atomic-red-team/atomics/Indexes/Matrices/windows-matrix.md

Windows Atomic Tests by ATT&CK Tactic & Technique

reconnaissance	resource-development	initial-access	execution	persistence	privilege-escalation	stealth	defense-impairment	credential-access	discovery	lateral-movement	collection	command-and-control	exfiltration	impact
		External Remote Services	Scheduled Task/Job: Scheduled Task	Scheduled Task/Job: Scheduled Task	Process Injection: Extra Window Memory Injection	Process Injection: Extra Window Memory Injection	Exploitation for Defense Impairment CONTRIBUTE A TEST	Adversary-in-the-Middle CONTRIBUTE A TEST	System Owner/User Discovery	Remote Services:VNC CONTRIBUTE A TEST	Archive Collected Data: Archive via Utility	Socket Filters CONTRIBUTE A TEST	Exfiltration Over Web Service CONTRIBUTE A TEST	Disk Structure Wipe CONTRIBUTE A TEST
		Compromise Software Dependencies and Development Tools CONTRIBUTE A TEST	Windows Management Instrumentation	Socket Filters CONTRIBUTE A TEST	Scheduled Task/Job: Scheduled Task	Socket Filters CONTRIBUTE A TEST	Modify or Spoof Tool UI CONTRIBUTE A TEST	Input Capture: Keylogging	System Network Configuration Discovery: Internet Connection Discovery	Taint Shared Content CONTRIBUTE A TEST	Screen Capture	Data Encoding: Standard Encoding	Exfiltration Over Webhook CONTRIBUTE A TEST	Direct Network Flood CONTRIBUTE A TEST
		Phishing: Spearphishing Link	Server Software Component	Boot or Logon Initialization Scripts CONTRIBUTE A TEST	Boot or Logon Initialization Scripts CONTRIBUTE A TEST	Fileless Storage CONTRIBUTE A TEST	Disable or Modify Tools: Disable or Modify Windows Event Log	Brute Force: Password Guessing	Permission Groups Discovery CONTRIBUTE A TEST	Replication Through Removable Media	Adversary-in-the-Middle CONTRIBUTE A TEST	Dynamic Resolution: Domain Generation Algorithms CONTRIBUTE A TEST	Scheduled Transfer CONTRIBUTE A TEST	External Defacement CONTRIBUTE A TEST
		Phishing: Spearphishing Attachment	Path Interception by PATH Environment Variable CONTRIBUTE A TEST	Event Triggered Execution: PowerShell Profile	Event Triggered Execution: PowerShell Profile	Signed Binary Proxy Execution: Rundll32	Domain Trust Modification CONTRIBUTE A TEST	OS Credential Dumping	Group Policy Discovery	Remote Services: SMB/Windows Admin Shares	Input Capture: Keylogging	Application Layer Protocol: DNS	Exfiltration Over Other Network Medium CONTRIBUTE A TEST	OS Exhaustion Flood CONTRIBUTE A TEST
		Compromise Hardware Supply Chain CONTRIBUTE A TEST	Command and Scripting Interpreter: JavaScript	Create or Modify System Process CONTRIBUTE A TEST	Create or Modify System Process CONTRIBUTE A TEST	Embedded Payloads CONTRIBUTE A TEST	Windows Host Firewall CONTRIBUTE A TEST	Steal Web Session Cookie	Device Driver Discovery	Use Alternate Authentication Material CONTRIBUTE A TEST	Sharepoint CONTRIBUTE A TEST	Publish/Subscribe Protocols CONTRIBUTE A TEST	Exfiltration Over Bluetooth CONTRIBUTE A TEST	Application Exhaustion Flood CONTRIBUTE A TEST
		Replication Through Removable Media	Hijack Execution Flow: Services Registry Permissions Weakness	External Remote Services	Abuse Elevation Control Mechanism: Bypass User Account Control	File/Path Exclusions CONTRIBUTE A TEST	Downgrade Attack	OS Credential Dumping: Security Account Manager	Account Discovery: Domain Account	Remote Services CONTRIBUTE A TEST	Audio Capture	Symmetric Cryptography CONTRIBUTE A TEST	Automated Exfiltration	Disk Wipe CONTRIBUTE A TEST
