| External Remote Services |
Scheduled Task/Job: Scheduled Task |
Scheduled Task/Job: Scheduled Task |
Process Injection: Extra Window Memory Injection |
Process Injection: Extra Window Memory Injection |
Adversary-in-the-Middle CONTRIBUTE A TEST |
System Owner/User Discovery |
Remote Services:VNC |
Archive Collected Data: Archive via Utility |
Exfiltration Over Web Service CONTRIBUTE A TEST |
Socket Filters CONTRIBUTE A TEST |
Disk Structure Wipe CONTRIBUTE A TEST |
| Compromise Software Dependencies and Development Tools CONTRIBUTE A TEST |
Windows Management Instrumentation |
Socket Filters CONTRIBUTE A TEST |
Scheduled Task/Job: Scheduled Task |
Socket Filters CONTRIBUTE A TEST |
Modify Authentication Process: Pluggable Authentication Modules |
Container and Resource Discovery |
Taint Shared Content CONTRIBUTE A TEST |
Screen Capture |
Exfiltration Over Webhook CONTRIBUTE A TEST |
Data Encoding: Standard Encoding |
Direct Network Flood CONTRIBUTE A TEST |
| Spearphishing Link CONTRIBUTE A TEST |
Shared Modules CONTRIBUTE A TEST |
Malicious Shell Modification CONTRIBUTE A TEST |
Boot or Logon Initialization Scripts CONTRIBUTE A TEST |
Indicator Removal from Tools CONTRIBUTE A TEST |
Input Capture: Keylogging |
Internet Connection Discovery CONTRIBUTE A TEST |
Application Access Token CONTRIBUTE A TEST |
Adversary-in-the-Middle CONTRIBUTE A TEST |
Scheduled Transfer CONTRIBUTE A TEST |
Domain Generation Algorithms CONTRIBUTE A TEST |
Stored Data Manipulation CONTRIBUTE A TEST |
| Spearphishing Link CONTRIBUTE A TEST |
Command and Scripting Interpreter: JavaScript |
Bootkit CONTRIBUTE A TEST |
Plist Modification CONTRIBUTE A TEST |
Fileless Storage CONTRIBUTE A TEST |
Brute Force: Password Guessing |
Permission Groups Discovery CONTRIBUTE A TEST |
SSH CONTRIBUTE A TEST |
Input Capture: Keylogging |
Exfiltration Over Other Network Medium CONTRIBUTE A TEST |
Application Layer Protocol: DNS |
External Defacement CONTRIBUTE A TEST |
| Phishing: Spearphishing Attachment |
Kubernetes Cronjob |
Boot or Logon Initialization Scripts CONTRIBUTE A TEST |
Path Interception by PATH Environment Variable CONTRIBUTE A TEST |
Signed Binary Proxy Execution: Rundll32 |
OS Credential Dumping |
Cloud Groups CONTRIBUTE A TEST |
Application Deployment Software CONTRIBUTE A TEST |
Data from Configuration Repository CONTRIBUTE A TEST |
Exfiltration Over Bluetooth CONTRIBUTE A TEST |
Domain Fronting CONTRIBUTE A TEST |
OS Exhaustion Flood CONTRIBUTE A TEST |
| Compromise Hardware Supply Chain CONTRIBUTE A TEST |
Regsvcs/Regasm CONTRIBUTE A TEST |
LC_LOAD_DYLIB Addition CONTRIBUTE A TEST |
File System Permissions Weakness CONTRIBUTE A TEST |
Hidden Window CONTRIBUTE A TEST |
LLMNR/NBT-NS Poisoning and Relay CONTRIBUTE A TEST |
Group Policy Discovery |
Replication Through Removable Media |
Sharepoint CONTRIBUTE A TEST |
Automated Exfiltration |
Symmetric Cryptography CONTRIBUTE A TEST |
Application Exhaustion Flood CONTRIBUTE A TEST |
| Replication Through Removable Media |
Inter-Process Communication: Dynamic Data Exchange |
Plist Modification CONTRIBUTE A TEST |
Event Triggered Execution: PowerShell Profile |
Embedded Payloads CONTRIBUTE A TEST |
Steal Web Session Cookie |
Device Driver Discovery CONTRIBUTE A TEST |
Direct Cloud VM Connections CONTRIBUTE A TEST |
Audio Capture |
Exfiltration Over Symmetric Encrypted Non-C2 Protocol CONTRIBUTE A TEST |
Fast Flux DNS CONTRIBUTE A TEST |
Disk Wipe CONTRIBUTE A TEST |
| Supply Chain Compromise |
User Execution: Malicious File |
Modify Authentication Process: Pluggable Authentication Modules |
Elevated Execution with Prompt CONTRIBUTE A TEST |
Plist Modification CONTRIBUTE A TEST |
OS Credential Dumping: Security Account Manager |
Account Discovery: Domain Account |
SSH Hijacking CONTRIBUTE A TEST |
Archive via Custom Method CONTRIBUTE A TEST |
Traffic Duplication CONTRIBUTE A TEST |
Application Layer Protocol CONTRIBUTE A TEST |
Stored Data Manipulation CONTRIBUTE A TEST |
| Exploit Public-Facing Application CONTRIBUTE A TEST |
Scheduled Task/Job: Cron |
Path Interception by PATH Environment Variable CONTRIBUTE A TEST |
Create or Modify System Process CONTRIBUTE A TEST |
Modify Authentication Process: Pluggable Authentication Modules |
Unsecured Credentials: Cloud Instance Metadata API |
Security Software Discovery CONTRIBUTE A TEST |
Remote Services: SMB/Windows Admin Shares |
Email Collection CONTRIBUTE A TEST |
Exfiltration to Code Repository CONTRIBUTE A TEST |
Custom Cryptographic Protocol CONTRIBUTE A TEST |
Service Stop |
| Content Injection CONTRIBUTE A TEST |
Component Object Model CONTRIBUTE A TEST |
File System Permissions Weakness CONTRIBUTE A TEST |
LC_LOAD_DYLIB Addition CONTRIBUTE A TEST |
Revert Cloud Instance CONTRIBUTE A TEST |
Securityd Memory CONTRIBUTE A TEST |
Account Discovery: Local Account |
Use Alternate Authentication Material CONTRIBUTE A TEST |
Data from Removable Media CONTRIBUTE A TEST |
Exfiltration Over Alternative Protocol - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol |
Remote Access Software |
Application or System Exploitation CONTRIBUTE A TEST |
| Valid Accounts: Default Accounts |
Scheduled Task/Job CONTRIBUTE A TEST |
Event Triggered Execution: PowerShell Profile |
Kubernetes Cronjob |
HISTCONTROL CONTRIBUTE A TEST |
Cloud Instance Metadata API CONTRIBUTE A TEST |
Virtualization/Sandbox Evasion: System Checks |
Remote Desktop Protocol CONTRIBUTE A TEST |
