atomic-red-team/atomics/Indexes/Matrices/macos-matrix.md

macOS Atomic Tests by ATT&CK Tactic & Technique

reconnaissance	resource-development	initial-access	execution	persistence	privilege-escalation	stealth	defense-impairment	credential-access	discovery	lateral-movement	collection	command-and-control	exfiltration	impact
		External Remote Services CONTRIBUTE A TEST	Server Software Component CONTRIBUTE A TEST	Socket Filters CONTRIBUTE A TEST	Boot or Logon Initialization Scripts CONTRIBUTE A TEST	Socket Filters CONTRIBUTE A TEST	Exploitation for Defense Impairment CONTRIBUTE A TEST	Adversary-in-the-Middle CONTRIBUTE A TEST	System Owner/User Discovery	Remote Services:VNC	Archive Collected Data: Archive via Utility	Socket Filters CONTRIBUTE A TEST	Exfiltration Over Web Service CONTRIBUTE A TEST	Disk Structure Wipe CONTRIBUTE A TEST
		Compromise Software Dependencies and Development Tools CONTRIBUTE A TEST	Path Interception by PATH Environment Variable CONTRIBUTE A TEST	Boot or Logon Initialization Scripts CONTRIBUTE A TEST	Create or Modify System Process CONTRIBUTE A TEST	Embedded Payloads CONTRIBUTE A TEST	Modify Authentication Process: Pluggable Authentication Modules CONTRIBUTE A TEST	Modify Authentication Process: Pluggable Authentication Modules CONTRIBUTE A TEST	System Network Configuration Discovery: Internet Connection Discovery	Taint Shared Content CONTRIBUTE A TEST	Screen Capture	Data Encoding: Standard Encoding	Exfiltration Over Webhook CONTRIBUTE A TEST	Direct Network Flood CONTRIBUTE A TEST
		Phishing: Spearphishing Link CONTRIBUTE A TEST	Command and Scripting Interpreter: JavaScript CONTRIBUTE A TEST	Modify Authentication Process: Pluggable Authentication Modules CONTRIBUTE A TEST	LC_LOAD_DYLIB Addition CONTRIBUTE A TEST	File/Path Exclusions CONTRIBUTE A TEST	File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification	Input Capture: Keylogging	Permission Groups Discovery CONTRIBUTE A TEST	Remote Services: SSH CONTRIBUTE A TEST	Adversary-in-the-Middle CONTRIBUTE A TEST	Dynamic Resolution: Domain Generation Algorithms CONTRIBUTE A TEST	Scheduled Transfer CONTRIBUTE A TEST	External Defacement CONTRIBUTE A TEST
		Phishing: Spearphishing Attachment CONTRIBUTE A TEST	User Execution: Malicious File CONTRIBUTE A TEST	Create or Modify System Process CONTRIBUTE A TEST	Abuse Elevation Control Mechanism: Sudo and Sudo Caching	Path Interception by PATH Environment Variable CONTRIBUTE A TEST	Modify or Spoof Tool UI CONTRIBUTE A TEST	Brute Force: Password Guessing CONTRIBUTE A TEST	Device Driver Discovery	SSH Hijacking CONTRIBUTE A TEST	Input Capture: Keylogging	Application Layer Protocol: DNS CONTRIBUTE A TEST	Exfiltration Over Other Network Medium CONTRIBUTE A TEST	OS Exhaustion Flood CONTRIBUTE A TEST
		Compromise Hardware Supply Chain CONTRIBUTE A TEST	Scheduled Task/Job: Cron	External Remote Services CONTRIBUTE A TEST	Boot or Logon Autostart Execution CONTRIBUTE A TEST	Hide Artifacts: Email Hiding Rules CONTRIBUTE A TEST	Downgrade Attack CONTRIBUTE A TEST	OS Credential Dumping CONTRIBUTE A TEST	Account Discovery: Domain Account CONTRIBUTE A TEST	Remote Services CONTRIBUTE A TEST	Audio Capture	Publish/Subscribe Protocols CONTRIBUTE A TEST	Exfiltration Over Bluetooth CONTRIBUTE A TEST	Application Exhaustion Flood CONTRIBUTE A TEST
