atomic-red-team/atomics/Indexes/Matrices/macos-matrix.md

macOS Atomic Tests by ATT&CK Tactic & Technique

initial-access	execution	persistence	privilege-escalation	defense-evasion	credential-access	discovery	lateral-movement	collection	exfiltration	command-and-control	impact
External Remote Services CONTRIBUTE A TEST	Shared Modules CONTRIBUTE A TEST	Socket Filters CONTRIBUTE A TEST	Boot or Logon Initialization Scripts CONTRIBUTE A TEST	Socket Filters CONTRIBUTE A TEST	Adversary-in-the-Middle CONTRIBUTE A TEST	System Owner/User Discovery	Remote Services:VNC	Archive Collected Data: Archive via Utility	Exfiltration Over Web Service CONTRIBUTE A TEST	Socket Filters CONTRIBUTE A TEST	Disk Structure Wipe CONTRIBUTE A TEST
Compromise Software Dependencies and Development Tools CONTRIBUTE A TEST	Command and Scripting Interpreter: JavaScript CONTRIBUTE A TEST	Malicious Shell Modification CONTRIBUTE A TEST	Plist Modification CONTRIBUTE A TEST	Indicator Removal from Tools CONTRIBUTE A TEST	Modify Authentication Process: Pluggable Authentication Modules CONTRIBUTE A TEST	Internet Connection Discovery CONTRIBUTE A TEST	Taint Shared Content CONTRIBUTE A TEST	Screen Capture	Exfiltration Over Webhook CONTRIBUTE A TEST	Data Encoding: Standard Encoding	Direct Network Flood CONTRIBUTE A TEST
Spearphishing Link CONTRIBUTE A TEST	User Execution: Malicious File CONTRIBUTE A TEST	Boot or Logon Initialization Scripts CONTRIBUTE A TEST	Path Interception by PATH Environment Variable CONTRIBUTE A TEST	Hidden Window CONTRIBUTE A TEST	Input Capture: Keylogging	Permission Groups Discovery CONTRIBUTE A TEST	SSH CONTRIBUTE A TEST	Adversary-in-the-Middle CONTRIBUTE A TEST	Scheduled Transfer CONTRIBUTE A TEST	Domain Generation Algorithms CONTRIBUTE A TEST	Stored Data Manipulation CONTRIBUTE A TEST
Spearphishing Link CONTRIBUTE A TEST	Scheduled Task/Job: Cron	LC_LOAD_DYLIB Addition CONTRIBUTE A TEST	File System Permissions Weakness CONTRIBUTE A TEST	Embedded Payloads CONTRIBUTE A TEST	Brute Force: Password Guessing CONTRIBUTE A TEST	Device Driver Discovery CONTRIBUTE A TEST	Application Deployment Software CONTRIBUTE A TEST	Input Capture: Keylogging	Exfiltration Over Other Network Medium CONTRIBUTE A TEST	Application Layer Protocol: DNS CONTRIBUTE A TEST	External Defacement CONTRIBUTE A TEST
Phishing: Spearphishing Attachment CONTRIBUTE A TEST	Scheduled Task/Job CONTRIBUTE A TEST	Plist Modification CONTRIBUTE A TEST	Elevated Execution with Prompt CONTRIBUTE A TEST	Plist Modification CONTRIBUTE A TEST	OS Credential Dumping CONTRIBUTE A TEST	Account Discovery: Domain Account CONTRIBUTE A TEST	SSH Hijacking CONTRIBUTE A TEST	Audio Capture	Exfiltration Over Bluetooth CONTRIBUTE A TEST	Domain Fronting CONTRIBUTE A TEST	OS Exhaustion Flood CONTRIBUTE A TEST
Compromise Hardware Supply Chain CONTRIBUTE A TEST	Command and Scripting Interpreter: AppleScript	Modify Authentication Process: Pluggable Authentication Modules CONTRIBUTE A TEST	Create or Modify System Process CONTRIBUTE A TEST	Modify Authentication Process: Pluggable Authentication Modules CONTRIBUTE A TEST	Steal Web Session Cookie	Security Software Discovery CONTRIBUTE A TEST	Remote Services CONTRIBUTE A TEST	Archive via Custom Method CONTRIBUTE A TEST	Automated Exfiltration CONTRIBUTE A TEST	Symmetric Cryptography CONTRIBUTE A TEST	Application Exhaustion Flood CONTRIBUTE A TEST