Data Staged: Local Data Staging |
Exfiltration Over C2 Channel |
Multilayer Encryption CONTRIBUTE A TEST |
Disk Structure Wipe CONTRIBUTE A TEST |
| Spearphishing Attachment CONTRIBUTE A TEST |
Command and Scripting Interpreter: AppleScript |
Systemd Service CONTRIBUTE A TEST |
Abuse Elevation Control Mechanism: Bypass User Account Control |
File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification |
Brute Force: Password Cracking |
Permission Groups Discovery: Domain Groups |
Remote Services CONTRIBUTE A TEST |
Email Collection: Local Email Collection |
Exfiltration Over Alternative Protocol |
Content Injection CONTRIBUTE A TEST |
Runtime Data Manipulation CONTRIBUTE A TEST |
| Trusted Relationship CONTRIBUTE A TEST |
Native API |
Create or Modify System Process CONTRIBUTE A TEST |
Abuse Elevation Control Mechanism: Sudo and Sudo Caching |
Signed Script Proxy Execution: Pubprn |
Credentials from Password Stores: Keychain |
System Service Discovery |
Remote Service Session Hijacking CONTRIBUTE A TEST |
Automated Collection |
Exfiltration over USB CONTRIBUTE A TEST |
Traffic Signaling CONTRIBUTE A TEST |
Reflection Amplification CONTRIBUTE A TEST |
| Phishing CONTRIBUTE A TEST |
Source CONTRIBUTE A TEST |
External Remote Services |
Hijack Execution Flow: Services Registry Permissions Weakness |
Path Interception by PATH Environment Variable CONTRIBUTE A TEST |
OS Credential Dumping: LSA Secrets |
Network Sniffing |
Remote Services: Windows Remote Management |
Clipboard Data |
Data Compressed CONTRIBUTE A TEST |
Standard Cryptographic Protocol CONTRIBUTE A TEST |
Service Exhaustion Flood CONTRIBUTE A TEST |
| Valid Accounts CONTRIBUTE A TEST |
Launchctl CONTRIBUTE A TEST |
Component Firmware CONTRIBUTE A TEST |
SID-History Injection CONTRIBUTE A TEST |
Direct Volume Access |
Forge Web Credentials: SAML token |
Network Share Discovery |
Remote Services: Distributed Component Object Model |
Data from Cloud Storage Object |
Exfiltration Over Web Service: Exfiltration to Text Storage Sites |
Protocol Tunneling |
Defacement CONTRIBUTE A TEST |
| Spearphishing Voice CONTRIBUTE A TEST |
Cloud API CONTRIBUTE A TEST |
LC_LOAD_DYLIB Addition CONTRIBUTE A TEST |
Boot or Logon Autostart Execution |
Email Hiding Rules CONTRIBUTE A TEST |
Securityd Memory CONTRIBUTE A TEST |
Peripheral Device Discovery |
Component Object Model and Distributed COM CONTRIBUTE A TEST |
Remote Data Staging CONTRIBUTE A TEST |
Exfiltration Over Web Service: Exfiltration to Cloud Storage |
Domain Generation Algorithms CONTRIBUTE A TEST |
Financial Theft CONTRIBUTE A TEST |
| Compromise Software Supply Chain CONTRIBUTE A TEST |
Deploy a container |
Kubernetes Cronjob |
Port Monitors CONTRIBUTE A TEST |
Rootkit |
Credentials in Registry CONTRIBUTE A TEST |
System Information Discovery |
Use Alternate Authentication Material: Pass the Ticket |
Data from Local System |
Data Transfer Size Limits |
Mail Protocols CONTRIBUTE A TEST |
Defacement: Internal Defacement |
| Domain Accounts CONTRIBUTE A TEST |
AppleScript CONTRIBUTE A TEST |
System Firmware CONTRIBUTE A TEST |
Sudo Caching CONTRIBUTE A TEST |
Component Firmware CONTRIBUTE A TEST |
OS Credential Dumping: Proc Filesystem |
Wi-Fi Discovery CONTRIBUTE A TEST |
Shared Webroot CONTRIBUTE A TEST |
Archive Collected Data: Archive via Library |
Transfer Data to Cloud Account CONTRIBUTE A TEST |
Communication Through Removable Media CONTRIBUTE A TEST |
Data Manipulation CONTRIBUTE A TEST |
| Spearphishing via Service CONTRIBUTE A TEST |
Rundll32 CONTRIBUTE A TEST |
Hijack Execution Flow: Services Registry Permissions Weakness |
Active Setup |
Double File Extension CONTRIBUTE A TEST |
Password Managers CONTRIBUTE A TEST |
Application Window Discovery |
Cloud Services CONTRIBUTE A TEST |
Network Device Configuration Dump CONTRIBUTE A TEST |
Data Encrypted CONTRIBUTE A TEST |
External Proxy CONTRIBUTE A TEST |
Account Access Removal |
| Hardware Additions CONTRIBUTE A TEST |
At (Linux) CONTRIBUTE A TEST |
Rc.common CONTRIBUTE A TEST |
Domain Trust Modification |
Abuse Elevation Control Mechanism: Bypass User Account Control |
Network Sniffing |
Email Account CONTRIBUTE A TEST |
Software Deployment Tools |
Archive Collected Data |
Exfiltration Over Physical Medium CONTRIBUTE A TEST |
Proxy CONTRIBUTE A TEST |
Data Encrypted for Impact |
| Drive-by Compromise CONTRIBUTE A TEST |
Regsvr32 CONTRIBUTE A TEST |
Bootkit CONTRIBUTE A TEST |
Create or Modify System Process: Windows Service |
Timestomp CONTRIBUTE A TEST |
Unsecured Credentials: Credentials in Registry |
Time Based Evasion CONTRIBUTE A TEST |
Exploitation of Remote Services CONTRIBUTE A TEST |
Browser Session Hijacking CONTRIBUTE A TEST |
Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
Dynamic Resolution CONTRIBUTE A TEST |
Disk Content Wipe CONTRIBUTE A TEST |
| Valid Accounts: Cloud Accounts |
LSASS Driver CONTRIBUTE A TEST |
Boot or Logon Autostart Execution |
Scheduled Task/Job: Cron |
Abuse Elevation Control Mechanism: Sudo and Sudo Caching |
Modify Authentication Process: Password Filter DLL |
Cloud Infrastructure Discovery |
Internal Spearphishing CONTRIBUTE A TEST |
DHCP Spoofing CONTRIBUTE A TEST |
|
Multi-hop Proxy CONTRIBUTE A TEST |
Endpoint Denial of Service CONTRIBUTE A TEST |
| Spearphishing via Service CONTRIBUTE A TEST |
Command and Scripting Interpreter CONTRIBUTE A TEST |
Port Monitors CONTRIBUTE A TEST |
Startup Items CONTRIBUTE A TEST |
