atomic-red-team/atomics/windows-matrix.md

Windows Atomic Tests by ATT&CK Tactic & Technique

initial-access	execution	persistence	privilege-escalation	defense-evasion	credential-access	discovery	lateral-movement	collection	exfiltration	command-and-control
Drive-by Compromise CONTRIBUTE A TEST	CMSTP	Accessibility Features	Access Token Manipulation	Access Token Manipulation	Account Manipulation	Account Discovery	Application Deployment Software CONTRIBUTE A TEST	Audio Capture	Automated Exfiltration CONTRIBUTE A TEST	Commonly Used Port CONTRIBUTE A TEST
Exploit Public-Facing Application CONTRIBUTE A TEST	Command-Line Interface	Account Manipulation	Accessibility Features	BITS Jobs	Brute Force	Application Window Discovery	Distributed Component Object Model CONTRIBUTE A TEST	Automated Collection	Data Compressed	Communication Through Removable Media CONTRIBUTE A TEST
External Remote Services CONTRIBUTE A TEST	Compiled HTML File	AppCert DLLs CONTRIBUTE A TEST	AppCert DLLs CONTRIBUTE A TEST	Binary Padding	Credential Dumping	Browser Bookmark Discovery	Exploitation of Remote Services CONTRIBUTE A TEST	Clipboard Data	Data Encrypted	Connection Proxy
Hardware Additions CONTRIBUTE A TEST	Control Panel Items	AppInit DLLs	AppInit DLLs	Bypass User Account Control	Credentials in Files	Domain Trust Discovery	Logon Scripts	Data Staged	Data Transfer Size Limits	Custom Command and Control Protocol CONTRIBUTE A TEST
Replication Through Removable Media CONTRIBUTE A TEST	Dynamic Data Exchange	Application Shimming	Application Shimming	CMSTP	Credentials in Registry	File and Directory Discovery	Pass the Hash	Data from Information Repositories CONTRIBUTE A TEST	Exfiltration Over Alternative Protocol	Custom Cryptographic Protocol CONTRIBUTE A TEST
Spearphishing Attachment	Execution through API CONTRIBUTE A TEST	Authentication Package CONTRIBUTE A TEST	Bypass User Account Control	Code Signing CONTRIBUTE A TEST	Exploitation for Credential Access CONTRIBUTE A TEST	Network Service Scanning	Pass the Ticket	Data from Local System	Exfiltration Over Command and Control Channel CONTRIBUTE A TEST	Data Encoding
Spearphishing Link CONTRIBUTE A TEST	Execution through Module Load CONTRIBUTE A TEST	BITS Jobs	DLL Search Order Hijacking	Compile After Delivery CONTRIBUTE A TEST	Forced Authentication CONTRIBUTE A TEST	Network Share Discovery	Remote Desktop Protocol	Data from Network Shared Drive CONTRIBUTE A TEST	Exfiltration Over Other Network Medium CONTRIBUTE A TEST	Data Obfuscation CONTRIBUTE A TEST
Spearphishing via Service CONTRIBUTE A TEST	Exploitation for Client Execution CONTRIBUTE A TEST	Bootkit CONTRIBUTE A TEST	Exploitation for Privilege Escalation CONTRIBUTE A TEST	Compiled HTML File	Hooking	Network Sniffing	Remote File Copy	Data from Removable Media CONTRIBUTE A TEST	Exfiltration Over Physical Medium CONTRIBUTE A TEST	Domain Fronting CONTRIBUTE A TEST
Supply Chain Compromise CONTRIBUTE A TEST	Graphical User Interface CONTRIBUTE A TEST	Browser Extensions	Extra Window Memory Injection CONTRIBUTE A TEST	Component Firmware CONTRIBUTE A TEST	Input Capture	Password Policy Discovery	Remote Services CONTRIBUTE A TEST	Email Collection	Scheduled Transfer CONTRIBUTE A TEST	Domain Generation Algorithms CONTRIBUTE A TEST
Trusted Relationship CONTRIBUTE A TEST	InstallUtil	Change Default File Association	File System Permissions Weakness CONTRIBUTE A TEST	Component Object Model Hijacking	Input Prompt	Peripheral Device Discovery CONTRIBUTE A TEST	Replication Through Removable Media CONTRIBUTE A TEST	Input Capture		Fallback Channels CONTRIBUTE A TEST
Valid Accounts CONTRIBUTE A TEST	LSASS Driver CONTRIBUTE A TEST	Component Firmware CONTRIBUTE A TEST	Hooking	Control Panel Items	Kerberoasting CONTRIBUTE A TEST	Permission Groups Discovery	Shared Webroot CONTRIBUTE A TEST	Man in the Browser CONTRIBUTE A TEST		Multi-Stage Channels CONTRIBUTE A TEST