		Supply Chain Compromise CONTRIBUTE A TEST	Scheduled Task/Job CONTRIBUTE A TEST	LC_LOAD_DYLIB Addition CONTRIBUTE A TEST	Scheduled Task/Job: Cron	Obfuscated Files or Information: Encrypted/Encoded File	Subvert Trust Controls: Gatekeeper Bypass	Steal Web Session Cookie	Account Discovery: Local Account	Remote Service Session Hijacking CONTRIBUTE A TEST	Archive via Custom Method CONTRIBUTE A TEST	Symmetric Cryptography CONTRIBUTE A TEST	Automated Exfiltration CONTRIBUTE A TEST	Disk Wipe CONTRIBUTE A TEST
		Exploit Public-Facing Application CONTRIBUTE A TEST	Command and Scripting Interpreter: AppleScript	Boot or Logon Autostart Execution CONTRIBUTE A TEST	Scheduled Task/Job CONTRIBUTE A TEST	Rootkit CONTRIBUTE A TEST	Code Signing CONTRIBUTE A TEST	Securityd Memory CONTRIBUTE A TEST	Virtualization/Sandbox Evasion: System Checks	Software Deployment Tools CONTRIBUTE A TEST	Email Collection CONTRIBUTE A TEST	Fast Flux DNS CONTRIBUTE A TEST	Exfiltration Over Symmetric Encrypted Non-C2 Protocol CONTRIBUTE A TEST	Stored Data Manipulation CONTRIBUTE A TEST
		Content Injection	Native API CONTRIBUTE A TEST	Browser Extensions CONTRIBUTE A TEST	Additional Local or Domain Groups CONTRIBUTE A TEST	Masquerading: Match Legitimate Name or Location	Subvert Trust Controls: Code Signing Policy Modification CONTRIBUTE A TEST	Brute Force: Password Cracking CONTRIBUTE A TEST	Permission Groups Discovery: Domain Groups CONTRIBUTE A TEST	Exploitation of Remote Services CONTRIBUTE A TEST	Data from Removable Media CONTRIBUTE A TEST	Application Layer Protocol CONTRIBUTE A TEST	Exfiltration to Code Repository CONTRIBUTE A TEST	Service Stop CONTRIBUTE A TEST
		Valid Accounts: Default Accounts	Hijack Execution Flow: LD_PRELOAD	Scheduled Task/Job: Cron	Boot or Logon Initialization Scripts: Logon Script (Mac)	Masquerade File Type CONTRIBUTE A TEST	Disable or Modify Tools: Clear Linux or Mac System Logs	Credentials from Password Stores: Keychain	System Service Discovery	Internal Spearphishing CONTRIBUTE A TEST	Data Staged: Local Data Staging	Remote Access Software CONTRIBUTE A TEST	Exfiltration Over Alternative Protocol - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Application or System Exploitation CONTRIBUTE A TEST
		Trusted Relationship CONTRIBUTE A TEST	Input Injection CONTRIBUTE A TEST	Scheduled Task/Job CONTRIBUTE A TEST	Process Injection CONTRIBUTE A TEST	Hide Artifacts CONTRIBUTE A TEST	File and Directory Permissions Modification CONTRIBUTE A TEST	Password Managers CONTRIBUTE A TEST	Network Sniffing	Lateral Tool Transfer CONTRIBUTE A TEST	Databases CONTRIBUTE A TEST	Content Injection	Exfiltration Over C2 Channel CONTRIBUTE A TEST	Runtime Data Manipulation CONTRIBUTE A TEST
