# MITRE ATT&CK Reference

_Auto-generated from Enterprise ATT&CK Matrix_

## RECONNAISSANCE ([RECONNAISSANCE])

| T-Code | Technique Name | Description |
| :--- | :--- | :--- |
| `T1589` | [Gather Victim Identity Information](https://attack.mitre.org/techniques/T1589) | Adversaries may gather information about the victim's identity that can be used during targeting. In... |
| `T1589.001` | [  ↳ Credentials](https://attack.mitre.org/techniques/T1589/001) | Adversaries may gather credentials that can be used during targeting. Account credentials gathered b... |
| `T1589.002` | [  ↳ Email Addresses](https://attack.mitre.org/techniques/T1589/002) | Adversaries may gather email addresses that can be used during targeting. Even if internal instances... |
| `T1589.003` | [  ↳ Employee Names](https://attack.mitre.org/techniques/T1589/003) | Adversaries may gather employee names that can be used during targeting. Employee names be used to d... |
| `T1590` | [Gather Victim Network Information](https://attack.mitre.org/techniques/T1590) | Adversaries may gather information about the victim's networks that can be used during targeting. In... |
| `T1590.001` | [  ↳ Domain Properties](https://attack.mitre.org/techniques/T1590/001) | Adversaries may gather information about the victim's network domain(s) that can be used during targ... |
| `T1590.002` | [  ↳ DNS](https://attack.mitre.org/techniques/T1590/002) | Adversaries may gather information about the victim's DNS that can be used during targeting. DNS inf... |
| `T1590.003` | [  ↳ Network Trust Dependencies](https://attack.mitre.org/techniques/T1590/003) | Adversaries may gather information about the victim's network trust dependencies that can be used du... |
| `T1590.004` | [  ↳ Network Topology](https://attack.mitre.org/techniques/T1590/004) | Adversaries may gather information about the victim's network topology that can be used during targe... |
| `T1590.005` | [  ↳ IP Addresses](https://attack.mitre.org/techniques/T1590/005) | Adversaries may gather the victim's IP addresses that can be used during targeting. Public IP addres... |
| `T1590.006` | [  ↳ Network Security Appliances](https://attack.mitre.org/techniques/T1590/006) | Adversaries may gather information about the victim's network security appliances that can be used d... |
| `T1591` | [Gather Victim Org Information](https://attack.mitre.org/techniques/T1591) | Adversaries may gather information about the victim's organization that can be used during targeting... |
| `T1591.001` | [  ↳ Determine Physical Locations](https://attack.mitre.org/techniques/T1591/001) | Adversaries may gather the victim's physical location(s) that can be used during targeting. Informat... |
| `T1591.002` | [  ↳ Business Relationships](https://attack.mitre.org/techniques/T1591/002) | Adversaries may gather information about the victim's business relationships that can be used during... |
| `T1591.003` | [  ↳ Identify Business Tempo](https://attack.mitre.org/techniques/T1591/003) | Adversaries may gather information about the victim's business tempo that can be used during targeti... |
| `T1591.004` | [  ↳ Identify Roles](https://attack.mitre.org/techniques/T1591/004) | Adversaries may gather information about identities and roles within the victim organization that ca... |
| `T1592` | [Gather Victim Host Information](https://attack.mitre.org/techniques/T1592) | Adversaries may gather information about the victim's hosts that can be used during targeting. Infor... |
| `T1592.001` | [  ↳ Hardware](https://attack.mitre.org/techniques/T1592/001) | Adversaries may gather information about the victim's host hardware that can be used during targetin... |
| `T1592.002` | [  ↳ Software](https://attack.mitre.org/techniques/T1592/002) | Adversaries may gather information about the victim's host software that can be used during targetin... |
| `T1592.003` | [  ↳ Firmware](https://attack.mitre.org/techniques/T1592/003) | Adversaries may gather information about the victim's host firmware that can be used during targetin... |
| `T1592.004` | [  ↳ Client Configurations](https://attack.mitre.org/techniques/T1592/004) | Adversaries may gather information about the victim's client configurations that can be used during ... |
| `T1593` | [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) | Adversaries may search freely available websites and/or domains for information about victims that c... |
| `T1593.001` | [  ↳ Social Media](https://attack.mitre.org/techniques/T1593/001) | Adversaries may search social media for information about victims that can be used during targeting.... |
| `T1593.002` | [  ↳ Search Engines](https://attack.mitre.org/techniques/T1593/002) | Adversaries may use search engines to collect information about victims that can be used during targ... |
| `T1593.003` | [  ↳ Code Repositories](https://attack.mitre.org/techniques/T1593/003) | Adversaries may search public code repositories for information about victims that can be used durin... |
| `T1594` | [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594) | Adversaries may search websites owned by the victim for information that can be used during targetin... |
| `T1595` | [Active Scanning](https://attack.mitre.org/techniques/T1595) | Adversaries may execute active reconnaissance scans to gather information that can be used during ta... |
| `T1595.001` | [  ↳ Scanning IP Blocks](https://attack.mitre.org/techniques/T1595/001) | Adversaries may scan victim IP blocks to gather information that can be used during targeting. Publi... |
| `T1595.002` | [  ↳ Vulnerability Scanning](https://attack.mitre.org/techniques/T1595/002) | Adversaries may scan victims for vulnerabilities that can be used during targeting. Vulnerability sc... |
| `T1595.003` | [  ↳ Wordlist Scanning](https://attack.mitre.org/techniques/T1595/003) | Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques. While ... |
| `T1596` | [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596) | Adversaries may search freely available technical databases for information about victims that can b... |
| `T1596.001` | [  ↳ DNS/Passive DNS](https://attack.mitre.org/techniques/T1596/001) | Adversaries may search DNS data for information about victims that can be used during targeting. DNS... |
| `T1596.002` | [  ↳ WHOIS](https://attack.mitre.org/techniques/T1596/002) | Adversaries may search public WHOIS data for information about victims that can be used during targe... |
| `T1596.003` | [  ↳ Digital Certificates](https://attack.mitre.org/techniques/T1596/003) | Adversaries may search public digital certificate data for information about victims that can be use... |
| `T1596.004` | [  ↳ CDNs](https://attack.mitre.org/techniques/T1596/004) | Adversaries may search content delivery network (CDN) data about victims that can be used during tar... |
| `T1596.005` | [  ↳ Scan Databases](https://attack.mitre.org/techniques/T1596/005) | Adversaries may search within public scan databases for information about victims that can be used d... |
| `T1597` | [Search Closed Sources](https://attack.mitre.org/techniques/T1597) | Adversaries may search and gather information about victims from closed (e.g., paid, private, or oth... |
| `T1597.001` | [  ↳ Threat Intel Vendors](https://attack.mitre.org/techniques/T1597/001) | Adversaries may search private data from threat intelligence vendors for information that can be use... |
| `T1597.002` | [  ↳ Purchase Technical Data](https://attack.mitre.org/techniques/T1597/002) | Adversaries may purchase technical information about victims that can be used during targeting. Info... |
| `T1598` | [Phishing for Information](https://attack.mitre.org/techniques/T1598) | Adversaries may send phishing messages to elicit sensitive information that can be used during targe... |
| `T1598.001` | [  ↳ Spearphishing Service](https://attack.mitre.org/techniques/T1598/001) | Adversaries may send spearphishing messages via third-party services to elicit sensitive information... |
| `T1598.002` | [  ↳ Spearphishing Attachment](https://attack.mitre.org/techniques/T1598/002) | Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive informat... |
| `T1598.003` | [  ↳ Spearphishing Link](https://attack.mitre.org/techniques/T1598/003) | Adversaries may send spearphishing messages with a malicious link to elicit sensitive information th... |
| `T1598.004` | [  ↳ Spearphishing Voice](https://attack.mitre.org/techniques/T1598/004) | Adversaries may use voice communications to elicit sensitive information that can be used during tar... |
| `T1681` | [Search Threat Vendor Data](https://attack.mitre.org/techniques/T1681) | Threat actors may seek information/indicators from closed or open threat intelligence sources gather... |

## RESOURCE DEVELOPMENT ([RESOURCE-DEVELOPMENT])

| T-Code | Technique Name | Description |
| :--- | :--- | :--- |
| `T1583` | [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) | Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide... |
| `T1583.001` | [  ↳ Domains](https://attack.mitre.org/techniques/T1583/001) | Adversaries may acquire domains that can be used during targeting. Domain names are the human readab... |
| `T1583.002` | [  ↳ DNS Server](https://attack.mitre.org/techniques/T1583/002) | Adversaries may set up their own Domain Name System (DNS) servers that can be used during targeting.... |
| `T1583.003` | [  ↳ Virtual Private Server](https://attack.mitre.org/techniques/T1583/003) | Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting. There exist a... |
| `T1583.004` | [  ↳ Server](https://attack.mitre.org/techniques/T1583/004) | Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use ... |
| `T1583.005` | [  ↳ Botnet](https://attack.mitre.org/techniques/T1583/005) | Adversaries may buy, lease, or rent a network of compromised systems that can be used during targeti... |
| `T1583.006` | [  ↳ Web Services](https://attack.mitre.org/techniques/T1583/006) | Adversaries may register for web services that can be used during targeting. A variety of popular we... |
| `T1583.007` | [  ↳ Serverless](https://attack.mitre.org/techniques/T1583/007) | Adversaries may purchase and configure serverless cloud infrastructure, such as Cloudflare Workers, ... |
| `T1583.008` | [  ↳ Malvertising](https://attack.mitre.org/techniques/T1583/008) | Adversaries may purchase online advertisements that can be abused to distribute malware to victims. ... |
| `T1584` | [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584) | Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastruct... |
| `T1584.001` | [  ↳ Domains](https://attack.mitre.org/techniques/T1584/001) | Adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registrat... |
| `T1584.002` | [  ↳ DNS Server](https://attack.mitre.org/techniques/T1584/002) | Adversaries may compromise third-party DNS servers that can be used during targeting. During post-co... |
| `T1584.003` | [  ↳ Virtual Private Server](https://attack.mitre.org/techniques/T1584/003) | Adversaries may compromise third-party Virtual Private Servers (VPSs) that can be used during target... |
| `T1584.004` | [  ↳ Server](https://attack.mitre.org/techniques/T1584/004) | Adversaries may compromise third-party servers that can be used during targeting. Use of servers all... |
| `T1584.005` | [  ↳ Botnet](https://attack.mitre.org/techniques/T1584/005) | Adversaries may compromise numerous third-party systems to form a botnet that can be used during tar... |
| `T1584.006` | [  ↳ Web Services](https://attack.mitre.org/techniques/T1584/006) | Adversaries may compromise access to third-party web services that can be used during targeting. A v... |
| `T1584.007` | [  ↳ Serverless](https://attack.mitre.org/techniques/T1584/007) | Adversaries may compromise serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda f... |
| `T1584.008` | [  ↳ Network Devices](https://attack.mitre.org/techniques/T1584/008) | Adversaries may compromise third-party network devices that can be used during targeting. Network de... |
| `T1585` | [Establish Accounts](https://attack.mitre.org/techniques/T1585) | Adversaries may create and cultivate accounts with services that can be used during targeting. Adver... |
| `T1585.001` | [  ↳ Social Media Accounts](https://attack.mitre.org/techniques/T1585/001) | Adversaries may create and cultivate social media accounts that can be used during targeting. Advers... |
| `T1585.002` | [  ↳ Email Accounts](https://attack.mitre.org/techniques/T1585/002) | Adversaries may create email accounts that can be used during targeting. Adversaries can use account... |
| `T1585.003` | [  ↳ Cloud Accounts](https://attack.mitre.org/techniques/T1585/003) | Adversaries may create accounts with cloud providers that can be used during targeting. Adversaries ... |
| `T1586` | [Compromise Accounts](https://attack.mitre.org/techniques/T1586) | Adversaries may compromise accounts with services that can be used during targeting. For operations ... |
| `T1586.001` | [  ↳ Social Media Accounts](https://attack.mitre.org/techniques/T1586/001) | Adversaries may compromise social media accounts that can be used during targeting. For operations i... |
| `T1586.002` | [  ↳ Email Accounts](https://attack.mitre.org/techniques/T1586/002) | Adversaries may compromise email accounts that can be used during targeting. Adversaries can use com... |
| `T1586.003` | [  ↳ Cloud Accounts](https://attack.mitre.org/techniques/T1586/003) | Adversaries may compromise cloud accounts that can be used during targeting. Adversaries can use com... |
| `T1587` | [Develop Capabilities](https://attack.mitre.org/techniques/T1587) | Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely... |
| `T1587.001` | [  ↳ Malware](https://attack.mitre.org/techniques/T1587/001) | Adversaries may develop malware and malware components that can be used during targeting. Building m... |
| `T1587.002` | [  ↳ Code Signing Certificates](https://attack.mitre.org/techniques/T1587/002) | Adversaries may create self-signed code signing certificates that can be used during targeting. Code... |
| `T1587.003` | [  ↳ Digital Certificates](https://attack.mitre.org/techniques/T1587/003) | Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS c... |
| `T1587.004` | [  ↳ Exploits](https://attack.mitre.org/techniques/T1587/004) | Adversaries may develop exploits that can be used during targeting. An exploit takes advantage of a ... |
| `T1588` | [Obtain Capabilities](https://attack.mitre.org/techniques/T1588) | Adversaries may buy and/or steal capabilities that can be used during targeting. Rather than develop... |
| `T1588.001` | [  ↳ Malware](https://attack.mitre.org/techniques/T1588/001) | Adversaries may buy, steal, or download malware that can be used during targeting. Malicious softwar... |
| `T1588.002` | [  ↳ Tool](https://attack.mitre.org/techniques/T1588/002) | Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can ... |
| `T1588.003` | [  ↳ Code Signing Certificates](https://attack.mitre.org/techniques/T1588/003) | Adversaries may buy and/or steal code signing certificates that can be used during targeting. Code s... |
| `T1588.004` | [  ↳ Digital Certificates](https://attack.mitre.org/techniques/T1588/004) | Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS cer... |
| `T1588.005` | [  ↳ Exploits](https://attack.mitre.org/techniques/T1588/005) | Adversaries may buy, steal, or download exploits that can be used during targeting. An exploit takes... |
| `T1588.006` | [  ↳ Vulnerabilities](https://attack.mitre.org/techniques/T1588/006) | Adversaries may acquire information about vulnerabilities that can be used during targeting. A vulne... |
| `T1588.007` | [  ↳ Artificial Intelligence](https://attack.mitre.org/techniques/T1588/007) | Adversaries may obtain access to generative artificial intelligence tools, such as large language mo... |
| `T1608` | [Stage Capabilities](https://attack.mitre.org/techniques/T1608) | Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting.... |
| `T1608.001` | [  ↳ Upload Malware](https://attack.mitre.org/techniques/T1608/001) | Adversaries may upload malware to third-party or adversary controlled infrastructure to make it acce... |
| `T1608.002` | [  ↳ Upload Tool](https://attack.mitre.org/techniques/T1608/002) | Adversaries may upload tools to third-party or adversary controlled infrastructure to make it access... |
| `T1608.003` | [  ↳ Install Digital Certificate](https://attack.mitre.org/techniques/T1608/003) | Adversaries may install SSL/TLS certificates that can be used during targeting. SSL/TLS certificates... |
| `T1608.004` | [  ↳ Drive-by Target](https://attack.mitre.org/techniques/T1608/004) | Adversaries may prepare an operational environment to infect systems that visit a website over the n... |
| `T1608.005` | [  ↳ Link Target](https://attack.mitre.org/techniques/T1608/005) | Adversaries may put in place resources that are referenced by a link that can be used during targeti... |
| `T1608.006` | [  ↳ SEO Poisoning](https://attack.mitre.org/techniques/T1608/006) | Adversaries may poison mechanisms that influence search engine optimization (SEO) to further lure st... |
| `T1650` | [Acquire Access](https://attack.mitre.org/techniques/T1650) | Adversaries may purchase or otherwise acquire an existing access to a target system or network. A va... |

