| Exploit Public-Facing Application | Command-Line Interface | [Browser Extensions](Persistence/Browser_Extensions.md) | Exploitation for Privilege Escalation | Clear Command History | Brute Force | Application Window Discovery | Application Deployment Software | Automated Collection | Data Compressed | Communication Through Removable Media|
| Hardware Additions | Exploitation for Client Execution | [Create Account](Persistence/Create_Account.md) | [Launch Daemon](Persistence/Launch_Daemon.md) |Code Signing | [Credentials in Files](Credential_Access/Credentials_in_Files.md) | Browser Bookmark Discovery | Exploitation of Remote Services | Clipboard Data | Data Encrypted | Connection Proxy|
| Spearphishing Attachment | Graphical User Interface | Dylib Hijacking | Plist Modification | [Disabling Security Tools](Defense_Evasion/Disabling_Security_Tools.md) | Exploitation for Credential Access | [File and Directory Discovery](Discovery/File_and_Directory_Discovery.md) | [Logon Scripts](Persistence/Logon_Scripts.md) | Data Staged | Data Transfer Size Limits | [Custom Command and Control Protocol](Command_and_Control/Custom_Command_and_Control_Protocol.md)l|
| Spearphishing Link | [Launchctl](Defense_Evasion/Launchctl.md) | [Hidden Files and Directories](Defense_Evasion/Hidden_Files_and_Directories) | Process Injection | Exploitation for Defense Evasion | Input Capture | [Network Service Scanning](Discovery/Network_Service_Scanning.md) | Remote File Copy | Data from Information Repositories | [Exfiltration Over Alternative Protocol](Exfiltration/Exfiltration_Over_Alternative_Protocol.md) | Custom Cryptographic Protocol|
| Spearphishing via Service | [Local Job Scheduling](Persistence/Local_Job_Scheduling.md) | Kernel Modules and Extensions | [Setuid and Setgid](Privilege_Escalation/Setuid_and_Setgid.md) | File Deletion | [Input Prompt](Credential_Access/Input_Prompt.md) | [Network Share Discovery](Discovery/Network_Share_Discovery.md) | Remote Services | Data from Local System | Exfiltration Over Command and Control Channel | Data Encoding|
| Supply Chain Compromise | Scripting | LC_LOAD_DYLIB Addition | [Startup Items](Persistence/Startup_Items.md) | [Gatekeeper Bypass](Defense_Evasion/Gatekeeper_Bypass.md) | [Keychain](Credential_Access/Keychain.md) | Password Policy Discovery | SSH Hijacking | Data from Network Shared Drive | Exfiltration Over Other Network Medium | Data Obfuscation|
| Trusted Relationship | Source | [Launch Agent](Persistence/Launch_Agent.md) | Sudo | [HISTCONTROL](Defense_Evasion/HISTCONTROL.md) | Network Sniffing |[Permission Groups Discovery](Discovery/Permissions_Groups_Discovery.md) | Third-party Software | Data from Removable Media | Exfiltration Over Physical Medium | Domain Fronting|