		Phishing CONTRIBUTE A TEST	Command and Scripting Interpreter CONTRIBUTE A TEST	Browser Extensions	Create or Modify System Process: Launch Daemon	Virtualization/Sandbox Evasion: System Checks	Plist File Modification	Network Sniffing	Network Share Discovery		Automated Collection CONTRIBUTE A TEST	Traffic Signaling CONTRIBUTE A TEST	Exfiltration Over Alternative Protocol	Reflection Amplification CONTRIBUTE A TEST
		Valid Accounts CONTRIBUTE A TEST	Malicious Library CONTRIBUTE A TEST	Additional Local or Domain Groups CONTRIBUTE A TEST	Valid Accounts: Default Accounts	Stripped Payloads CONTRIBUTE A TEST	Multi-Factor Authentication CONTRIBUTE A TEST	Ccache Files CONTRIBUTE A TEST	Peripheral Device Discovery CONTRIBUTE A TEST		Clipboard Data	Protocol Tunneling	Exfiltration over USB CONTRIBUTE A TEST	Service Exhaustion Flood CONTRIBUTE A TEST
		Spearphishing Voice CONTRIBUTE A TEST	System Services: Launchctl	Boot or Logon Initialization Scripts: Logon Script (Mac)	Event Triggered Execution: Trap	Break Process Trees CONTRIBUTE A TEST	Prevent Command History Logging	Steal or Forge Kerberos Tickets CONTRIBUTE A TEST	System Information Discovery		Remote Data Staging CONTRIBUTE A TEST	Mail Protocols CONTRIBUTE A TEST	Exfiltration Over Web Service: Exfiltration to Text Storage Sites CONTRIBUTE A TEST	Defacement CONTRIBUTE A TEST
		Compromise Software Supply Chain CONTRIBUTE A TEST	XPC Services CONTRIBUTE A TEST	Traffic Signaling CONTRIBUTE A TEST	Abuse Elevation Control Mechanism CONTRIBUTE A TEST	Clear Network Connection History and Configurations CONTRIBUTE A TEST	Subvert Trust Controls CONTRIBUTE A TEST	Credentials from Password Stores CONTRIBUTE A TEST	System Network Configuration Discovery: Wi-Fi Discovery CONTRIBUTE A TEST		Data from Local System	Communication Through Removable Media CONTRIBUTE A TEST	Exfiltration Over Web Service: Exfiltration to Cloud Storage	Bandwidth Hijacking CONTRIBUTE A TEST
		Domain Accounts CONTRIBUTE A TEST	User Execution CONTRIBUTE A TEST	Create or Modify System Process: Launch Daemon	Abuse Elevation Control Mechanism: Setuid and Setgid	Indicator Removal on Host: Clear Command History	Disable or Modify Tools	Unsecured Credentials	Backup Software Discovery CONTRIBUTE A TEST		Archive Collected Data: Archive via Library CONTRIBUTE A TEST	External Proxy CONTRIBUTE A TEST	Data Transfer Size Limits	Financial Theft CONTRIBUTE A TEST
		Hardware Additions CONTRIBUTE A TEST	Software Deployment Tools CONTRIBUTE A TEST	Server Software Component: Web Shell CONTRIBUTE A TEST	SSH Authorized Keys	Deobfuscate/Decode Files or Information	Subvert Trust Controls: Install Root Certificate	Credentials from Password Stores: Credentials from Web Browsers	Application Window Discovery CONTRIBUTE A TEST		Archive Collected Data CONTRIBUTE A TEST	Proxy CONTRIBUTE A TEST	Exfiltration Over Physical Medium CONTRIBUTE A TEST	Defacement: Internal Defacement CONTRIBUTE A TEST