## INITIAL ACCESS ([INITIAL-ACCESS])

| T-Code | Technique Name | Description |
| :--- | :--- | :--- |
| `T1078` | [Valid Accounts](https://attack.mitre.org/techniques/T1078) | Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Acce... |
| `T1078.001` | [  ↳ Default Accounts](https://attack.mitre.org/techniques/T1078/001) | Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Acce... |
| `T1078.002` | [  ↳ Domain Accounts](https://attack.mitre.org/techniques/T1078/002) | Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Acces... |
| `T1078.003` | [  ↳ Local Accounts](https://attack.mitre.org/techniques/T1078/003) | Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access... |
| `T1078.004` | [  ↳ Cloud Accounts](https://attack.mitre.org/techniques/T1078/004) | Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Acc... |
| `T1091` | [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091) | Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying... |
| `T1133` | [External Remote Services](https://attack.mitre.org/techniques/T1133) | Adversaries may leverage external-facing remote services to initially access and/or persist within a... |
| `T1189` | [Drive-by Compromise](https://attack.mitre.org/techniques/T1189) | Adversaries may gain access to a system through a user visiting a website over the normal course of ... |
| `T1190` | [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) | Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially acce... |
| `T1195` | [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) | Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consu... |
| `T1195.001` | [  ↳ Compromise Software Dependencies and Development Tools](https://attack.mitre.org/techniques/T1195/001) | Adversaries may manipulate software dependencies and development tools prior to receipt by a final c... |
| `T1195.002` | [  ↳ Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002) | Adversaries may manipulate application software prior to receipt by a final consumer for the purpose... |
| `T1195.003` | [  ↳ Compromise Hardware Supply Chain](https://attack.mitre.org/techniques/T1195/003) | Adversaries may manipulate hardware components in products prior to receipt by a final consumer for ... |
| `T1199` | [Trusted Relationship](https://attack.mitre.org/techniques/T1199) | Adversaries may breach or otherwise leverage organizations who have access to intended victims. Acce... |
| `T1200` | [Hardware Additions](https://attack.mitre.org/techniques/T1200) | Adversaries may physically introduce computer accessories, networking hardware, or other computing d... |
| `T1566` | [Phishing](https://attack.mitre.org/techniques/T1566) | Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are e... |
| `T1566.001` | [  ↳ Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) | Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access t... |
| `T1566.002` | [  ↳ Spearphishing Link](https://attack.mitre.org/techniques/T1566/002) | Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to vict... |
| `T1566.003` | [  ↳ Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003) | Adversaries may send spearphishing messages via third-party services in an attempt to gain access to... |
| `T1566.004` | [  ↳ Spearphishing Voice](https://attack.mitre.org/techniques/T1566/004) | Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing ... |
| `T1659` | [Content Injection](https://attack.mitre.org/techniques/T1659) | Adversaries may gain access and continuously communicate with victims by injecting malicious content... |
| `T1669` | [Wi-Fi Networks](https://attack.mitre.org/techniques/T1669) | Adversaries may gain initial access to target systems by connecting to wireless networks. They may a... |

## EXECUTION ([EXECUTION])

| T-Code | Technique Name | Description |
| :--- | :--- | :--- |
| `T1047` | [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) | Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and pay... |
| `T1053` | [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053) | Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of ... |
| `T1053.002` | [  ↳ At](https://attack.mitre.org/techniques/T1053/002) | Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task sche... |
| `T1053.003` | [  ↳ Cron](https://attack.mitre.org/techniques/T1053/003) | Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurr... |
| `T1053.005` | [  ↳ Scheduled Task](https://attack.mitre.org/techniques/T1053/005) | Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring... |
| `T1053.006` | [  ↳ Systemd Timers](https://attack.mitre.org/techniques/T1053/006) | Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution o... |
| `T1053.007` | [  ↳ Container Orchestration Job](https://attack.mitre.org/techniques/T1053/007) | Adversaries may abuse task scheduling functionality provided by container orchestration tools such a... |
| `T1059` | [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) | Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. The... |
| `T1059.001` | [  ↳ PowerShell](https://attack.mitre.org/techniques/T1059/001) | Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful intera... |
| `T1059.002` | [  ↳ AppleScript](https://attack.mitre.org/techniques/T1059/002) | Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed ... |
| `T1059.003` | [  ↳ Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) | Adversaries may abuse the Windows command shell for execution. The Windows command shell ([cmd](http... |
| `T1059.004` | [  ↳ Unix Shell](https://attack.mitre.org/techniques/T1059/004) | Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary com... |
| `T1059.005` | [  ↳ Visual Basic](https://attack.mitre.org/techniques/T1059/005) | Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Micro... |
| `T1059.006` | [  ↳ Python](https://attack.mitre.org/techniques/T1059/006) | Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/... |
| `T1059.007` | [  ↳ JavaScript](https://attack.mitre.org/techniques/T1059/007) | Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a plat... |
| `T1059.008` | [  ↳ Network Device CLI](https://attack.mitre.org/techniques/T1059/008) | Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to ex... |
| `T1059.009` | [  ↳ Cloud API](https://attack.mitre.org/techniques/T1059/009) | Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments... |
| `T1059.010` | [  ↳ AutoHotKey & AutoIT](https://attack.mitre.org/techniques/T1059/010) | Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation ... |
| `T1059.011` | [  ↳ Lua](https://attack.mitre.org/techniques/T1059/011) | Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and ... |
| `T1059.012` | [  ↳ Hypervisor CLI](https://attack.mitre.org/techniques/T1059/012) | Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands. Hyp... |
| `T1059.013` | [  ↳ Container CLI/API](https://attack.mitre.org/techniques/T1059/013) | Adversaries may abuse built-in CLI tools or API calls to execute malicious commands in containerized... |
| `T1072` | [Software Deployment Tools](https://attack.mitre.org/techniques/T1072) | Adversaries may gain access to and use centralized software suites installed within an enterprise to... |
| `T1106` | [Native API](https://attack.mitre.org/techniques/T1106) | Adversaries may interact with the native OS application programming interface (API) to execute behav... |
| `T1129` | [Shared Modules](https://attack.mitre.org/techniques/T1129) | Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable... |
| `T1203` | [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203) | Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabili... |
| `T1204` | [User Execution](https://attack.mitre.org/techniques/T1204) | An adversary may rely upon specific actions by a user in order to gain execution. Users may be subje... |
| `T1204.001` | [  ↳ Malicious Link](https://attack.mitre.org/techniques/T1204/001) | An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be... |
| `T1204.002` | [  ↳ Malicious File](https://attack.mitre.org/techniques/T1204/002) | An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be ... |
| `T1204.003` | [  ↳ Malicious Image](https://attack.mitre.org/techniques/T1204/003) | Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Service... |
| `T1204.004` | [  ↳ Malicious Copy and Paste](https://attack.mitre.org/techniques/T1204/004) | An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be ... |
| `T1204.005` | [  ↳ Malicious Library](https://attack.mitre.org/techniques/T1204/005) | Adversaries may rely on a user installing a malicious library to facilitate execution. Threat actors... |
| `T1559` | [Inter-Process Communication](https://attack.mitre.org/techniques/T1559) | Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command executi... |
| `T1559.001` | [  ↳ Component Object Model](https://attack.mitre.org/techniques/T1559/001) | Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an int... |
| `T1559.002` | [  ↳ Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) | Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a clie... |
| `T1559.003` | [  ↳ XPC Services](https://attack.mitre.org/techniques/T1559/003) | Adversaries can provide malicious content to an XPC service daemon for local code execution. macOS u... |
| `T1569` | [System Services](https://attack.mitre.org/techniques/T1569) | Adversaries may abuse system services or daemons to execute commands or programs. Adversaries can ex... |
| `T1569.001` | [  ↳ Launchctl](https://attack.mitre.org/techniques/T1569/001) | Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, ... |
| `T1569.002` | [  ↳ Service Execution](https://attack.mitre.org/techniques/T1569/002) | Adversaries may abuse the Windows service control manager to execute malicious commands or payloads.... |
| `T1569.003` | [  ↳ Systemctl](https://attack.mitre.org/techniques/T1569/003) | Adversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface ... |
| `T1609` | [Container Administration Command](https://attack.mitre.org/techniques/T1609) | Adversaries may abuse a container administration service to execute commands within a container. A c... |
| `T1610` | [Deploy Container](https://attack.mitre.org/techniques/T1610) | Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In... |
| `T1648` | [Serverless Execution](https://attack.mitre.org/techniques/T1648) | Adversaries may abuse serverless computing, integration, and automation services to execute arbitrar... |
| `T1651` | [Cloud Administration Command](https://attack.mitre.org/techniques/T1651) | Adversaries may abuse cloud management services to execute commands within virtual machines. Resourc... |
| `T1674` | [Input Injection](https://attack.mitre.org/techniques/T1674) | Adversaries may simulate keystrokes on a victim’s computer by various means to perform any type of a... |
| `T1675` | [ESXi Administration Command](https://attack.mitre.org/techniques/T1675) | Adversaries may abuse ESXi administration services to execute commands on guest machines hosted with... |
| `T1677` | [Poisoned Pipeline Execution](https://attack.mitre.org/techniques/T1677) | Adversaries may manipulate continuous integration / continuous development (CI/CD) processes by inje... |