Modify Cloud Compute Infrastructure CONTRIBUTE A TEST |
Steal or Forge Kerberos Tickets: AS-REP Roasting |
Browser Bookmark Discovery |
Pass the Ticket CONTRIBUTE A TEST |
Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay |
|
Web Service CONTRIBUTE A TEST |
Runtime Data Manipulation CONTRIBUTE A TEST |
| Valid Accounts: Local Accounts |
Component Object Model and Distributed COM CONTRIBUTE A TEST |
Active Setup |
Account Manipulation: Additional Cloud Roles |
System Firmware CONTRIBUTE A TEST |
Steal or Forge Kerberos Tickets CONTRIBUTE A TEST |
System Network Configuration Discovery |
Lateral Tool Transfer |
Web Portal Capture CONTRIBUTE A TEST |
|
DNS Calculation CONTRIBUTE A TEST |
Transmitted Data Manipulation CONTRIBUTE A TEST |
|
Kubernetes Exec Into Container |
Screensaver CONTRIBUTE A TEST |
Boot or Logon Autostart Execution: Print Processors |
Hijack Execution Flow: Services Registry Permissions Weakness |
Credentials from Password Stores |
Account Discovery CONTRIBUTE A TEST |
SSH Hijacking CONTRIBUTE A TEST |
Video Capture |
|
Multi-Stage Channels CONTRIBUTE A TEST |
Resource Hijacking |
|
CMSTP CONTRIBUTE A TEST |
TFTP Boot CONTRIBUTE A TEST |
Hijack Execution Flow: DLL Search Order Hijacking |
Bootkit CONTRIBUTE A TEST |
Unsecured Credentials |
Domain Trust Discovery |
Pass the Hash CONTRIBUTE A TEST |
Confluence CONTRIBUTE A TEST |
|
Port Knocking CONTRIBUTE A TEST |
Transmitted Data Manipulation CONTRIBUTE A TEST |
|
Scripting CONTRIBUTE A TEST |
Create or Modify System Process: Windows Service |
AppInit DLLs CONTRIBUTE A TEST |
Code Signing CONTRIBUTE A TEST |
Bash History CONTRIBUTE A TEST |
File and Directory Discovery |
Windows Remote Management CONTRIBUTE A TEST |
Email Collection: Email Forwarding Rule |
|
Multiband Communication CONTRIBUTE A TEST |
Data Destruction |
|
System Services: Launchctl |
Scheduled Task/Job: Cron |
Additional Container Cluster Roles CONTRIBUTE A TEST |
Mavinject CONTRIBUTE A TEST |
Credentials from Web Browsers CONTRIBUTE A TEST |
System Network Connections Discovery |
Web Session Cookie CONTRIBUTE A TEST |
Data Staged CONTRIBUTE A TEST |
|
File Transfer Protocols CONTRIBUTE A TEST |
Network Denial of Service CONTRIBUTE A TEST |
|
Network Device CLI CONTRIBUTE A TEST |
Startup Items CONTRIBUTE A TEST |
Scheduled Task/Job CONTRIBUTE A TEST |
Process Hollowing CONTRIBUTE A TEST |
Hybrid Identity CONTRIBUTE A TEST |
Virtualization/Sandbox Evasion CONTRIBUTE A TEST |
Web Session Cookie CONTRIBUTE A TEST |
Input Capture: GUI Input Capture |
|
One-Way Communication CONTRIBUTE A TEST |
Firmware Corruption CONTRIBUTE A TEST |
|
XPC Services CONTRIBUTE A TEST |
Office Application Startup |
Service Registry Permissions Weakness CONTRIBUTE A TEST |
Masquerading: Match Legitimate Name or Location |
Private Keys CONTRIBUTE A TEST |
Cloud Storage Object Discovery |
Remote Service Session Hijacking: RDP Hijacking |
Data from Network Shared Drive |
|
Proxy: Multi-hop Proxy |
Inhibit System Recovery |
|
User Execution CONTRIBUTE A TEST |
Account Manipulation: Additional Cloud Roles |
Thread Execution Hijacking |
Weaken Encryption CONTRIBUTE A TEST |
Credentials from Password Stores: Credentials from Web Browsers |
Log Enumeration |
Use Alternate Authentication Material: Pass the Hash |
Remote Email Collection CONTRIBUTE A TEST |
|
Data Obfuscation CONTRIBUTE A TEST |
Disk Content Wipe CONTRIBUTE A TEST |
|
Control Panel Items CONTRIBUTE A TEST |
Boot or Logon Autostart Execution: Print Processors |
Event Triggered Execution: Application Shimming |
Masquerade File Type CONTRIBUTE A TEST |
DHCP Spoofing CONTRIBUTE A TEST |
Cloud Account CONTRIBUTE A TEST |
Remote Services: Remote Desktop Protocol |
Input Capture CONTRIBUTE A TEST |
|
Non-Standard Port |
System Shutdown/Reboot |
|
Launchd CONTRIBUTE A TEST |
Hijack Execution Flow: DLL Search Order Hijacking |
Boot or Logon Autostart Execution: Port Monitors |
Regsvcs/Regasm CONTRIBUTE A TEST |
Unsecured Credentials: Private Keys |
Process Discovery |
Application Access Token CONTRIBUTE A TEST |
ARP Cache Poisoning CONTRIBUTE A TEST |
|
Encrypted Channel |
|
|
Software Deployment Tools |
AppInit DLLs CONTRIBUTE A TEST |
Boot or Logon Initialization Scripts: Logon Script (Mac) |
Hide Artifacts |
Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay |
User Activity Based Checks CONTRIBUTE A TEST |
Windows Admin Shares CONTRIBUTE A TEST |
Code Repositories CONTRIBUTE A TEST |
|
Bidirectional Communication CONTRIBUTE A TEST |
|
|
Command and Scripting Interpreter: PowerShell |
Office Application Startup: Add-ins |
Process Injection |
Domain Trust Modification |
OS Credential Dumping: LSASS Memory |
Permission Groups Discovery: Local Groups |
|
Data from Information Repositories CONTRIBUTE A TEST |
|
Asymmetric Cryptography CONTRIBUTE A TEST |
|
|
Mshta CONTRIBUTE A TEST |
Server Software Component: Transport Agent |
DLL Search Order Hijacking CONTRIBUTE A TEST |
Application Access Token CONTRIBUTE A TEST |
Hooking CONTRIBUTE A TEST |
Password Policy Discovery |
|
SNMP (MIB Dump) CONTRIBUTE A TEST |
|
Non-Application Layer Protocol |
|
|
Scheduled Task/Job: Systemd Timers |
Additional Container Cluster Roles CONTRIBUTE A TEST |
New Service CONTRIBUTE A TEST |
Impair Defenses: Safe Boot Mode |
Brute Force: Password Spraying |
System Location Discovery: System Language Discovery |
|
Input Capture: Credential API Hooking |
|
Protocol Impersonation CONTRIBUTE A TEST |