		Drive-by Compromise CONTRIBUTE A TEST	Command and Scripting Interpreter: Bash	Valid Accounts: Default Accounts	Boot or Logon Autostart Execution: Login Items	Social Engineering CONTRIBUTE A TEST	Disable or Modify System Firewall CONTRIBUTE A TEST	DHCP Spoofing CONTRIBUTE A TEST	Time Based Evasion		DHCP Spoofing CONTRIBUTE A TEST	IDE Tunneling CONTRIBUTE A TEST	Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	Compute Hijacking CONTRIBUTE A TEST
		Spearphishing via Service CONTRIBUTE A TEST	Inter-Process Communication CONTRIBUTE A TEST	Event Triggered Execution: Trap	Event Triggered Execution: Emond	Masquerading CONTRIBUTE A TEST	Modify Authentication Process CONTRIBUTE A TEST	Unsecured Credentials: Private Keys	Browser Bookmark Discovery		Web Portal Capture CONTRIBUTE A TEST	Dynamic Resolution CONTRIBUTE A TEST		Data Manipulation CONTRIBUTE A TEST
		Valid Accounts: Local Accounts	Hijack Execution Flow CONTRIBUTE A TEST	Create Account: Local Account	Account Manipulation CONTRIBUTE A TEST	Email Collection: Mailbox Manipulation		Brute Force: Password Spraying CONTRIBUTE A TEST	Virtual Machine Discovery CONTRIBUTE A TEST		Video Capture CONTRIBUTE A TEST	Web Service CONTRIBUTE A TEST		Account Access Removal
		Wi-Fi Networks CONTRIBUTE A TEST	Lua CONTRIBUTE A TEST	IDE Extensions CONTRIBUTE A TEST	Boot or Logon Autostart Execution: Kernel Modules and Extensions	Process Injection CONTRIBUTE A TEST		Web Portal Capture CONTRIBUTE A TEST	System Network Configuration Discovery		Email Collection: Email Forwarding Rule CONTRIBUTE A TEST	DNS Calculation CONTRIBUTE A TEST		Data Encrypted for Impact
			Exploitation for Client Execution CONTRIBUTE A TEST	SSH Authorized Keys	Valid Accounts CONTRIBUTE A TEST	Traffic Signaling CONTRIBUTE A TEST		Steal or Forge Authentication Certificates CONTRIBUTE A TEST	Account Discovery CONTRIBUTE A TEST		Data Staged CONTRIBUTE A TEST	Multi-Stage Channels CONTRIBUTE A TEST		Email Bombing CONTRIBUTE A TEST
			Command and Scripting Interpreter: Python CONTRIBUTE A TEST	Create Account: Domain Account CONTRIBUTE A TEST	Exploitation for Privilege Escalation CONTRIBUTE A TEST	Signed Binary Proxy Execution CONTRIBUTE A TEST		Unsecured Credentials: Bash History	File and Directory Discovery		Input Capture: GUI Input Capture	Port Knocking CONTRIBUTE A TEST		Endpoint Denial of Service CONTRIBUTE A TEST
			System Services CONTRIBUTE A TEST	Component Firmware CONTRIBUTE A TEST	Event Triggered Execution CONTRIBUTE A TEST	Indicator Removal on Host: Timestomp		Unsecured Credentials: Credentials In Files	System Network Connections Discovery		Data from Network Shared Drive CONTRIBUTE A TEST	File Transfer Protocols CONTRIBUTE A TEST		Resource Hijacking
			Command and Scripting Interpreter: Visual Basic CONTRIBUTE A TEST	Pre-OS Boot CONTRIBUTE A TEST	Event Triggered Execution: .bash_profile .bashrc and .shrc	Reflective Code Loading CONTRIBUTE A TEST		Web Cookies CONTRIBUTE A TEST	Virtualization/Sandbox Evasion CONTRIBUTE A TEST		Input Capture CONTRIBUTE A TEST	One-Way Communication CONTRIBUTE A TEST		Transmitted Data Manipulation CONTRIBUTE A TEST