		Supply Chain Compromise	Inter-Process Communication: Dynamic Data Exchange	Pre-OS Boot: System Firmware	Boot or Logon Autostart Execution	Signed Script Proxy Execution: Pubprn	Code Signing CONTRIBUTE A TEST	Brute Force: Password Cracking	Account Discovery: Local Account	Remote Service Session Hijacking CONTRIBUTE A TEST	Archive via Custom Method CONTRIBUTE A TEST	Fast Flux DNS CONTRIBUTE A TEST	Exfiltration Over Symmetric Encrypted Non-C2 Protocol CONTRIBUTE A TEST	Stored Data Manipulation CONTRIBUTE A TEST
		Exploit Public-Facing Application CONTRIBUTE A TEST	User Execution: Malicious File	Bootkit CONTRIBUTE A TEST	Active Setup	Path Interception by PATH Environment Variable CONTRIBUTE A TEST	File and Directory Permissions Modification: Windows File and Directory Permissions Modification	OS Credential Dumping: LSA Secrets	Virtualization/Sandbox Evasion: System Checks	Remote Services: Windows Remote Management	Email Collection CONTRIBUTE A TEST	Application Layer Protocol	Exfiltration to Code Repository CONTRIBUTE A TEST	Service Stop
		Content Injection	Component Object Model CONTRIBUTE A TEST	Boot or Logon Autostart Execution	Domain Trust Modification CONTRIBUTE A TEST	Direct Volume Access	Modify Authentication Process: Password Filter DLL	Forge Web Credentials: SAML token CONTRIBUTE A TEST	Permission Groups Discovery: Domain Groups	Remote Services: Distributed Component Object Model	Data from Removable Media	Remote Access Software	Exfiltration Over Alternative Protocol - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Application or System Exploitation CONTRIBUTE A TEST
		Valid Accounts: Default Accounts	Hijack Execution Flow: DLL	Active Setup	Create or Modify System Process: Windows Service	Hide Artifacts: Email Hiding Rules CONTRIBUTE A TEST	Subvert Trust Controls: SIP and Trust Provider Hijacking	Password Managers CONTRIBUTE A TEST	System Service Discovery	Use Alternate Authentication Material: Pass the Ticket	Data Staged: Local Data Staging	Content Injection	Exfiltration Over C2 Channel	Runtime Data Manipulation CONTRIBUTE A TEST
		Trusted Relationship CONTRIBUTE A TEST	AppDomainManager CONTRIBUTE A TEST	Browser Extensions CONTRIBUTE A TEST	Boot or Logon Autostart Execution: Print Processors	Obfuscated Files or Information: Encrypted/Encoded File	Hybrid Identity CONTRIBUTE A TEST	Network Sniffing	Network Sniffing	Software Deployment Tools	Email Collection: Local Email Collection	Traffic Signaling CONTRIBUTE A TEST	Exfiltration Over Alternative Protocol	Reflection Amplification CONTRIBUTE A TEST
		Phishing CONTRIBUTE A TEST	Scheduled Task/Job CONTRIBUTE A TEST	Create or Modify System Process: Windows Service	Scheduled Task/Job CONTRIBUTE A TEST	Rootkit CONTRIBUTE A TEST	Rogue Domain Controller	Unsecured Credentials: Credentials in Registry	Network Share Discovery	Exploitation of Remote Services CONTRIBUTE A TEST	Databases CONTRIBUTE A TEST	Protocol Tunneling	Exfiltration over USB CONTRIBUTE A TEST	Service Exhaustion Flood CONTRIBUTE A TEST
		Valid Accounts CONTRIBUTE A TEST	Native API	Office Application Startup	Additional Local or Domain Groups CONTRIBUTE A TEST	Masquerading: Double File Extension	Subvert Trust Controls: Code Signing Policy Modification	Modify Authentication Process: Password Filter DLL	Peripheral Device Discovery	Internal Spearphishing CONTRIBUTE A TEST	Automated Collection	Mail Protocols CONTRIBUTE A TEST	Exfiltration Over Web Service: Exfiltration to Text Storage Sites	Defacement CONTRIBUTE A TEST
