Cloud Accounts CONTRIBUTE A TEST |
AppleScript |
.bash_profile and .bashrc |
.bash_profile and .bashrc |
Abuse Elevation Control Mechanism CONTRIBUTE A TEST |
/etc/passwd and /etc/shadow CONTRIBUTE A TEST |
Account Discovery CONTRIBUTE A TEST |
Application Access Token CONTRIBUTE A TEST |
Archive Collected Data |
Automated Exfiltration |
Application Layer Protocol CONTRIBUTE A TEST |
Account Access Removal |
Compromise Hardware Supply Chain CONTRIBUTE A TEST |
At (Linux) |
Accessibility Features |
Abuse Elevation Control Mechanism CONTRIBUTE A TEST |
Access Token Manipulation CONTRIBUTE A TEST |
Bash History |
Application Window Discovery |
Component Object Model and Distributed COM CONTRIBUTE A TEST |
Archive via Custom Method CONTRIBUTE A TEST |
Data Transfer Size Limits |
Asymmetric Cryptography CONTRIBUTE A TEST |
Application Exhaustion Flood CONTRIBUTE A TEST |
Compromise Software Dependencies and Development Tools CONTRIBUTE A TEST |
At (Windows) |
Account Manipulation |
Access Token Manipulation CONTRIBUTE A TEST |
Application Access Token CONTRIBUTE A TEST |
Brute Force CONTRIBUTE A TEST |
Browser Bookmark Discovery |
Distributed Component Object Model |
Archive via Library CONTRIBUTE A TEST |
Exfiltration Over Alternative Protocol |
Bidirectional Communication CONTRIBUTE A TEST |
Application or System Exploitation CONTRIBUTE A TEST |
Compromise Software Supply Chain CONTRIBUTE A TEST |
Command and Scripting Interpreter CONTRIBUTE A TEST |
Add Office 365 Global Administrator Role CONTRIBUTE A TEST |
Accessibility Features |
Asynchronous Procedure Call |
Cached Domain Credentials CONTRIBUTE A TEST |
Cloud Account CONTRIBUTE A TEST |
Exploitation of Remote Services CONTRIBUTE A TEST |
Archive via Utility |
Exfiltration Over Asymmetric Encrypted Non-C2 Protocol CONTRIBUTE A TEST |
Commonly Used Port CONTRIBUTE A TEST |
Data Destruction |
Default Accounts |
Component Object Model CONTRIBUTE A TEST |
Add-ins CONTRIBUTE A TEST |
AppCert DLLs CONTRIBUTE A TEST |
BITS Jobs |
Cloud Instance Metadata API CONTRIBUTE A TEST |
Cloud Groups CONTRIBUTE A TEST |
Internal Spearphishing CONTRIBUTE A TEST |
Audio Capture |
Exfiltration Over Bluetooth CONTRIBUTE A TEST |
Communication Through Removable Media CONTRIBUTE A TEST |
Data Encrypted for Impact CONTRIBUTE A TEST |
Domain Accounts CONTRIBUTE A TEST |
Component Object Model and Distributed COM CONTRIBUTE A TEST |
Additional Azure Service Principal Credentials CONTRIBUTE A TEST |
AppInit DLLs |
Binary Padding |
Credential API Hooking |
Cloud Service Dashboard CONTRIBUTE A TEST |
Lateral Tool Transfer CONTRIBUTE A TEST |
Automated Collection |
Exfiltration Over C2 Channel CONTRIBUTE A TEST |
DNS |
Data Manipulation CONTRIBUTE A TEST |
Drive-by Compromise CONTRIBUTE A TEST |
Cron |
AppCert DLLs CONTRIBUTE A TEST |
Application Shimming |
Bootkit CONTRIBUTE A TEST |
Credential Stuffing CONTRIBUTE A TEST |
Cloud Service Discovery CONTRIBUTE A TEST |
Pass the Hash |
Clipboard Data |
Exfiltration Over Other Network Medium CONTRIBUTE A TEST |
DNS Calculation CONTRIBUTE A TEST |
Defacement CONTRIBUTE A TEST |
Exploit Public-Facing Application CONTRIBUTE A TEST |
Dynamic Data Exchange |
AppInit DLLs |
Asynchronous Procedure Call |
Bypass User Access Control |
Credentials In Files |
Domain Account |