Supply Chain Compromise CONTRIBUTE A TEST	Native API CONTRIBUTE A TEST	Path Interception by PATH Environment Variable CONTRIBUTE A TEST	LC_LOAD_DYLIB Addition CONTRIBUTE A TEST	HISTCONTROL CONTRIBUTE A TEST	Securityd Memory CONTRIBUTE A TEST	Account Discovery: Local Account	Remote Service Session Hijacking CONTRIBUTE A TEST	Email Collection CONTRIBUTE A TEST	Exfiltration Over Symmetric Encrypted Non-C2 Protocol CONTRIBUTE A TEST	Fast Flux DNS CONTRIBUTE A TEST	Disk Wipe CONTRIBUTE A TEST
Exploit Public-Facing Application CONTRIBUTE A TEST	Source CONTRIBUTE A TEST	File System Permissions Weakness CONTRIBUTE A TEST	Abuse Elevation Control Mechanism: Sudo and Sudo Caching	File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification	Brute Force: Password Cracking CONTRIBUTE A TEST	Virtualization/Sandbox Evasion: System Checks	Software Deployment Tools CONTRIBUTE A TEST	Data from Removable Media CONTRIBUTE A TEST	Exfiltration to Code Repository CONTRIBUTE A TEST	Application Layer Protocol CONTRIBUTE A TEST	Stored Data Manipulation CONTRIBUTE A TEST
Content Injection CONTRIBUTE A TEST	Launchctl CONTRIBUTE A TEST	Create or Modify System Process CONTRIBUTE A TEST	Boot or Logon Autostart Execution CONTRIBUTE A TEST	Path Interception by PATH Environment Variable CONTRIBUTE A TEST	Credentials from Password Stores: Keychain	Permission Groups Discovery: Domain Groups CONTRIBUTE A TEST	Exploitation of Remote Services CONTRIBUTE A TEST	Data Staged: Local Data Staging	Exfiltration Over Alternative Protocol - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Custom Cryptographic Protocol CONTRIBUTE A TEST	Service Stop CONTRIBUTE A TEST
Valid Accounts: Default Accounts	AppleScript CONTRIBUTE A TEST	External Remote Services CONTRIBUTE A TEST	Sudo Caching CONTRIBUTE A TEST	Email Hiding Rules CONTRIBUTE A TEST	Securityd Memory CONTRIBUTE A TEST	System Service Discovery CONTRIBUTE A TEST	Internal Spearphishing CONTRIBUTE A TEST	Automated Collection CONTRIBUTE A TEST	Exfiltration Over C2 Channel CONTRIBUTE A TEST	Remote Access Software CONTRIBUTE A TEST	Application or System Exploitation CONTRIBUTE A TEST
Spearphishing Attachment CONTRIBUTE A TEST	Command and Scripting Interpreter CONTRIBUTE A TEST	LC_LOAD_DYLIB Addition CONTRIBUTE A TEST	Scheduled Task/Job: Cron	Rootkit CONTRIBUTE A TEST	Password Managers CONTRIBUTE A TEST	Network Sniffing	Lateral Tool Transfer CONTRIBUTE A TEST	Clipboard Data	Exfiltration Over Alternative Protocol	Multilayer Encryption CONTRIBUTE A TEST	Disk Structure Wipe CONTRIBUTE A TEST
Trusted Relationship CONTRIBUTE A TEST	Scripting CONTRIBUTE A TEST	Rc.common CONTRIBUTE A TEST	Startup Items CONTRIBUTE A TEST	Timestomp CONTRIBUTE A TEST	Network Sniffing	Network Share Discovery	SSH Hijacking CONTRIBUTE A TEST	Remote Data Staging CONTRIBUTE A TEST	Exfiltration over USB CONTRIBUTE A TEST	Content Injection CONTRIBUTE A TEST	Runtime Data Manipulation CONTRIBUTE A TEST
Phishing CONTRIBUTE A TEST	System Services: Launchctl	Boot or Logon Autostart Execution CONTRIBUTE A TEST	Scheduled Task/Job CONTRIBUTE A TEST	Abuse Elevation Control Mechanism: Sudo and Sudo Caching	Steal or Forge Kerberos Tickets CONTRIBUTE A TEST	Peripheral Device Discovery CONTRIBUTE A TEST		Data from Local System CONTRIBUTE A TEST	Data Compressed CONTRIBUTE A TEST	Traffic Signaling CONTRIBUTE A TEST	Reflection Amplification CONTRIBUTE A TEST
