atomic-red-team/atomics/Indexes/Matrices/matrix.md

All Atomic Tests by ATT&CK Tactic & Technique

initial-access	execution	persistence	privilege-escalation	defense-evasion	credential-access	discovery	lateral-movement	collection	exfiltration	command-and-control	impact
Cloud Accounts	AppleScript	Accessibility Features	Abuse Elevation Control Mechanism CONTRIBUTE A TEST	Abuse Elevation Control Mechanism CONTRIBUTE A TEST	/etc/passwd and /etc/shadow	Account Discovery CONTRIBUTE A TEST	Application Access Token CONTRIBUTE A TEST	ARP Cache Poisoning CONTRIBUTE A TEST	Automated Exfiltration	Application Layer Protocol CONTRIBUTE A TEST	Account Access Removal
Compromise Hardware Supply Chain CONTRIBUTE A TEST	At (Linux)	Account Manipulation	Access Token Manipulation CONTRIBUTE A TEST	Access Token Manipulation CONTRIBUTE A TEST	ARP Cache Poisoning CONTRIBUTE A TEST	Application Window Discovery	Component Object Model and Distributed COM CONTRIBUTE A TEST	Archive Collected Data	Data Transfer Size Limits	Asymmetric Cryptography CONTRIBUTE A TEST	Application Exhaustion Flood CONTRIBUTE A TEST
Compromise Software Dependencies and Development Tools CONTRIBUTE A TEST	At (Windows)	Active Setup CONTRIBUTE A TEST	Accessibility Features	Application Access Token CONTRIBUTE A TEST	AS-REP Roasting	Browser Bookmark Discovery	Distributed Component Object Model	Archive via Custom Method CONTRIBUTE A TEST	Exfiltration Over Alternative Protocol	Bidirectional Communication CONTRIBUTE A TEST	Application or System Exploitation CONTRIBUTE A TEST
Compromise Software Supply Chain CONTRIBUTE A TEST	Command and Scripting Interpreter CONTRIBUTE A TEST	Add Office 365 Global Administrator Role CONTRIBUTE A TEST	Active Setup CONTRIBUTE A TEST	Asynchronous Procedure Call	Bash History	Cloud Account CONTRIBUTE A TEST	Exploitation of Remote Services CONTRIBUTE A TEST	Archive via Library	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Commonly Used Port CONTRIBUTE A TEST	Data Destruction
Default Accounts	Component Object Model CONTRIBUTE A TEST	Add-ins	AppCert DLLs CONTRIBUTE A TEST	BITS Jobs	Brute Force CONTRIBUTE A TEST	Cloud Groups CONTRIBUTE A TEST	Internal Spearphishing CONTRIBUTE A TEST	Archive via Utility	Exfiltration Over Bluetooth CONTRIBUTE A TEST	Communication Through Removable Media CONTRIBUTE A TEST	Data Encrypted for Impact
Domain Accounts CONTRIBUTE A TEST	Component Object Model and Distributed COM CONTRIBUTE A TEST	Additional Cloud Credentials	AppInit DLLs	Binary Padding	Cached Domain Credentials CONTRIBUTE A TEST	Cloud Infrastructure Discovery CONTRIBUTE A TEST	Lateral Tool Transfer CONTRIBUTE A TEST	Audio Capture	Exfiltration Over C2 Channel	DNS	Data Manipulation CONTRIBUTE A TEST
Drive-by Compromise CONTRIBUTE A TEST	Container Administration Command	AppCert DLLs CONTRIBUTE A TEST	Application Shimming	Bootkit CONTRIBUTE A TEST	Cloud Instance Metadata API CONTRIBUTE A TEST	Cloud Service Dashboard CONTRIBUTE A TEST	Pass the Hash	Automated Collection	Exfiltration Over Other Network Medium CONTRIBUTE A TEST	DNS Calculation CONTRIBUTE A TEST	Defacement CONTRIBUTE A TEST
Exploit Public-Facing Application CONTRIBUTE A TEST	Container Orchestration Job	AppInit DLLs	Asynchronous Procedure Call	Build Image on Host CONTRIBUTE A TEST	Container API	Cloud Service Discovery CONTRIBUTE A TEST	Pass the Ticket	Clipboard Data	Exfiltration Over Physical Medium CONTRIBUTE A TEST	Data Encoding CONTRIBUTE A TEST	Direct Network Flood CONTRIBUTE A TEST
