation: Parent PID Spoofing
151. Gather Victim Org Information: Business Relationships
152. System Binary Proxy Execution: Regsvr32
153. Modify Authentication Process: Reversible Encryption
154. Impair Defenses: Downgrade Attack
155. Unsecured Credentials: Credentials In Files
156. Adversary-in-the-Middle: Evil Twin
157. Event Triggered Execution: Emond
158. Obtain Capabilities: Digital Certificates
159. Application Layer Protocol: Web Protocols
160. Scheduled Task/Job: Cron
161. Data from Configuration Repository
162. System Network Configuration Discovery: Wi-Fi Discovery
163. Domain or Tenant Policy Modification: Trust Modification
164. Phishing: Spearphishing Link
165. Data Manipulation: Stored Data Manipulation
166. Direct Volume Access
167. Modify Cloud Compute Infrastructure: Create Snapshot
168. Command and Scripting Interpreter: Unix Shell
169. Forced Authentication
170. Boot or Logon Autostart Execution: XDG Autostart Entries
171. Adversary-in-the-Middle: DHCP Spoofing
172. Device Driver Discovery
173. Stage Capabilities: Upload Tool
174. Command and Scripting Interpreter
175. Boot or Logon Autostart Execution: Authentication Package
176. Event Triggered Execution: Netsh Helper DLL
177. Exploitation for Privilege Escalation
178. Dynamic Resolution: DNS Calculation
179. Phishing: Spearphishing Attachment
180. Command and Scripting Interpreter: Python
181. Input Capture: GUI Input Capture
182. Exploitation for Defense Evasion
183. Data Manipulation: Transmitted Data Manipulation
184. OS Credential Dumping: LSASS Memory
185. Obfuscated Files or Information: Encrypted/Encoded File
186. Web Service
187. File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification
188. Credentials from Password Stores: Windows Credential Manager
189. Indicator Removal: Clear Persistence
190. Command and Scripting Interpreter: AppleScript
191. System Script Proxy Execution: PubPrn
192. Exfiltration Over Physical Medium: Exfiltration over USB
193. Data Obfuscation: Steganography
194. Gather Victim Identity Information: Credentials
195. Develop Capabilities: Exploits
196. Account Manipulation: Device Registration
197. Deploy Container
198. Remote Services: Distributed Component Object Model
199. Gather Victim Host Information: Hardware
200. Boot or Logon Initialization Scripts: RC Scripts
201. Scheduled Task/Job: Scheduled Task
202. Impair Defenses: Disable or Modify Cloud Logs
203. Modify Cloud Compute Infrastructure: Revert Cloud Instance
204. Domain or Tenant Policy Modification: Group Policy Modification
205. Scheduled Task/Job: Container Orchestration Job
206. Account Access Removal
207. Virtualization/Sandbox Evasion: System Checks
208. Data Encoding: Standard Encoding
209. Modify Cloud Resource Hierarchy
210. Shared Modules
211. Network Share Discovery
212. Steal or Forge Kerberos Tickets: Kerberoasting
213. Boot or Logon Autostart Execution: Time Providers
214. Inter-Process Communication: Component Object Model
215. Process Injection
216. Phishing: Spearphishing Voice
217. Remote Service Session Hijacking: RDP Hijacking
218. Boot or Logon Autostart Execution: LSASS Driver
219. Masquerading: Masquerade Task or Service
220. Stage Capabilities: SEO Poisoning
221. Remote Services: Direct Cloud VM Connections
222. Modify Cloud Compute Infrastructure: Create Cloud Instance
223. OS Credential Dumping: /etc/passwd and /etc/shadow
224. Valid Accounts
225. Steal or Forge Authentication Certificates
226. Steal Application Access Token
227. Server Software Component: Transport Agent
228. Transfer Data to Cloud Account
229. Abuse Elevation Control Mechanism: Setuid and Setgid
230. Office Application Startup: Outlook Home Page
231. Acquire Access
232. Pre-OS Boot
233. Event Triggered Execution: Windows Management Instrumentation Event Subscription
234. Permission Groups Discovery: Domain Groups
235. Container and Resource Discovery
236. Hijack Execution Flow: Path Interception by PATH Environment Variable
237. Masquerading: Break Process Trees
238. OS Credential Dumping: DCSync
239. User Execution: Malicious File
240. Clipboard Data
241. Develop Capabilities: Code Signing Certificates
242. Hijack Execution Flow: Path Interception by Unquoted Path
243. Search Open Websites/Domains: Search Engines
244. Phishing for Information: Spearphishing Link
245. Archive Collected Data
246. Hijack Execution Flow: KernelCallbackTable
247. Phishing