			Malicious Copy and Paste CONTRIBUTE A TEST	Boot or Logon Autostart Execution: Login Items	Elevated Execution with Prompt CONTRIBUTE A TEST	Mutual Exclusion CONTRIBUTE A TEST		Forge Web Credentials CONTRIBUTE A TEST	Log Enumeration CONTRIBUTE A TEST		ARP Cache Poisoning CONTRIBUTE A TEST	Proxy: Multi-hop Proxy		Data Destruction
			Malicious Link CONTRIBUTE A TEST	Port Knocking CONTRIBUTE A TEST	Boot or Logon Initialization Scripts: Startup Items	Ignore Process Interrupts CONTRIBUTE A TEST		Multi-Factor Authentication Request Generation CONTRIBUTE A TEST	Process Discovery		Data from Information Repositories CONTRIBUTE A TEST	Remote Access Hardware CONTRIBUTE A TEST		Network Denial of Service CONTRIBUTE A TEST
			Scheduled Task/Job: At CONTRIBUTE A TEST	Compromise Host Software Binary CONTRIBUTE A TEST	Domain Accounts CONTRIBUTE A TEST	Time Based Evasion		Exploitation for Credential Access CONTRIBUTE A TEST	User Activity Based Checks CONTRIBUTE A TEST		Input Capture: Credential API Hooking CONTRIBUTE A TEST	Data Obfuscation CONTRIBUTE A TEST		Firmware Corruption CONTRIBUTE A TEST
			Dylib Hijacking CONTRIBUTE A TEST	Event Triggered Execution: Emond	Event Triggered Execution: Python Startup Hooks	Electron Applications CONTRIBUTE A TEST		Input Capture: GUI Input Capture	Permission Groups Discovery: Local Groups			Non-Standard Port		Inhibit System Recovery
				Account Manipulation CONTRIBUTE A TEST	Create or Modify System Process: Launch Agent	Obfuscated Files or Information: Binary Padding		Brute Force CONTRIBUTE A TEST	Password Policy Discovery			Encrypted Channel CONTRIBUTE A TEST		Disk Content Wipe CONTRIBUTE A TEST
				Boot or Logon Autostart Execution: Kernel Modules and Extensions	Installer Packages CONTRIBUTE A TEST	Valid Accounts: Default Accounts		Brute Force: Credential Stuffing	System Location Discovery: System Language Discovery CONTRIBUTE A TEST			Bidirectional Communication CONTRIBUTE A TEST		System Shutdown/Reboot
				Valid Accounts CONTRIBUTE A TEST	Boot or Logon Initialization Scripts: Rc.common	Hijack Execution Flow: LD_PRELOAD		Multi-Factor Authentication CONTRIBUTE A TEST	System Location Discovery			Asymmetric Cryptography CONTRIBUTE A TEST
				Multi-Factor Authentication CONTRIBUTE A TEST	Boot or Logon Autostart Execution: Re-opened Applications	Junk Code Insertion CONTRIBUTE A TEST		Input Capture CONTRIBUTE A TEST	Software Discovery: Security Software Discovery			Non-Application Layer Protocol CONTRIBUTE A TEST
				Event Triggered Execution CONTRIBUTE A TEST	TCC Manipulation CONTRIBUTE A TEST	Extended Attributes CONTRIBUTE A TEST		ARP Cache Poisoning CONTRIBUTE A TEST	Remote System Discovery			Protocol or Service Impersonation CONTRIBUTE A TEST
				Event Triggered Execution: .bash_profile .bashrc and .shrc	Scheduled Task/Job: At CONTRIBUTE A TEST	Right-to-Left Override CONTRIBUTE A TEST		Multi-Factor Authentication Interception CONTRIBUTE A TEST	Network Service Discovery			Domain Fronting CONTRIBUTE A TEST
				Boot or Logon Initialization Scripts: Startup Items	Valid Accounts: Local Accounts	SVG Smuggling CONTRIBUTE A TEST		Modify Authentication Process CONTRIBUTE A TEST	Software Discovery			Data Encoding CONTRIBUTE A TEST