Pass the Ticket |
Confluence CONTRIBUTE A TEST |
Exfiltration Over Physical Medium CONTRIBUTE A TEST |
Data Encoding CONTRIBUTE A TEST |
Direct Network Flood CONTRIBUTE A TEST |
External Remote Services CONTRIBUTE A TEST |
Exploitation for Client Execution CONTRIBUTE A TEST |
Application Shimming |
At (Linux) |
CMSTP |
Credentials from Password Stores CONTRIBUTE A TEST |
Domain Groups |
RDP Hijacking |
Credential API Hooking |
Exfiltration Over Symmetric Encrypted Non-C2 Protocol CONTRIBUTE A TEST |
Data Obfuscation CONTRIBUTE A TEST |
Disk Content Wipe CONTRIBUTE A TEST |
Hardware Additions CONTRIBUTE A TEST |
Graphical User Interface CONTRIBUTE A TEST |
At (Linux) |
At (Windows) |
COR_PROFILER |
Credentials from Web Browsers |
Domain Trust Discovery |
Remote Desktop Protocol |
Data Staged CONTRIBUTE A TEST |
Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol |
Dead Drop Resolver CONTRIBUTE A TEST |
Disk Structure Wipe CONTRIBUTE A TEST |
Local Accounts CONTRIBUTE A TEST |
Inter-Process Communication CONTRIBUTE A TEST |
At (Windows) |
Authentication Package CONTRIBUTE A TEST |
Clear Command History |
Credentials in Registry |
Email Account CONTRIBUTE A TEST |
Remote Service Session Hijacking CONTRIBUTE A TEST |
Data from Cloud Storage Object CONTRIBUTE A TEST |
Exfiltration Over Web Service CONTRIBUTE A TEST |
Domain Fronting CONTRIBUTE A TEST |
Disk Wipe CONTRIBUTE A TEST |
Phishing CONTRIBUTE A TEST |
JavaScript/JScript CONTRIBUTE A TEST |
Authentication Package CONTRIBUTE A TEST |
Boot or Logon Autostart Execution CONTRIBUTE A TEST |
Clear Linux or Mac System Logs |
DCSync CONTRIBUTE A TEST |
File and Directory Discovery |
Remote Services CONTRIBUTE A TEST |
Data from Information Repositories CONTRIBUTE A TEST |
Exfiltration over USB CONTRIBUTE A TEST |
Domain Generation Algorithms CONTRIBUTE A TEST |
Endpoint Denial of Service CONTRIBUTE A TEST |
Replication Through Removable Media CONTRIBUTE A TEST |
Launchctl |
BITS Jobs |
Boot or Logon Initialization Scripts CONTRIBUTE A TEST |
Clear Windows Event Logs |
Domain Controller Authentication CONTRIBUTE A TEST |
Local Account |
Replication Through Removable Media CONTRIBUTE A TEST |
Data from Local System CONTRIBUTE A TEST |
Exfiltration to Cloud Storage CONTRIBUTE A TEST |
Dynamic Resolution CONTRIBUTE A TEST |
External Defacement CONTRIBUTE A TEST |
Spearphishing Attachment |
Launchd |
Boot or Logon Autostart Execution CONTRIBUTE A TEST |
Bypass User Access Control |
Cloud Accounts CONTRIBUTE A TEST |
Exploitation for Credential Access CONTRIBUTE A TEST |
Local Groups |
SMB/Windows Admin Shares |
Data from Network Shared Drive CONTRIBUTE A TEST |
Exfiltration to Code Repository CONTRIBUTE A TEST |
Encrypted Channel |
Firmware Corruption CONTRIBUTE A TEST |
Spearphishing Link CONTRIBUTE A TEST |
Malicious File |
Boot or Logon Initialization Scripts CONTRIBUTE A TEST |
COR_PROFILER |
Code Signing CONTRIBUTE A TEST |
Forced Authentication CONTRIBUTE A TEST |
Network Service Scanning |
SSH CONTRIBUTE A TEST |
Data from Removable Media CONTRIBUTE A TEST |
Scheduled Transfer CONTRIBUTE A TEST |
External Proxy CONTRIBUTE A TEST |
Inhibit System Recovery |
Spearphishing via Service CONTRIBUTE A TEST |
Malicious Link CONTRIBUTE A TEST |
Bootkit CONTRIBUTE A TEST |
Change Default File Association |