|
|
Graphical User Interface CONTRIBUTE A TEST |
Scheduled Task/Job CONTRIBUTE A TEST |
Escape to Host |
TFTP Boot CONTRIBUTE A TEST |
Web Portal Capture CONTRIBUTE A TEST |
Query Registry |
|
|
|
Uncommonly Used Port CONTRIBUTE A TEST |
|
|
Command and Scripting Interpreter: Bash |
Login Item CONTRIBUTE A TEST |
Boot or Logon Autostart Execution: Shortcut Modification |
Virtualization/Sandbox Evasion: System Checks |
OS Credential Dumping: Cached Domain Credentials |
System Location Discovery CONTRIBUTE A TEST |
|
|
|
Domain Fronting CONTRIBUTE A TEST |
|
|
Inter-Process Communication |
Modify Authentication Process: Password Filter DLL |
AppCert DLLs CONTRIBUTE A TEST |
Indicator Removal on Host: Clear FreeBSD, Linux or Mac System Logs |
Steal or Forge Kerberos Tickets: Golden Ticket |
Software Discovery: Security Software Discovery |
|
|
|
Data Encoding CONTRIBUTE A TEST |
|
|
User Execution: Malicious Image |
Server Software Component: Terminal Services DLL |
Boot or Logon Autostart Execution: Security Support Provider |
Signed Binary Proxy Execution: InstallUtil |
Steal or Forge Authentication Certificates |
Cloud Service Discovery |
|
|
|
Non-Standard Encoding CONTRIBUTE A TEST |
|
|
Trap CONTRIBUTE A TEST |
Browser Extensions |
Extra Window Memory Injection CONTRIBUTE A TEST |
Disabling Security Tools CONTRIBUTE A TEST |
Unsecured Credentials: Bash History |
Remote System Discovery |
|
|
|
Application Layer Protocol: Web Protocols |
|
|
Exploitation for Client Execution CONTRIBUTE A TEST |
Service Registry Permissions Weakness CONTRIBUTE A TEST |
Create or Modify System Process: Launch Daemon |
Stripped Payloads CONTRIBUTE A TEST |
Unsecured Credentials: Credentials In Files |
Network Service Discovery |
|
|
|
Ingress Tool Transfer |
|
|
Local Job Scheduling CONTRIBUTE A TEST |
Outlook Rules CONTRIBUTE A TEST |
Hijack Execution Flow: Path Interception by Search Order Hijacking |
Hijack Execution Flow: DLL Search Order Hijacking |
Web Cookies CONTRIBUTE A TEST |
Software Discovery |
|
|
|
Steganography CONTRIBUTE A TEST |
|
|
Windows Remote Management CONTRIBUTE A TEST |
Event Triggered Execution: Application Shimming |
Domain Policy Modification: Group Policy Modification |
Subvert Trust Controls: Gatekeeper Bypass |
Steal Application Access Token |
Cloud Service Dashboard CONTRIBUTE A TEST |
|
|
|
Fallback Channels CONTRIBUTE A TEST |
|
|
Command and Scripting Interpreter: Python |
Boot or Logon Autostart Execution: Port Monitors |
Valid Accounts: Default Accounts |
Code Signing CONTRIBUTE A TEST |
Unsecured Credentials: Group Policy Preferences |
Debugger Evasion CONTRIBUTE A TEST |
|
|
|
Proxy: Internal Proxy |
|
|
System Services CONTRIBUTE A TEST |
Boot or Logon Initialization Scripts: Logon Script (Mac) |
Time Providers |
Break Process Trees CONTRIBUTE A TEST |
Network Provider DLL CONTRIBUTE A TEST |
System Time Discovery |
|
|
|
Custom Command and Control Protocol CONTRIBUTE A TEST |
|
|
Command and Scripting Interpreter: Windows Command Shell |
Traffic Signaling CONTRIBUTE A TEST |
Image File Execution Options Injection CONTRIBUTE A TEST |
File and Directory Permissions Modification: Windows File and Directory Permissions Modification |
Input Prompt CONTRIBUTE A TEST |
|
|
|
|
Dead Drop Resolver CONTRIBUTE A TEST |
|
|
Compiled HTML File CONTRIBUTE A TEST |
DLL Search Order Hijacking CONTRIBUTE A TEST |
Event Triggered Execution: Trap |
Signed Binary Proxy Execution: Msiexec |
Forge Web Credentials CONTRIBUTE A TEST |
|
|
|
|
Junk Data CONTRIBUTE A TEST |
|
|
Cloud Administration Command CONTRIBUTE A TEST |
New Service CONTRIBUTE A TEST |
Hijack Execution Flow: LD_PRELOAD |
Modify Authentication Process: Password Filter DLL |
Multi-Factor Authentication Request Generation CONTRIBUTE A TEST |
|
|
|
|
Commonly Used Port CONTRIBUTE A TEST |
|
|
Command and Scripting Interpreter: Visual Basic |
Boot or Logon Autostart Execution: Shortcut Modification |
At (Linux) CONTRIBUTE A TEST |
Clear Network Connection History and Configurations CONTRIBUTE A TEST |
Chat Messages CONTRIBUTE A TEST |
|
|
|
|
|
|
|
Space after Filename CONTRIBUTE A TEST |
Hypervisor CONTRIBUTE A TEST |
Hooking CONTRIBUTE A TEST |
Reduce Key Space CONTRIBUTE A TEST |
Exploitation for Credential Access CONTRIBUTE A TEST |
|
|
|
|
|
|
|
Serverless Execution CONTRIBUTE A TEST |
AppCert DLLs CONTRIBUTE A TEST |
Plist Modification CONTRIBUTE A TEST |
Indicator Removal on Host: Clear Command History |
Keychain CONTRIBUTE A TEST |
|
|
|
|
|
|
|
Dynamic Data Exchange CONTRIBUTE A TEST |
Implant Internal Image CONTRIBUTE A TEST |
Abuse Elevation Control Mechanism CONTRIBUTE A TEST |
Indirect Command Execution |
Input Capture: GUI Input Capture |
|
|
|
|
|
|
|
Malicious Link CONTRIBUTE A TEST |
Boot or Logon Autostart Execution: Security Support Provider |
Create Process with Token |
Revert Cloud Instance CONTRIBUTE A TEST |
Brute Force CONTRIBUTE A TEST |
|
|
|
|
|
|
|
System Services: Service Execution |
Winlogon Helper DLL CONTRIBUTE A TEST |
Abuse Elevation Control Mechanism: Setuid and Setgid |
Deobfuscate/Decode Files or Information |
Brute Force: Credential Stuffing |
|
|
|
|
|
|
|
Scheduled Task/Job: At |
Authentication Package CONTRIBUTE A TEST |
Boot or Logon Autostart Execution: Winlogon Helper DLL |
Impair Defenses |
Kerberoasting CONTRIBUTE A TEST |
|
|
|
|
|
|
|
Service Execution CONTRIBUTE A TEST |
Launchctl CONTRIBUTE A TEST |