248. Account Manipulation: Additional Local or Domain Groups
249. System Service Discovery
250. Hide Artifacts: Hidden Files and Directories
251. Trusted Developer Utilities Proxy Execution
252. Reflective Code Loading
253. Acquire Infrastructure: DNS Server
254. Modify Authentication Process: Hybrid Identity
255. Drive-by Compromise
256. Subvert Trust Controls
257. Remote Services: Cloud Services
258. Resource Hijacking: SMS Pumping
259. Impair Defenses: Spoof Security Alerting
260. Log Enumeration
261. Gather Victim Org Information
262. Multi-Factor Authentication Interception
263. Search Open Technical Databases: DNS/Passive DNS
264. System Information Discovery
265. Defacement: Internal Defacement
266. System Binary Proxy Execution: Rundll32
267. Trusted Developer Utilities Proxy Execution: ClickOnce
268. Application Layer Protocol
269. System Location Discovery
270. Video Capture
271. Replication Through Removable Media
272. System Binary Proxy Execution: Control Panel
273. Data Transfer Size Limits
274. Indirect Command Execution
275. Compromise Infrastructure: DNS Server
276. Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
277. Impair Defenses: Disable or Modify Linux Audit System
278. User Execution: Malicious Image
279. Modify Cloud Compute Infrastructure
280. Power Settings
281. System Shutdown/Reboot
282. Compromise Accounts: Social Media Accounts
283. OS Credential Dumping: Security Account Manager
284. Automated Exfiltration
285. Modify Authentication Process: Network Device Authentication
286. Resource Hijacking
287. Hide Infrastructure
288. Non-Standard Port
289. Lateral Tool Transfer
290. Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
291. Pre-OS Boot: System Firmware
292. Serverless Execution
293. Data from Information Repositories
294. System Binary Proxy Execution: Msiexec
295. Abuse Elevation Control Mechanism: Bypass User Account Control
296. Permission Groups Discovery: Local Groups
297. Non-Application Layer Protocol
298. Deobfuscate/Decode Files or Information
299. Exfiltration Over C2 Channel
300. Server Software Component: IIS Components
301. System Network Configuration Discovery: Internet Connection Discovery
302. Masquerading: Match Legitimate Name or Location
303. Email Collection: Remote Email Collection
304. Office Application Startup: Office Test
305. Boot or Logon Autostart Execution: Winlogon Helper DLL
306. Compromise Infrastructure: Web Services
307. Search Open Technical Databases: Digital Certificates
308. Impersonation
309. Active Scanning
310. Multi-Stage Channels
311. Boot or Logon Initialization Scripts: Network Logon Script
312. Data from Information Repositories: Customer Relationship Management Software
313. Boot or Logon Initialization Scripts
314. Supply Chain Compromise: Compromise Software Supply Chain
315. Modify Authentication Process: Domain Controller Authentication
316. Search Open Technical Databases: WHOIS
317. Gather Victim Network Information: Domain Properties
318. Gather Victim Host Information: Client Configurations
319. Credentials from Password Stores: Credentials from Web Browsers
320. Remote Service Session Hijacking: SSH Hijacking
321. Exploitation for Credential Access
322. Steal Web Session Cookie
323. Masquerading: Double File Extension
324. Data Staged
325. Modify Registry
326. Compromise Infrastructure
327. Boot or Logon Initialization Scripts: Startup Items
328. OS Credential Dumping: LSA Secrets
329. Archive Collected Data: Archive via Custom Method
330. Hijack Execution Flow: Services File Permissions Weakness
331. Container Administration Command
332. Defacement: External Defacement
333. Indicator Removal: File Deletion
334. Active Scanning: Vulnerability Scanning
335. Supply Chain Compromise: Compromise Software Dependencies and Development Tools
336. Automated Exfiltration: Traffic Duplication
337. Hide Artifacts: Hidden Window
338. Boot or Logon Initialization Scripts: Login Hook
339. Cloud Service Discovery
340. System Network Configuration Discovery
341. Exfiltration Over Other Network Medium
342. Event Triggered Execution: Installer Packages
343. Masquerading: Rename System Utilities
344. Brute Force: Password Guessing
345. Plist File Modification
346. Dynamic Resolution
347. Event Triggered Execution: Accessibility Features
348. Search Open Technical Databases: Scan Databases
349. Impair Defenses: Impair Command History Logging