External Remote Services	Cron	Application Shimming	At (Linux)	Bypass User Account Control	Credential API Hooking	Container and Resource Discovery CONTRIBUTE A TEST	RDP Hijacking	Confluence CONTRIBUTE A TEST	Exfiltration Over Symmetric Encrypted Non-C2 Protocol CONTRIBUTE A TEST	Data Obfuscation CONTRIBUTE A TEST	Disk Content Wipe CONTRIBUTE A TEST
Hardware Additions CONTRIBUTE A TEST	Deploy Container CONTRIBUTE A TEST	At (Linux)	At (Windows)	CMSTP	Credential Stuffing	Domain Account	Remote Desktop Protocol	Credential API Hooking	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	Dead Drop Resolver CONTRIBUTE A TEST	Disk Structure Wipe CONTRIBUTE A TEST
Local Accounts	Dynamic Data Exchange	At (Windows)	Authentication Package	COR_PROFILER	Credentials In Files	Domain Groups	Remote Service Session Hijacking CONTRIBUTE A TEST	Data Staged CONTRIBUTE A TEST	Exfiltration Over Web Service	Domain Fronting CONTRIBUTE A TEST	Disk Wipe CONTRIBUTE A TEST
Phishing CONTRIBUTE A TEST	Exploitation for Client Execution CONTRIBUTE A TEST	Authentication Package	Boot or Logon Autostart Execution CONTRIBUTE A TEST	Clear Command History	Credentials from Password Stores	Domain Trust Discovery	Remote Services CONTRIBUTE A TEST	Data from Cloud Storage Object CONTRIBUTE A TEST	Exfiltration over USB CONTRIBUTE A TEST	Domain Generation Algorithms CONTRIBUTE A TEST	Endpoint Denial of Service CONTRIBUTE A TEST
Replication Through Removable Media	Graphical User Interface CONTRIBUTE A TEST	BITS Jobs	Boot or Logon Initialization Scripts CONTRIBUTE A TEST	Clear Linux or Mac System Logs	Credentials from Web Browsers	Email Account CONTRIBUTE A TEST	Replication Through Removable Media	Data from Configuration Repository CONTRIBUTE A TEST	Exfiltration to Cloud Storage CONTRIBUTE A TEST	Dynamic Resolution CONTRIBUTE A TEST	External Defacement CONTRIBUTE A TEST
Spearphishing Attachment	Inter-Process Communication CONTRIBUTE A TEST	Boot or Logon Autostart Execution CONTRIBUTE A TEST	Bypass User Account Control	Clear Windows Event Logs	Credentials in Registry	File and Directory Discovery	SMB/Windows Admin Shares	Data from Information Repositories CONTRIBUTE A TEST	Exfiltration to Code Repository CONTRIBUTE A TEST	Encrypted Channel	Firmware Corruption CONTRIBUTE A TEST
Spearphishing Link CONTRIBUTE A TEST	JavaScript CONTRIBUTE A TEST	Boot or Logon Initialization Scripts CONTRIBUTE A TEST	COR_PROFILER	Cloud Accounts	DCSync	Internet Connection Discovery CONTRIBUTE A TEST	SSH CONTRIBUTE A TEST	Data from Local System CONTRIBUTE A TEST	Scheduled Transfer CONTRIBUTE A TEST	External Proxy CONTRIBUTE A TEST	Inhibit System Recovery
Spearphishing via Service CONTRIBUTE A TEST	Launchctl	Bootkit CONTRIBUTE A TEST	Change Default File Association	Code Signing CONTRIBUTE A TEST	Domain Controller Authentication CONTRIBUTE A TEST	Local Account	SSH Hijacking CONTRIBUTE A TEST	Data from Network Shared Drive CONTRIBUTE A TEST	Traffic Duplication CONTRIBUTE A TEST	Fallback Channels CONTRIBUTE A TEST	Internal Defacement
Supply Chain Compromise CONTRIBUTE A TEST	Launchd	Browser Extensions	Cloud Accounts	Code Signing Policy Modification CONTRIBUTE A TEST	Exploitation for Credential Access CONTRIBUTE A TEST	Local Groups	Shared Webroot CONTRIBUTE A TEST	Data from Removable Media CONTRIBUTE A TEST	Transfer Data to Cloud Account CONTRIBUTE A TEST	Fast Flux DNS CONTRIBUTE A TEST	Network Denial of Service CONTRIBUTE A TEST