Compile After Delivery |
GUI Input Capture |
Network Share Discovery |
SSH Hijacking CONTRIBUTE A TEST |
Email Collection CONTRIBUTE A TEST |
Transfer Data to Cloud Account CONTRIBUTE A TEST |
Fallback Channels CONTRIBUTE A TEST |
Internal Defacement CONTRIBUTE A TEST |
Supply Chain Compromise CONTRIBUTE A TEST |
Native API |
Browser Extensions |
Cloud Accounts CONTRIBUTE A TEST |
Compiled HTML File |
Golden Ticket CONTRIBUTE A TEST |
Network Sniffing |
Shared Webroot CONTRIBUTE A TEST |
Email Forwarding Rule CONTRIBUTE A TEST |
|
Fast Flux DNS CONTRIBUTE A TEST |
Network Denial of Service CONTRIBUTE A TEST |
Trusted Relationship CONTRIBUTE A TEST |
PowerShell |
COR_PROFILER |
Component Object Model Hijacking CONTRIBUTE A TEST |
Component Firmware CONTRIBUTE A TEST |
Group Policy Preferences |
Password Policy Discovery |
Software Deployment Tools CONTRIBUTE A TEST |
GUI Input Capture |
|
File Transfer Protocols CONTRIBUTE A TEST |
OS Exhaustion Flood CONTRIBUTE A TEST |
Valid Accounts CONTRIBUTE A TEST |
Python CONTRIBUTE A TEST |
Change Default File Association |
Create Process with Token CONTRIBUTE A TEST |
Control Panel |
Input Capture CONTRIBUTE A TEST |
Peripheral Device Discovery CONTRIBUTE A TEST |
Taint Shared Content CONTRIBUTE A TEST |
Input Capture CONTRIBUTE A TEST |
|
Ingress Tool Transfer |
Reflection Amplification CONTRIBUTE A TEST |
|
Scheduled Task |
Cloud Account CONTRIBUTE A TEST |
Create or Modify System Process CONTRIBUTE A TEST |
Create Cloud Instance CONTRIBUTE A TEST |
Kerberoasting |
Permission Groups Discovery CONTRIBUTE A TEST |
Use Alternate Authentication Material CONTRIBUTE A TEST |
Keylogging |
|
Internal Proxy |
Resource Hijacking |
|
Scheduled Task/Job CONTRIBUTE A TEST |
Cloud Accounts CONTRIBUTE A TEST |
Cron |
Create Process with Token CONTRIBUTE A TEST |
Keychain |
Process Discovery |
VNC CONTRIBUTE A TEST |
LLMNR/NBT-NS Poisoning and SMB Relay CONTRIBUTE A TEST |
|
Junk Data CONTRIBUTE A TEST |
Runtime Data Manipulation CONTRIBUTE A TEST |
|
Scripting CONTRIBUTE A TEST |
Component Firmware CONTRIBUTE A TEST |
DLL Search Order Hijacking |
Create Snapshot CONTRIBUTE A TEST |
Keylogging |
Query Registry |
Web Session Cookie CONTRIBUTE A TEST |
Local Data Staging |
|
Mail Protocols CONTRIBUTE A TEST |
Service Exhaustion Flood CONTRIBUTE A TEST |
|
Service Execution |
Component Object Model Hijacking CONTRIBUTE A TEST |
DLL Side-Loading |
DLL Search Order Hijacking |
LLMNR/NBT-NS Poisoning and SMB Relay CONTRIBUTE A TEST |
Remote System Discovery |
Windows Remote Management |
Local Email Collection |
|
Multi-Stage Channels CONTRIBUTE A TEST |
Service Stop |
|
Shared Modules CONTRIBUTE A TEST |
Compromise Client Software Binary CONTRIBUTE A TEST |
Default Accounts |
DLL Side-Loading |
LSA Secrets |
Security Software Discovery |
|
Man in the Browser CONTRIBUTE A TEST |
|
Multi-hop Proxy CONTRIBUTE A TEST |
Stored Data Manipulation CONTRIBUTE A TEST |
|
Software Deployment Tools CONTRIBUTE A TEST |
Create Account CONTRIBUTE A TEST |
Domain Accounts CONTRIBUTE A TEST |
Default Accounts |
LSASS Memory |
Software Discovery |
|
Man-in-the-Middle CONTRIBUTE A TEST |
|
Multiband Communication CONTRIBUTE A TEST |
System Shutdown/Reboot |
|
Source CONTRIBUTE A TEST |
Create or Modify System Process CONTRIBUTE A TEST |