350. Modify System Image: Patch System Image
351. Proxy: External Proxy
352. Data from Information Repositories: Code Repositories
353. OS Credential Dumping
354. Endpoint Denial of Service: OS Exhaustion Flood
355. System Binary Proxy Execution: Regsvcs/Regasm
356. Office Application Startup
357. Obfuscated Files or Information: Software Packing
358. Account Discovery: Email Account
359. Exfiltration Over Web Service: Exfiltration to Cloud Storage
360. Hide Artifacts: Process Argument Spoofing
361. Remote System Discovery
362. Escape to Host
363. System Binary Proxy Execution: InstallUtil
364. Dynamic Resolution: Fast Flux DNS
365. Data from Information Repositories: Sharepoint
366. Access Token Manipulation: Token Impersonation/Theft
367. Protocol Tunneling
368. Abuse Elevation Control Mechanism: Elevated Execution with Prompt
369. Brute Force: Password Cracking
370. Data Obfuscation: Protocol or Service Impersonation
371. Debugger Evasion
372. Content Injection
373. Office Application Startup: Outlook Forms
374. Pre-OS Boot: TFTP Boot
375. Defacement
376. Remote Services: Windows Remote Management
377. Account Manipulation: Additional Cloud Roles
378. Use Alternate Authentication Material: Pass the Ticket
379. Weaken Encryption
380. Create Account: Cloud Account
381. Endpoint Denial of Service
382. Account Discovery
383. Obtain Capabilities: Tool
384. Compromise Infrastructure: Domains
385. Process Injection: Dynamic-link Library Injection
386. Obfuscated Files or Information: Embedded Payloads
387. Email Collection: Local Email Collection
388. Stage Capabilities: Link Target
389. Automated Collection
390. Dynamic Resolution: Domain Generation Algorithms
391. User Execution
392. Develop Capabilities: Malware
393. Search Open Websites/Domains: Social Media
394. Valid Accounts: Cloud Accounts
395. Input Capture: Credential API Hooking
396. Input Capture
397. Abuse Elevation Control Mechanism: TCC Manipulation
398. Communication Through Removable Media
399. Data from Local System
400. Disk Wipe
401. Command and Scripting Interpreter: AutoHotKey & AutoIT
402. Process Injection: Portable Executable Injection
403. Screen Capture
404. Subvert Trust Controls: Gatekeeper Bypass
405. Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol
406. Web Service: Dead Drop Resolver
407. Command and Scripting Interpreter: Visual Basic
408. Gather Victim Network Information: Network Security Appliances
409. Process Injection: Thread Execution Hijacking
410. Web Service: One-Way Communication
411. Active Scanning: Scanning IP Blocks
412. Obtain Capabilities: Malware
413. Hide Artifacts: Ignore Process Interrupts
414. Account Manipulation: Additional Container Cluster Roles
415. Impair Defenses: Disable Windows Event Logging
416. Command and Scripting Interpreter: Windows Command Shell
417. Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth
418. Compromise Accounts: Cloud Accounts
419. Web Service: Bidirectional Communication
420. Indicator Removal: Clear Network Connection History and Configurations
421. Steal or Forge Kerberos Tickets: AS-REP Roasting
422. Network Service Discovery
423. Data from Information Repositories: Confluence
424. Compromise Infrastructure: Botnet
425. Browser Information Discovery
426. Boot or Logon Autostart Execution
427. Compromise Accounts
428. Create or Modify System Process: Container Service
429. Encrypted Channel
430. Application Window Discovery
431. Credentials from Password Stores: Cloud Secrets Management Stores
432. Scheduled Task/Job: At
433. Hardware Additions
434. Obtain Capabilities: Code Signing Certificates
435. Network Denial of Service: Direct Network Flood
436. Permission Groups Discovery: Cloud Groups
437. Server Software Component: Web Shell
438. Create Account: Domain Account
439. Inter-Process Communication: XPC Services
440. Rogue Domain Controller
441. Valid Accounts: Default Accounts
442. Pre-OS Boot: Component Firmware
443. Hide Artifacts: Email Hiding Rules
444. Data Destruction: Lifecycle-Triggered Deletion
445. Data Manipulation: Runtime Data Manipulation
446. Hide Artifacts: Run Virtual Instance
447. OS Credential Dumping: Cached Domain Credentials
448. Masquerading: Masquerade Account Name
449. Boot or Logon Autostart Execution: Port Monitors
450. Hijack Execution Flow: Services Registry Permissions Weakness
451. Hide Artifacts: Hidden File System