Trusted Relationship CONTRIBUTE A TEST	Malicious File	COR_PROFILER	Component Object Model Hijacking	Compile After Delivery	Forced Authentication	Network Service Scanning	Software Deployment Tools	Email Collection CONTRIBUTE A TEST		File Transfer Protocols CONTRIBUTE A TEST	OS Exhaustion Flood CONTRIBUTE A TEST
Valid Accounts CONTRIBUTE A TEST	Malicious Image CONTRIBUTE A TEST	Change Default File Association	Container Orchestration Job	Compiled HTML File	Forge Web Credentials CONTRIBUTE A TEST	Network Share Discovery	Taint Shared Content CONTRIBUTE A TEST	Email Forwarding Rule CONTRIBUTE A TEST		Ingress Tool Transfer	Reflection Amplification CONTRIBUTE A TEST
	Malicious Link CONTRIBUTE A TEST	Cloud Account	Create Process with Token	Component Firmware CONTRIBUTE A TEST	GUI Input Capture	Network Sniffing	Use Alternate Authentication Material CONTRIBUTE A TEST	GUI Input Capture		Internal Proxy	Resource Hijacking
	Native API	Cloud Accounts	Create or Modify System Process CONTRIBUTE A TEST	Control Panel	Golden Ticket	Password Policy Discovery	VNC CONTRIBUTE A TEST	Input Capture CONTRIBUTE A TEST		Junk Data CONTRIBUTE A TEST	Runtime Data Manipulation CONTRIBUTE A TEST
	Network Device CLI CONTRIBUTE A TEST	Component Firmware CONTRIBUTE A TEST	Cron	Create Cloud Instance CONTRIBUTE A TEST	Group Policy Preferences	Peripheral Device Discovery	Web Session Cookie CONTRIBUTE A TEST	Keylogging		Mail Protocols CONTRIBUTE A TEST	Service Exhaustion Flood CONTRIBUTE A TEST
	PowerShell	Component Object Model Hijacking	DLL Search Order Hijacking	Create Process with Token	Input Capture CONTRIBUTE A TEST	Permission Groups Discovery CONTRIBUTE A TEST	Windows Remote Management	LLMNR/NBT-NS Poisoning and SMB Relay		Multi-Stage Channels CONTRIBUTE A TEST	Service Stop
	Python	Compromise Client Software Binary CONTRIBUTE A TEST	DLL Side-Loading	Create Snapshot CONTRIBUTE A TEST	Kerberoasting	Process Discovery		Local Data Staging		Multi-hop Proxy	Stored Data Manipulation CONTRIBUTE A TEST
	Scheduled Task	Container Orchestration Job	Default Accounts	DLL Search Order Hijacking	Keychain	Query Registry		Local Email Collection		Multiband Communication CONTRIBUTE A TEST	System Shutdown/Reboot
	Scheduled Task/Job CONTRIBUTE A TEST	Create Account CONTRIBUTE A TEST	Domain Accounts CONTRIBUTE A TEST	DLL Side-Loading	Keylogging	Remote System Discovery		Man in the Browser CONTRIBUTE A TEST		Non-Application Layer Protocol	Transmitted Data Manipulation CONTRIBUTE A TEST
	Scripting CONTRIBUTE A TEST	Create or Modify System Process CONTRIBUTE A TEST	Domain Policy Modification CONTRIBUTE A TEST	Default Accounts	LLMNR/NBT-NS Poisoning and SMB Relay	Security Software Discovery		Man-in-the-Middle CONTRIBUTE A TEST		Non-Standard Encoding CONTRIBUTE A TEST
	Service Execution	Cron	Domain Trust Modification	Delete Cloud Instance CONTRIBUTE A TEST	LSA Secrets	Software Discovery		Network Device Configuration Dump CONTRIBUTE A TEST		Non-Standard Port
	Shared Modules CONTRIBUTE A TEST	DLL Search Order Hijacking	Dylib Hijacking CONTRIBUTE A TEST	Deobfuscate/Decode Files or Information	LSASS Memory	System Checks		Remote Data Staging CONTRIBUTE A TEST		One-Way Communication CONTRIBUTE A TEST
	Software Deployment Tools	DLL Side-Loading	Dynamic Linker Hijacking	Deploy Container CONTRIBUTE A TEST	Man-in-the-Middle CONTRIBUTE A TEST	System Information Discovery		Remote Email Collection CONTRIBUTE A TEST		Port Knocking CONTRIBUTE A TEST