	Mshta	Component Object Model Hijacking	Image File Execution Options Injection	DCShadow	LLMNR/NBT-NS Poisoning and Relay CONTRIBUTE A TEST	Process Discovery	Taint Shared Content CONTRIBUTE A TEST	Screen Capture		Multi-hop Proxy CONTRIBUTE A TEST
	PowerShell	Create Account	New Service	DLL Search Order Hijacking	Network Sniffing	Query Registry	Third-party Software CONTRIBUTE A TEST	Video Capture CONTRIBUTE A TEST		Multiband Communication CONTRIBUTE A TEST
	Regsvcs/Regasm	DLL Search Order Hijacking	Path Interception CONTRIBUTE A TEST	DLL Side-Loading CONTRIBUTE A TEST	Password Filter DLL	Remote System Discovery	Windows Admin Shares			Multilayer Encryption CONTRIBUTE A TEST
	Regsvr32	External Remote Services CONTRIBUTE A TEST	Port Monitors CONTRIBUTE A TEST	Deobfuscate/Decode Files or Information	Private Keys	Security Software Discovery	Windows Remote Management			Remote Access Tools CONTRIBUTE A TEST
	Rundll32	File System Permissions Weakness CONTRIBUTE A TEST	Process Injection	Disabling Security Tools	Two-Factor Authentication Interception CONTRIBUTE A TEST	System Information Discovery				Remote File Copy
	Scheduled Task	Hidden Files and Directories	SID-History Injection CONTRIBUTE A TEST	Execution Guardrails CONTRIBUTE A TEST		System Network Configuration Discovery				Standard Application Layer Protocol
	Scripting	Hooking	Scheduled Task	Exploitation for Defense Evasion CONTRIBUTE A TEST		System Network Connections Discovery				Standard Cryptographic Protocol CONTRIBUTE A TEST
	Service Execution	Hypervisor	Service Registry Permissions Weakness CONTRIBUTE A TEST	Extra Window Memory Injection CONTRIBUTE A TEST		System Owner/User Discovery				Standard Non-Application Layer Protocol CONTRIBUTE A TEST
	Signed Binary Proxy Execution	Image File Execution Options Injection	Valid Accounts CONTRIBUTE A TEST	File Deletion		System Service Discovery				Uncommonly Used Port
	Signed Script Proxy Execution	LSASS Driver CONTRIBUTE A TEST	Web Shell	File Permissions Modification		System Time Discovery				Web Service CONTRIBUTE A TEST
	Third-party Software CONTRIBUTE A TEST	Logon Scripts		File System Logical Offsets CONTRIBUTE A TEST		Virtualization/Sandbox Evasion CONTRIBUTE A TEST
	Trusted Developer Utilities	Modify Existing Service		Group Policy Modification CONTRIBUTE A TEST
	User Execution CONTRIBUTE A TEST	Netsh Helper DLL		Hidden Files and Directories
	Windows Management Instrumentation	New Service		Image File Execution Options Injection
	Windows Remote Management	Office Application Startup		Indicator Blocking CONTRIBUTE A TEST
	XSL Script Processing	Path Interception CONTRIBUTE A TEST		Indicator Removal from Tools CONTRIBUTE A TEST
		Port Monitors CONTRIBUTE A TEST		Indicator Removal on Host
		Redundant Access CONTRIBUTE A TEST		Indirect Command Execution
		Registry Run Keys / Startup Folder		Install Root Certificate
		SIP and Trust Provider Hijacking CONTRIBUTE A TEST		InstallUtil
		Scheduled Task		Masquerading
		Screensaver		Modify Registry
		Security Support Provider		Mshta
		Service Registry Permissions Weakness CONTRIBUTE A TEST		NTFS File Attributes
		Shortcut Modification CONTRIBUTE A TEST		Network Share Connection Removal
		System Firmware CONTRIBUTE A TEST		Obfuscated Files or Information
		Time Providers CONTRIBUTE A TEST		Process Doppelgänging CONTRIBUTE A TEST
		Valid Accounts CONTRIBUTE A TEST		Process Hollowing CONTRIBUTE A TEST
		Web Shell		Process Injection
		Windows Management Instrumentation Event Subscription		Redundant Access CONTRIBUTE A TEST
		Winlogon Helper DLL		Regsvcs/Regasm
				Regsvr32
				Rootkit
				Rundll32
				SIP and Trust Provider Hijacking CONTRIBUTE A TEST
				Scripting
				Signed Binary Proxy Execution
				Signed Script Proxy Execution
				Software Packing CONTRIBUTE A TEST
				Template Injection CONTRIBUTE A TEST
				Timestomp
				Trusted Developer Utilities
				Valid Accounts CONTRIBUTE A TEST
				Virtualization/Sandbox Evasion CONTRIBUTE A TEST
				Web Service CONTRIBUTE A TEST
				XSL Script Processing