Dylib Hijacking CONTRIBUTE A TEST |
Delete Cloud Instance CONTRIBUTE A TEST |
Man-in-the-Middle CONTRIBUTE A TEST |
System Checks CONTRIBUTE A TEST |
|
Remote Data Staging CONTRIBUTE A TEST |
|
Non-Application Layer Protocol |
Transmitted Data Manipulation CONTRIBUTE A TEST |
|
System Services CONTRIBUTE A TEST |
Cron |
Dynamic-link Library Injection CONTRIBUTE A TEST |
Deobfuscate/Decode Files or Information |
Modify Authentication Process CONTRIBUTE A TEST |
System Information Discovery |
|
Remote Email Collection CONTRIBUTE A TEST |
|
Non-Standard Encoding CONTRIBUTE A TEST |
|
|
Unix Shell |
DLL Search Order Hijacking |
Elevated Execution with Prompt CONTRIBUTE A TEST |
Direct Volume Access CONTRIBUTE A TEST |
NTDS |
System Network Configuration Discovery |
|
Screen Capture |
|
Non-Standard Port |
|
|
User Execution CONTRIBUTE A TEST |
DLL Side-Loading |
Emond |
Disable Windows Event Logging |
Network Sniffing |
System Network Connections Discovery |
|
Sharepoint CONTRIBUTE A TEST |
|
One-Way Communication CONTRIBUTE A TEST |
|
|
Visual Basic |
Default Accounts |
Event Triggered Execution CONTRIBUTE A TEST |
Disable or Modify Cloud Firewall CONTRIBUTE A TEST |
OS Credential Dumping |
System Owner/User Discovery |
|
Video Capture CONTRIBUTE A TEST |
|
Port Knocking CONTRIBUTE A TEST |
|
|
Windows Command Shell |
Domain Account CONTRIBUTE A TEST |
Executable Installer File Permissions Weakness CONTRIBUTE A TEST |
Disable or Modify System Firewall |
Password Cracking |
System Service Discovery |
|
Web Portal Capture CONTRIBUTE A TEST |
|
Protocol Impersonation CONTRIBUTE A TEST |
|
|
Windows Management Instrumentation |
Domain Accounts CONTRIBUTE A TEST |
Exploitation for Privilege Escalation CONTRIBUTE A TEST |
Disable or Modify Tools |
Password Filter DLL |
System Time Discovery |
|
|
|
Protocol Tunneling CONTRIBUTE A TEST |
|
|
|
Dylib Hijacking CONTRIBUTE A TEST |
Extra Window Memory Injection CONTRIBUTE A TEST |
Domain Accounts CONTRIBUTE A TEST |
Password Guessing |
Time Based Evasion CONTRIBUTE A TEST |
|
|
|
Proxy CONTRIBUTE A TEST |
|
|
|
Emond |
Group Policy Modification CONTRIBUTE A TEST |
Domain Controller Authentication CONTRIBUTE A TEST |
Password Spraying |
User Activity Based Checks CONTRIBUTE A TEST |
|
|
|
Remote Access Software |
|
|
|
Event Triggered Execution CONTRIBUTE A TEST |
Hijack Execution Flow CONTRIBUTE A TEST |
Dylib Hijacking CONTRIBUTE A TEST |
Pluggable Authentication Modules CONTRIBUTE A TEST |
Virtualization/Sandbox Evasion CONTRIBUTE A TEST |
|
|
|
Standard Encoding |
|
|
|
Exchange Email Delegate Permissions CONTRIBUTE A TEST |
Image File Execution Options Injection |
Dynamic-link Library Injection CONTRIBUTE A TEST |
Private Keys |
|
|
|
|
Steganography CONTRIBUTE A TEST |
|
|
|
Executable Installer File Permissions Weakness CONTRIBUTE A TEST |
Kernel Modules and Extensions |
Elevated Execution with Prompt CONTRIBUTE A TEST |
Proc Filesystem CONTRIBUTE A TEST |
|
|
|
|
Symmetric Cryptography CONTRIBUTE A TEST |
|
|
|
External Remote Services CONTRIBUTE A TEST |
LC_LOAD_DYLIB Addition CONTRIBUTE A TEST |
Environmental Keying CONTRIBUTE A TEST |
Security Account Manager |
|
|
|
|
Traffic Signaling CONTRIBUTE A TEST |
|
|
|
Hijack Execution Flow CONTRIBUTE A TEST |
LD_PRELOAD |