		Spearphishing Voice CONTRIBUTE A TEST	Command and Scripting Interpreter: AutoHotKey & AutoIT	Boot or Logon Autostart Execution: Print Processors	Thread Execution Hijacking	Pre-OS Boot: System Firmware	Modify Registry	Steal or Forge Kerberos Tickets: AS-REP Roasting	System Information Discovery	Lateral Tool Transfer	Clipboard Data	Communication Through Removable Media CONTRIBUTE A TEST	Exfiltration Over Web Service: Exfiltration to Cloud Storage	Bandwidth Hijacking CONTRIBUTE A TEST
		Compromise Software Supply Chain CONTRIBUTE A TEST	Hijack Execution Flow: Path Interception by Search Order Hijacking	Office Application Startup: Add-ins	Event Triggered Execution: Application Shimming	Hijack Execution Flow: Services Registry Permissions Weakness	Domain Policy Modification: Group Policy Modification	Steal or Forge Kerberos Tickets CONTRIBUTE A TEST	System Network Configuration Discovery: Wi-Fi Discovery	Remote Service Session Hijacking: RDP Hijacking	Remote Data Staging CONTRIBUTE A TEST	External Proxy CONTRIBUTE A TEST	Data Transfer Size Limits	Financial Theft CONTRIBUTE A TEST
		Domain Accounts CONTRIBUTE A TEST	Input Injection CONTRIBUTE A TEST	Server Software Component: Transport Agent	Boot or Logon Autostart Execution: Port Monitors	Bootkit CONTRIBUTE A TEST	File and Directory Permissions Modification	Credentials from Password Stores	Backup Software Discovery CONTRIBUTE A TEST	Use Alternate Authentication Material: Pass the Hash	Data from Local System	Proxy CONTRIBUTE A TEST	Exfiltration Over Physical Medium CONTRIBUTE A TEST	Defacement: Internal Defacement
		Hardware Additions CONTRIBUTE A TEST	Executable Installer File Permissions Weakness CONTRIBUTE A TEST	Scheduled Task/Job CONTRIBUTE A TEST	Process Injection	Mavinject CONTRIBUTE A TEST	Disable or Modify Tools: Clear Windows Event Logs	Unsecured Credentials	Application Window Discovery	Remote Services: Remote Desktop Protocol	Archive Collected Data: Archive via Library CONTRIBUTE A TEST	IDE Tunneling CONTRIBUTE A TEST	Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	Compute Hijacking CONTRIBUTE A TEST
		Drive-by Compromise CONTRIBUTE A TEST	Command and Scripting Interpreter	Modify Authentication Process: Password Filter DLL	Escape to Host CONTRIBUTE A TEST	Masquerading: Match Legitimate Name or Location	Subvert Trust Controls: Mark-of-the-Web Bypass	Hybrid Identity CONTRIBUTE A TEST	Email Account CONTRIBUTE A TEST		Archive Collected Data	Dynamic Resolution CONTRIBUTE A TEST		Data Manipulation CONTRIBUTE A TEST
		Spearphishing via Service CONTRIBUTE A TEST	Malicious Library CONTRIBUTE A TEST	Server Software Component: Terminal Services DLL	Boot or Logon Autostart Execution: Shortcut Modification	Masquerade File Type CONTRIBUTE A TEST	Network Provider DLL CONTRIBUTE A TEST	Credentials from Password Stores: Credentials from Web Browsers	Time Based Evasion CONTRIBUTE A TEST		Browser Session Hijacking CONTRIBUTE A TEST	Web Service CONTRIBUTE A TEST		Account Access Removal
		Valid Accounts: Local Accounts	JamPlus CONTRIBUTE A TEST	Browser Extensions	Boot or Logon Autostart Execution: Security Support Provider	Hide Artifacts	Multi-Factor Authentication CONTRIBUTE A TEST	DHCP Spoofing CONTRIBUTE A TEST	Browser Bookmark Discovery		DHCP Spoofing CONTRIBUTE A TEST	DNS Calculation CONTRIBUTE A TEST		Data Encrypted for Impact
		Wi-Fi Networks CONTRIBUTE A TEST	User Execution CONTRIBUTE A TEST	Office Application Startup: Outlook Rules	Domain Policy Modification: Group Policy Modification	Virtualization/Sandbox Evasion: System Checks	Prevent Command History Logging	Unsecured Credentials: Private Keys	Virtual Machine Discovery CONTRIBUTE A TEST		Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay	Multi-Stage Channels CONTRIBUTE A TEST		Email Bombing CONTRIBUTE A TEST