				Domain Accounts CONTRIBUTE A TEST		Component Firmware CONTRIBUTE A TEST		Input Capture: Credential API Hooking CONTRIBUTE A TEST	Debugger Evasion CONTRIBUTE A TEST			Remote Desktop Software CONTRIBUTE A TEST
				Event Triggered Execution: Python Startup Hooks		Indicator Removal on Host CONTRIBUTE A TEST			Local Storage Discovery CONTRIBUTE A TEST			Non-Standard Encoding CONTRIBUTE A TEST
				Create or Modify System Process: Launch Agent		Masquerading: Masquerade Task or Service CONTRIBUTE A TEST			System Time Discovery			Application Layer Protocol: Web Protocols
				Server Software Component CONTRIBUTE A TEST		Pre-OS Boot CONTRIBUTE A TEST						Ingress Tool Transfer
				Installer Packages CONTRIBUTE A TEST		Virtualization/Sandbox Evasion CONTRIBUTE A TEST						Hide Infrastructure CONTRIBUTE A TEST
				Boot or Logon Initialization Scripts: Rc.common		Execution Guardrails CONTRIBUTE A TEST						Data Obfuscation via Steganography CONTRIBUTE A TEST
				Exclusive Control CONTRIBUTE A TEST		Port Knocking CONTRIBUTE A TEST						Fallback Channels CONTRIBUTE A TEST
				Create Account CONTRIBUTE A TEST		Hide Artifacts: Hidden Users						Proxy: Internal Proxy
				Boot or Logon Autostart Execution: Re-opened Applications		User Activity Based Checks CONTRIBUTE A TEST						Dead Drop Resolver CONTRIBUTE A TEST
				Power Settings CONTRIBUTE A TEST		Delay Execution CONTRIBUTE A TEST						Junk Data CONTRIBUTE A TEST
				Scheduled Task/Job: At CONTRIBUTE A TEST		Hijack Execution Flow CONTRIBUTE A TEST
				Modify Authentication Process CONTRIBUTE A TEST		Browser Fingerprint CONTRIBUTE A TEST
				Valid Accounts: Local Accounts		Indicator Removal from Tools CONTRIBUTE A TEST
						Valid Accounts CONTRIBUTE A TEST
						Resource Forking CONTRIBUTE A TEST
						Obfuscated Files or Information
						Invalid Code Signature CONTRIBUTE A TEST
						Run Virtual Instance CONTRIBUTE A TEST
						Polymorphic Code CONTRIBUTE A TEST
						Masquerading: Rename System Utilities CONTRIBUTE A TEST
						Steganography CONTRIBUTE A TEST
						Domain Accounts CONTRIBUTE A TEST
						Obfuscated Files or Information: Compile After Delivery
						VBA Stomping CONTRIBUTE A TEST
						Hide Artifacts: Hidden Window CONTRIBUTE A TEST
						Relocate Malware CONTRIBUTE A TEST
						Impersonation CONTRIBUTE A TEST
						Clear Persistence CONTRIBUTE A TEST
						Masquerade Account Name CONTRIBUTE A TEST
						HTML Smuggling CONTRIBUTE A TEST
						Command Obfuscation CONTRIBUTE A TEST
						Indicator Removal on Host: File Deletion
						Obfuscated Files or Information: Software Packing
						Hidden File System CONTRIBUTE A TEST
						Debugger Evasion CONTRIBUTE A TEST
						Masquerading: Space after Filename
						Invisible Unicode CONTRIBUTE A TEST
						Hide Artifacts: Hidden Files and Directories
						Environmental Keying CONTRIBUTE A TEST
						Compression CONTRIBUTE A TEST
						Dylib Hijacking CONTRIBUTE A TEST
						Email Spoofing CONTRIBUTE A TEST
						Valid Accounts: Local Accounts
						Exploitation for Stealth CONTRIBUTE A TEST