Executable Installer File Permissions Weakness CONTRIBUTE A TEST |
Securityd Memory CONTRIBUTE A TEST |
|
|
|
|
Web Protocols |
|
|
|
Hypervisor CONTRIBUTE A TEST |
LSASS Driver CONTRIBUTE A TEST |
Execution Guardrails CONTRIBUTE A TEST |
Silver Ticket CONTRIBUTE A TEST |
|
|
|
|
Web Service CONTRIBUTE A TEST |
|
|
|
Image File Execution Options Injection |
Launch Agent |
Exploitation for Defense Evasion CONTRIBUTE A TEST |
Steal Application Access Token CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
Implant Container Image CONTRIBUTE A TEST |
Launch Daemon |
Extra Window Memory Injection CONTRIBUTE A TEST |
Steal Web Session Cookie CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
Kernel Modules and Extensions |
Launchd |
File Deletion |
Steal or Forge Kerberos Tickets CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
LC_LOAD_DYLIB Addition CONTRIBUTE A TEST |
Local Accounts CONTRIBUTE A TEST |
File and Directory Permissions Modification CONTRIBUTE A TEST |
Two-Factor Authentication Interception CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
LD_PRELOAD |
Logon Script (Mac) |
Gatekeeper Bypass |
Unsecured Credentials CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
LSASS Driver CONTRIBUTE A TEST |
Logon Script (Windows) |
Group Policy Modification CONTRIBUTE A TEST |
Web Portal Capture CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
Launch Agent |
Make and Impersonate Token CONTRIBUTE A TEST |
HISTCONTROL |
|
|
|
|
|
|
|
|
|
Launch Daemon |
Netsh Helper DLL |
Hidden File System CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Launchd |
Network Logon Script CONTRIBUTE A TEST |
Hidden Files and Directories |
|
|
|
|
|
|
|
|
|
Local Account |
Parent PID Spoofing |
Hidden Users |
|
|
|
|
|
|
|
|
|
Local Accounts CONTRIBUTE A TEST |
Path Interception CONTRIBUTE A TEST |
Hidden Window |
|
|
|
|
|
|
|
|
|
Logon Script (Mac) |
Path Interception by PATH Environment Variable CONTRIBUTE A TEST |
Hide Artifacts CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Logon Script (Windows) |
Path Interception by Search Order Hijacking CONTRIBUTE A TEST |
Hijack Execution Flow CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Netsh Helper DLL |
Path Interception by Unquoted Path |
Impair Defenses CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Network Logon Script CONTRIBUTE A TEST |
Plist Modification |
Indicator Blocking CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Office Application Startup CONTRIBUTE A TEST |
Port Monitors CONTRIBUTE A TEST |
Indicator Removal from Tools CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Office Template Macros CONTRIBUTE A TEST |
Portable Executable Injection CONTRIBUTE A TEST |
Indicator Removal on Host |
|
|
|
|
|
|
|
|
|
Office Test CONTRIBUTE A TEST |
PowerShell Profile |
Indirect Command Execution |
|
|
|
|
|
|
|
|
|
Outlook Forms CONTRIBUTE A TEST |
Proc Memory CONTRIBUTE A TEST |
Install Root Certificate |
|
|
|
|
|
|
|
|
|
Outlook Home Page CONTRIBUTE A TEST |
Process Doppelgänging CONTRIBUTE A TEST |
InstallUtil |
|
|
|
|
|
|
|
|
|
Outlook Rules CONTRIBUTE A TEST |
Process Hollowing |
Invalid Code Signature CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Path Interception CONTRIBUTE A TEST |
Process Injection |
