Gather Victim Network Information

Gather Victim Org Information

Gather Victim Host Information

Search Open Websites/Domains

Search Victim-Owned Websites

Active Scanning

Search Open Technical Databases

Search Closed Sources

Phishing for Information

Search Threat Vendor Data

Query Public AI Services

Acquire Infrastructure

Compromise Infrastructure

Establish Accounts

Compromise Accounts

Develop Capabilities

Obtain Capabilities

Acquire Access

Generate Content

Supply Chain Compromise

Trusted Relationship

Content Injection

Wi-Fi Networks

Windows Management Instrumentation

Scheduled Task/Job

Software Deployment Tools

Native API

Trusted Developer Utilities Proxy Execution

Shared Modules

BITS Jobs

Inter-Process Communication

Container Administration Command

Deploy Container

Serverless Execution

Cloud Administration Command

Input Injection

ESXi Administration Command

Poisoned Pipeline Execution

Boot or Logon Initialization Scripts

Scheduled Task/Job

Modify Registry

Office Application Startup

Software Extensions

BITS Jobs

Traffic Signaling

Pre-OS Boot

Create or Modify System Process

Boot or Logon Autostart Execution

Modify Authentication Process

Power Settings

Exclusive Control

Cloud Application Integration

Boot or Logon Initialization Scripts

Scheduled Task/Job

Domain or Tenant Policy Modification

Create or Modify System Process

Boot or Logon Autostart Execution

Escape to Host

Input Capture

Multi-Factor Authentication Interception

Forced Authentication

Credentials from Password Stores

Modify Authentication Process

Steal or Forge Kerberos Tickets

Forge Web Credentials

Multi-Factor Authentication Request Generation

Steal or Forge Authentication Certificates

System Service Discovery

Application Window Discovery

Query Registry

System Network Configuration Discovery

Remote System Discovery

System Owner/User Discovery

System Network Connections Discovery

Permission Groups Discovery

System Information Discovery

Peripheral Device Discovery

System Time Discovery

Network Share Discovery

Password Policy Discovery

Browser Information Discovery

Domain Trust Discovery

Cloud Service Discovery

Cloud Service Dashboard

Cloud Infrastructure Discovery

Container and Resource Discovery

System Location Discovery

Group Policy Discovery

Cloud Storage Object Discovery

Debugger Evasion

Device Driver Discovery

Log Enumeration

Virtual Machine Discovery

Local Storage Discovery

Remote Services

Software Deployment Tools

Internal Spearphishing

Lateral Tool Transfer

Data from Removable Media

Data from Network Shared Drive

Input Capture

Data Staged

Screen Capture

Email Collection

Clipboard Data

Automated Collection

Audio Capture

Video Capture

Data from Cloud Storage

Archive Collected Data

Data from Configuration Repository

Data Obfuscation

Fallback Channels

Application Layer Protocol

Proxy

Communication Through Removable Media

Non-Application Layer Protocol

Web Service

Multi-Stage Channels

Data Encoding

Traffic Signaling

Remote Access Tools

Dynamic Resolution

Non-Standard Port

Protocol Tunneling

Encrypted Channel

Content Injection

Hide Infrastructure

Exfiltration Over Other Network Medium

Automated Exfiltration

Scheduled Transfer

Data Transfer Size Limits

Exfiltration Over C2 Channel

Exfiltration Over Alternative Protocol

Exfiltration Over Physical Medium

Transfer Data to Cloud Account

Exfiltration Over Web Service

Data Encrypted for Impact

Inhibit System Recovery

Firmware Corruption

Network Denial of Service

Disk Wipe

Financial Theft

Email Bombing