Valid Accounts CONTRIBUTE A TEST	XPC Services CONTRIBUTE A TEST	Scheduled Task/Job: Cron	Boot or Logon Initialization Scripts: Logon Script (Mac)	Code Signing CONTRIBUTE A TEST	Credentials from Password Stores CONTRIBUTE A TEST	System Information Discovery		Archive Collected Data: Archive via Library CONTRIBUTE A TEST	Exfiltration Over Web Service: Exfiltration to Text Storage Sites CONTRIBUTE A TEST	Standard Cryptographic Protocol CONTRIBUTE A TEST	Service Exhaustion Flood CONTRIBUTE A TEST
Spearphishing Voice CONTRIBUTE A TEST	User Execution CONTRIBUTE A TEST	Startup Items CONTRIBUTE A TEST	Process Injection CONTRIBUTE A TEST	Masquerading: Match Legitimate Name or Location	Unsecured Credentials	Wi-Fi Discovery CONTRIBUTE A TEST		Archive Collected Data CONTRIBUTE A TEST	Exfiltration Over Web Service: Exfiltration to Cloud Storage CONTRIBUTE A TEST	Protocol Tunneling CONTRIBUTE A TEST	Defacement CONTRIBUTE A TEST
Compromise Software Supply Chain CONTRIBUTE A TEST	Launchd CONTRIBUTE A TEST	Scheduled Task/Job CONTRIBUTE A TEST	Create or Modify System Process: Launch Daemon	Masquerade File Type CONTRIBUTE A TEST	Bash History CONTRIBUTE A TEST	Application Window Discovery CONTRIBUTE A TEST		DHCP Spoofing CONTRIBUTE A TEST	Data Transfer Size Limits	Domain Generation Algorithms CONTRIBUTE A TEST	Financial Theft CONTRIBUTE A TEST
Domain Accounts CONTRIBUTE A TEST	Software Deployment Tools CONTRIBUTE A TEST	Login Item CONTRIBUTE A TEST	Valid Accounts: Default Accounts	Hide Artifacts CONTRIBUTE A TEST	Credentials from Web Browsers CONTRIBUTE A TEST	Time Based Evasion CONTRIBUTE A TEST		Web Portal Capture CONTRIBUTE A TEST	Data Encrypted CONTRIBUTE A TEST	Mail Protocols CONTRIBUTE A TEST	Defacement: Internal Defacement CONTRIBUTE A TEST
Spearphishing via Service CONTRIBUTE A TEST	Graphical User Interface CONTRIBUTE A TEST	Browser Extensions	Event Triggered Execution: Trap	Virtualization/Sandbox Evasion: System Checks	Private Keys CONTRIBUTE A TEST	Browser Bookmark Discovery		Video Capture CONTRIBUTE A TEST	Exfiltration Over Physical Medium CONTRIBUTE A TEST	Communication Through Removable Media CONTRIBUTE A TEST	Data Manipulation CONTRIBUTE A TEST
Hardware Additions CONTRIBUTE A TEST	Command and Scripting Interpreter: Bash	Boot or Logon Initialization Scripts: Logon Script (Mac)	Hijack Execution Flow: LD_PRELOAD	Indicator Removal on Host: Clear FreeBSD, Linux or Mac System Logs	Credentials from Password Stores: Credentials from Web Browsers	System Network Configuration Discovery		Email Collection: Email Forwarding Rule CONTRIBUTE A TEST	Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	External Proxy CONTRIBUTE A TEST	Account Access Removal
Drive-by Compromise CONTRIBUTE A TEST	Inter-Process Communication CONTRIBUTE A TEST	Traffic Signaling CONTRIBUTE A TEST	Plist Modification CONTRIBUTE A TEST	Disabling Security Tools CONTRIBUTE A TEST	DHCP Spoofing CONTRIBUTE A TEST	Account Discovery CONTRIBUTE A TEST		Data Staged CONTRIBUTE A TEST		Proxy CONTRIBUTE A TEST	Data Encrypted for Impact
Spearphishing via Service CONTRIBUTE A TEST	Trap CONTRIBUTE A TEST	Launchctl CONTRIBUTE A TEST	Abuse Elevation Control Mechanism CONTRIBUTE A TEST	Stripped Payloads CONTRIBUTE A TEST	Unsecured Credentials: Private Keys	File and Directory Discovery		Input Capture: GUI Input Capture		Dynamic Resolution CONTRIBUTE A TEST	Disk Content Wipe CONTRIBUTE A TEST