			Software Deployment Tools	Additional Local or Domain Groups CONTRIBUTE A TEST	Valid Accounts: Default Accounts	Signed Binary Proxy Execution: InstallUtil	Subvert Trust Controls CONTRIBUTE A TEST	Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay	System Network Configuration Discovery		Web Portal Capture CONTRIBUTE A TEST	Port Knocking CONTRIBUTE A TEST		Endpoint Denial of Service CONTRIBUTE A TEST
			Command and Scripting Interpreter: PowerShell	Event Triggered Execution: Application Shimming	Time Providers	Stripped Payloads CONTRIBUTE A TEST	Disable or Modify Tools	OS Credential Dumping: LSASS Memory	Account Discovery CONTRIBUTE A TEST		Video Capture	File Transfer Protocols CONTRIBUTE A TEST		Resource Hijacking
			Services File Permissions Weakness CONTRIBUTE A TEST	Boot or Logon Autostart Execution: Port Monitors	Abuse Elevation Control Mechanism CONTRIBUTE A TEST	Hijack Execution Flow: DLL	Subvert Trust Controls: Install Root Certificate	Brute Force: Password Spraying	Domain Trust Discovery		Email Collection: Email Forwarding Rule CONTRIBUTE A TEST	One-Way Communication CONTRIBUTE A TEST		Transmitted Data Manipulation CONTRIBUTE A TEST
			KernelCallbackTable CONTRIBUTE A TEST	Traffic Signaling CONTRIBUTE A TEST	Create Process with Token	AppDomainManager CONTRIBUTE A TEST	Safe Mode Boot	Web Portal Capture CONTRIBUTE A TEST	File and Directory Discovery		Data Staged CONTRIBUTE A TEST	Proxy: Multi-hop Proxy		Data Destruction
			Inter-Process Communication	Boot or Logon Autostart Execution: Shortcut Modification	Boot or Logon Autostart Execution: Winlogon Helper DLL	Signed Binary Proxy Execution: Msiexec	Modify Authentication Process: Domain Controller Authentication	OS Credential Dumping: Cached Domain Credentials	System Network Connections Discovery		Input Capture: GUI Input Capture	Remote Access Hardware CONTRIBUTE A TEST		Network Denial of Service CONTRIBUTE A TEST
			Hijack Execution Flow CONTRIBUTE A TEST	Boot or Logon Autostart Execution: Security Support Provider	Event Triggered Execution: Image File Execution Options Injection	Clear Network Connection History and Configurations CONTRIBUTE A TEST	Reversible Encryption CONTRIBUTE A TEST	Steal or Forge Kerberos Tickets: Golden Ticket	Virtualization/Sandbox Evasion CONTRIBUTE A TEST		Data from Network Shared Drive	Data Obfuscation CONTRIBUTE A TEST		Firmware Corruption CONTRIBUTE A TEST
			Lua CONTRIBUTE A TEST	Hybrid Identity CONTRIBUTE A TEST	Process Doppelgänging CONTRIBUTE A TEST	Indicator Removal on Host: Clear Command History	Domain or Tenant Policy Modification CONTRIBUTE A TEST	Steal or Forge Authentication Certificates	Log Enumeration		Email Collection: Remote Email Collection CONTRIBUTE A TEST	Non-Standard Port		Inhibit System Recovery
			Exploitation for Client Execution CONTRIBUTE A TEST	Modify Registry	Event Triggered Execution: Accessibility Features	Indirect Command Execution	Disable or Modify System Firewall	Unsecured Credentials: Bash History CONTRIBUTE A TEST	Process Discovery		Input Capture CONTRIBUTE A TEST	Encrypted Channel		Disk Content Wipe CONTRIBUTE A TEST
			Hijack Execution Flow: Path Interception by Unquoted Path	Server Software Component: Web Shell	Process Injection: Asynchronous Procedure Call	Deobfuscate/Decode Files or Information	Modify Authentication Process CONTRIBUTE A TEST	Unsecured Credentials: Credentials In Files	User Activity Based Checks CONTRIBUTE A TEST		ARP Cache Poisoning CONTRIBUTE A TEST	Bidirectional Communication CONTRIBUTE A TEST		System Shutdown/Reboot