## PERSISTENCE ([PERSISTENCE])

| T-Code | Technique Name | Description |
| :--- | :--- | :--- |
| `T1037` | [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037) | Adversaries may use scripts automatically executed at boot or logon initialization to establish pers... |
| `T1037.001` | [  ↳ Logon Script (Windows)](https://attack.mitre.org/techniques/T1037/001) | Adversaries may use Windows logon scripts automatically executed at logon initialization to establis... |
| `T1037.002` | [  ↳ Login Hook](https://attack.mitre.org/techniques/T1037/002) | Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is ... |
| `T1037.003` | [  ↳ Network Logon Script](https://attack.mitre.org/techniques/T1037/003) | Adversaries may use network logon scripts automatically executed at logon initialization to establis... |
| `T1037.004` | [  ↳ RC Scripts](https://attack.mitre.org/techniques/T1037/004) | Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like... |
| `T1037.005` | [  ↳ Startup Items](https://attack.mitre.org/techniques/T1037/005) | Adversaries may use startup items automatically executed at boot initialization to establish persist... |
| `T1053` | [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053) | Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of ... |
| `T1053.002` | [  ↳ At](https://attack.mitre.org/techniques/T1053/002) | Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task sche... |
| `T1053.003` | [  ↳ Cron](https://attack.mitre.org/techniques/T1053/003) | Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurr... |
| `T1053.005` | [  ↳ Scheduled Task](https://attack.mitre.org/techniques/T1053/005) | Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring... |
| `T1053.006` | [  ↳ Systemd Timers](https://attack.mitre.org/techniques/T1053/006) | Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution o... |
| `T1053.007` | [  ↳ Container Orchestration Job](https://attack.mitre.org/techniques/T1053/007) | Adversaries may abuse task scheduling functionality provided by container orchestration tools such a... |
| `T1078` | [Valid Accounts](https://attack.mitre.org/techniques/T1078) | Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Acce... |
| `T1078.001` | [  ↳ Default Accounts](https://attack.mitre.org/techniques/T1078/001) | Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Acce... |
| `T1078.002` | [  ↳ Domain Accounts](https://attack.mitre.org/techniques/T1078/002) | Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Acces... |
| `T1078.003` | [  ↳ Local Accounts](https://attack.mitre.org/techniques/T1078/003) | Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access... |
| `T1078.004` | [  ↳ Cloud Accounts](https://attack.mitre.org/techniques/T1078/004) | Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Acc... |
| `T1098` | [Account Manipulation](https://attack.mitre.org/techniques/T1098) | Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account man... |
| `T1098.001` | [  ↳ Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) | Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent acces... |
| `T1098.002` | [  ↳ Additional Email Delegate Permissions](https://attack.mitre.org/techniques/T1098/002) | Adversaries may grant additional permission levels to maintain persistent access to an adversary-con... |
| `T1098.003` | [  ↳ Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) | An adversary may add additional roles or permissions to an adversary-controlled cloud account to mai... |
| `T1098.004` | [  ↳ SSH Authorized Keys](https://attack.mitre.org/techniques/T1098/004) | Adversaries may modify the SSH <code>authorized_keys</code> file to maintain persistence on a victim... |
| `T1098.005` | [  ↳ Device Registration](https://attack.mitre.org/techniques/T1098/005) | Adversaries may register a device to an adversary-controlled account. Devices may be registered in a... |
| `T1098.006` | [  ↳ Additional Container Cluster Roles](https://attack.mitre.org/techniques/T1098/006) | An adversary may add additional roles or permissions to an adversary-controlled user or service acco... |
| `T1098.007` | [  ↳ Additional Local or Domain Groups](https://attack.mitre.org/techniques/T1098/007) | An adversary may add additional local or domain groups to an adversary-controlled account to maintai... |
| `T1112` | [Modify Registry](https://attack.mitre.org/techniques/T1112) | Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid i... |
| `T1133` | [External Remote Services](https://attack.mitre.org/techniques/T1133) | Adversaries may leverage external-facing remote services to initially access and/or persist within a... |
| `T1136` | [Create Account](https://attack.mitre.org/techniques/T1136) | Adversaries may create an account to maintain access to victim systems.(Citation: Symantec WastedLoc... |
| `T1136.001` | [  ↳ Local Account](https://attack.mitre.org/techniques/T1136/001) | Adversaries may create a local account to maintain access to victim systems. Local accounts are thos... |
| `T1136.002` | [  ↳ Domain Account](https://attack.mitre.org/techniques/T1136/002) | Adversaries may create a domain account to maintain access to victim systems. Domain accounts are th... |
| `T1136.003` | [  ↳ Cloud Account](https://attack.mitre.org/techniques/T1136/003) | Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level... |
| `T1137` | [Office Application Startup](https://attack.mitre.org/techniques/T1137) | Adversaries may leverage Microsoft Office-based applications for persistence between startups. Micro... |
| `T1137.001` | [  ↳ Office Template Macros](https://attack.mitre.org/techniques/T1137/001) | Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Micr... |
| `T1137.002` | [  ↳ Office Test](https://attack.mitre.org/techniques/T1137/002) | Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a com... |
| `T1137.003` | [  ↳ Outlook Forms](https://attack.mitre.org/techniques/T1137/003) | Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system. Outlook... |
| `T1137.004` | [  ↳ Outlook Home Page](https://attack.mitre.org/techniques/T1137/004) | Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised s... |
| `T1137.005` | [  ↳ Outlook Rules](https://attack.mitre.org/techniques/T1137/005) | Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system. Outlook... |
| `T1137.006` | [  ↳ Add-ins](https://attack.mitre.org/techniques/T1137/006) | Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office... |
| `T1176` | [Software Extensions](https://attack.mitre.org/techniques/T1176) | Adversaries may abuse software extensions to establish persistent access to victim systems. Software... |
| `T1176.001` | [  ↳ Browser Extensions](https://attack.mitre.org/techniques/T1176/001) | Adversaries may abuse internet browser extensions to establish persistent access to victim systems. ... |
| `T1176.002` | [  ↳ IDE Extensions](https://attack.mitre.org/techniques/T1176/002) | Adversaries may abuse an integrated development environment (IDE) extension to establish persistent ... |
| `T1197` | [BITS Jobs](https://attack.mitre.org/techniques/T1197) | Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. W... |
| `T1205` | [Traffic Signaling](https://attack.mitre.org/techniques/T1205) | Adversaries may use traffic signaling to hide open ports or other malicious functionality used for p... |
| `T1205.001` | [  ↳ Port Knocking](https://attack.mitre.org/techniques/T1205/001) | Adversaries may use port knocking to hide open ports used for persistence or command and control. To... |
| `T1205.002` | [  ↳ Socket Filters](https://attack.mitre.org/techniques/T1205/002) | Adversaries may attach filters to a network socket to monitor then activate backdoors used for persi... |
| `T1505` | [Server Software Component](https://attack.mitre.org/techniques/T1505) | Adversaries may abuse legitimate extensible development features of servers to establish persistent ... |
| `T1505.001` | [  ↳ SQL Stored Procedures](https://attack.mitre.org/techniques/T1505/001) | Adversaries may abuse SQL stored procedures to establish persistent access to systems. SQL Stored Pr... |
| `T1505.002` | [  ↳ Transport Agent](https://attack.mitre.org/techniques/T1505/002) | Adversaries may abuse Microsoft transport agents to establish persistent access to systems. Microsof... |
| `T1505.003` | [  ↳ Web Shell](https://attack.mitre.org/techniques/T1505/003) | Adversaries may backdoor web servers with web shells to establish persistent access to systems. A We... |
| `T1505.004` | [  ↳ IIS Components](https://attack.mitre.org/techniques/T1505/004) | Adversaries may install malicious components that run on Internet Information Services (IIS) web ser... |
| `T1505.005` | [  ↳ Terminal Services DLL](https://attack.mitre.org/techniques/T1505/005) | Adversaries may abuse components of Terminal Services to enable persistent access to systems. Micros... |
| `T1505.006` | [  ↳ vSphere Installation Bundles](https://attack.mitre.org/techniques/T1505/006) | Adversaries may abuse vSphere Installation Bundles (VIBs) to establish persistent access to ESXi hyp... |
| `T1525` | [Implant Internal Image](https://attack.mitre.org/techniques/T1525) | Adversaries may implant cloud or container images with malicious code to establish persistence after... |
| `T1542` | [Pre-OS Boot](https://attack.mitre.org/techniques/T1542) | Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During t... |
| `T1542.001` | [  ↳ System Firmware](https://attack.mitre.org/techniques/T1542/001) | Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) an... |
| `T1542.002` | [  ↳ Component Firmware](https://attack.mitre.org/techniques/T1542/002) | Adversaries may modify component firmware to persist on systems. Some adversaries may employ sophist... |
| `T1542.003` | [  ↳ Bootkit](https://attack.mitre.org/techniques/T1542/003) | Adversaries may use bootkits to persist on systems. A bootkit is a malware variant that modifies the... |
| `T1542.004` | [  ↳ ROMMONkit](https://attack.mitre.org/techniques/T1542/004) | Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary co... |
| `T1542.005` | [  ↳ TFTP Boot](https://attack.mitre.org/techniques/T1542/005) | Adversaries may abuse netbooting to load an unauthorized network device operating system from a Triv... |
| `T1543` | [Create or Modify System Process](https://attack.mitre.org/techniques/T1543) | Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as ... |
| `T1543.001` | [  ↳ Launch Agent](https://attack.mitre.org/techniques/T1543/001) | Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of p... |
| `T1543.002` | [  ↳ Systemd Service](https://attack.mitre.org/techniques/T1543/002) | Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part o... |
| `T1543.003` | [  ↳ Windows Service](https://attack.mitre.org/techniques/T1543/003) | Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part o... |
| `T1543.004` | [  ↳ Launch Daemon](https://attack.mitre.org/techniques/T1543/004) | Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence... |
| `T1543.005` | [  ↳ Container Service](https://attack.mitre.org/techniques/T1543/005) | Adversaries may create or modify container or container cluster management tools that run as daemons... |
| `T1546` | [Event Triggered Execution](https://attack.mitre.org/techniques/T1546) | Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger... |
| `T1546.001` | [  ↳ Change Default File Association](https://attack.mitre.org/techniques/T1546/001) | Adversaries may establish persistence by executing malicious content triggered by a file type associ... |
| `T1546.002` | [  ↳ Screensaver](https://attack.mitre.org/techniques/T1546/002) | Adversaries may establish persistence by executing malicious content triggered by user inactivity. S... |
| `T1546.003` | [  ↳ Windows Management Instrumentation Event Subscription](https://attack.mitre.org/techniques/T1546/003) | Adversaries may establish persistence and elevate privileges by executing malicious content triggere... |
| `T1546.004` | [  ↳ Unix Shell Configuration Modification](https://attack.mitre.org/techniques/T1546/004) | Adversaries may establish persistence through executing malicious commands triggered by a user’s she... |
| `T1546.005` | [  ↳ Trap](https://attack.mitre.org/techniques/T1546/005) | Adversaries may establish persistence by executing malicious content triggered by an interrupt signa... |
| `T1546.006` | [  ↳ LC_LOAD_DYLIB Addition](https://attack.mitre.org/techniques/T1546/006) | Adversaries may establish persistence by executing malicious content triggered by the execution of t... |
| `T1546.007` | [  ↳ Netsh Helper DLL](https://attack.mitre.org/techniques/T1546/007) | Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs.... |
| `T1546.008` | [  ↳ Accessibility Features](https://attack.mitre.org/techniques/T1546/008) | Adversaries may establish persistence and/or elevate privileges by executing malicious content trigg... |
| `T1546.009` | [  ↳ AppCert DLLs](https://attack.mitre.org/techniques/T1546/009) | Adversaries may establish persistence and/or elevate privileges by executing malicious content trigg... |
| `T1546.010` | [  ↳ AppInit DLLs](https://attack.mitre.org/techniques/T1546/010) | Adversaries may establish persistence and/or elevate privileges by executing malicious content trigg... |
| `T1546.011` | [  ↳ Application Shimming](https://attack.mitre.org/techniques/T1546/011) | Adversaries may establish persistence and/or elevate privileges by executing malicious content trigg... |
| `T1546.012` | [  ↳ Image File Execution Options Injection](https://attack.mitre.org/techniques/T1546/012) | Adversaries may establish persistence and/or elevate privileges by executing malicious content trigg... |
| `T1546.013` | [  ↳ PowerShell Profile](https://attack.mitre.org/techniques/T1546/013) | Adversaries may gain persistence and elevate privileges by executing malicious content triggered by ... |
| `T1546.014` | [  ↳ Emond](https://attack.mitre.org/techniques/T1546/014) | Adversaries may gain persistence and elevate privileges by executing malicious content triggered by ... |
| `T1546.015` | [  ↳ Component Object Model Hijacking](https://attack.mitre.org/techniques/T1546/015) | Adversaries may establish persistence by executing malicious content triggered by hijacked reference... |
| `T1546.016` | [  ↳ Installer Packages](https://attack.mitre.org/techniques/T1546/016) | Adversaries may establish persistence and elevate privileges by using an installer to trigger the ex... |
| `T1546.017` | [  ↳ Udev Rules](https://attack.mitre.org/techniques/T1546/017) | Adversaries may maintain persistence through executing malicious content triggered using udev rules.... |
| `T1546.018` | [  ↳ Python Startup Hooks](https://attack.mitre.org/techniques/T1546/018) | Adversaries may achieve persistence by leveraging Python’s startup mechanisms, including path config... |
| `T1547` | [Boot or Logon Autostart Execution](https://attack.mitre.org/techniques/T1547) | Adversaries may configure system settings to automatically execute a program during system boot or l... |
| `T1547.001` | [  ↳ Registry Run Keys / Startup Folder](https://attack.mitre.org/techniques/T1547/001) | Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a... |
| `T1547.002` | [  ↳ Authentication Package](https://attack.mitre.org/techniques/T1547/002) | Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authent... |
| `T1547.003` | [  ↳ Time Providers](https://attack.mitre.org/techniques/T1547/003) | Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service... |
| `T1547.004` | [  ↳ Winlogon Helper DLL](https://attack.mitre.org/techniques/T1547/004) | Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. W... |
| `T1547.005` | [  ↳ Security Support Provider](https://attack.mitre.org/techniques/T1547/005) | Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windo... |
| `T1547.006` | [  ↳ Kernel Modules and Extensions](https://attack.mitre.org/techniques/T1547/006) | Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel ... |
| `T1547.007` | [  ↳ Re-opened Applications](https://attack.mitre.org/techniques/T1547/007) | Adversaries may modify plist files to automatically run an application when a user logs in. When a u... |
| `T1547.008` | [  ↳ LSASS Driver](https://attack.mitre.org/techniques/T1547/008) | Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Window... |
| `T1547.009` | [  ↳ Shortcut Modification](https://attack.mitre.org/techniques/T1547/009) | Adversaries may create or modify shortcuts that can execute a program during system boot or user log... |
| `T1547.010` | [  ↳ Port Monitors](https://attack.mitre.org/techniques/T1547/010) | Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistenc... |
| `T1547.012` | [  ↳ Print Processors](https://attack.mitre.org/techniques/T1547/012) | Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/... |
| `T1547.013` | [  ↳ XDG Autostart Entries](https://attack.mitre.org/techniques/T1547/013) | Adversaries may add or modify XDG Autostart Entries to execute malicious programs or commands when a... |
| `T1547.014` | [  ↳ Active Setup](https://attack.mitre.org/techniques/T1547/014) | Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machin... |
| `T1547.015` | [  ↳ Login Items](https://attack.mitre.org/techniques/T1547/015) | Adversaries may add login items to execute upon user login to gain persistence or escalate privilege... |
| `T1554` | [Compromise Host Software Binary](https://attack.mitre.org/techniques/T1554) | Adversaries may modify host software binaries to establish persistent access to systems. Software bi... |
| `T1556` | [Modify Authentication Process](https://attack.mitre.org/techniques/T1556) | Adversaries may modify authentication mechanisms and processes to access user credentials or enable ... |
| `T1556.001` | [  ↳ Domain Controller Authentication](https://attack.mitre.org/techniques/T1556/001) | Adversaries may patch the authentication process on a domain controller to bypass the typical authen... |
| `T1556.002` | [  ↳ Password Filter DLL](https://attack.mitre.org/techniques/T1556/002) | Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentica... |
| `T1556.003` | [  ↳ Pluggable Authentication Modules](https://attack.mitre.org/techniques/T1556/003) | Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable o... |
| `T1556.004` | [  ↳ Network Device Authentication](https://attack.mitre.org/techniques/T1556/004) | Adversaries may use [Patch System Image](https://attack.mitre.org/techniques/T1601/001) to hard code... |
| `T1556.005` | [  ↳ Reversible Encryption](https://attack.mitre.org/techniques/T1556/005) | An adversary may abuse Active Directory authentication encryption properties to gain access to crede... |
| `T1556.006` | [  ↳ Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006) | Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent ... |
| `T1556.007` | [  ↳ Hybrid Identity](https://attack.mitre.org/techniques/T1556/007) | Adversaries may patch, modify, or otherwise backdoor cloud authentication processes that are tied to... |
| `T1556.008` | [  ↳ Network Provider DLL](https://attack.mitre.org/techniques/T1556/008) | Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture clearte... |
| `T1556.009` | [  ↳ Conditional Access Policies](https://attack.mitre.org/techniques/T1556/009) | Adversaries may disable or modify conditional access policies to enable persistent access to comprom... |
| `T1574` | [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574) | Adversaries may execute their own malicious payloads by hijacking the way operating systems run prog... |
| `T1574.001` | [  ↳ DLL](https://attack.mitre.org/techniques/T1574/001) | Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate pr... |
| `T1574.004` | [  ↳ Dylib Hijacking](https://attack.mitre.org/techniques/T1574/004) | Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an ex... |
| `T1574.005` | [  ↳ Executable Installer File Permissions Weakness](https://attack.mitre.org/techniques/T1574/005) | Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer.... |
| `T1574.006` | [  ↳ Dynamic Linker Hijacking](https://attack.mitre.org/techniques/T1574/006) | Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic ... |
| `T1574.007` | [  ↳ Path Interception by PATH Environment Variable](https://attack.mitre.org/techniques/T1574/007) | Adversaries may execute their own malicious payloads by hijacking environment variables used to load... |
| `T1574.008` | [  ↳ Path Interception by Search Order Hijacking](https://attack.mitre.org/techniques/T1574/008) | Adversaries may execute their own malicious payloads by hijacking the search order used to load othe... |
| `T1574.009` | [  ↳ Path Interception by Unquoted Path](https://attack.mitre.org/techniques/T1574/009) | Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. A... |
| `T1574.010` | [  ↳ Services File Permissions Weakness](https://attack.mitre.org/techniques/T1574/010) | Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adv... |
| `T1574.011` | [  ↳ Services Registry Permissions Weakness](https://attack.mitre.org/techniques/T1574/011) | Adversaries may execute their own malicious payloads by hijacking the Registry entries used by servi... |
| `T1574.012` | [  ↳ COR_PROFILER](https://attack.mitre.org/techniques/T1574/012) | Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of progr... |
| `T1574.013` | [  ↳ KernelCallbackTable](https://attack.mitre.org/techniques/T1574/013) | Adversaries may abuse the <code>KernelCallbackTable</code> of a process to hijack its execution flow... |
| `T1574.014` | [  ↳ AppDomainManager](https://attack.mitre.org/techniques/T1574/014) | Adversaries may execute their own malicious payloads by hijacking how the .NET `AppDomainManager` lo... |
| `T1653` | [Power Settings](https://attack.mitre.org/techniques/T1653) | Adversaries may impair a system's ability to hibernate, reboot, or shut down in order to extend acce... |
| `T1668` | [Exclusive Control](https://attack.mitre.org/techniques/T1668) | Adversaries who successfully compromise a system may attempt to maintain persistence by “closing the... |
| `T1671` | [Cloud Application Integration](https://attack.mitre.org/techniques/T1671) | Adversaries may achieve persistence by leveraging OAuth application integrations in a software-as-a-... |