Valid Accounts: Local Accounts	Exploitation for Client Execution CONTRIBUTE A TEST	Create or Modify System Process: Launch Daemon	Abuse Elevation Control Mechanism: Setuid and Setgid	Subvert Trust Controls: Gatekeeper Bypass	Brute Force: Password Spraying CONTRIBUTE A TEST	System Network Connections Discovery		Data from Network Shared Drive CONTRIBUTE A TEST		Multi-hop Proxy CONTRIBUTE A TEST	Endpoint Denial of Service CONTRIBUTE A TEST
	Local Job Scheduling CONTRIBUTE A TEST	Server Software Component: Web Shell CONTRIBUTE A TEST	SSH Authorized Keys	Code Signing CONTRIBUTE A TEST	Web Portal Capture CONTRIBUTE A TEST	Virtualization/Sandbox Evasion CONTRIBUTE A TEST		Input Capture CONTRIBUTE A TEST		Web Service CONTRIBUTE A TEST	Runtime Data Manipulation CONTRIBUTE A TEST
	Command and Scripting Interpreter: Python CONTRIBUTE A TEST	Valid Accounts: Default Accounts	Boot or Logon Autostart Execution: Login Items	Break Process Trees CONTRIBUTE A TEST	Steal or Forge Authentication Certificates CONTRIBUTE A TEST	Log Enumeration CONTRIBUTE A TEST		ARP Cache Poisoning CONTRIBUTE A TEST		DNS Calculation CONTRIBUTE A TEST	Transmitted Data Manipulation CONTRIBUTE A TEST
	System Services CONTRIBUTE A TEST	Event Triggered Execution: Trap	Launchd CONTRIBUTE A TEST	Clear Network Connection History and Configurations CONTRIBUTE A TEST	Unsecured Credentials: Bash History	Process Discovery		Data from Information Repositories CONTRIBUTE A TEST		Multi-Stage Channels CONTRIBUTE A TEST	Resource Hijacking
	Command and Scripting Interpreter: Visual Basic CONTRIBUTE A TEST	Hijack Execution Flow: LD_PRELOAD	Event Triggered Execution: Emond	Indicator Removal on Host: Clear Command History	Unsecured Credentials: Credentials In Files	User Activity Based Checks CONTRIBUTE A TEST				Port Knocking CONTRIBUTE A TEST	Transmitted Data Manipulation CONTRIBUTE A TEST
	Space after Filename CONTRIBUTE A TEST	Create Account: Local Account	Sudo CONTRIBUTE A TEST	Deobfuscate/Decode Files or Information	Web Cookies CONTRIBUTE A TEST	Permission Groups Discovery: Local Groups				Multiband Communication CONTRIBUTE A TEST	Data Destruction
	Malicious Link CONTRIBUTE A TEST	Plist Modification CONTRIBUTE A TEST	Account Manipulation CONTRIBUTE A TEST	Impair Defenses CONTRIBUTE A TEST	Input Prompt CONTRIBUTE A TEST	Password Policy Discovery				File Transfer Protocols CONTRIBUTE A TEST	Network Denial of Service CONTRIBUTE A TEST
	Scheduled Task/Job: At CONTRIBUTE A TEST	Re-opened Applications CONTRIBUTE A TEST	Boot or Logon Autostart Execution: Kernel Modules and Extensions	Masquerading CONTRIBUTE A TEST	Forge Web Credentials CONTRIBUTE A TEST	System Location Discovery: System Language Discovery CONTRIBUTE A TEST				One-Way Communication CONTRIBUTE A TEST	Firmware Corruption CONTRIBUTE A TEST
		Redundant Access CONTRIBUTE A TEST	Dylib Hijacking CONTRIBUTE A TEST	Email Collection: Mailbox Manipulation	Multi-Factor Authentication Request Generation CONTRIBUTE A TEST	System Location Discovery CONTRIBUTE A TEST				Proxy: Multi-hop Proxy	Inhibit System Recovery CONTRIBUTE A TEST
		SSH Authorized Keys	Hijack Execution Flow CONTRIBUTE A TEST	Process Injection CONTRIBUTE A TEST	Exploitation for Credential Access CONTRIBUTE A TEST	Software Discovery: Security Software Discovery				Data Obfuscation CONTRIBUTE A TEST	Disk Content Wipe CONTRIBUTE A TEST