SSH Authorized Keys |
Thread Execution Hijacking |
Multi-Factor Authentication CONTRIBUTE A TEST |
|
|
|
|
|
|
|
PowerShell CONTRIBUTE A TEST |
Hybrid Identity CONTRIBUTE A TEST |
Event Triggered Execution: Image File Execution Options Injection |
Masquerading |
Forced Authentication |
|
|
|
|
|
|
|
InstallUtil CONTRIBUTE A TEST |
Create or Modify System Process: Launch Daemon |
Temporary Elevated Cloud Access CONTRIBUTE A TEST |
Email Collection: Mailbox Manipulation |
Password Filter DLL CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
Hijack Execution Flow: Path Interception by Search Order Hijacking |
Process Doppelgänging CONTRIBUTE A TEST |
Process Injection |
Credentials in Files CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
Server Software Component: Web Shell |
Executable Installer File Permissions Weakness CONTRIBUTE A TEST |
Traffic Signaling CONTRIBUTE A TEST |
Input Capture CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
Valid Accounts: Default Accounts |
Event Triggered Execution: Accessibility Features |
Signed Binary Proxy Execution |
ARP Cache Poisoning CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
Time Providers |
PowerShell Profile CONTRIBUTE A TEST |
DLL Search Order Hijacking CONTRIBUTE A TEST |
Cloud Secrets Management Stores CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
Image File Execution Options Injection CONTRIBUTE A TEST |
Process Injection: Asynchronous Procedure Call |
Indicator Removal on Host: Timestomp |
OS Credential Dumping: /etc/passwd, /etc/master.passwd and /etc/shadow |
|
|
|
|
|
|
|
|
Modify Existing Service CONTRIBUTE A TEST |
Application Shimming CONTRIBUTE A TEST |
Reflective Code Loading |
Steal or Forge Kerberos Tickets: Silver Ticket |
|
|
|
|
|
|
|
|
Event Triggered Execution: Trap |
Event Triggered Execution: AppCert DLLs |
Ignore Process Interrupts CONTRIBUTE A TEST |
Credentials from Password Stores: Windows Credential Manager |
|
|
|
|
|
|
|
|
Hijack Execution Flow: LD_PRELOAD |
Device Registration CONTRIBUTE A TEST |
Time Based Evasion CONTRIBUTE A TEST |
Domain Controller Authentication CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
Create Account: Local Account |
Process Injection: Portable Executable Injection |
Signed Binary Proxy Execution: CMSTP |
Reversible Encryption CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
At (Linux) CONTRIBUTE A TEST |
Boot or Logon Autostart Execution: Login Items |
Impair Defenses: Disable Windows Event Logging |
Multi-Factor Authentication Interception CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
Hooking CONTRIBUTE A TEST |
Access Token Manipulation: Token Impersonation/Theft |
Signed Binary Proxy Execution: Control Panel |
OS Credential Dumping: NTDS |
|
|
|
|
|
|
|
|
Plist Modification CONTRIBUTE A TEST |
Account Manipulation: Additional Cloud Credentials |
Network Address Translation Traversal CONTRIBUTE A TEST |
Steal or Forge Kerberos Tickets: Kerberoasting |
|
|
|
|
|
|
|
|
Boot or Logon Autostart Execution: Winlogon Helper DLL |
Make and Impersonate Token CONTRIBUTE A TEST |
Binary Padding CONTRIBUTE A TEST |
OS Credential Dumping: DCSync |
|
|
|
|
|
|
|
|
System Firmware CONTRIBUTE A TEST |
Launchd CONTRIBUTE A TEST |
Use Alternate Authentication Material CONTRIBUTE A TEST |
Modify Authentication Process CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
Change Default File Association CONTRIBUTE A TEST |
Event Triggered Execution: Windows Management Instrumentation Event Subscription |
Extra Window Memory Injection CONTRIBUTE A TEST |
Input Capture: Credential API Hooking |
|
|
|
|
|
|
|
|
Re-opened Applications CONTRIBUTE A TEST |
Access Token Manipulation: Parent PID Spoofing |
Impair Defenses: Disable or Modify System Firewall |
Kubernetes List Secrets |
|
|
|
|
|
|
|
|
Redundant Access CONTRIBUTE A TEST |
Event Triggered Execution: Change Default File Association |
Launchctl CONTRIBUTE A TEST |
Network Device Authentication CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
SSH Authorized Keys |
VDSO Hijacking CONTRIBUTE A TEST |
Subvert Trust Controls: SIP and Trust Provider Hijacking |
|
|
|
|
|
|
|
|
|
Kernel Modules and Extensions CONTRIBUTE A TEST |
Accessibility Features CONTRIBUTE A TEST |
Hybrid Identity CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Security Support Provider CONTRIBUTE A TEST |
Event Triggered Execution: Emond |
Disable or Modify Linux Audit System CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Event Triggered Execution: Image File Execution Options Injection |
Parent PID Spoofing CONTRIBUTE A TEST |
Rogue Domain Controller |
|
|
|
|
|
|
|
|
|
LSASS Driver CONTRIBUTE A TEST |
Sudo CONTRIBUTE A TEST |
Code Signing Policy Modification CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Executable Installer File Permissions Weakness CONTRIBUTE A TEST |
Services File Permissions Weakness CONTRIBUTE A TEST |
Deploy a container |
|
|
|
|
|
|
|
|
|
Event Triggered Execution: Accessibility Features |
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
File Deletion CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
PowerShell Profile CONTRIBUTE A TEST |
Account Manipulation |
Modify Registry |
|
|
|
|
|
|
|
|
|
SIP and Trust Provider Hijacking CONTRIBUTE A TEST |
Boot or Logon Autostart Execution: Kernel Modules and Extensions |
Hijack Execution Flow: Path Interception by Search Order Hijacking |
|
|
|
|
|
|
|
|
|