## PRIVILEGE ESCALATION ([PRIVILEGE-ESCALATION])

| T-Code | Technique Name | Description |
| :--- | :--- | :--- |
| `T1037` | [Boot or Logon Initialization Scripts](https://attack.mitre.org/techniques/T1037) | Adversaries may use scripts automatically executed at boot or logon initialization to establish pers... |
| `T1037.001` | [  ↳ Logon Script (Windows)](https://attack.mitre.org/techniques/T1037/001) | Adversaries may use Windows logon scripts automatically executed at logon initialization to establis... |
| `T1037.002` | [  ↳ Login Hook](https://attack.mitre.org/techniques/T1037/002) | Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is ... |
| `T1037.003` | [  ↳ Network Logon Script](https://attack.mitre.org/techniques/T1037/003) | Adversaries may use network logon scripts automatically executed at logon initialization to establis... |
| `T1037.004` | [  ↳ RC Scripts](https://attack.mitre.org/techniques/T1037/004) | Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like... |
| `T1037.005` | [  ↳ Startup Items](https://attack.mitre.org/techniques/T1037/005) | Adversaries may use startup items automatically executed at boot initialization to establish persist... |
| `T1053` | [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053) | Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of ... |
| `T1053.002` | [  ↳ At](https://attack.mitre.org/techniques/T1053/002) | Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task sche... |
| `T1053.003` | [  ↳ Cron](https://attack.mitre.org/techniques/T1053/003) | Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurr... |
| `T1053.005` | [  ↳ Scheduled Task](https://attack.mitre.org/techniques/T1053/005) | Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring... |
| `T1053.006` | [  ↳ Systemd Timers](https://attack.mitre.org/techniques/T1053/006) | Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution o... |
| `T1053.007` | [  ↳ Container Orchestration Job](https://attack.mitre.org/techniques/T1053/007) | Adversaries may abuse task scheduling functionality provided by container orchestration tools such a... |
| `T1055` | [Process Injection](https://attack.mitre.org/techniques/T1055) | Adversaries may inject code into processes in order to evade process-based defenses as well as possi... |
| `T1055.001` | [  ↳ Dynamic-link Library Injection](https://attack.mitre.org/techniques/T1055/001) | Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based ... |
| `T1055.002` | [  ↳ Portable Executable Injection](https://attack.mitre.org/techniques/T1055/002) | Adversaries may inject portable executables (PE) into processes in order to evade process-based defe... |
| `T1055.003` | [  ↳ Thread Execution Hijacking](https://attack.mitre.org/techniques/T1055/003) | Adversaries may inject malicious code into hijacked processes in order to evade process-based defens... |
| `T1055.004` | [  ↳ Asynchronous Procedure Call](https://attack.mitre.org/techniques/T1055/004) | Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue... |
| `T1055.005` | [  ↳ Thread Local Storage](https://attack.mitre.org/techniques/T1055/005) | Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in ord... |
| `T1055.008` | [  ↳ Ptrace System Calls](https://attack.mitre.org/techniques/T1055/008) | Adversaries may inject malicious code into processes via ptrace (process trace) system calls in orde... |
| `T1055.009` | [  ↳ Proc Memory](https://attack.mitre.org/techniques/T1055/009) | Adversaries may inject malicious code into processes via the /proc filesystem in order to evade proc... |
| `T1055.011` | [  ↳ Extra Window Memory Injection](https://attack.mitre.org/techniques/T1055/011) | Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade p... |
| `T1055.012` | [  ↳ Process Hollowing](https://attack.mitre.org/techniques/T1055/012) | Adversaries may inject malicious code into suspended and hollowed processes in order to evade proces... |
| `T1055.013` | [  ↳ Process Doppelgänging](https://attack.mitre.org/techniques/T1055/013) | Adversaries may inject malicious code into process via process doppelgänging in order to evade proce... |
| `T1055.014` | [  ↳ VDSO Hijacking](https://attack.mitre.org/techniques/T1055/014) | Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-ba... |
| `T1055.015` | [  ↳ ListPlanting](https://attack.mitre.org/techniques/T1055/015) | Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order t... |
| `T1068` | [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068) | Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation o... |
| `T1078` | [Valid Accounts](https://attack.mitre.org/techniques/T1078) | Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Acce... |
| `T1078.001` | [  ↳ Default Accounts](https://attack.mitre.org/techniques/T1078/001) | Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Acce... |
| `T1078.002` | [  ↳ Domain Accounts](https://attack.mitre.org/techniques/T1078/002) | Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Acces... |
| `T1078.003` | [  ↳ Local Accounts](https://attack.mitre.org/techniques/T1078/003) | Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access... |
| `T1078.004` | [  ↳ Cloud Accounts](https://attack.mitre.org/techniques/T1078/004) | Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Acc... |
| `T1098` | [Account Manipulation](https://attack.mitre.org/techniques/T1098) | Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account man... |
| `T1098.001` | [  ↳ Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) | Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent acces... |
| `T1098.002` | [  ↳ Additional Email Delegate Permissions](https://attack.mitre.org/techniques/T1098/002) | Adversaries may grant additional permission levels to maintain persistent access to an adversary-con... |
| `T1098.003` | [  ↳ Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) | An adversary may add additional roles or permissions to an adversary-controlled cloud account to mai... |
| `T1098.004` | [  ↳ SSH Authorized Keys](https://attack.mitre.org/techniques/T1098/004) | Adversaries may modify the SSH <code>authorized_keys</code> file to maintain persistence on a victim... |
| `T1098.005` | [  ↳ Device Registration](https://attack.mitre.org/techniques/T1098/005) | Adversaries may register a device to an adversary-controlled account. Devices may be registered in a... |
| `T1098.006` | [  ↳ Additional Container Cluster Roles](https://attack.mitre.org/techniques/T1098/006) | An adversary may add additional roles or permissions to an adversary-controlled user or service acco... |
| `T1098.007` | [  ↳ Additional Local or Domain Groups](https://attack.mitre.org/techniques/T1098/007) | An adversary may add additional local or domain groups to an adversary-controlled account to maintai... |
| `T1134` | [Access Token Manipulation](https://attack.mitre.org/techniques/T1134) | Adversaries may modify access tokens to operate under a different user or system security context to... |
| `T1134.001` | [  ↳ Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) | Adversaries may duplicate then impersonate another user's existing token to escalate privileges and ... |
| `T1134.002` | [  ↳ Create Process with Token](https://attack.mitre.org/techniques/T1134/002) | Adversaries may create a new process with an existing token to escalate privileges and bypass access... |
| `T1134.003` | [  ↳ Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) | Adversaries may make new tokens and impersonate users to escalate privileges and bypass access contr... |
| `T1134.004` | [  ↳ Parent PID Spoofing](https://attack.mitre.org/techniques/T1134/004) | Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitor... |
| `T1134.005` | [  ↳ SID-History Injection](https://attack.mitre.org/techniques/T1134/005) | Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Win... |
| `T1484` | [Domain or Tenant Policy Modification](https://attack.mitre.org/techniques/T1484) | Adversaries may modify the configuration settings of a domain or identity tenant to evade defenses a... |
| `T1484.001` | [  ↳ Group Policy Modification](https://attack.mitre.org/techniques/T1484/001) | Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access cont... |
| `T1484.002` | [  ↳ Trust Modification](https://attack.mitre.org/techniques/T1484/002) | Adversaries may add new domain trusts, modify the properties of existing domain trusts, or otherwise... |
| `T1543` | [Create or Modify System Process](https://attack.mitre.org/techniques/T1543) | Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as ... |
| `T1543.001` | [  ↳ Launch Agent](https://attack.mitre.org/techniques/T1543/001) | Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of p... |
| `T1543.002` | [  ↳ Systemd Service](https://attack.mitre.org/techniques/T1543/002) | Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part o... |
| `T1543.003` | [  ↳ Windows Service](https://attack.mitre.org/techniques/T1543/003) | Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part o... |
| `T1543.004` | [  ↳ Launch Daemon](https://attack.mitre.org/techniques/T1543/004) | Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence... |
| `T1543.005` | [  ↳ Container Service](https://attack.mitre.org/techniques/T1543/005) | Adversaries may create or modify container or container cluster management tools that run as daemons... |
| `T1546` | [Event Triggered Execution](https://attack.mitre.org/techniques/T1546) | Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger... |
| `T1546.001` | [  ↳ Change Default File Association](https://attack.mitre.org/techniques/T1546/001) | Adversaries may establish persistence by executing malicious content triggered by a file type associ... |
| `T1546.002` | [  ↳ Screensaver](https://attack.mitre.org/techniques/T1546/002) | Adversaries may establish persistence by executing malicious content triggered by user inactivity. S... |
| `T1546.003` | [  ↳ Windows Management Instrumentation Event Subscription](https://attack.mitre.org/techniques/T1546/003) | Adversaries may establish persistence and elevate privileges by executing malicious content triggere... |
| `T1546.004` | [  ↳ Unix Shell Configuration Modification](https://attack.mitre.org/techniques/T1546/004) | Adversaries may establish persistence through executing malicious commands triggered by a user’s she... |
| `T1546.005` | [  ↳ Trap](https://attack.mitre.org/techniques/T1546/005) | Adversaries may establish persistence by executing malicious content triggered by an interrupt signa... |
| `T1546.006` | [  ↳ LC_LOAD_DYLIB Addition](https://attack.mitre.org/techniques/T1546/006) | Adversaries may establish persistence by executing malicious content triggered by the execution of t... |
| `T1546.007` | [  ↳ Netsh Helper DLL](https://attack.mitre.org/techniques/T1546/007) | Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs.... |
| `T1546.008` | [  ↳ Accessibility Features](https://attack.mitre.org/techniques/T1546/008) | Adversaries may establish persistence and/or elevate privileges by executing malicious content trigg... |
| `T1546.009` | [  ↳ AppCert DLLs](https://attack.mitre.org/techniques/T1546/009) | Adversaries may establish persistence and/or elevate privileges by executing malicious content trigg... |
| `T1546.010` | [  ↳ AppInit DLLs](https://attack.mitre.org/techniques/T1546/010) | Adversaries may establish persistence and/or elevate privileges by executing malicious content trigg... |
| `T1546.011` | [  ↳ Application Shimming](https://attack.mitre.org/techniques/T1546/011) | Adversaries may establish persistence and/or elevate privileges by executing malicious content trigg... |
| `T1546.012` | [  ↳ Image File Execution Options Injection](https://attack.mitre.org/techniques/T1546/012) | Adversaries may establish persistence and/or elevate privileges by executing malicious content trigg... |
| `T1546.013` | [  ↳ PowerShell Profile](https://attack.mitre.org/techniques/T1546/013) | Adversaries may gain persistence and elevate privileges by executing malicious content triggered by ... |
| `T1546.014` | [  ↳ Emond](https://attack.mitre.org/techniques/T1546/014) | Adversaries may gain persistence and elevate privileges by executing malicious content triggered by ... |
| `T1546.015` | [  ↳ Component Object Model Hijacking](https://attack.mitre.org/techniques/T1546/015) | Adversaries may establish persistence by executing malicious content triggered by hijacked reference... |
| `T1546.016` | [  ↳ Installer Packages](https://attack.mitre.org/techniques/T1546/016) | Adversaries may establish persistence and elevate privileges by using an installer to trigger the ex... |
| `T1546.017` | [  ↳ Udev Rules](https://attack.mitre.org/techniques/T1546/017) | Adversaries may maintain persistence through executing malicious content triggered using udev rules.... |
| `T1546.018` | [  ↳ Python Startup Hooks](https://attack.mitre.org/techniques/T1546/018) | Adversaries may achieve persistence by leveraging Python’s startup mechanisms, including path config... |
| `T1547` | [Boot or Logon Autostart Execution](https://attack.mitre.org/techniques/T1547) | Adversaries may configure system settings to automatically execute a program during system boot or l... |
| `T1547.001` | [  ↳ Registry Run Keys / Startup Folder](https://attack.mitre.org/techniques/T1547/001) | Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a... |
| `T1547.002` | [  ↳ Authentication Package](https://attack.mitre.org/techniques/T1547/002) | Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authent... |
| `T1547.003` | [  ↳ Time Providers](https://attack.mitre.org/techniques/T1547/003) | Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service... |
| `T1547.004` | [  ↳ Winlogon Helper DLL](https://attack.mitre.org/techniques/T1547/004) | Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. W... |
| `T1547.005` | [  ↳ Security Support Provider](https://attack.mitre.org/techniques/T1547/005) | Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windo... |
| `T1547.006` | [  ↳ Kernel Modules and Extensions](https://attack.mitre.org/techniques/T1547/006) | Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel ... |
| `T1547.007` | [  ↳ Re-opened Applications](https://attack.mitre.org/techniques/T1547/007) | Adversaries may modify plist files to automatically run an application when a user logs in. When a u... |
| `T1547.008` | [  ↳ LSASS Driver](https://attack.mitre.org/techniques/T1547/008) | Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Window... |
| `T1547.009` | [  ↳ Shortcut Modification](https://attack.mitre.org/techniques/T1547/009) | Adversaries may create or modify shortcuts that can execute a program during system boot or user log... |
| `T1547.010` | [  ↳ Port Monitors](https://attack.mitre.org/techniques/T1547/010) | Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistenc... |
| `T1547.012` | [  ↳ Print Processors](https://attack.mitre.org/techniques/T1547/012) | Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/... |
| `T1547.013` | [  ↳ XDG Autostart Entries](https://attack.mitre.org/techniques/T1547/013) | Adversaries may add or modify XDG Autostart Entries to execute malicious programs or commands when a... |
| `T1547.014` | [  ↳ Active Setup](https://attack.mitre.org/techniques/T1547/014) | Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machin... |
| `T1547.015` | [  ↳ Login Items](https://attack.mitre.org/techniques/T1547/015) | Adversaries may add login items to execute upon user login to gain persistence or escalate privilege... |
| `T1548` | [Abuse Elevation Control Mechanism](https://attack.mitre.org/techniques/T1548) | Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level pe... |
| `T1548.001` | [  ↳ Setuid and Setgid](https://attack.mitre.org/techniques/T1548/001) | An adversary may abuse configurations where an application has the setuid or setgid bits set in orde... |
| `T1548.002` | [  ↳ Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) | Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account ... |
| `T1548.003` | [  ↳ Sudo and Sudo Caching](https://attack.mitre.org/techniques/T1548/003) | Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries ... |
| `T1548.004` | [  ↳ Elevated Execution with Prompt](https://attack.mitre.org/techniques/T1548/004) | Adversaries may leverage the <code>AuthorizationExecuteWithPrivileges</code> API to escalate privile... |
| `T1548.005` | [  ↳ Temporary Elevated Cloud Access](https://attack.mitre.org/techniques/T1548/005) | Adversaries may abuse permission configurations that allow them to gain temporarily elevated access ... |
| `T1548.006` | [  ↳ TCC Manipulation](https://attack.mitre.org/techniques/T1548/006) | Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database t... |
| `T1574` | [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574) | Adversaries may execute their own malicious payloads by hijacking the way operating systems run prog... |
| `T1574.001` | [  ↳ DLL](https://attack.mitre.org/techniques/T1574/001) | Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate pr... |
| `T1574.004` | [  ↳ Dylib Hijacking](https://attack.mitre.org/techniques/T1574/004) | Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an ex... |
| `T1574.005` | [  ↳ Executable Installer File Permissions Weakness](https://attack.mitre.org/techniques/T1574/005) | Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer.... |
| `T1574.006` | [  ↳ Dynamic Linker Hijacking](https://attack.mitre.org/techniques/T1574/006) | Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic ... |
| `T1574.007` | [  ↳ Path Interception by PATH Environment Variable](https://attack.mitre.org/techniques/T1574/007) | Adversaries may execute their own malicious payloads by hijacking environment variables used to load... |
| `T1574.008` | [  ↳ Path Interception by Search Order Hijacking](https://attack.mitre.org/techniques/T1574/008) | Adversaries may execute their own malicious payloads by hijacking the search order used to load othe... |
| `T1574.009` | [  ↳ Path Interception by Unquoted Path](https://attack.mitre.org/techniques/T1574/009) | Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. A... |
| `T1574.010` | [  ↳ Services File Permissions Weakness](https://attack.mitre.org/techniques/T1574/010) | Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adv... |
| `T1574.011` | [  ↳ Services Registry Permissions Weakness](https://attack.mitre.org/techniques/T1574/011) | Adversaries may execute their own malicious payloads by hijacking the Registry entries used by servi... |
| `T1574.012` | [  ↳ COR_PROFILER](https://attack.mitre.org/techniques/T1574/012) | Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of progr... |
| `T1574.013` | [  ↳ KernelCallbackTable](https://attack.mitre.org/techniques/T1574/013) | Adversaries may abuse the <code>KernelCallbackTable</code> of a process to hijack its execution flow... |
| `T1574.014` | [  ↳ AppDomainManager](https://attack.mitre.org/techniques/T1574/014) | Adversaries may execute their own malicious payloads by hijacking how the .NET `AppDomainManager` lo... |
| `T1611` | [Escape to Host](https://attack.mitre.org/techniques/T1611) | Adversaries may break out of a container or virtualized environment to gain access to the underlying... |