		Kernel Modules and Extensions CONTRIBUTE A TEST	Valid Accounts CONTRIBUTE A TEST	Traffic Signaling CONTRIBUTE A TEST	Keychain CONTRIBUTE A TEST	Remote System Discovery				Non-Standard Port	System Shutdown/Reboot
		Create Account: Domain Account CONTRIBUTE A TEST	Exploitation for Privilege Escalation CONTRIBUTE A TEST	Signed Binary Proxy Execution CONTRIBUTE A TEST	Input Capture: GUI Input Capture	Network Service Discovery				Encrypted Channel CONTRIBUTE A TEST
		Component Firmware CONTRIBUTE A TEST	Event Triggered Execution CONTRIBUTE A TEST	Indicator Removal on Host: Timestomp	Brute Force CONTRIBUTE A TEST	Software Discovery				Bidirectional Communication CONTRIBUTE A TEST
		Pre-OS Boot CONTRIBUTE A TEST	Event Triggered Execution: .bash_profile .bashrc and .shrc	Reflective Code Loading CONTRIBUTE A TEST	Brute Force: Credential Stuffing	Debugger Evasion CONTRIBUTE A TEST				Asymmetric Cryptography CONTRIBUTE A TEST
		Boot or Logon Autostart Execution: Login Items	Elevated Execution with Prompt CONTRIBUTE A TEST	Ignore Process Interrupts CONTRIBUTE A TEST	Multi-Factor Authentication CONTRIBUTE A TEST					Non-Application Layer Protocol CONTRIBUTE A TEST
		Port Knocking CONTRIBUTE A TEST	Setuid and Setgid CONTRIBUTE A TEST	Time Based Evasion CONTRIBUTE A TEST	Credentials in Files CONTRIBUTE A TEST					Protocol Impersonation CONTRIBUTE A TEST
		Launchd CONTRIBUTE A TEST	Boot or Logon Initialization Scripts: Startup Items	Binary Padding CONTRIBUTE A TEST	Input Capture CONTRIBUTE A TEST					Uncommonly Used Port CONTRIBUTE A TEST
		Compromise Client Software Binary CONTRIBUTE A TEST	Web Shell CONTRIBUTE A TEST	Impair Defenses: Disable or Modify System Firewall CONTRIBUTE A TEST	ARP Cache Poisoning CONTRIBUTE A TEST					Domain Fronting CONTRIBUTE A TEST
		Event Triggered Execution: Emond	Domain Accounts CONTRIBUTE A TEST	Launchctl CONTRIBUTE A TEST	Multi-Factor Authentication Interception CONTRIBUTE A TEST					Data Encoding CONTRIBUTE A TEST
		Account Manipulation CONTRIBUTE A TEST	Create or Modify System Process: Launch Agent	Code Signing Policy Modification CONTRIBUTE A TEST	Modify Authentication Process CONTRIBUTE A TEST					Non-Standard Encoding CONTRIBUTE A TEST
		Boot or Logon Autostart Execution: Kernel Modules and Extensions	Emond CONTRIBUTE A TEST	File Deletion CONTRIBUTE A TEST						Application Layer Protocol: Web Protocols
		Dylib Hijacking CONTRIBUTE A TEST	Installer Packages CONTRIBUTE A TEST	Obfuscated Files or Information: Binary Padding						Ingress Tool Transfer
		Hijack Execution Flow CONTRIBUTE A TEST	Boot or Logon Initialization Scripts: Rc.common	Valid Accounts: Default Accounts						Steganography CONTRIBUTE A TEST
		Valid Accounts CONTRIBUTE A TEST	Boot or Logon Autostart Execution: Re-opened Applications	Hijack Execution Flow: LD_PRELOAD						Fallback Channels CONTRIBUTE A TEST
		Multi-Factor Authentication CONTRIBUTE A TEST	Launch Daemon CONTRIBUTE A TEST	File and Directory Permissions Modification CONTRIBUTE A TEST						Proxy: Internal Proxy
		Trap CONTRIBUTE A TEST	Scheduled Task/Job: At CONTRIBUTE A TEST	Abuse Elevation Control Mechanism CONTRIBUTE A TEST						Custom Command and Control Protocol CONTRIBUTE A TEST
		Event Triggered Execution CONTRIBUTE A TEST	Dylib Hijacking CONTRIBUTE A TEST	Abuse Elevation Control Mechanism: Setuid and Setgid						Dead Drop Resolver CONTRIBUTE A TEST
		Event Triggered Execution: .bash_profile .bashrc and .shrc	Valid Accounts: Local Accounts	Redundant Access CONTRIBUTE A TEST						Junk Data CONTRIBUTE A TEST
