Gather Victim Org Information

Gather Victim Identity Information

Gather Victim Host Information

Search Open Websites/Domains

Gather Victim Network Information

Acquire Infrastructure

Obtain Capabilities

Develop Capabilities

Compromise Infrastructure

Exploit Public-Facing Application

Valid Accounts

Drive-by Compromise

External Remote Services

Phishing

Replication Through Removable Media

Supply Chain Compromise

Trusted Relationship

Hardware Additions

Exploitation for Client Execution

Command and Scripting Interpreter

Hijack Execution Flow

Scheduled Task/Job

User Execution

Windows Management Instrumentation

System Services

Native API

Software Deployment Tools

Trusted Developer Utilities Proxy Execution

BITS Jobs

Shared Modules

Inter-Process Communication

Valid Accounts

External Remote Services

Create Account

Account Manipulation

Scheduled Task/Job

Modify Registry

Software Extensions

Boot or Logon Autostart Execution

Boot or Logon Autostart Execution

Create or Modify System Process

Create or Modify System Process

Server Software Component

Server Software Component

Pre-OS Boot

Pre-OS Boot

Event Triggered Execution

Event Triggered Execution

BITS Jobs

Modify Authentication Process

Implant Internal Image

Implant Internal Image

Compromise Host Software Binary

Exploitation for Privilege Escalation

Valid Accounts

Process Injection

Account Manipulation

Scheduled Task/Job

Abuse Elevation Control Mechanism

Boot or Logon Autostart Execution

Boot or Logon Autostart Execution

Create or Modify System Process

Create or Modify System Process

Access Token Manipulation

Event Triggered Execution

Event Triggered Execution

Domain or Tenant Policy Modification

Domain or Tenant Policy Modification

OS Credential Dumping

Brute Force

Adversary-in-the-Middle

Unsecured Credentials

Steal Web Session Cookie

Steal Web Session Cookie

Input Capture

Credentials from Password Stores

Network Sniffing

Steal Application Access Token

Steal Application Access Token

Exploitation for Credential Access

Multi-Factor Authentication Interception

Steal or Forge Kerberos Tickets

Forced Authentication

Modify Authentication Process

File and Directory Discovery

System Information Discovery

Remote System Discovery

Process Discovery

System Owner/User Discovery

Virtualization/Sandbox Evasion

Virtualization/Sandbox Evasion

Network Service Discovery

Software Discovery

Software Discovery

System Network Configuration Discovery

Account Discovery

Query Registry

Network Share Discovery

Permission Groups Discovery

Application Window Discovery

System Network Connections Discovery

Network Sniffing

Domain Trust Discovery

Domain Trust Discovery

System Time Discovery

Peripheral Device Discovery

System Service Discovery

Browser Information Discovery

Exploitation of Remote Services

Remote Services

Replication Through Removable Media

Use Alternate Authentication Material

Software Deployment Tools

Remote Service Session Hijacking

Lateral Tool Transfer

Taint Shared Content

Internal Spearphishing

Internal Spearphishing

Data from Local System

Adversary-in-the-Middle

Input Capture

Browser Session Hijacking

Screen Capture

Data from Information Repositories

Archive Collected Data

Data from Cloud Storage

Data from Cloud Storage

Email Collection

Automated Collection

Data Staged

Clipboard Data

Data from Network Shared Drive

Video Capture

Audio Capture

Ingress Tool Transfer

Application Layer Protocol

Encrypted Channel

Proxy

Non-Application Layer Protocol

Protocol Tunneling

Non-Standard Port

Data Obfuscation

Remote Access Tools

Web Service

Fallback Channels

Data Encoding

Dynamic Resolution

Multi-Stage Channels

Exfiltration Over C2 Channel

Automated Exfiltration

Exfiltration Over Web Service

Exfiltration Over Alternative Protocol

Data Transfer Size Limits

Data Encrypted for Impact

Data Encrypted for Impact

Data Destruction

Data Destruction

Resource Hijacking

Resource Hijacking

Endpoint Denial of Service

Endpoint Denial of Service

Data Manipulation

Inhibit System Recovery

Inhibit System Recovery

Service Stop

Service Stop

Account Access Removal

Account Access Removal

Network Denial of Service

Network Denial of Service

Defacement

Defacement

System Shutdown/Reboot

System Shutdown/Reboot

Disk Wipe