			BITS Jobs	Valid Accounts: Default Accounts	Event Triggered Execution: AppCert DLLs	Thread Execution Hijacking		Web Cookies CONTRIBUTE A TEST	Permission Groups Discovery: Local Groups		Data from Information Repositories CONTRIBUTE A TEST	Asymmetric Cryptography CONTRIBUTE A TEST
			Trusted Developer Utilities Proxy Execution: MSBuild	Time Providers	Device Registration CONTRIBUTE A TEST	Social Engineering CONTRIBUTE A TEST		Unsecured Credentials: Group Policy Preferences	Password Policy Discovery		Input Capture: Credential API Hooking	Non-Application Layer Protocol
			ClickOnce CONTRIBUTE A TEST	Create Account: Local Account	Process Injection: Portable Executable Injection	Masquerading		Network Provider DLL CONTRIBUTE A TEST	System Location Discovery: System Language Discovery			Protocol or Service Impersonation CONTRIBUTE A TEST
			Command and Scripting Interpreter: Python CONTRIBUTE A TEST	IDE Extensions CONTRIBUTE A TEST	Access Token Manipulation: Token Impersonation/Theft	Email Collection: Mailbox Manipulation		Forge Web Credentials CONTRIBUTE A TEST	Query Registry			Domain Fronting CONTRIBUTE A TEST
			System Services CONTRIBUTE A TEST	Boot or Logon Autostart Execution: Winlogon Helper DLL	Make and Impersonate Token CONTRIBUTE A TEST	Process Injection		Multi-Factor Authentication Request Generation CONTRIBUTE A TEST	System Location Discovery			Data Encoding CONTRIBUTE A TEST
			Command and Scripting Interpreter: Windows Command Shell	Event Triggered Execution: Image File Execution Options Injection	Event Triggered Execution: Windows Management Instrumentation Event Subscription	Traffic Signaling CONTRIBUTE A TEST		Exploitation for Credential Access CONTRIBUTE A TEST	Software Discovery: Security Software Discovery			Remote Desktop Software CONTRIBUTE A TEST
			Command and Scripting Interpreter: Visual Basic	Event Triggered Execution: Accessibility Features	Access Token Manipulation: Parent PID Spoofing	Signed Binary Proxy Execution		Input Capture: GUI Input Capture	Remote System Discovery			Non-Standard Encoding CONTRIBUTE A TEST
			Malicious Copy and Paste CONTRIBUTE A TEST	Create Account: Domain Account	Event Triggered Execution: Change Default File Association	Indicator Removal on Host: Timestomp		Brute Force CONTRIBUTE A TEST	Network Service Discovery			Application Layer Protocol: Web Protocols
			Malicious Link CONTRIBUTE A TEST	Component Firmware CONTRIBUTE A TEST	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	Reflective Code Loading		Brute Force: Credential Stuffing	Software Discovery			Ingress Tool Transfer
			System Services: Service Execution	Office Application Startup: Office Template Macros.	Account Manipulation	Mutual Exclusion CONTRIBUTE A TEST		Multi-Factor Authentication CONTRIBUTE A TEST	Debugger Evasion			Hide Infrastructure CONTRIBUTE A TEST
			Scheduled Task/Job: At	Event Triggered Execution: AppCert DLLs	Valid Accounts CONTRIBUTE A TEST	Ignore Process Interrupts CONTRIBUTE A TEST		Forced Authentication	Local Storage Discovery CONTRIBUTE A TEST			Data Obfuscation via Steganography
			Trusted Developer Utilities Proxy Execution	Device Registration CONTRIBUTE A TEST	Process Injection: Process Hollowing	Time Based Evasion CONTRIBUTE A TEST		Input Capture CONTRIBUTE A TEST	System Time Discovery			Fallback Channels CONTRIBUTE A TEST