	Source CONTRIBUTE A TEST	Default Accounts	Dynamic-link Library Injection	Direct Volume Access	Modify Authentication Process CONTRIBUTE A TEST	System Location Discovery CONTRIBUTE A TEST		SNMP (MIB Dump) CONTRIBUTE A TEST		Protocol Impersonation CONTRIBUTE A TEST
	System Services CONTRIBUTE A TEST	Domain Account	Elevated Execution with Prompt CONTRIBUTE A TEST	Disable Cloud Logs	NTDS	System Network Configuration Discovery		Screen Capture		Protocol Tunneling
	Systemd Timers	Domain Accounts CONTRIBUTE A TEST	Emond	Disable Crypto Hardware CONTRIBUTE A TEST	Network Device Authentication CONTRIBUTE A TEST	System Network Connections Discovery		Sharepoint CONTRIBUTE A TEST		Proxy CONTRIBUTE A TEST
	Unix Shell	Domain Controller Authentication CONTRIBUTE A TEST	Escape to Host	Disable Windows Event Logging	Network Sniffing	System Owner/User Discovery		Video Capture		Remote Access Software
	User Execution CONTRIBUTE A TEST	Dylib Hijacking CONTRIBUTE A TEST	Event Triggered Execution CONTRIBUTE A TEST	Disable or Modify Cloud Firewall CONTRIBUTE A TEST	OS Credential Dumping	System Service Discovery		Web Portal Capture CONTRIBUTE A TEST		Standard Encoding
	Visual Basic	Dynamic Linker Hijacking	Executable Installer File Permissions Weakness CONTRIBUTE A TEST	Disable or Modify System Firewall	Password Cracking	System Time Discovery				Steganography CONTRIBUTE A TEST
	Windows Command Shell	Emond	Exploitation for Privilege Escalation CONTRIBUTE A TEST	Disable or Modify Tools	Password Filter DLL	Time Based Evasion CONTRIBUTE A TEST				Symmetric Cryptography CONTRIBUTE A TEST
	Windows Management Instrumentation	Event Triggered Execution CONTRIBUTE A TEST	Extra Window Memory Injection CONTRIBUTE A TEST	Domain Accounts CONTRIBUTE A TEST	Password Guessing	User Activity Based Checks CONTRIBUTE A TEST				Traffic Signaling CONTRIBUTE A TEST
		Exchange Email Delegate Permissions CONTRIBUTE A TEST	Group Policy Modification CONTRIBUTE A TEST	Domain Controller Authentication CONTRIBUTE A TEST	Password Managers CONTRIBUTE A TEST	Virtualization/Sandbox Evasion CONTRIBUTE A TEST				Web Protocols
		Executable Installer File Permissions Weakness CONTRIBUTE A TEST	Hijack Execution Flow CONTRIBUTE A TEST	Domain Policy Modification CONTRIBUTE A TEST	Password Spraying					Web Service CONTRIBUTE A TEST
		External Remote Services	Image File Execution Options Injection	Domain Trust Modification	Pluggable Authentication Modules
		Hijack Execution Flow CONTRIBUTE A TEST	Kernel Modules and Extensions	Downgrade System Image CONTRIBUTE A TEST	Private Keys
		Hypervisor CONTRIBUTE A TEST	LC_LOAD_DYLIB Addition CONTRIBUTE A TEST	Dylib Hijacking CONTRIBUTE A TEST	Proc Filesystem
		Image File Execution Options Injection	LSASS Driver CONTRIBUTE A TEST	Dynamic Linker Hijacking	SAML Tokens
		Implant Internal Image CONTRIBUTE A TEST	Launch Agent	Dynamic-link Library Injection	Security Account Manager
		Kernel Modules and Extensions	Launch Daemon	Elevated Execution with Prompt CONTRIBUTE A TEST	Securityd Memory CONTRIBUTE A TEST
		LC_LOAD_DYLIB Addition CONTRIBUTE A TEST	Launchd	Environmental Keying CONTRIBUTE A TEST	Silver Ticket CONTRIBUTE A TEST
		LSASS Driver CONTRIBUTE A TEST	Local Accounts	Executable Installer File Permissions Weakness CONTRIBUTE A TEST	Steal Application Access Token CONTRIBUTE A TEST
		Launch Agent	Logon Script (Mac)	Execution Guardrails CONTRIBUTE A TEST	Steal Web Session Cookie CONTRIBUTE A TEST
		Launch Daemon	Logon Script (Windows)	Exploitation for Defense Evasion CONTRIBUTE A TEST	Steal or Forge Kerberos Tickets CONTRIBUTE A TEST