Create Account: Domain Account |
KernelCallbackTable CONTRIBUTE A TEST |
Unused/Unsupported Cloud Regions CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Component Firmware CONTRIBUTE A TEST |
Scheduled Task/Job: Systemd Timers |
Obfuscated Files or Information: Binary Padding |
|
|
|
|
|
|
|
|
|
Office Template Macros CONTRIBUTE A TEST |
Dylib Hijacking CONTRIBUTE A TEST |
Domain Policy Modification: Group Policy Modification |
|
|
|
|
|
|
|
|
|
Application Shimming CONTRIBUTE A TEST |
Hijack Execution Flow CONTRIBUTE A TEST |
Valid Accounts: Default Accounts |
|
|
|
|
|
|
|
|
|
Event Triggered Execution: AppCert DLLs |
Valid Accounts CONTRIBUTE A TEST |
Image File Execution Options Injection CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Device Registration CONTRIBUTE A TEST |
Process Injection: Process Hollowing |
Rundll32 CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Pre-OS Boot CONTRIBUTE A TEST |
Exploitation for Privilege Escalation CONTRIBUTE A TEST |
Hijack Execution Flow: LD_PRELOAD |
|
|
|
|
|
|
|
|
|
Boot or Logon Autostart Execution: Login Items |
Event Triggered Execution |
Indicator Removal on Host: Clear Windows Event Logs |
|
|
|
|
|
|
|
|
|
Port Knocking CONTRIBUTE A TEST |
Event Triggered Execution: .bash_profile .bashrc and .shrc |
File and Directory Permissions Modification CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Account Manipulation: Additional Cloud Credentials |
Access Token Manipulation: SID-History Injection |
Abuse Elevation Control Mechanism CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Launchd CONTRIBUTE A TEST |
Elevated Execution with Prompt CONTRIBUTE A TEST |
Create Process with Token |
|
|
|
|
|
|
|
|
|
Network Provider DLL CONTRIBUTE A TEST |
Authentication Package |
Abuse Elevation Control Mechanism: Setuid and Setgid |
|
|
|
|
|
|
|
|
|
Event Triggered Execution: Windows Management Instrumentation Event Subscription |
Event Triggered Execution: Component Object Model Hijacking |
Regsvr32 CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Registry Run Keys / Startup Folder CONTRIBUTE A TEST |
Hijack Execution Flow: Path Interception by Unquoted Path |
Indicator Blocking CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Compromise Client Software Binary CONTRIBUTE A TEST |
Setuid and Setgid CONTRIBUTE A TEST |
Redundant Access CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Shortcut Modification CONTRIBUTE A TEST |
Boot or Logon Initialization Scripts: Startup Items |
Signed Binary Proxy Execution: Odbcconf |
|
|
|
|
|
|
|
|
|
Event Triggered Execution: Change Default File Association |
Web Shell CONTRIBUTE A TEST |
Temporary Elevated Cloud Access CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Component Object Model Hijacking CONTRIBUTE A TEST |
Domain Accounts CONTRIBUTE A TEST |
Gatekeeper Bypass CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Accessibility Features CONTRIBUTE A TEST |
Path Interception CONTRIBUTE A TEST |
Software Packing CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Event Triggered Execution: Emond |
Network Logon Script CONTRIBUTE A TEST |
Process Doppelgänging CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Services File Permissions Weakness CONTRIBUTE A TEST |
Bypass User Account Control CONTRIBUTE A TEST |
Delete Cloud Instance CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
Event Triggered Execution: AppInit DLLs |
Executable Installer File Permissions Weakness CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Create Account: Cloud Account |
Event Triggered Execution: Screensaver |
SIP and Trust Provider Hijacking CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Account Manipulation |
Create or Modify System Process: Launch Agent |
Impair Defenses: Indicator Blocking |
|
|
|
|
|
|
|
|
|
Boot or Logon Autostart Execution: Kernel Modules and Extensions |
Proc Memory CONTRIBUTE A TEST |
Disable or Modify Cloud Firewall CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
KernelCallbackTable CONTRIBUTE A TEST |
Emond CONTRIBUTE A TEST |
Right-to-Left Override CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Scheduled Task/Job: Systemd Timers |
Installer Packages CONTRIBUTE A TEST |
Component Firmware CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
ROMMONkit CONTRIBUTE A TEST |
Boot or Logon Initialization Scripts: Rc.common |
Indicator Removal on Host |
|
|
|
|
|
|
|
|
|
Outlook Forms CONTRIBUTE A TEST |
Access Token Manipulation CONTRIBUTE A TEST |
Use Alternate Authentication Material: Pass the Ticket |
|
|
|
|
|
|
|
|
|
Dylib Hijacking CONTRIBUTE A TEST |
Create or Modify System Process: SysV/Systemd Service |
Masquerading: Masquerade Task or Service |
|
|
|
|
|
|
|
|
|
Hijack Execution Flow CONTRIBUTE A TEST |
XDG Autostart Entries CONTRIBUTE A TEST |
Process Injection: Asynchronous Procedure Call |
|
|
|
|
|
|
|
|
|
Valid Accounts CONTRIBUTE A TEST |
Thread Local Storage CONTRIBUTE A TEST |
Plist File Modification |
|
|
|
|
|
|
|
|
|
Multi-Factor Authentication CONTRIBUTE A TEST |
Boot or Logon Autostart Execution: Re-opened Applications |
CMSTP CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
IIS Components |
Hijack Execution Flow: DLL Side-Loading |
Subvert Trust Controls: Mark-of-the-Web Bypass |
|
|
|
|
|
|
|
|
|
Trap CONTRIBUTE A TEST |
Account Manipulation: Additional Email Delegate Permissions |