		Local Job Scheduling CONTRIBUTE A TEST		Gatekeeper Bypass CONTRIBUTE A TEST						Commonly Used Port CONTRIBUTE A TEST
		Setuid and Setgid CONTRIBUTE A TEST		Software Packing CONTRIBUTE A TEST
		Boot or Logon Initialization Scripts: Startup Items		Impair Defenses: Indicator Blocking CONTRIBUTE A TEST
		Web Shell CONTRIBUTE A TEST		Right-to-Left Override CONTRIBUTE A TEST
		Domain Accounts CONTRIBUTE A TEST		Component Firmware CONTRIBUTE A TEST
		Create or Modify System Process: Launch Agent		Indicator Removal on Host CONTRIBUTE A TEST
		Emond CONTRIBUTE A TEST		Masquerading: Masquerade Task or Service CONTRIBUTE A TEST
		Server Software Component CONTRIBUTE A TEST		Plist File Modification
		Installer Packages CONTRIBUTE A TEST		Pre-OS Boot CONTRIBUTE A TEST
		Hidden Files and Directories CONTRIBUTE A TEST		Scripting CONTRIBUTE A TEST
		Boot or Logon Initialization Scripts: Rc.common		Downgrade Attack CONTRIBUTE A TEST
		Launch Agent CONTRIBUTE A TEST		Virtualization/Sandbox Evasion CONTRIBUTE A TEST
		Create Account CONTRIBUTE A TEST		Execution Guardrails CONTRIBUTE A TEST
		Boot or Logon Autostart Execution: Re-opened Applications		Port Knocking CONTRIBUTE A TEST
		Launch Daemon CONTRIBUTE A TEST		Hide Artifacts: Hidden Users
		Power Settings CONTRIBUTE A TEST		Impair Defenses: HISTCONTROL
		Scheduled Task/Job: At CONTRIBUTE A TEST		User Activity Based Checks CONTRIBUTE A TEST
		Modify Authentication Process CONTRIBUTE A TEST		LC_MAIN Hijacking CONTRIBUTE A TEST
		Dylib Hijacking CONTRIBUTE A TEST		Impair Defenses: Disable or Modify Tools
		Valid Accounts: Local Accounts		Hijack Execution Flow CONTRIBUTE A TEST
				Indicator Removal from Tools CONTRIBUTE A TEST
				Valid Accounts CONTRIBUTE A TEST
				Resource Forking CONTRIBUTE A TEST
				Obfuscated Files or Information
				Multi-Factor Authentication CONTRIBUTE A TEST
				Invalid Code Signature CONTRIBUTE A TEST
				Run Virtual Instance CONTRIBUTE A TEST
				Subvert Trust Controls CONTRIBUTE A TEST
				Elevated Execution with Prompt CONTRIBUTE A TEST
				Masquerading: Rename System Utilities CONTRIBUTE A TEST
				Spoof Security Alerting CONTRIBUTE A TEST
				Steganography CONTRIBUTE A TEST
				Domain Accounts CONTRIBUTE A TEST
				Subvert Trust Controls: Install Root Certificate
				Obfuscated Files or Information: Compile After Delivery
				VBA Stomping CONTRIBUTE A TEST
				Impersonation CONTRIBUTE A TEST
				Hide Artifacts: Hidden Window CONTRIBUTE A TEST
				Hidden Users CONTRIBUTE A TEST
				Compile After Delivery CONTRIBUTE A TEST
				Clear Persistence CONTRIBUTE A TEST
				Clear Command History CONTRIBUTE A TEST
				HTML Smuggling CONTRIBUTE A TEST
				Command Obfuscation CONTRIBUTE A TEST
				Install Root Certificate CONTRIBUTE A TEST
				Indicator Removal on Host: File Deletion
				Hidden Files and Directories CONTRIBUTE A TEST
				Obfuscated Files or Information: Software Packing
				Hidden File System CONTRIBUTE A TEST
				Space after Filename CONTRIBUTE A TEST
				Debugger Evasion CONTRIBUTE A TEST
				Masquerading: Space after Filename
				Hide Artifacts: Hidden Files and Directories
				Environmental Keying CONTRIBUTE A TEST
				Modify Authentication Process CONTRIBUTE A TEST
				Dylib Hijacking CONTRIBUTE A TEST
				Valid Accounts: Local Accounts
				Exploitation for Defense Evasion CONTRIBUTE A TEST