			Hijack Execution Flow: COR_PROFILER	Pre-OS Boot CONTRIBUTE A TEST	Exploitation for Privilege Escalation CONTRIBUTE A TEST	Signed Binary Proxy Execution: CMSTP		ARP Cache Poisoning CONTRIBUTE A TEST				Proxy: Internal Proxy
				Port Knocking CONTRIBUTE A TEST	Event Triggered Execution	Signed Binary Proxy Execution: Control Panel		Steal or Forge Kerberos Tickets: Silver Ticket				Dead Drop Resolver CONTRIBUTE A TEST
				Network Provider DLL CONTRIBUTE A TEST	Access Token Manipulation: SID-History Injection	Electron Applications CONTRIBUTE A TEST		Credentials from Password Stores: Windows Credential Manager				Junk Data CONTRIBUTE A TEST
				Event Triggered Execution: Windows Management Instrumentation Event Subscription	Authentication Package	Hijack Execution Flow: Path Interception by Search Order Hijacking		Modify Authentication Process: Domain Controller Authentication
				Compromise Host Software Binary CONTRIBUTE A TEST	Event Triggered Execution: Component Object Model Hijacking	Obfuscated Files or Information: Binary Padding CONTRIBUTE A TEST		Reversible Encryption CONTRIBUTE A TEST
				Event Triggered Execution: Change Default File Association	Domain Accounts CONTRIBUTE A TEST	Valid Accounts: Default Accounts		Multi-Factor Authentication Interception CONTRIBUTE A TEST
				Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	Event Triggered Execution: Python Startup Hooks	Junk Code Insertion CONTRIBUTE A TEST		OS Credential Dumping: NTDS
				Account Manipulation	Network Logon Script CONTRIBUTE A TEST	Create Process with Token		Steal or Forge Kerberos Tickets: Kerberoasting
				Outlook Forms CONTRIBUTE A TEST	Event Triggered Execution: AppInit DLLs	Signed Binary Proxy Execution: Odbcconf		OS Credential Dumping: DCSync
				Valid Accounts CONTRIBUTE A TEST	Event Triggered Execution: Screensaver	Process Doppelgänging CONTRIBUTE A TEST		Modify Authentication Process CONTRIBUTE A TEST
				Multi-Factor Authentication CONTRIBUTE A TEST	Installer Packages CONTRIBUTE A TEST	Executable Installer File Permissions Weakness CONTRIBUTE A TEST		Input Capture: Credential API Hooking
				IIS Components	Access Token Manipulation CONTRIBUTE A TEST	Right-to-Left Override CONTRIBUTE A TEST
				Event Triggered Execution	Thread Local Storage CONTRIBUTE A TEST	SVG Smuggling CONTRIBUTE A TEST
				Authentication Package	Account Manipulation: Additional Email Delegate Permissions CONTRIBUTE A TEST	Component Firmware CONTRIBUTE A TEST
				Event Triggered Execution: Component Object Model Hijacking	Boot or Logon Initialization Scripts: Logon Script (Windows)	Indicator Removal on Host
				Office Application Startup: Outlook Home Page	Process Injection: ListPlanting	Masquerading: Masquerade Task or Service
				Domain Accounts CONTRIBUTE A TEST	Domain or Tenant Policy Modification CONTRIBUTE A TEST	Process Injection: Asynchronous Procedure Call
				Event Triggered Execution: Python Startup Hooks	Boot or Logon Autostart Execution: LSASS Driver	JamPlus CONTRIBUTE A TEST
				Network Logon Script CONTRIBUTE A TEST	Scheduled Task/Job: At	Pre-OS Boot CONTRIBUTE A TEST
				BITS Jobs	Process Injection: Dynamic-link Library Injection	Process Injection: Portable Executable Injection
				Event Triggered Execution: AppInit DLLs	Event Triggered Execution: Netsh Helper DLL	Verclsid CONTRIBUTE A TEST
				Event Triggered Execution: Screensaver	Valid Accounts: Local Accounts	Virtualization/Sandbox Evasion CONTRIBUTE A TEST
				Server Software Component CONTRIBUTE A TEST		Signed Binary Proxy Execution: Mshta
				Modify Authentication Process: Domain Controller Authentication		Execution Guardrails CONTRIBUTE A TEST