Disable Crypto Hardware CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Event Triggered Execution |
Launch Daemon CONTRIBUTE A TEST |
Pre-OS Boot CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Event Triggered Execution: .bash_profile .bashrc and .shrc |
Ptrace System Calls CONTRIBUTE A TEST |
Scripting CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Authentication Package |
Boot or Logon Initialization Scripts: Logon Script (Windows) |
Build Image on Host |
|
|
|
|
|
|
|
|
|
Netsh Helper DLL CONTRIBUTE A TEST |
ListPlanting CONTRIBUTE A TEST |
Process Injection: Portable Executable Injection |
|
|
|
|
|
|
|
|
|
Event Triggered Execution: Component Object Model Hijacking |
Domain Policy Modification CONTRIBUTE A TEST |
Verclsid CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Office Application Startup: Outlook Home Page |
Boot or Logon Autostart Execution: LSASS Driver |
Downgrade Attack CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Hijack Execution Flow: Path Interception by Unquoted Path |
Valid Accounts: Cloud Accounts |
Virtualization/Sandbox Evasion CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Local Job Scheduling CONTRIBUTE A TEST |
Scheduled Task/Job: At |
Signed Binary Proxy Execution: Mshta |
|
|
|
|
|
|
|
|
|
Setuid and Setgid CONTRIBUTE A TEST |
Process Injection: Dynamic-link Library Injection |
Execution Guardrails CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Boot or Logon Initialization Scripts: Startup Items |
Event Triggered Execution: Netsh Helper DLL |
Access Token Manipulation: Token Impersonation/Theft |
|
|
|
|
|
|
|
|
|
Web Shell CONTRIBUTE A TEST |
Dylib Hijacking CONTRIBUTE A TEST |
Port Knocking CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Domain Accounts CONTRIBUTE A TEST |
Valid Accounts: Local Accounts |
LNK Icon Smuggling CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Path Interception CONTRIBUTE A TEST |
Hijack Execution Flow: COR_PROFILER |
Hide Artifacts: Hidden Users |
|
|
|
|
|
|
|
|
|
Network Logon Script CONTRIBUTE A TEST |
|
Make and Impersonate Token CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
BITS Jobs |
|
Control Panel Items CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Event Triggered Execution: AppInit DLLs |
|
Impair Defenses: HISTCONTROL |
|
|
|
|
|
|
|
|
|
Event Triggered Execution: Screensaver |
|
Network Provider DLL CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Create or Modify System Process: Launch Agent |
|
User Activity Based Checks CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Emond CONTRIBUTE A TEST |
|
Access Token Manipulation: Parent PID Spoofing |
|
|
|
|
|
|
|
|
|
Server Software Component CONTRIBUTE A TEST |
|
VDSO Hijacking CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Domain Controller Authentication CONTRIBUTE A TEST |
|
Component Object Model Hijacking CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Reversible Encryption CONTRIBUTE A TEST |
|
Parent PID Spoofing CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Installer Packages CONTRIBUTE A TEST |
|
Services File Permissions Weakness CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Hidden Files and Directories CONTRIBUTE A TEST |
|
LC_MAIN Hijacking CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Boot or Logon Initialization Scripts: Rc.common |
|
Mshta CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Time Providers CONTRIBUTE A TEST |
|
KernelCallbackTable CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Launch Agent CONTRIBUTE A TEST |
|
ROMMONkit CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Create or Modify System Process: SysV/Systemd Service |
|
Signed Binary Proxy Execution: Compiled HTML File |
|
|
|
|
|
|
|
|
|
Create Account CONTRIBUTE A TEST |
|
Indicator Removal on Host: Network Share Connection Removal |
|
|
|
|
|
|
|
|
|
XDG Autostart Entries CONTRIBUTE A TEST |
|
Impair Defenses: Disable or Modify Tools |
|
|
|
|
|
|
|
|
|
Boot or Logon Autostart Execution: Re-opened Applications |
|
Modify System Image CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Hijack Execution Flow: DLL Side-Loading |
|
Hijack Execution Flow CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Account Manipulation: Additional Email Delegate Permissions |
|
Indicator Removal from Tools CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Windows Management Instrumentation Event Subscription CONTRIBUTE A TEST |
|
Valid Accounts CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Launch Daemon CONTRIBUTE A TEST |
|
DLL Side-Loading CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Power Settings CONTRIBUTE A TEST |
|
Process Injection: Process Hollowing |
|
|
|
|
|
|
|
|
|
Boot or Logon Initialization Scripts: Logon Script (Windows) |
|
Resource Forking CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Office Application Startup: Office Test |
|
Obfuscated Files or Information |
|
|
|
|
|
|
|
|
|
Boot or Logon Autostart Execution: LSASS Driver |
|
Multi-Factor Authentication CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Valid Accounts: Cloud Accounts |
|
Invalid Code Signature CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Scheduled Task/Job: At |
|
Run Virtual Instance |
|
|
|
|
|
|
|
|
|
Modify Authentication Process CONTRIBUTE A TEST |
|
Access Token Manipulation: SID-History Injection |
|
|
|
|
|
|
|
|
|
Event Triggered Execution: Netsh Helper DLL |
|
Network Boundary Bridging CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