		Launchd	Make and Impersonate Token CONTRIBUTE A TEST	Extra Window Memory Injection CONTRIBUTE A TEST	Two-Factor Authentication Interception CONTRIBUTE A TEST
		Local Account	Netsh Helper DLL	File Deletion	Unsecured Credentials CONTRIBUTE A TEST
		Local Accounts	Network Logon Script CONTRIBUTE A TEST	File and Directory Permissions Modification CONTRIBUTE A TEST	Web Cookies CONTRIBUTE A TEST
		Logon Script (Mac)	Parent PID Spoofing	Gatekeeper Bypass	Web Portal Capture CONTRIBUTE A TEST
		Logon Script (Windows)	Path Interception CONTRIBUTE A TEST	Group Policy Modification CONTRIBUTE A TEST	Windows Credential Manager CONTRIBUTE A TEST
		Modify Authentication Process CONTRIBUTE A TEST	Path Interception by PATH Environment Variable CONTRIBUTE A TEST	Hidden File System CONTRIBUTE A TEST
		Netsh Helper DLL	Path Interception by Search Order Hijacking CONTRIBUTE A TEST	Hidden Files and Directories
		Network Device Authentication CONTRIBUTE A TEST	Path Interception by Unquoted Path	Hidden Users
		Network Logon Script CONTRIBUTE A TEST	Plist Modification	Hidden Window
		Office Application Startup	Port Monitors	Hide Artifacts
		Office Template Macros CONTRIBUTE A TEST	Portable Executable Injection CONTRIBUTE A TEST	Hijack Execution Flow CONTRIBUTE A TEST
		Office Test	PowerShell Profile	Impair Command History Logging
		Outlook Forms CONTRIBUTE A TEST	Print Processors CONTRIBUTE A TEST	Impair Defenses CONTRIBUTE A TEST
		Outlook Home Page	Proc Memory CONTRIBUTE A TEST	Indicator Blocking
		Outlook Rules CONTRIBUTE A TEST	Process Doppelgänging CONTRIBUTE A TEST	Indicator Removal from Tools CONTRIBUTE A TEST
		Password Filter DLL	Process Hollowing	Indicator Removal on Host
		Path Interception CONTRIBUTE A TEST	Process Injection	Indirect Command Execution
		Path Interception by PATH Environment Variable CONTRIBUTE A TEST	Ptrace System Calls CONTRIBUTE A TEST	Install Root Certificate
		Path Interception by Search Order Hijacking CONTRIBUTE A TEST	RC Scripts	InstallUtil
		Path Interception by Unquoted Path	Re-opened Applications	Invalid Code Signature CONTRIBUTE A TEST
		Plist Modification	Registry Run Keys / Startup Folder	LC_MAIN Hijacking CONTRIBUTE A TEST
		Pluggable Authentication Modules	SID-History Injection CONTRIBUTE A TEST	Linux and Mac File and Directory Permissions Modification
		Port Knocking CONTRIBUTE A TEST	Scheduled Task	Local Accounts
		Port Monitors	Scheduled Task/Job CONTRIBUTE A TEST	MSBuild
		PowerShell Profile	Screensaver	Make and Impersonate Token CONTRIBUTE A TEST
		Pre-OS Boot CONTRIBUTE A TEST	Security Support Provider	Mark-of-the-Web Bypass
		Print Processors CONTRIBUTE A TEST	Services File Permissions Weakness CONTRIBUTE A TEST	Masquerade Task or Service
		RC Scripts	Services Registry Permissions Weakness	Masquerading
		ROMMONkit CONTRIBUTE A TEST	Setuid and Setgid	Match Legitimate Name or Location
		Re-opened Applications	Shortcut Modification	Modify Authentication Process CONTRIBUTE A TEST
		Redundant Access CONTRIBUTE A TEST	Startup Items	Modify Cloud Compute Infrastructure CONTRIBUTE A TEST
		Registry Run Keys / Startup Folder	Sudo and Sudo Caching	Modify Registry
		SQL Stored Procedures CONTRIBUTE A TEST	Systemd Service	Modify System Image CONTRIBUTE A TEST
		SSH Authorized Keys	Systemd Timers	Mshta
		Scheduled Task	Thread Execution Hijacking CONTRIBUTE A TEST	Msiexec
		Scheduled Task/Job CONTRIBUTE A TEST	Thread Local Storage CONTRIBUTE A TEST	NTFS File Attributes