LC_MAIN Hijacking CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Path Interception by PATH Environment Variable CONTRIBUTE A TEST |
Ptrace System Calls CONTRIBUTE A TEST |
LD_PRELOAD |
|
|
|
|
|
|
|
|
|
Path Interception by Search Order Hijacking CONTRIBUTE A TEST |
Rc.common |
Linux and Mac File and Directory Permissions Modification |
|
|
|
|
|
|
|
|
|
Path Interception by Unquoted Path |
Re-opened Applications |
Local Accounts CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Plist Modification |
Registry Run Keys / Startup Folder |
MSBuild |
|
|
|
|
|
|
|
|
|
Port Knocking CONTRIBUTE A TEST |
SID-History Injection CONTRIBUTE A TEST |
Make and Impersonate Token CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Port Monitors CONTRIBUTE A TEST |
Scheduled Task |
Masquerade Task or Service CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
PowerShell Profile |
Scheduled Task/Job CONTRIBUTE A TEST |
Masquerading CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Pre-OS Boot CONTRIBUTE A TEST |
Screensaver |
Match Legitimate Name or Location CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Rc.common |
Security Support Provider |
Modify Authentication Process CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Re-opened Applications |
Services File Permissions Weakness CONTRIBUTE A TEST |
Modify Cloud Compute Infrastructure CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Redundant Access CONTRIBUTE A TEST |
Services Registry Permissions Weakness |
Modify Registry |
|
|
|
|
|
|
|
|
|
Registry Run Keys / Startup Folder |
Setuid and Setgid |
Mshta |
|
|
|
|
|
|
|
|
|
SQL Stored Procedures CONTRIBUTE A TEST |
Shortcut Modification |
Msiexec |
|
|
|
|
|
|
|
|
|
SSH Authorized Keys |
Startup Items |
NTFS File Attributes |
|
|
|
|
|
|
|
|
|
Scheduled Task |
Sudo and Sudo Caching |
Network Share Connection Removal |
|
|
|
|
|
|
|
|
|
Scheduled Task/Job CONTRIBUTE A TEST |
Systemd Service |
Obfuscated Files or Information |
|
|
|
|
|
|
|
|
|
Screensaver |
Thread Execution Hijacking CONTRIBUTE A TEST |
Odbcconf |
|
|
|
|
|
|
|
|
|
Security Support Provider |
Thread Local Storage CONTRIBUTE A TEST |
Parent PID Spoofing |
|
|
|
|
|
|
|
|
|
Server Software Component CONTRIBUTE A TEST |
Time Providers CONTRIBUTE A TEST |
Pass the Hash |
|
|
|
|
|
|
|
|
|
Services File Permissions Weakness CONTRIBUTE A TEST |
Token Impersonation/Theft CONTRIBUTE A TEST |
Pass the Ticket |
|
|
|
|
|
|
|
|
|
Services Registry Permissions Weakness |
Trap |
Password Filter DLL |
|
|
|
|
|
|
|
|
|
Shortcut Modification |
VDSO Hijacking CONTRIBUTE A TEST |
Path Interception by PATH Environment Variable CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Startup Items |
Valid Accounts CONTRIBUTE A TEST |
Path Interception by Search Order Hijacking CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
System Firmware CONTRIBUTE A TEST |
Windows Management Instrumentation Event Subscription |
Path Interception by Unquoted Path |
|
|
|
|
|
|
|
|
|
Systemd Service |
Windows Service |
Pluggable Authentication Modules CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Time Providers CONTRIBUTE A TEST |
Winlogon Helper DLL |
Port Knocking CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Traffic Signaling CONTRIBUTE A TEST |
|
Portable Executable Injection CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Transport Agent |