SQL Stored Procedures CONTRIBUTE A TEST |
|
Subvert Trust Controls CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Network Device Authentication CONTRIBUTE A TEST |
|
Elevated Execution with Prompt CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Dylib Hijacking CONTRIBUTE A TEST |
|
Signed Binary Proxy Execution: Regsvr32 |
|
|
|
|
|
|
|
|
|
Valid Accounts: Local Accounts |
|
Masquerading: Rename System Utilities |
|
|
|
|
|
|
|
|
|
Hijack Execution Flow: COR_PROFILER |
|
Spoof Security Alerting CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Hijack Execution Flow: Path Interception by Unquoted Path |
|
|
|
|
|
|
|
|
|
|
|
Process Doppelgänging CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Steganography CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Web Session Cookie CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Domain Accounts CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Signed Binary Proxy Execution: Regsvcs/Regasm |
|
|
|
|
|
|
|
|
|
|
|
Web Session Cookie CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Subvert Trust Controls: Install Root Certificate |
|
|
|
|
|
|
|
|
|
|
|
Obfuscated Files or Information: Compile After Delivery |
|
|
|
|
|
|
|
|
|
|
|
VBA Stomping CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
BITS Jobs |
|
|
|
|
|
|
|
|
|
|
|
Trusted Developer Utilities Proxy Execution: MSBuild |
|
|
|
|
|
|
|
|
|
|
|
Impersonation CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Modify Cloud Compute Configurations CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Bypass User Account Control CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Impair Defenses: Disable Cloud Logs |
|
|
|
|
|
|
|
|
|
|
|
Hide Artifacts: Hidden Window |
|
|
|
|
|
|
|
|
|
|
|
Hidden Users CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Create Cloud Instance CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Compile After Delivery CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Proc Memory CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Compiled HTML File CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Patch System Image CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Clear Persistence CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Clear Command History CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Domain Controller Authentication CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
HTML Smuggling |
|
|
|
|
|
|
|
|
|
|
|
Reversible Encryption CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Command Obfuscation CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Install Root Certificate CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Indicator Removal on Host: File Deletion |
|
|
|
|
|
|
|
|
|
|
|
Hidden Files and Directories CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Template Injection |
|
|
|
|
|
|
|
|
|
|
|
Access Token Manipulation CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Obfuscated Files or Information: Software Packing |
|
|
|
|
|
|
|
|
|
|
|
Hidden File System CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Space after Filename CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Thread Local Storage CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Debugger Evasion CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Masquerading: Space after Filename |
|
|
|
|
|
|
|
|
|
|
|
Use Alternate Authentication Material: Pass the Hash |
|
|
|
|
|
|
|
|
|
|
|
Hijack Execution Flow: DLL Side-Loading |
|
|
|
|
|
|
|
|
|
|
|
Network Share Connection Removal CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Ptrace System Calls CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Dynamic API Resolution CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
ListPlanting CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Domain Policy Modification CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
XSL Script Processing |
|
|
|
|
|
|
|
|
|
|
|
Hide Artifacts: Hidden Files and Directories |
|
|
|
|
|
|
|
|
|
|
|
Create Snapshot CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Application Access Token CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Valid Accounts: Cloud Accounts |
|
|
|
|
|
|
|
|
|
|
|
Environmental Keying CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Hide Artifacts: NTFS File Attributes |
|
|
|
|
|
|
|
|
|
|
|
NTFS File Attributes CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Process Injection: Dynamic-link Library Injection |
|
|
|
|
|
|
|
|
|
|
|
Modify Authentication Process CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Signed Script Proxy Execution |
|
|
|
|
|
|
|
|
|
|
|
InstallUtil CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Network Device Authentication CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Dylib Hijacking CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Downgrade System Image CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Valid Accounts: Local Accounts |
|
|
|
|
|
|
|
|
|
|
|
Exploitation for Defense Evasion CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Trusted Developer Utilities Proxy Execution |
|
|
|
|
|
|
|
|
|
|
|
MMC CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Process Argument Spoofing CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Hijack Execution Flow: COR_PROFILER |
|
|
|
|
|
|
|
Atomic Red Team doc generator