452. Subvert Trust Controls: SIP and Trust Provider Hijacking
453. Boot or Logon Autostart Execution: Shortcut Modification
454. Gather Victim Org Information: Determine Physical Locations
455. Credentials from Password Stores: Securityd Memory
456. Obfuscated Files or Information: Polymorphic Code
457. Search Open Technical Databases
458. System Binary Proxy Execution: MMC
459. Masquerading: Right-to-Left Override
460. Compromise Infrastructure: Virtual Private Server
461. Process Injection: Thread Local Storage
462. Compromise Accounts: Email Accounts
463. Hide Artifacts: File/Path Exclusions
464. Data from Network Shared Drive
465. Phishing for Information: Spearphishing Voice
466. OS Credential Dumping: Proc Filesystem
467. Boot or Logon Autostart Execution: Print Processors
468. Resource Hijacking: Bandwidth Hijacking
469. Gather Victim Org Information: Identify Business Tempo
470. Acquire Infrastructure: Serverless
471. Process Injection: ListPlanting
472. Proxy: Internal Proxy
473. Hide Artifacts
474. Trusted Relationship
475. System Services
476. Modify Cloud Compute Infrastructure: Delete Cloud Instance
477. OS Credential Dumping: NTDS
478. Hide Artifacts: Resource Forking
479. Masquerading
480. Valid Accounts: Domain Accounts
481. Hijack Execution Flow: Dynamic Linker Hijacking
482. Data from Information Repositories: Messaging Applications
483. Remote Services: SSH
484. Cloud Storage Object Discovery
485. Account Manipulation: Additional Email Delegate Permissions
486. Boot or Logon Autostart Execution: Login Items
487. Internal Spearphishing
488. Phishing for Information: Spearphishing Attachment
489. Event Triggered Execution: Component Object Model Hijacking
490. Boot or Logon Autostart Execution: Kernel Modules and Extensions
491. Indicator Removal: Clear Linux or Mac System Logs
492. Inter-Process Communication
493. Virtualization/Sandbox Evasion: User Activity Based Checks
494. Command and Scripting Interpreter: PowerShell
495. Phishing for Information
496. Data from Removable Media
497. Remote Services: Remote Desktop Protocol
498. Valid Accounts: Local Accounts
499. Indicator Removal: Timestomp
500. Software Discovery
501. Data from Configuration Repository: SNMP (MIB Dump)
502. Use Alternate Authentication Material: Pass the Hash
503. Event Triggered Execution
504. Remote Access Software
505. Brute Force
506. Event Triggered Execution: Application Shimming
507. Email Collection
508. Access Token Manipulation: Make and Impersonate Token
509. Encrypted Channel: Asymmetric Cryptography
510. Data Staged: Local Data Staging
511. Unsecured Credentials: Chat Messages
512. Forge Web Credentials: Web Cookies
513. Acquire Infrastructure: Malvertising
514. Search Open Websites/Domains: Code Repositories
515. Event Triggered Execution: Image File Execution Options Injection
516. Firmware Corruption
517. Application Layer Protocol: Mail Protocols
518. Network Boundary Bridging
519. Scheduled Task/Job: Systemd Timers
520. Disk Wipe: Disk Structure Wipe
521. Data Destruction
522. Scheduled Transfer
523. Masquerading: Masquerade File Type
524. Acquire Infrastructure: Virtual Private Server
525. Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay
526. Obfuscated Files or Information: Steganography
527. Unsecured Credentials
528. Obfuscated Files or Information: Dynamic API Resolution
529. Brute Force: Credential Stuffing
530. Search Closed Sources
531. Obfuscated Files or Information: Binary Padding
532. Audio Capture
533. Boot or Logon Autostart Execution: Active Setup
534. Process Injection: Asynchronous Procedure Call
535. Cloud Service Dashboard
536. Hide Artifacts: NTFS File Attributes
537. Unsecured Credentials: Private Keys
538. Group Policy Discovery
539. System Binary Proxy Execution: Mavinject
540. Gather Victim Host Information: Firmware
541. Event Triggered Execution: Udev Rules
542. Command and Scripting Interpreter: Network Device CLI
543. Process Injection: Process Hollowing
544. Acquire Infrastructure
545. Search Closed Sources: Purchase Technical Data
546. XSL Script Processing
547. Process Injection: VDSO Hijacking
548. Server Software Component
549. Steal or Forge Kerberos Tickets: Silver Ticket
550. Process Injection: Proc Memory
551. Stage Capabilities: Drive-by Target
552. Boot or Logon Autostart Execution: Re-opened Applications
553. Proxy: Domain Fronting
554. System Location Discovery: System Language Discovery