## DEFENSE EVASION ([DEFENSE-EVASION])

| T-Code | Technique Name | Description |
| :--- | :--- | :--- |
| `T1006` | [Direct Volume Access](https://attack.mitre.org/techniques/T1006) | Adversaries may directly access a volume to bypass file access controls and file system monitoring. ... |
| `T1014` | [Rootkit](https://attack.mitre.org/techniques/T1014) | Adversaries may use rootkits to hide the presence of programs, files, network connections, services,... |
| `T1027` | [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) | Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting... |
| `T1027.001` | [  ↳ Binary Padding](https://attack.mitre.org/techniques/T1027/001) | Adversaries may use binary padding to add junk data and change the on-disk representation of malware... |
| `T1027.002` | [  ↳ Software Packing](https://attack.mitre.org/techniques/T1027/002) | Adversaries may perform software packing or virtual machine software protection to conceal their cod... |
| `T1027.003` | [  ↳ Steganography](https://attack.mitre.org/techniques/T1027/003) | Adversaries may use steganography techniques in order to prevent the detection of hidden information... |
| `T1027.004` | [  ↳ Compile After Delivery](https://attack.mitre.org/techniques/T1027/004) | Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to vi... |
| `T1027.005` | [  ↳ Indicator Removal from Tools](https://attack.mitre.org/techniques/T1027/005) | Adversaries may remove indicators from tools if they believe their malicious tool was detected, quar... |
| `T1027.006` | [  ↳ HTML Smuggling](https://attack.mitre.org/techniques/T1027/006) | Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of s... |
| `T1027.007` | [  ↳ Dynamic API Resolution](https://attack.mitre.org/techniques/T1027/007) | Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to... |
| `T1027.008` | [  ↳ Stripped Payloads](https://attack.mitre.org/techniques/T1027/008) | Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and oth... |
| `T1027.009` | [  ↳ Embedded Payloads](https://attack.mitre.org/techniques/T1027/009) | Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherw... |
| `T1027.010` | [  ↳ Command Obfuscation](https://attack.mitre.org/techniques/T1027/010) | Adversaries may obfuscate content during command execution to impede detection. Command-line obfusca... |
| `T1027.011` | [  ↳ Fileless Storage](https://attack.mitre.org/techniques/T1027/011) | Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. Filele... |
| `T1027.012` | [  ↳ LNK Icon Smuggling](https://attack.mitre.org/techniques/T1027/012) | Adversaries may smuggle commands to download malicious payloads past content filters by hiding them ... |
| `T1027.013` | [  ↳ Encrypted/Encoded File](https://attack.mitre.org/techniques/T1027/013) | Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to ... |
| `T1027.014` | [  ↳ Polymorphic Code](https://attack.mitre.org/techniques/T1027/014) | Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detec... |
| `T1027.015` | [  ↳ Compression](https://attack.mitre.org/techniques/T1027/015) | Adversaries may use compression to obfuscate their payloads or files. Compressed file formats such a... |
| `T1027.016` | [  ↳ Junk Code Insertion](https://attack.mitre.org/techniques/T1027/016) | Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code ... |
| `T1027.017` | [  ↳ SVG Smuggling](https://attack.mitre.org/techniques/T1027/017) | Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of s... |
| `T1036` | [Masquerading](https://attack.mitre.org/techniques/T1036) | Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or ... |
| `T1036.001` | [  ↳ Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001) | Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceivi... |
| `T1036.002` | [  ↳ Right-to-Left Override](https://attack.mitre.org/techniques/T1036/002) | Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a stri... |
| `T1036.003` | [  ↳ Rename Legitimate Utilities](https://attack.mitre.org/techniques/T1036/003) | Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning ... |
| `T1036.004` | [  ↳ Masquerade Task or Service](https://attack.mitre.org/techniques/T1036/004) | Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or ... |
| `T1036.005` | [  ↳ Match Legitimate Resource Name or Location](https://attack.mitre.org/techniques/T1036/005) | Adversaries may match or approximate the name or location of legitimate files, Registry keys, or oth... |
| `T1036.006` | [  ↳ Space after Filename](https://attack.mitre.org/techniques/T1036/006) | Adversaries can hide a program's true filetype by changing the extension of a file. With certain fil... |
| `T1036.007` | [  ↳ Double File Extension](https://attack.mitre.org/techniques/T1036/007) | Adversaries may abuse a double extension in the filename as a means of masquerading the true file ty... |
| `T1036.008` | [  ↳ Masquerade File Type](https://attack.mitre.org/techniques/T1036/008) | Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's f... |
| `T1036.009` | [  ↳ Break Process Trees](https://attack.mitre.org/techniques/T1036/009) | An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent... |
| `T1036.010` | [  ↳ Masquerade Account Name](https://attack.mitre.org/techniques/T1036/010) | Adversaries may match or approximate the names of legitimate accounts to make newly created ones app... |
| `T1036.011` | [  ↳ Overwrite Process Arguments](https://attack.mitre.org/techniques/T1036/011) | Adversaries may modify a process's in-memory arguments to change its name in order to appear as a le... |
| `T1036.012` | [  ↳ Browser Fingerprint](https://attack.mitre.org/techniques/T1036/012) | Adversaries may attempt to blend in with legitimate traffic by spoofing browser and system attribute... |
| `T1055` | [Process Injection](https://attack.mitre.org/techniques/T1055) | Adversaries may inject code into processes in order to evade process-based defenses as well as possi... |
| `T1055.001` | [  ↳ Dynamic-link Library Injection](https://attack.mitre.org/techniques/T1055/001) | Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based ... |
| `T1055.002` | [  ↳ Portable Executable Injection](https://attack.mitre.org/techniques/T1055/002) | Adversaries may inject portable executables (PE) into processes in order to evade process-based defe... |
| `T1055.003` | [  ↳ Thread Execution Hijacking](https://attack.mitre.org/techniques/T1055/003) | Adversaries may inject malicious code into hijacked processes in order to evade process-based defens... |
| `T1055.004` | [  ↳ Asynchronous Procedure Call](https://attack.mitre.org/techniques/T1055/004) | Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue... |
| `T1055.005` | [  ↳ Thread Local Storage](https://attack.mitre.org/techniques/T1055/005) | Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in ord... |
| `T1055.008` | [  ↳ Ptrace System Calls](https://attack.mitre.org/techniques/T1055/008) | Adversaries may inject malicious code into processes via ptrace (process trace) system calls in orde... |
| `T1055.009` | [  ↳ Proc Memory](https://attack.mitre.org/techniques/T1055/009) | Adversaries may inject malicious code into processes via the /proc filesystem in order to evade proc... |
| `T1055.011` | [  ↳ Extra Window Memory Injection](https://attack.mitre.org/techniques/T1055/011) | Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade p... |
| `T1055.012` | [  ↳ Process Hollowing](https://attack.mitre.org/techniques/T1055/012) | Adversaries may inject malicious code into suspended and hollowed processes in order to evade proces... |
| `T1055.013` | [  ↳ Process Doppelgänging](https://attack.mitre.org/techniques/T1055/013) | Adversaries may inject malicious code into process via process doppelgänging in order to evade proce... |
| `T1055.014` | [  ↳ VDSO Hijacking](https://attack.mitre.org/techniques/T1055/014) | Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-ba... |
| `T1055.015` | [  ↳ ListPlanting](https://attack.mitre.org/techniques/T1055/015) | Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order t... |
| `T1070` | [Indicator Removal](https://attack.mitre.org/techniques/T1070) | Adversaries may delete or modify artifacts generated within systems to remove evidence of their pres... |
| `T1070.001` | [  ↳ Clear Windows Event Logs](https://attack.mitre.org/techniques/T1070/001) | Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs ar... |
| `T1070.002` | [  ↳ Clear Linux or Mac System Logs](https://attack.mitre.org/techniques/T1070/002) | Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track ... |
| `T1070.003` | [  ↳ Clear Command History](https://attack.mitre.org/techniques/T1070/003) | In addition to clearing system logs, an adversary may clear the command history of a compromised acc... |
| `T1070.004` | [  ↳ File Deletion](https://attack.mitre.org/techniques/T1070/004) | Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools,... |
| `T1070.005` | [  ↳ Network Share Connection Removal](https://attack.mitre.org/techniques/T1070/005) | Adversaries may remove share connections that are no longer useful in order to clean up traces of th... |
| `T1070.006` | [  ↳ Timestomp](https://attack.mitre.org/techniques/T1070/006) | Adversaries may modify file time attributes to hide new files or changes to existing files. Timestom... |
| `T1070.007` | [  ↳ Clear Network Connection History and Configurations](https://attack.mitre.org/techniques/T1070/007) | Adversaries may clear or remove evidence of malicious network connections in order to clean up trace... |
| `T1070.008` | [  ↳ Clear Mailbox Data](https://attack.mitre.org/techniques/T1070/008) | Adversaries may modify mail and mail application data to remove evidence of their activity. Email ap... |
| `T1070.009` | [  ↳ Clear Persistence](https://attack.mitre.org/techniques/T1070/009) | Adversaries may clear artifacts associated with previously established persistence on a host system ... |
| `T1070.010` | [  ↳ Relocate Malware](https://attack.mitre.org/techniques/T1070/010) | Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim syst... |
| `T1078` | [Valid Accounts](https://attack.mitre.org/techniques/T1078) | Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Acce... |
| `T1078.001` | [  ↳ Default Accounts](https://attack.mitre.org/techniques/T1078/001) | Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Acce... |
| `T1078.002` | [  ↳ Domain Accounts](https://attack.mitre.org/techniques/T1078/002) | Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Acces... |
| `T1078.003` | [  ↳ Local Accounts](https://attack.mitre.org/techniques/T1078/003) | Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access... |
| `T1078.004` | [  ↳ Cloud Accounts](https://attack.mitre.org/techniques/T1078/004) | Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Acc... |
| `T1112` | [Modify Registry](https://attack.mitre.org/techniques/T1112) | Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid i... |
| `T1127` | [Trusted Developer Utilities Proxy Execution](https://attack.mitre.org/techniques/T1127) | Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloa... |
| `T1127.001` | [  ↳ MSBuild](https://attack.mitre.org/techniques/T1127/001) | Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.ex... |
| `T1127.002` | [  ↳ ClickOnce](https://attack.mitre.org/techniques/T1127/002) | Adversaries may use ClickOnce applications (.appref-ms and .application files) to proxy execution of... |
| `T1127.003` | [  ↳ JamPlus](https://attack.mitre.org/techniques/T1127/003) | Adversaries may use `JamPlus` to proxy the execution of a malicious script. `JamPlus` is a build uti... |
| `T1134` | [Access Token Manipulation](https://attack.mitre.org/techniques/T1134) | Adversaries may modify access tokens to operate under a different user or system security context to... |
| `T1134.001` | [  ↳ Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) | Adversaries may duplicate then impersonate another user's existing token to escalate privileges and ... |
| `T1134.002` | [  ↳ Create Process with Token](https://attack.mitre.org/techniques/T1134/002) | Adversaries may create a new process with an existing token to escalate privileges and bypass access... |
| `T1134.003` | [  ↳ Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) | Adversaries may make new tokens and impersonate users to escalate privileges and bypass access contr... |
| `T1134.004` | [  ↳ Parent PID Spoofing](https://attack.mitre.org/techniques/T1134/004) | Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitor... |
| `T1134.005` | [  ↳ SID-History Injection](https://attack.mitre.org/techniques/T1134/005) | Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Win... |
| `T1140` | [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) | Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to ... |
| `T1197` | [BITS Jobs](https://attack.mitre.org/techniques/T1197) | Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. W... |
| `T1202` | [Indirect Command Execution](https://attack.mitre.org/techniques/T1202) | Adversaries may abuse utilities that allow for command execution to bypass security restrictions tha... |
| `T1205` | [Traffic Signaling](https://attack.mitre.org/techniques/T1205) | Adversaries may use traffic signaling to hide open ports or other malicious functionality used for p... |
| `T1205.001` | [  ↳ Port Knocking](https://attack.mitre.org/techniques/T1205/001) | Adversaries may use port knocking to hide open ports used for persistence or command and control. To... |
| `T1205.002` | [  ↳ Socket Filters](https://attack.mitre.org/techniques/T1205/002) | Adversaries may attach filters to a network socket to monitor then activate backdoors used for persi... |
| `T1207` | [Rogue Domain Controller](https://attack.mitre.org/techniques/T1207) | Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data. ... |
| `T1211` | [Exploitation for Defense Evasion](https://attack.mitre.org/techniques/T1211) | Adversaries may exploit a system or application vulnerability to bypass security features. Exploitat... |
| `T1216` | [System Script Proxy Execution](https://attack.mitre.org/techniques/T1216) | Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malic... |
| `T1216.001` | [  ↳ PubPrn](https://attack.mitre.org/techniques/T1216/001) | Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a [Visual Bas... |
| `T1216.002` | [  ↳ SyncAppvPublishingServer](https://attack.mitre.org/techniques/T1216/002) | Adversaries may abuse SyncAppvPublishingServer.vbs to proxy execution of malicious [PowerShell](http... |
| `T1218` | [System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218) | Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious co... |
| `T1218.001` | [  ↳ Compiled HTML File](https://attack.mitre.org/techniques/T1218/001) | Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly d... |
| `T1218.002` | [  ↳ Control Panel](https://attack.mitre.org/techniques/T1218/002) | Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Pane... |
| `T1218.003` | [  ↳ CMSTP](https://attack.mitre.org/techniques/T1218/003) | Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager P... |
| `T1218.004` | [  ↳ InstallUtil](https://attack.mitre.org/techniques/T1218/004) | Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. Instal... |
| `T1218.005` | [  ↳ Mshta](https://attack.mitre.org/techniques/T1218/005) | Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScrip... |
| `T1218.007` | [  ↳ Msiexec](https://attack.mitre.org/techniques/T1218/007) | Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the comma... |
| `T1218.008` | [  ↳ Odbcconf](https://attack.mitre.org/techniques/T1218/008) | Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windo... |
| `T1218.009` | [  ↳ Regsvcs/Regasm](https://attack.mitre.org/techniques/T1218/009) | Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utilit... |
| `T1218.010` | [  ↳ Regsvr32](https://attack.mitre.org/techniques/T1218/010) | Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-l... |
| `T1218.011` | [  ↳ Rundll32](https://attack.mitre.org/techniques/T1218/011) | Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice ex... |
| `T1218.012` | [  ↳ Verclsid](https://attack.mitre.org/techniques/T1218/012) | Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as th... |
| `T1218.013` | [  ↳ Mavinject](https://attack.mitre.org/techniques/T1218/013) | Adversaries may abuse mavinject.exe to proxy execution of malicious code. Mavinject.exe is the Micro... |
| `T1218.014` | [  ↳ MMC](https://attack.mitre.org/techniques/T1218/014) | Adversaries may abuse mmc.exe to proxy execution of malicious .msc files. Microsoft Management Conso... |
| `T1218.015` | [  ↳ Electron Applications](https://attack.mitre.org/techniques/T1218/015) | Adversaries may abuse components of the Electron framework to execute malicious code. The Electron f... |
| `T1220` | [XSL Script Processing](https://attack.mitre.org/techniques/T1220) | Adversaries may bypass application control and obscure execution of code by embedding scripts inside... |
| `T1221` | [Template Injection](https://attack.mitre.org/techniques/T1221) | Adversaries may create or modify references in user document templates to conceal malicious code or ... |
| `T1222` | [File and Directory Permissions Modification](https://attack.mitre.org/techniques/T1222) | Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs)... |
| `T1222.001` | [  ↳ Windows File and Directory Permissions Modification](https://attack.mitre.org/techniques/T1222/001) | Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs)... |
| `T1222.002` | [  ↳ Linux and Mac File and Directory Permissions Modification](https://attack.mitre.org/techniques/T1222/002) | Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs)... |
| `T1480` | [Execution Guardrails](https://attack.mitre.org/techniques/T1480) | Adversaries may use execution guardrails to constrain execution or actions based on adversary suppli... |
| `T1480.001` | [  ↳ Environmental Keying](https://attack.mitre.org/techniques/T1480/001) | Adversaries may environmentally key payloads or other features of malware to evade defenses and cons... |
| `T1480.002` | [  ↳ Mutual Exclusion](https://attack.mitre.org/techniques/T1480/002) | Adversaries may constrain execution or actions based on the presence of a mutex associated with malw... |
| `T1484` | [Domain or Tenant Policy Modification](https://attack.mitre.org/techniques/T1484) | Adversaries may modify the configuration settings of a domain or identity tenant to evade defenses a... |
| `T1484.001` | [  ↳ Group Policy Modification](https://attack.mitre.org/techniques/T1484/001) | Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access cont... |
| `T1484.002` | [  ↳ Trust Modification](https://attack.mitre.org/techniques/T1484/002) | Adversaries may add new domain trusts, modify the properties of existing domain trusts, or otherwise... |