|
Pre-OS Boot CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Trap |
|
Proc Memory CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Valid Accounts CONTRIBUTE A TEST |
|
Process Doppelgänging CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Web Shell |
|
Process Hollowing |
|
|
|
|
|
|
|
|
|
Windows Management Instrumentation Event Subscription |
|
Process Injection |
|
|
|
|
|
|
|
|
|
Windows Service |
|
Ptrace System Calls CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
Winlogon Helper DLL |
|
PubPrn |
|
|
|
|
|
|
|
|
|
|
|
Redundant Access CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Regsvcs/Regasm |
|
|
|
|
|
|
|
|
|
|
|
Regsvr32 |
|
|
|
|
|
|
|
|
|
|
|
Rename System Utilities |
|
|
|
|
|
|
|
|
|
|
|
Revert Cloud Instance CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Right-to-Left Override CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Rogue Domain Controller |
|
|
|
|
|
|
|
|
|
|
|
Rootkit |
|
|
|
|
|
|
|
|
|
|
|
Run Virtual Instance CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Rundll32 |
|
|
|
|
|
|
|
|
|
|
|
SID-History Injection CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
SIP and Trust Provider Hijacking CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Scripting CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Services File Permissions Weakness CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Services Registry Permissions Weakness |
|
|
|
|
|
|
|
|
|
|
|
Setuid and Setgid |
|
|
|
|
|
|
|
|
|
|
|
Signed Binary Proxy Execution |
|
|
|
|
|
|
|
|
|
|
|
Signed Script Proxy Execution |
|
|
|
|
|
|
|
|
|
|
|
Software Packing |
|
|
|
|
|
|
|
|
|
|
|
Space after Filename |
|
|
|
|
|
|
|
|
|
|
|
Steganography CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Subvert Trust Controls CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Sudo and Sudo Caching |
|
|
|
|
|
|
|
|
|
|
|
System Checks CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
System Firmware CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Template Injection CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Thread Execution Hijacking CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Thread Local Storage CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Time Based Evasion CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Timestomp |
|
|
|
|
|
|
|
|
|
|
|
Token Impersonation/Theft CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Traffic Signaling CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Trusted Developer Utilities Proxy Execution CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Unused/Unsupported Cloud Regions CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Use Alternate Authentication Material CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
User Activity Based Checks CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
VDSO Hijacking CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Valid Accounts CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Virtualization/Sandbox Evasion CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Web Session Cookie CONTRIBUTE A TEST |
|
|
|
|
|
|
|
|
|
|
|
Windows File and Directory Permissions Modification |
|
|
|
|
|
|
|
|
|
|
|
XSL Script Processing |
|
|
|
|
|
|
|