		Screensaver	Time Providers CONTRIBUTE A TEST	Network Address Translation Traversal CONTRIBUTE A TEST
		Security Support Provider	Token Impersonation/Theft	Network Boundary Bridging CONTRIBUTE A TEST
		Server Software Component CONTRIBUTE A TEST	Trap	Network Device Authentication CONTRIBUTE A TEST
		Services File Permissions Weakness CONTRIBUTE A TEST	Unix Shell Configuration Modification	Network Share Connection Removal
		Services Registry Permissions Weakness	VDSO Hijacking CONTRIBUTE A TEST	Obfuscated Files or Information
		Shortcut Modification	Valid Accounts CONTRIBUTE A TEST	Odbcconf
		Startup Items	Windows Management Instrumentation Event Subscription	Parent PID Spoofing
		System Firmware CONTRIBUTE A TEST	Windows Service	Pass the Hash
		Systemd Service	Winlogon Helper DLL	Pass the Ticket
		Systemd Timers	XDG Autostart Entries CONTRIBUTE A TEST	Password Filter DLL
		TFTP Boot CONTRIBUTE A TEST		Patch System Image CONTRIBUTE A TEST
		Time Providers CONTRIBUTE A TEST		Path Interception by PATH Environment Variable CONTRIBUTE A TEST
		Traffic Signaling CONTRIBUTE A TEST		Path Interception by Search Order Hijacking CONTRIBUTE A TEST
		Transport Agent		Path Interception by Unquoted Path
		Trap		Pluggable Authentication Modules
		Unix Shell Configuration Modification		Port Knocking CONTRIBUTE A TEST
		Valid Accounts CONTRIBUTE A TEST		Portable Executable Injection CONTRIBUTE A TEST
		Web Shell		Pre-OS Boot CONTRIBUTE A TEST
		Windows Management Instrumentation Event Subscription		Proc Memory CONTRIBUTE A TEST
		Windows Service		Process Doppelgänging CONTRIBUTE A TEST
		Winlogon Helper DLL		Process Hollowing
		XDG Autostart Entries CONTRIBUTE A TEST		Process Injection
				Ptrace System Calls CONTRIBUTE A TEST
				PubPrn
				ROMMONkit CONTRIBUTE A TEST
				Reduce Key Space CONTRIBUTE A TEST
				Redundant Access CONTRIBUTE A TEST
				Regsvcs/Regasm
				Regsvr32
				Rename System Utilities
				Revert Cloud Instance CONTRIBUTE A TEST
				Right-to-Left Override CONTRIBUTE A TEST
				Rogue Domain Controller
				Rootkit
				Run Virtual Instance
				Rundll32
				SID-History Injection CONTRIBUTE A TEST
				SIP and Trust Provider Hijacking CONTRIBUTE A TEST
				Scripting CONTRIBUTE A TEST
				Services File Permissions Weakness CONTRIBUTE A TEST
				Services Registry Permissions Weakness
				Setuid and Setgid
				Signed Binary Proxy Execution
				Signed Script Proxy Execution
				Software Packing
				Space after Filename
				Steganography CONTRIBUTE A TEST
				Subvert Trust Controls CONTRIBUTE A TEST
				Sudo and Sudo Caching
				System Checks
				System Firmware CONTRIBUTE A TEST
				TFTP Boot CONTRIBUTE A TEST
				Template Injection
				Thread Execution Hijacking CONTRIBUTE A TEST
				Thread Local Storage CONTRIBUTE A TEST
				Time Based Evasion CONTRIBUTE A TEST
				Timestomp
				Token Impersonation/Theft
				Traffic Signaling CONTRIBUTE A TEST
				Trusted Developer Utilities Proxy Execution CONTRIBUTE A TEST
				Unused/Unsupported Cloud Regions CONTRIBUTE A TEST
				Use Alternate Authentication Material CONTRIBUTE A TEST
				User Activity Based Checks CONTRIBUTE A TEST
				VBA Stomping CONTRIBUTE A TEST
				VDSO Hijacking CONTRIBUTE A TEST
				Valid Accounts CONTRIBUTE A TEST
				Verclsid CONTRIBUTE A TEST
				Virtualization/Sandbox Evasion CONTRIBUTE A TEST
				Weaken Encryption CONTRIBUTE A TEST
				Web Session Cookie CONTRIBUTE A TEST
				Windows File and Directory Permissions Modification
				XSL Script Processing