| `T1497` | [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) | Adversaries may employ various means to detect and avoid virtualization and analysis environments. T... |
| `T1497.001` | [  ↳ System Checks](https://attack.mitre.org/techniques/T1497/001) | Adversaries may employ various system checks to detect and avoid virtualization and analysis environ... |
| `T1497.002` | [  ↳ User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002) | Adversaries may employ various user activity checks to detect and avoid virtualization and analysis ... |
| `T1497.003` | [  ↳ Time Based Checks](https://attack.mitre.org/techniques/T1497/003) | Adversaries may employ various time-based methods to detect virtualization and analysis environments... |
| `T1535` | [Unused/Unsupported Cloud Regions](https://attack.mitre.org/techniques/T1535) | Adversaries may create cloud instances in unused geographic service regions in order to evade detect... |
| `T1542` | [Pre-OS Boot](https://attack.mitre.org/techniques/T1542) | Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During t... |
| `T1542.001` | [  ↳ System Firmware](https://attack.mitre.org/techniques/T1542/001) | Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) an... |
| `T1542.002` | [  ↳ Component Firmware](https://attack.mitre.org/techniques/T1542/002) | Adversaries may modify component firmware to persist on systems. Some adversaries may employ sophist... |
| `T1542.003` | [  ↳ Bootkit](https://attack.mitre.org/techniques/T1542/003) | Adversaries may use bootkits to persist on systems. A bootkit is a malware variant that modifies the... |
| `T1542.004` | [  ↳ ROMMONkit](https://attack.mitre.org/techniques/T1542/004) | Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary co... |
| `T1542.005` | [  ↳ TFTP Boot](https://attack.mitre.org/techniques/T1542/005) | Adversaries may abuse netbooting to load an unauthorized network device operating system from a Triv... |
| `T1548` | [Abuse Elevation Control Mechanism](https://attack.mitre.org/techniques/T1548) | Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level pe... |
| `T1548.001` | [  ↳ Setuid and Setgid](https://attack.mitre.org/techniques/T1548/001) | An adversary may abuse configurations where an application has the setuid or setgid bits set in orde... |
| `T1548.002` | [  ↳ Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) | Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account ... |
| `T1548.003` | [  ↳ Sudo and Sudo Caching](https://attack.mitre.org/techniques/T1548/003) | Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries ... |
| `T1548.004` | [  ↳ Elevated Execution with Prompt](https://attack.mitre.org/techniques/T1548/004) | Adversaries may leverage the <code>AuthorizationExecuteWithPrivileges</code> API to escalate privile... |
| `T1548.005` | [  ↳ Temporary Elevated Cloud Access](https://attack.mitre.org/techniques/T1548/005) | Adversaries may abuse permission configurations that allow them to gain temporarily elevated access ... |
| `T1548.006` | [  ↳ TCC Manipulation](https://attack.mitre.org/techniques/T1548/006) | Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database t... |
| `T1550` | [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550) | Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, an... |
| `T1550.001` | [  ↳ Application Access Token](https://attack.mitre.org/techniques/T1550/001) | Adversaries may use stolen application access tokens to bypass the typical authentication process an... |
| `T1550.002` | [  ↳ Pass the Hash](https://attack.mitre.org/techniques/T1550/002) | Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment... |
| `T1550.003` | [  ↳ Pass the Ticket](https://attack.mitre.org/techniques/T1550/003) | Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environm... |
| `T1550.004` | [  ↳ Web Session Cookie](https://attack.mitre.org/techniques/T1550/004) | Adversaries can use stolen session cookies to authenticate to web applications and services. This te... |
| `T1553` | [Subvert Trust Controls](https://attack.mitre.org/techniques/T1553) | Adversaries may undermine security controls that will either warn users of untrusted activity or pre... |
| `T1553.001` | [  ↳ Gatekeeper Bypass](https://attack.mitre.org/techniques/T1553/001) | Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts an... |
| `T1553.002` | [  ↳ Code Signing](https://attack.mitre.org/techniques/T1553/002) | Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Cod... |
| `T1553.003` | [  ↳ SIP and Trust Provider Hijacking](https://attack.mitre.org/techniques/T1553/003) | Adversaries may tamper with SIP and trust provider components to mislead the operating system and ap... |
| `T1553.004` | [  ↳ Install Root Certificate](https://attack.mitre.org/techniques/T1553/004) | Adversaries may install a root certificate on a compromised system to avoid warnings when connecting... |
| `T1553.005` | [  ↳ Mark-of-the-Web Bypass](https://attack.mitre.org/techniques/T1553/005) | Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, ... |
| `T1553.006` | [  ↳ Code Signing Policy Modification](https://attack.mitre.org/techniques/T1553/006) | Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. Co... |
| `T1556` | [Modify Authentication Process](https://attack.mitre.org/techniques/T1556) | Adversaries may modify authentication mechanisms and processes to access user credentials or enable ... |
| `T1556.001` | [  ↳ Domain Controller Authentication](https://attack.mitre.org/techniques/T1556/001) | Adversaries may patch the authentication process on a domain controller to bypass the typical authen... |
| `T1556.002` | [  ↳ Password Filter DLL](https://attack.mitre.org/techniques/T1556/002) | Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentica... |
| `T1556.003` | [  ↳ Pluggable Authentication Modules](https://attack.mitre.org/techniques/T1556/003) | Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable o... |
| `T1556.004` | [  ↳ Network Device Authentication](https://attack.mitre.org/techniques/T1556/004) | Adversaries may use [Patch System Image](https://attack.mitre.org/techniques/T1601/001) to hard code... |
| `T1556.005` | [  ↳ Reversible Encryption](https://attack.mitre.org/techniques/T1556/005) | An adversary may abuse Active Directory authentication encryption properties to gain access to crede... |
| `T1556.006` | [  ↳ Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006) | Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent ... |
| `T1556.007` | [  ↳ Hybrid Identity](https://attack.mitre.org/techniques/T1556/007) | Adversaries may patch, modify, or otherwise backdoor cloud authentication processes that are tied to... |
| `T1556.008` | [  ↳ Network Provider DLL](https://attack.mitre.org/techniques/T1556/008) | Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture clearte... |
| `T1556.009` | [  ↳ Conditional Access Policies](https://attack.mitre.org/techniques/T1556/009) | Adversaries may disable or modify conditional access policies to enable persistent access to comprom... |
| `T1562` | [Impair Defenses](https://attack.mitre.org/techniques/T1562) | Adversaries may maliciously modify components of a victim environment in order to hinder or disable ... |
| `T1562.001` | [  ↳ Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001) | Adversaries may modify and/or disable security tools to avoid possible detection of their malware/to... |
| `T1562.002` | [  ↳ Disable Windows Event Logging](https://attack.mitre.org/techniques/T1562/002) | Adversaries may disable Windows event logging to limit data that can be leveraged for detections and... |
| `T1562.003` | [  ↳ Impair Command History Logging](https://attack.mitre.org/techniques/T1562/003) | Adversaries may impair command history logging to hide commands they run on a compromised system. Va... |
| `T1562.004` | [  ↳ Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1562/004) | Adversaries may disable or modify system firewalls in order to bypass controls limiting network usag... |
| `T1562.006` | [  ↳ Indicator Blocking](https://attack.mitre.org/techniques/T1562/006) | An adversary may attempt to block indicators or events typically captured by sensors from being gath... |
| `T1562.007` | [  ↳ Disable or Modify Cloud Firewall](https://attack.mitre.org/techniques/T1562/007) | Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limi... |
| `T1562.008` | [  ↳ Disable or Modify Cloud Logs](https://attack.mitre.org/techniques/T1562/008) | An adversary may disable or modify cloud logging capabilities and integrations to limit what data is... |
| `T1562.009` | [  ↳ Safe Mode Boot](https://attack.mitre.org/techniques/T1562/009) | Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Window... |
| `T1562.010` | [  ↳ Downgrade Attack](https://attack.mitre.org/techniques/T1562/010) | Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/... |
| `T1562.011` | [  ↳ Spoof Security Alerting](https://attack.mitre.org/techniques/T1562/011) | Adversaries may spoof security alerting from tools, presenting false evidence to impair defenders’ a... |
| `T1562.012` | [  ↳ Disable or Modify Linux Audit System](https://attack.mitre.org/techniques/T1562/012) | Adversaries may disable or modify the Linux audit system to hide malicious activity and avoid detect... |
| `T1562.013` | [  ↳ Disable or Modify Network Device Firewall](https://attack.mitre.org/techniques/T1562/013) | Adversaries may disable network device-based firewall mechanisms entirely or add, delete, or modify ... |
| `T1564` | [Hide Artifacts](https://attack.mitre.org/techniques/T1564) | Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operat... |
| `T1564.001` | [  ↳ Hidden Files and Directories](https://attack.mitre.org/techniques/T1564/001) | Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent nor... |
| `T1564.002` | [  ↳ Hidden Users](https://attack.mitre.org/techniques/T1564/002) | Adversaries may use hidden users to hide the presence of user accounts they create or modify. Admini... |
| `T1564.003` | [  ↳ Hidden Window](https://attack.mitre.org/techniques/T1564/003) | Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In s... |
| `T1564.004` | [  ↳ NTFS File Attributes](https://attack.mitre.org/techniques/T1564/004) | Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. E... |
| `T1564.005` | [  ↳ Hidden File System](https://attack.mitre.org/techniques/T1564/005) | Adversaries may use a hidden file system to conceal malicious activity from users and security tools... |
| `T1564.006` | [  ↳ Run Virtual Instance](https://attack.mitre.org/techniques/T1564/006) | Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide v... |
| `T1564.007` | [  ↳ VBA Stomping](https://attack.mitre.org/techniques/T1564/007) | Adversaries may hide malicious Visual Basic for Applications (VBA) payloads embedded within MS Offic... |
| `T1564.008` | [  ↳ Email Hiding Rules](https://attack.mitre.org/techniques/T1564/008) | Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email c... |
| `T1564.009` | [  ↳ Resource Forking](https://attack.mitre.org/techniques/T1564/009) | Adversaries may abuse resource forks to hide malicious code or executables to evade detection and by... |
| `T1564.010` | [  ↳ Process Argument Spoofing](https://attack.mitre.org/techniques/T1564/010) | Adversaries may attempt to hide process command-line arguments by overwriting process memory. Proces... |
| `T1564.011` | [  ↳ Ignore Process Interrupts](https://attack.mitre.org/techniques/T1564/011) | Adversaries may evade defensive mechanisms by executing commands that hide from process interrupt si... |
| `T1564.012` | [  ↳ File/Path Exclusions](https://attack.mitre.org/techniques/T1564/012) | Adversaries may attempt to hide their file-based artifacts by writing them to specific folders or fi... |
| `T1564.013` | [  ↳ Bind Mounts](https://attack.mitre.org/techniques/T1564/013) | Adversaries may abuse bind mounts on file structures to hide their activity and artifacts from nativ... |
| `T1564.014` | [  ↳ Extended Attributes](https://attack.mitre.org/techniques/T1564/014) | Adversaries may abuse extended attributes (xattrs) on macOS and Linux to hide their malicious data i... |
| `T1574` | [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574) | Adversaries may execute their own malicious payloads by hijacking the way operating systems run prog... |
| `T1574.001` | [  ↳ DLL](https://attack.mitre.org/techniques/T1574/001) | Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate pr... |
| `T1574.004` | [  ↳ Dylib Hijacking](https://attack.mitre.org/techniques/T1574/004) | Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an ex... |
| `T1574.005` | [  ↳ Executable Installer File Permissions Weakness](https://attack.mitre.org/techniques/T1574/005) | Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer.... |
| `T1574.006` | [  ↳ Dynamic Linker Hijacking](https://attack.mitre.org/techniques/T1574/006) | Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic ... |
| `T1574.007` | [  ↳ Path Interception by PATH Environment Variable](https://attack.mitre.org/techniques/T1574/007) | Adversaries may execute their own malicious payloads by hijacking environment variables used to load... |
| `T1574.008` | [  ↳ Path Interception by Search Order Hijacking](https://attack.mitre.org/techniques/T1574/008) | Adversaries may execute their own malicious payloads by hijacking the search order used to load othe... |
| `T1574.009` | [  ↳ Path Interception by Unquoted Path](https://attack.mitre.org/techniques/T1574/009) | Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. A... |
| `T1574.010` | [  ↳ Services File Permissions Weakness](https://attack.mitre.org/techniques/T1574/010) | Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adv... |
| `T1574.011` | [  ↳ Services Registry Permissions Weakness](https://attack.mitre.org/techniques/T1574/011) | Adversaries may execute their own malicious payloads by hijacking the Registry entries used by servi... |
| `T1574.012` | [  ↳ COR_PROFILER](https://attack.mitre.org/techniques/T1574/012) | Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of progr... |
| `T1574.013` | [  ↳ KernelCallbackTable](https://attack.mitre.org/techniques/T1574/013) | Adversaries may abuse the <code>KernelCallbackTable</code> of a process to hijack its execution flow... |
| `T1574.014` | [  ↳ AppDomainManager](https://attack.mitre.org/techniques/T1574/014) | Adversaries may execute their own malicious payloads by hijacking how the .NET `AppDomainManager` lo... |
| `T1578` | [Modify Cloud Compute Infrastructure](https://attack.mitre.org/techniques/T1578) | An adversary may attempt to modify a cloud account's compute service infrastructure to evade defense... |
| `T1578.001` | [  ↳ Create Snapshot](https://attack.mitre.org/techniques/T1578/001) | An adversary may create a snapshot or data backup within a cloud account to evade defenses. A snapsh... |
| `T1578.002` | [  ↳ Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) | An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud... |
| `T1578.003` | [  ↳ Delete Cloud Instance](https://attack.mitre.org/techniques/T1578/003) | An adversary may delete a cloud instance after they have performed malicious activities in an attemp... |
| `T1578.004` | [  ↳ Revert Cloud Instance](https://attack.mitre.org/techniques/T1578/004) | An adversary may revert changes made to a cloud instance after they have performed malicious activit... |
| `T1578.005` | [  ↳ Modify Cloud Compute Configurations](https://attack.mitre.org/techniques/T1578/005) | Adversaries may modify settings that directly affect the size, locations, and resources available to... |
| `T1599` | [Network Boundary Bridging](https://attack.mitre.org/techniques/T1599) | Adversaries may bridge network boundaries by compromising perimeter network devices or internal devi... |
| `T1599.001` | [  ↳ Network Address Translation Traversal](https://attack.mitre.org/techniques/T1599/001) | Adversaries may bridge network boundaries by modifying a network device’s Network Address Translatio... |
| `T1600` | [Weaken Encryption](https://attack.mitre.org/techniques/T1600) | Adversaries may compromise a network device’s encryption capability in order to bypass encryption th... |
| `T1600.001` | [  ↳ Reduce Key Space](https://attack.mitre.org/techniques/T1600/001) | Adversaries may reduce the level of effort required to decrypt data transmitted over the network by ... |
| `T1600.002` | [  ↳ Disable Crypto Hardware](https://attack.mitre.org/techniques/T1600/002) | Adversaries disable a network device’s dedicated hardware encryption, which may enable them to lever... |
| `T1601` | [Modify System Image](https://attack.mitre.org/techniques/T1601) | Adversaries may make changes to the operating system of embedded network devices to weaken defenses ... |
| `T1601.001` | [  ↳ Patch System Image](https://attack.mitre.org/techniques/T1601/001) | Adversaries may modify the operating system of a network device to introduce new capabilities or wea... |
| `T1601.002` | [  ↳ Downgrade System Image](https://attack.mitre.org/techniques/T1601/002) | Adversaries may install an older version of the operating system of a network device to weaken secur... |
| `T1610` | [Deploy Container](https://attack.mitre.org/techniques/T1610) | Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In... |
| `T1612` | [Build Image on Host](https://attack.mitre.org/techniques/T1612) | Adversaries may build a container image directly on a host to bypass defenses that monitor for the r... |
| `T1620` | [Reflective Code Loading](https://attack.mitre.org/techniques/T1620) | Adversaries may reflectively load code into a process in order to conceal the execution of malicious... |
| `T1622` | [Debugger Evasion](https://attack.mitre.org/techniques/T1622) | Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by ... |
| `T1647` | [Plist File Modification](https://attack.mitre.org/techniques/T1647) | Adversaries may modify property list files (plist files) to enable other malicious activity, while a... |
| `T1656` | [Impersonation](https://attack.mitre.org/techniques/T1656) | Adversaries may impersonate a trusted person or organization in order to persuade and trick a target... |
| `T1666` | [Modify Cloud Resource Hierarchy](https://attack.mitre.org/techniques/T1666) | Adversaries may attempt to modify hierarchical structures in infrastructure-as-a-service (IaaS) envi... |
| `T1672` | [Email Spoofing](https://attack.mitre.org/techniques/T1672) | Adversaries may fake, or spoof, a sender’s identity by modifying the value of relevant email headers... |
| `T1678` | [Delay Execution](https://attack.mitre.org/techniques/T1678) | Adversaries may employ various time-based methods to evade detection and analysis. These techniques ... |
| `T1679` | [Selective Exclusion](https://attack.mitre.org/techniques/T1679) | Adversaries may intentionally exclude certain files, folders, directories, file types, or system com... |