				Reversible Encryption CONTRIBUTE A TEST		Access Token Manipulation: Token Impersonation/Theft
				Installer Packages CONTRIBUTE A TEST		Port Knocking CONTRIBUTE A TEST
				Exclusive Control CONTRIBUTE A TEST		LNK Icon Smuggling CONTRIBUTE A TEST
				Create Account CONTRIBUTE A TEST		Hide Artifacts: Hidden Users
				Account Manipulation: Additional Email Delegate Permissions CONTRIBUTE A TEST		Make and Impersonate Token CONTRIBUTE A TEST
				Power Settings CONTRIBUTE A TEST		User Activity Based Checks CONTRIBUTE A TEST
				Boot or Logon Initialization Scripts: Logon Script (Windows)		Access Token Manipulation: Parent PID Spoofing
				Office Application Startup: Office Test		Selective Exclusion CONTRIBUTE A TEST
				Boot or Logon Autostart Execution: LSASS Driver		Services File Permissions Weakness CONTRIBUTE A TEST
				Scheduled Task/Job: At		Delay Execution CONTRIBUTE A TEST
				Modify Authentication Process CONTRIBUTE A TEST		KernelCallbackTable CONTRIBUTE A TEST
				Event Triggered Execution: Netsh Helper DLL		Signed Binary Proxy Execution: Compiled HTML File
				SQL Stored Procedures CONTRIBUTE A TEST		Indicator Removal on Host: Network Share Connection Removal
				Valid Accounts: Local Accounts		Hijack Execution Flow CONTRIBUTE A TEST
						Browser Fingerprint CONTRIBUTE A TEST
						Indicator Removal from Tools CONTRIBUTE A TEST
						Valid Accounts CONTRIBUTE A TEST
						Process Injection: Process Hollowing
						Obfuscated Files or Information
						Invalid Code Signature CONTRIBUTE A TEST
						Run Virtual Instance
						Polymorphic Code CONTRIBUTE A TEST
						Access Token Manipulation: SID-History Injection
						Signed Binary Proxy Execution: Regsvr32
						Masquerading: Rename System Utilities
						Hijack Execution Flow: Path Interception by Unquoted Path
						Steganography CONTRIBUTE A TEST
						Domain Accounts CONTRIBUTE A TEST
						Signed Binary Proxy Execution: Regsvcs/Regasm
						Obfuscated Files or Information: Compile After Delivery
						VBA Stomping CONTRIBUTE A TEST
						BITS Jobs
						Trusted Developer Utilities Proxy Execution: MSBuild
						Hide Artifacts: Hidden Window
						ClickOnce CONTRIBUTE A TEST
						Relocate Malware CONTRIBUTE A TEST
						Impersonation CONTRIBUTE A TEST
						Clear Persistence CONTRIBUTE A TEST
						Masquerade Account Name CONTRIBUTE A TEST
						HTML Smuggling
						Command Obfuscation CONTRIBUTE A TEST
						Indicator Removal on Host: File Deletion
						Template Injection
						Access Token Manipulation CONTRIBUTE A TEST
						Obfuscated Files or Information: Software Packing CONTRIBUTE A TEST
						Hidden File System CONTRIBUTE A TEST
						Thread Local Storage CONTRIBUTE A TEST
						Debugger Evasion
						SyncAppvPublishingServer CONTRIBUTE A TEST
						Invisible Unicode CONTRIBUTE A TEST
						Obfuscated Files or Information: Dynamic API Resolution
						Process Injection: ListPlanting
						XSL Script Processing
						Hide Artifacts: Hidden Files and Directories
						Environmental Keying CONTRIBUTE A TEST
						Hide Artifacts: NTFS File Attributes
						Process Injection: Dynamic-link Library Injection
						Signed Script Proxy Execution
						Compression CONTRIBUTE A TEST
						Email Spoofing CONTRIBUTE A TEST
						Valid Accounts: Local Accounts
						Exploitation for Stealth CONTRIBUTE A TEST
						Trusted Developer Utilities Proxy Execution
						MMC CONTRIBUTE A TEST
						Process Argument Spoofing CONTRIBUTE A TEST
						Hijack Execution Flow: COR_PROFILER