555. Endpoint Denial of Service: Service Exhaustion Flood
556. Process Injection: Ptrace System Calls
557. Supply Chain Compromise
558. Exfiltration Over Web Service: Exfiltration to Code Repository
559. Boot or Logon Initialization Scripts: Logon Script (Windows)
560. Execution Guardrails: Mutual Exclusion
561. Abuse Elevation Control Mechanism
562. Credentials from Password Stores: Password Managers
563. Hijack Execution Flow: DLL Search Order Hijacking
564. Remote Services: VNC
565. Credentials from Password Stores: Keychain
566. Disk Wipe: Disk Content Wipe
567. Fallback Channels
568. Application Layer Protocol: Publish/Subscribe Protocols
569. Phishing for Information: Spearphishing Service
570. Resource Hijacking: Cloud Service Hijacking
571. Impair Defenses: Disable or Modify System Firewall
572. Pre-OS Boot: Bootkit
573. File and Directory Permissions Modification: Windows File and Directory Permissions Modification
574. name
575. Obtain Capabilities
576. Office Application Startup: Outlook Rules
577. Acquire Infrastructure: Server
578. Process Injection: Process Doppelgänging
579. Steal or Forge Kerberos Tickets
580. Establish Accounts: Email Accounts
581. Obfuscated Files or Information: HTML Smuggling
582. Event Triggered Execution: Change Default File Association
583. Acquire Infrastructure: Web Services
584. Search Victim-Owned Websites
585. System Binary Proxy Execution: Electron Applications
586. Gather Victim Network Information: Network Trust Dependencies
587. Modify System Image
588. Gather Victim Identity Information: Email Addresses
589. Resource Hijacking: Compute Hijacking
590. System Services: Launchctl
591. Command and Scripting Interpreter: Cloud API
592. System Binary Proxy Execution: Verclsid
593. Gather Victim Network Information: IP Addresses
594. Remote Service Session Hijacking
595. Acquire Infrastructure: Botnet
596. Taint Shared Content
597. Browser Session Hijacking
598. Modify Authentication Process: Conditional Access Policies
599. Gather Victim Org Information: Identify Roles
600. Encrypted Channel: Symmetric Cryptography
601. Compromise Infrastructure: Network Devices
602. Inhibit System Recovery
603. Hide Artifacts: VBA Stomping
604. Domain or Tenant Policy Modification
605. Data Obfuscation: Junk Data
606. Use Alternate Authentication Material: Web Session Cookie
607. Office Application Startup: Add-ins
608. Stage Capabilities: Install Digital Certificate
609. Masquerading: Space after Filename
610. Gather Victim Identity Information: Employee Names
611. Data Obfuscation
612. System Binary Proxy Execution: Odbcconf
613. System Services: Service Execution
614. Hide Artifacts: Hidden Users
615. Cloud Infrastructure Discovery
616. Subvert Trust Controls: Install Root Certificate
617. Stage Capabilities
618. Subvert Trust Controls: Code Signing Policy Modification
619. Ingress Tool Transfer
620. Permission Groups Discovery
621. Proxy: Multi-hop Proxy
622. Hijack Execution Flow: COR_PROFILER
623. Input Capture: Keylogging
624. System Network Connections Discovery
625. External Remote Services
626. Data Manipulation
627. Hijack Execution Flow: Path Interception by Search Order Hijacking
628. Traffic Signaling
629. System Binary Proxy Execution
630. Abuse Elevation Control Mechanism: Sudo and Sudo Caching
631. Event Triggered Execution: LC_LOAD_DYLIB Addition
632. Process Injection: Extra Window Memory Injection
633. Command and Scripting Interpreter: JavaScript
634. Proxy
635. Event Triggered Execution: PowerShell Profile
636. Impair Defenses
637. System Binary Proxy Execution: CMSTP
638. Create or Modify System Process: Systemd Service
639. Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access
640. Account Manipulation
641. Acquire Infrastructure: Domains
642. Unsecured Credentials: Container API
643. Compromise Infrastructure: Serverless
644. Hijack Execution Flow
645. Obfuscated Files or Information
646. Traffic Signaling: Socket Filters
647. Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations
648. Hijack Execution Flow: DLL Side-Loading
649. Indicator Removal: Relocate Malware
650. Network Sniffing
651. Indicator Removal: Network Share Connection Removal
652. Create or Modify System Process: Windows Service
653. Implant Internal Image
654. System Owner/User Discovery
655. Rootkit
656. Impair Defenses: Indicator Blocking
657. Forge Web Credentials: SAML Tokens