## CREDENTIAL ACCESS ([CREDENTIAL-ACCESS])

| T-Code | Technique Name | Description |
| :--- | :--- | :--- |
| `T1003` | [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) | Adversaries may attempt to dump credentials to obtain account login and credential material, normall... |
| `T1003.001` | [  ↳ LSASS Memory](https://attack.mitre.org/techniques/T1003/001) | Adversaries may attempt to access credential material stored in the process memory of the Local Secu... |
| `T1003.002` | [  ↳ Security Account Manager](https://attack.mitre.org/techniques/T1003/002) | Adversaries may attempt to extract credential material from the Security Account Manager (SAM) datab... |
| `T1003.003` | [  ↳ NTDS](https://attack.mitre.org/techniques/T1003/003) | Adversaries may attempt to access or create a copy of the Active Directory domain database in order ... |
| `T1003.004` | [  ↳ LSA Secrets](https://attack.mitre.org/techniques/T1003/004) | Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secret... |
| `T1003.005` | [  ↳ Cached Domain Credentials](https://attack.mitre.org/techniques/T1003/005) | Adversaries may attempt to access cached domain credentials used to allow authentication to occur in... |
| `T1003.006` | [  ↳ DCSync](https://attack.mitre.org/techniques/T1003/006) | Adversaries may attempt to access credentials and other sensitive information by abusing a Windows D... |
| `T1003.007` | [  ↳ Proc Filesystem](https://attack.mitre.org/techniques/T1003/007) | Adversaries may gather credentials from the proc filesystem or `/proc`. The proc filesystem is a pse... |
| `T1003.008` | [  ↳ /etc/passwd and /etc/shadow](https://attack.mitre.org/techniques/T1003/008) | Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code... |
| `T1040` | [Network Sniffing](https://attack.mitre.org/techniques/T1040) | Adversaries may passively sniff network traffic to capture information about an environment, includi... |
| `T1056` | [Input Capture](https://attack.mitre.org/techniques/T1056) | Adversaries may use methods of capturing user input to obtain credentials or collect information. Du... |
| `T1056.001` | [  ↳ Keylogging](https://attack.mitre.org/techniques/T1056/001) | Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is l... |
| `T1056.002` | [  ↳ GUI Input Capture](https://attack.mitre.org/techniques/T1056/002) | Adversaries may mimic common operating system GUI components to prompt users for credentials with a ... |
| `T1056.003` | [  ↳ Web Portal Capture](https://attack.mitre.org/techniques/T1056/003) | Adversaries may install code on externally facing portals, such as a VPN login page, to capture and ... |
| `T1056.004` | [  ↳ Credential API Hooking](https://attack.mitre.org/techniques/T1056/004) | Adversaries may hook into Windows application programming interface (API) functions and Linux system... |
| `T1110` | [Brute Force](https://attack.mitre.org/techniques/T1110) | Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or ... |
| `T1110.001` | [  ↳ Password Guessing](https://attack.mitre.org/techniques/T1110/001) | Adversaries with no prior knowledge of legitimate credentials within the system or environment may g... |
| `T1110.002` | [  ↳ Password Cracking](https://attack.mitre.org/techniques/T1110/002) | Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext pa... |
| `T1110.003` | [  ↳ Password Spraying](https://attack.mitre.org/techniques/T1110/003) | Adversaries may use a single or small list of commonly used passwords against many different account... |
| `T1110.004` | [  ↳ Credential Stuffing](https://attack.mitre.org/techniques/T1110/004) | Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to t... |
| `T1111` | [Multi-Factor Authentication Interception](https://attack.mitre.org/techniques/T1111) | Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token gener... |
| `T1187` | [Forced Authentication](https://attack.mitre.org/techniques/T1187) | Adversaries may gather credential material by invoking or forcing a user to automatically provide au... |
| `T1212` | [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212) | Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation ... |
| `T1528` | [Steal Application Access Token](https://attack.mitre.org/techniques/T1528) | Adversaries can steal application access tokens as a means of acquiring credentials to access remote... |
| `T1539` | [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539) | An adversary may steal web application or service session cookies and use them to gain access to web... |
| `T1552` | [Unsecured Credentials](https://attack.mitre.org/techniques/T1552) | Adversaries may search compromised systems to find and obtain insecurely stored credentials. These c... |
| `T1552.001` | [  ↳ Credentials In Files](https://attack.mitre.org/techniques/T1552/001) | Adversaries may search local file systems and remote file shares for files containing insecurely sto... |
| `T1552.002` | [  ↳ Credentials in Registry](https://attack.mitre.org/techniques/T1552/002) | Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Wi... |
| `T1552.003` | [  ↳ Shell History](https://attack.mitre.org/techniques/T1552/003) | Adversaries may search the command history on compromised systems for insecurely stored credentials.... |
| `T1552.004` | [  ↳ Private Keys](https://attack.mitre.org/techniques/T1552/004) | Adversaries may search for private key certificate files on compromised systems for insecurely store... |
| `T1552.005` | [  ↳ Cloud Instance Metadata API](https://attack.mitre.org/techniques/T1552/005) | Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other s... |
| `T1552.006` | [  ↳ Group Policy Preferences](https://attack.mitre.org/techniques/T1552/006) | Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP are too... |
| `T1552.007` | [  ↳ Container API](https://attack.mitre.org/techniques/T1552/007) | Adversaries may gather credentials via APIs within a containers environment. APIs in these environme... |
| `T1552.008` | [  ↳ Chat Messages](https://attack.mitre.org/techniques/T1552/008) | Adversaries may directly collect unsecured credentials stored or passed through user communication s... |
| `T1555` | [Credentials from Password Stores](https://attack.mitre.org/techniques/T1555) | Adversaries may search for common password storage locations to obtain user credentials.(Citation: F... |
| `T1555.001` | [  ↳ Keychain](https://attack.mitre.org/techniques/T1555/001) | Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS cred... |
| `T1555.002` | [  ↳ Securityd Memory](https://attack.mitre.org/techniques/T1555/002) | An adversary with root access may gather credentials by reading `securityd`’s memory. `securityd` is... |
| `T1555.003` | [  ↳ Credentials from Web Browsers](https://attack.mitre.org/techniques/T1555/003) | Adversaries may acquire credentials from web browsers by reading files specific to the target browse... |
| `T1555.004` | [  ↳ Windows Credential Manager](https://attack.mitre.org/techniques/T1555/004) | Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stor... |
| `T1555.005` | [  ↳ Password Managers](https://attack.mitre.org/techniques/T1555/005) | Adversaries may acquire user credentials from third-party password managers.(Citation: ise Password ... |
| `T1555.006` | [  ↳ Cloud Secrets Management Stores](https://attack.mitre.org/techniques/T1555/006) | Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secret... |
| `T1556` | [Modify Authentication Process](https://attack.mitre.org/techniques/T1556) | Adversaries may modify authentication mechanisms and processes to access user credentials or enable ... |
| `T1556.001` | [  ↳ Domain Controller Authentication](https://attack.mitre.org/techniques/T1556/001) | Adversaries may patch the authentication process on a domain controller to bypass the typical authen... |
| `T1556.002` | [  ↳ Password Filter DLL](https://attack.mitre.org/techniques/T1556/002) | Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentica... |
| `T1556.003` | [  ↳ Pluggable Authentication Modules](https://attack.mitre.org/techniques/T1556/003) | Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable o... |
| `T1556.004` | [  ↳ Network Device Authentication](https://attack.mitre.org/techniques/T1556/004) | Adversaries may use [Patch System Image](https://attack.mitre.org/techniques/T1601/001) to hard code... |
| `T1556.005` | [  ↳ Reversible Encryption](https://attack.mitre.org/techniques/T1556/005) | An adversary may abuse Active Directory authentication encryption properties to gain access to crede... |
| `T1556.006` | [  ↳ Multi-Factor Authentication](https://attack.mitre.org/techniques/T1556/006) | Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent ... |
| `T1556.007` | [  ↳ Hybrid Identity](https://attack.mitre.org/techniques/T1556/007) | Adversaries may patch, modify, or otherwise backdoor cloud authentication processes that are tied to... |
| `T1556.008` | [  ↳ Network Provider DLL](https://attack.mitre.org/techniques/T1556/008) | Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture clearte... |
| `T1556.009` | [  ↳ Conditional Access Policies](https://attack.mitre.org/techniques/T1556/009) | Adversaries may disable or modify conditional access policies to enable persistent access to comprom... |
| `T1557` | [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) | Adversaries may attempt to position themselves between two or more networked devices using an advers... |
| `T1557.001` | [  ↳ LLMNR/NBT-NS Poisoning and SMB Relay](https://attack.mitre.org/techniques/T1557/001) | By responding to LLMNR/NBT-NS network traffic, adversaries may spoof an authoritative source for nam... |
| `T1557.002` | [  ↳ ARP Cache Poisoning](https://attack.mitre.org/techniques/T1557/002) | Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the c... |
| `T1557.003` | [  ↳ DHCP Spoofing](https://attack.mitre.org/techniques/T1557/003) | Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configu... |
| `T1557.004` | [  ↳ Evil Twin](https://attack.mitre.org/techniques/T1557/004) | Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malic... |
| `T1558` | [Steal or Forge Kerberos Tickets](https://attack.mitre.org/techniques/T1558) | Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets t... |
| `T1558.001` | [  ↳ Golden Ticket](https://attack.mitre.org/techniques/T1558/001) | Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TG... |
| `T1558.002` | [  ↳ Silver Ticket](https://attack.mitre.org/techniques/T1558/002) | Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forg... |
| `T1558.003` | [  ↳ Kerberoasting](https://attack.mitre.org/techniques/T1558/003) | Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obta... |
| `T1558.004` | [  ↳ AS-REP Roasting](https://attack.mitre.org/techniques/T1558/004) | Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by [Pas... |
| `T1558.005` | [  ↳ Ccache Files](https://attack.mitre.org/techniques/T1558/005) | ... |
| `T1606` | [Forge Web Credentials](https://attack.mitre.org/techniques/T1606) | Adversaries may forge credential materials that can be used to gain access to web applications or In... |
| `T1606.001` | [  ↳ Web Cookies](https://attack.mitre.org/techniques/T1606/001) | Adversaries may forge web cookies that can be used to gain access to web applications or Internet se... |
| `T1606.002` | [  ↳ SAML Tokens](https://attack.mitre.org/techniques/T1606/002) | An adversary may forge SAML tokens with any permissions claims and lifetimes if they possess a valid... |
| `T1621` | [Multi-Factor Authentication Request Generation](https://attack.mitre.org/techniques/T1621) | Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to ac... |
| `T1649` | [Steal or Forge Authentication Certificates](https://attack.mitre.org/techniques/T1649) | Adversaries may steal or forge certificates used for authentication to access remote systems or reso... |

## DISCOVERY ([DISCOVERY])

| T-Code | Technique Name | Description |
| :--- | :--- | :--- |
| `T1007` | [System Service Discovery](https://attack.mitre.org/techniques/T1007) | Adversaries may try to gather information about registered local system services. Adversaries may ob... |
| `T1010` | [Application Window Discovery](https://attack.mitre.org/techniques/T1010) | Adversaries may attempt to get a listing of open application windows. Window listings could convey i... |
| `T1012` | [Query Registry](https://attack.mitre.org/techniques/T1012) | Adversaries may interact with the Windows Registry to gather information about the system, configura... |
| `T1016` | [System Network Configuration Discovery](https://attack.mitre.org/techniques/T1016) | Adversaries may look for details about the network configuration and settings, such as IP and/or MAC... |
| `T1016.001` | [  ↳ Internet Connection Discovery](https://attack.mitre.org/techniques/T1016/001) | Adversaries may check for Internet connectivity on compromised systems. This may be performed during... |
| `T1016.002` | [  ↳ Wi-Fi Discovery](https://attack.mitre.org/techniques/T1016/002) | Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on... |
| `T1018` | [Remote System Discovery](https://attack.mitre.org/techniques/T1018) | Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical ... |
| `T1033` | [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) | Adversaries may attempt to identify the primary user, currently logged in user, set of users that co... |
| `T1040` | [Network Sniffing](https://attack.mitre.org/techniques/T1040) | Adversaries may passively sniff network traffic to capture information about an environment, includi... |
| `T1046` | [Network Service Discovery](https://attack.mitre.org/techniques/T1046) | Adversaries may attempt to get a listing of services running on remote hosts and local network infra... |
| `T1049` | [System Network Connections Discovery](https://attack.mitre.org/techniques/T1049) | Adversaries may attempt to get a listing of network connections to or from the compromised system th... |
| `T1057` | [Process Discovery](https://attack.mitre.org/techniques/T1057) | Adversaries may attempt to get information about running processes on a system. Information obtained... |
| `T1069` | [Permission Groups Discovery](https://attack.mitre.org/techniques/T1069) | Adversaries may attempt to discover group and permission settings. This information can help adversa... |
| `T1069.001` | [  ↳ Local Groups](https://attack.mitre.org/techniques/T1069/001) | Adversaries may attempt to find local system groups and permission settings. The knowledge of local ... |
| `T1069.002` | [  ↳ Domain Groups](https://attack.mitre.org/techniques/T1069/002) | Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain... |
| `T1069.003` | [  ↳ Cloud Groups](https://attack.mitre.org/techniques/T1069/003) | Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permiss... |
| `T1082` | [System Information Discovery](https://attack.mitre.org/techniques/T1082) | An adversary may attempt to get detailed information about the operating system and hardware, includ... |
| `T1083` | [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) | Adversaries may enumerate files and directories or may search in specific locations of a host or net... |
| `T1087` | [Account Discovery](https://attack.mitre.org/techniques/T1087) | Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a syste... |
| `T1087.001` | [  ↳ Local Account](https://attack.mitre.org/techniques/T1087/001) | Adversaries may attempt to get a listing of local system accounts. This information can help adversa... |
| `T1087.002` | [  ↳ Domain Account](https://attack.mitre.org/techniques/T1087/002) | Adversaries may attempt to get a listing of domain accounts. This information can help adversaries d... |
| `T1087.003` | [  ↳ Email Account](https://attack.mitre.org/techniques/T1087/003) | Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dum... |
| `T1087.004` | [  ↳ Cloud Account](https://attack.mitre.org/techniques/T1087/004) | Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and con... |
| `T1120` | [Peripheral Device Discovery](https://attack.mitre.org/techniques/T1120) | Adversaries may attempt to gather information about attached peripheral devices and components conne... |
| `T1124` | [System Time Discovery](https://attack.mitre.org/techniques/T1124) | An adversary may gather the system time and/or time zone settings from a local or remote system. The... |
| `T1135` | [Network Share Discovery](https://attack.mitre.org/techniques/T1135) | Adversaries may look for folders and drives shared on remote systems as a means of identifying sourc... |
| `T1201` | [Password Policy Discovery](https://attack.mitre.org/techniques/T1201) | Adversaries may attempt to access detailed information about the password policy used within an ente... |
| `T1217` | [Browser Information Discovery](https://attack.mitre.org/techniques/T1217) | Adversaries may enumerate information about browsers to learn more about compromised environments. D... |
| `T1482` | [Domain Trust Discovery](https://attack.mitre.org/techniques/T1482) | Adversaries may attempt to gather information on domain trust relationships that may be used to iden... |
| `T1497` | [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) | Adversaries may employ various means to detect and avoid virtualization and analysis environments. T... |
| `T1497.001` | [  ↳ System Checks](https://attack.mitre.org/techniques/T1497/001) | Adversaries may employ various system checks to detect and avoid virtualization and analysis environ... |
| `T1497.002` | [  ↳ User Activity Based Checks](https://attack.mitre.org/techniques/T1497/002) | Adversaries may employ various user activity checks to detect and avoid virtualization and analysis ... |
| `T1497.003` | [  ↳ Time Based Checks](https://attack.mitre.org/techniques/T1497/003) | Adversaries may employ various time-based methods to detect virtualization and analysis environments... |
| `T1518` | [Software Discovery](https://attack.mitre.org/techniques/T1518) | Adversaries may attempt to get a listing of software and software versions that are installed on a s... |
| `T1518.001` | [  ↳ Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) | Adversaries may attempt to get a listing of security software, configurations, defensive tools, and ... |
| `T1518.002` | [  ↳ Backup Software Discovery](https://attack.mitre.org/techniques/T1518/002) | Adversaries may attempt to get a listing of backup software or configurations that are installed on ... |
| `T1526` | [Cloud Service Discovery](https://attack.mitre.org/techniques/T1526) | An adversary may attempt to enumerate the cloud services running on a system after gaining access. T... |
| `T1538` | [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538) | An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful informatio... |
| `T1580` | [Cloud Infrastructure Discovery](https://attack.mitre.org/techniques/T1580) | An adversary may attempt to discover infrastructure and resources that are available within an infra... |
| `T1613` | [Container and Resource Discovery](https://attack.mitre.org/techniques/T1613) | Adversaries may attempt to discover containers and other resources that are available within a conta... |
| `T1614` | [System Location Discovery](https://attack.mitre.org/techniques/T1614) | ... |
| `T1614.001` | [  ↳ System Language Discovery](https://attack.mitre.org/techniques/T1614/001) | Adversaries may attempt to gather information about the system language of a victim in order to infe... |
| `T1615` | [Group Policy Discovery](https://attack.mitre.org/techniques/T1615) | Adversaries may gather information on Group Policy settings to identify paths for privilege escalati... |
| `T1619` | [Cloud Storage Object Discovery](https://attack.mitre.org/techniques/T1619) | Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this informat... |
| `T1622` | [Debugger Evasion](https://attack.mitre.org/techniques/T1622) | Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by ... |
| `T1652` | [Device Driver Discovery](https://attack.mitre.org/techniques/T1652) | Adversaries may attempt to enumerate local device drivers on a victim host. Information about device... |
| `T1654` | [Log Enumeration](https://attack.mitre.org/techniques/T1654) | Adversaries may enumerate system and service logs to find useful data. These logs may highlight vari... |
| `T1673` | [Virtual Machine Discovery](https://attack.mitre.org/techniques/T1673) | An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host ... |
| `T1680` | [Local Storage Discovery](https://attack.mitre.org/techniques/T1680) | Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or fre... |

## LATERAL MOVEMENT ([LATERAL-MOVEMENT])

| T-Code | Technique Name | Description |
| :--- | :--- | :--- |
| `T1021` | [Remote Services](https://attack.mitre.org/techniques/T1021) | Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a servic... |
| `T1021.001` | [  ↳ Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001) | Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a comput... |
| `T1021.002` | [  ↳ SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) | Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with a r... |
| `T1021.003` | [  ↳ Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) | Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with rem... |
| `T1021.004` | [  ↳ SSH](https://attack.mitre.org/techniques/T1021/004) | Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote m... |
| `T1021.005` | [  ↳ VNC](https://attack.mitre.org/techniques/T1021/005) | Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely control ... |
| `T1021.006` | [  ↳ Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) | Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with rem... |
| `T1021.007` | [  ↳ Cloud Services](https://attack.mitre.org/techniques/T1021/007) | Adversaries may log into accessible cloud services within a compromised environment using [Valid Acc... |
| `T1021.008` | [  ↳ Direct Cloud VM Connections](https://attack.mitre.org/techniques/T1021/008) | Adversaries may leverage [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log directly... |
| `T1072` | [Software Deployment Tools](https://attack.mitre.org/techniques/T1072) | Adversaries may gain access to and use centralized software suites installed within an enterprise to... |
| `T1080` | [Taint Shared Content](https://attack.mitre.org/techniques/T1080) | ... |
| `T1091` | [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091) | Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying... |
| `T1210` | [Exploitation of Remote Services](https://attack.mitre.org/techniques/T1210) | Adversaries may exploit remote services to gain unauthorized access to internal systems once inside ... |
| `T1534` | [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) | After they already have access to accounts or systems within the environment, adversaries may use in... |
| `T1550` | [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550) | Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, an... |
| `T1550.001` | [  ↳ Application Access Token](https://attack.mitre.org/techniques/T1550/001) | Adversaries may use stolen application access tokens to bypass the typical authentication process an... |
| `T1550.002` | [  ↳ Pass the Hash](https://attack.mitre.org/techniques/T1550/002) | Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment... |
| `T1550.003` | [  ↳ Pass the Ticket](https://attack.mitre.org/techniques/T1550/003) | Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environm... |
| `T1550.004` | [  ↳ Web Session Cookie](https://attack.mitre.org/techniques/T1550/004) | Adversaries can use stolen session cookies to authenticate to web applications and services. This te... |
| `T1563` | [Remote Service Session Hijacking](https://attack.mitre.org/techniques/T1563) | Adversaries may take control of preexisting sessions with remote services to move laterally in an en... |
| `T1563.001` | [  ↳ SSH Hijacking](https://attack.mitre.org/techniques/T1563/001) | Adversaries may hijack a legitimate user's SSH session to move laterally within an environment. Secu... |
| `T1563.002` | [  ↳ RDP Hijacking](https://attack.mitre.org/techniques/T1563/002) | Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an enviro... |
| `T1570` | [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570) | Adversaries may transfer tools or other files between systems in a compromised environment. Once bro... |

## COLLECTION ([COLLECTION])

| T-Code | Technique Name | Description |
| :--- | :--- | :--- |
| `T1005` | [Data from Local System](https://attack.mitre.org/techniques/T1005) | Adversaries may search local system sources, such as file systems, configuration files, local databa... |
| `T1025` | [Data from Removable Media](https://attack.mitre.org/techniques/T1025) | Adversaries may search connected removable media on computers they have compromised to find files of... |
| `T1039` | [Data from Network Shared Drive](https://attack.mitre.org/techniques/T1039) | Adversaries may search network shares on computers they have compromised to find files of interest. ... |
| `T1056` | [Input Capture](https://attack.mitre.org/techniques/T1056) | Adversaries may use methods of capturing user input to obtain credentials or collect information. Du... |
| `T1056.001` | [  ↳ Keylogging](https://attack.mitre.org/techniques/T1056/001) | Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is l... |
| `T1056.002` | [  ↳ GUI Input Capture](https://attack.mitre.org/techniques/T1056/002) | Adversaries may mimic common operating system GUI components to prompt users for credentials with a ... |
| `T1056.003` | [  ↳ Web Portal Capture](https://attack.mitre.org/techniques/T1056/003) | Adversaries may install code on externally facing portals, such as a VPN login page, to capture and ... |
| `T1056.004` | [  ↳ Credential API Hooking](https://attack.mitre.org/techniques/T1056/004) | Adversaries may hook into Windows application programming interface (API) functions and Linux system... |
| `T1074` | [Data Staged](https://attack.mitre.org/techniques/T1074) | Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data ... |
| `T1074.001` | [  ↳ Local Data Staging](https://attack.mitre.org/techniques/T1074/001) | Adversaries may stage collected data in a central location or directory on the local system prior to... |
| `T1074.002` | [  ↳ Remote Data Staging](https://attack.mitre.org/techniques/T1074/002) | Adversaries may stage data collected from multiple systems in a central location or directory on one... |
| `T1113` | [Screen Capture](https://attack.mitre.org/techniques/T1113) | Adversaries may attempt to take screen captures of the desktop to gather information over the course... |
| `T1114` | [Email Collection](https://attack.mitre.org/techniques/T1114) | Adversaries may target user email to collect sensitive information. Emails may contain sensitive dat... |
| `T1114.001` | [  ↳ Local Email Collection](https://attack.mitre.org/techniques/T1114/001) | Adversaries may target user email on local systems to collect sensitive information. Files containin... |
| `T1114.002` | [  ↳ Remote Email Collection](https://attack.mitre.org/techniques/T1114/002) | Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive info... |
| `T1114.003` | [  ↳ Email Forwarding Rule](https://attack.mitre.org/techniques/T1114/003) | Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse... |
| `T1115` | [Clipboard Data](https://attack.mitre.org/techniques/T1115) | Adversaries may collect data stored in the clipboard from users copying information within or betwee... |
| `T1119` | [Automated Collection](https://attack.mitre.org/techniques/T1119) | Once established within a system or network, an adversary may use automated techniques for collectin... |
| `T1123` | [Audio Capture](https://attack.mitre.org/techniques/T1123) | An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applica... |
| `T1125` | [Video Capture](https://attack.mitre.org/techniques/T1125) | An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or a... |
| `T1185` | [Browser Session Hijacking](https://attack.mitre.org/techniques/T1185) | Adversaries may take advantage of security vulnerabilities and inherent functionality in browser sof... |
| `T1213` | [Data from Information Repositories](https://attack.mitre.org/techniques/T1213) | Adversaries may leverage information repositories to mine valuable information. Information reposito... |
| `T1213.001` | [  ↳ Confluence](https://attack.mitre.org/techniques/T1213/001) | ... |
| `T1213.002` | [  ↳ Sharepoint](https://attack.mitre.org/techniques/T1213/002) | Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePo... |
| `T1213.003` | [  ↳ Code Repositories](https://attack.mitre.org/techniques/T1213/003) | Adversaries may leverage code repositories to collect valuable information. Code repositories are to... |
| `T1213.004` | [  ↳ Customer Relationship Management Software](https://attack.mitre.org/techniques/T1213/004) | Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable informatio... |
| `T1213.005` | [  ↳ Messaging Applications](https://attack.mitre.org/techniques/T1213/005) | Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and ... |
| `T1213.006` | [  ↳ Databases](https://attack.mitre.org/techniques/T1213/006) | Adversaries may leverage databases to mine valuable information. These databases may be hosted on-pr... |
| `T1530` | [Data from Cloud Storage](https://attack.mitre.org/techniques/T1530) | Adversaries may access data from cloud storage.... |
| `T1557` | [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) | Adversaries may attempt to position themselves between two or more networked devices using an advers... |
| `T1557.001` | [  ↳ LLMNR/NBT-NS Poisoning and SMB Relay](https://attack.mitre.org/techniques/T1557/001) | By responding to LLMNR/NBT-NS network traffic, adversaries may spoof an authoritative source for nam... |
| `T1557.002` | [  ↳ ARP Cache Poisoning](https://attack.mitre.org/techniques/T1557/002) | Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the c... |
| `T1557.003` | [  ↳ DHCP Spoofing](https://attack.mitre.org/techniques/T1557/003) | Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configu... |
| `T1557.004` | [  ↳ Evil Twin](https://attack.mitre.org/techniques/T1557/004) | Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malic... |
| `T1560` | [Archive Collected Data](https://attack.mitre.org/techniques/T1560) | An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing t... |
| `T1560.001` | [  ↳ Archive via Utility](https://attack.mitre.org/techniques/T1560/001) | Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many ... |
| `T1560.002` | [  ↳ Archive via Library](https://attack.mitre.org/techniques/T1560/002) | An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party li... |
| `T1560.003` | [  ↳ Archive via Custom Method](https://attack.mitre.org/techniques/T1560/003) | An adversary may compress or encrypt data that is collected prior to exfiltration using a custom met... |
| `T1602` | [Data from Configuration Repository](https://attack.mitre.org/techniques/T1602) | Adversaries may collect data related to managed devices from configuration repositories. Configurati... |
| `T1602.001` | [  ↳ SNMP (MIB Dump)](https://attack.mitre.org/techniques/T1602/001) | Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable informa... |
| `T1602.002` | [  ↳ Network Device Configuration Dump](https://attack.mitre.org/techniques/T1602/002) | Adversaries may access network configuration files to collect sensitive data about the device and th... |

## COMMAND AND CONTROL ([COMMAND-AND-CONTROL])

| T-Code | Technique Name | Description |
| :--- | :--- | :--- |
| `T1001` | [Data Obfuscation](https://attack.mitre.org/techniques/T1001) | Adversaries may obfuscate command and control traffic to make it more difficult to detect.(Citation:... |
| `T1001.001` | [  ↳ Junk Data](https://attack.mitre.org/techniques/T1001/001) | Adversaries may add junk data to protocols used for command and control to make detection more diffi... |
| `T1001.002` | [  ↳ Steganography](https://attack.mitre.org/techniques/T1001/002) | Adversaries may use steganographic techniques to hide command and control traffic to make detection ... |
| `T1001.003` | [  ↳ Protocol or Service Impersonation](https://attack.mitre.org/techniques/T1001/003) | Adversaries may impersonate legitimate protocols or web service traffic to disguise command and cont... |
| `T1008` | [Fallback Channels](https://attack.mitre.org/techniques/T1008) | Adversaries may use fallback or alternate communication channels if the primary channel is compromis... |
| `T1071` | [Application Layer Protocol](https://attack.mitre.org/techniques/T1071) | Adversaries may communicate using OSI application layer protocols to avoid detection/network filteri... |
| `T1071.001` | [  ↳ Web Protocols](https://attack.mitre.org/techniques/T1071/001) | Adversaries may communicate using application layer protocols associated with web traffic to avoid d... |
| `T1071.002` | [  ↳ File Transfer Protocols](https://attack.mitre.org/techniques/T1071/002) | Adversaries may communicate using application layer protocols associated with transferring files to ... |
| `T1071.003` | [  ↳ Mail Protocols](https://attack.mitre.org/techniques/T1071/003) | Adversaries may communicate using application layer protocols associated with electronic mail delive... |
| `T1071.004` | [  ↳ DNS](https://attack.mitre.org/techniques/T1071/004) | Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid d... |
| `T1071.005` | [  ↳ Publish/Subscribe Protocols](https://attack.mitre.org/techniques/T1071/005) | Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid d... |
| `T1090` | [Proxy](https://attack.mitre.org/techniques/T1090) | Adversaries may use a connection proxy to direct network traffic between systems or act as an interm... |
| `T1090.001` | [  ↳ Internal Proxy](https://attack.mitre.org/techniques/T1090/001) | Adversaries may use an internal proxy to direct command and control traffic between two or more syst... |
| `T1090.002` | [  ↳ External Proxy](https://attack.mitre.org/techniques/T1090/002) | Adversaries may use an external proxy to act as an intermediary for network communications to a comm... |
| `T1090.003` | [  ↳ Multi-hop Proxy](https://attack.mitre.org/techniques/T1090/003) | Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typical... |
| `T1090.004` | [  ↳ Domain Fronting](https://attack.mitre.org/techniques/T1090/004) | Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other serv... |
| `T1092` | [Communication Through Removable Media](https://attack.mitre.org/techniques/T1092) | Adversaries can perform command and control between compromised hosts on potentially disconnected ne... |
| `T1095` | [Non-Application Layer Protocol](https://attack.mitre.org/techniques/T1095) | Adversaries may use an OSI non-application layer protocol for communication between host and C2 serv... |
| `T1102` | [Web Service](https://attack.mitre.org/techniques/T1102) | Adversaries may use an existing, legitimate external Web service as a means for relaying data to/fro... |
| `T1102.001` | [  ↳ Dead Drop Resolver](https://attack.mitre.org/techniques/T1102/001) | Adversaries may use an existing, legitimate external Web service to host information that points to ... |
| `T1102.002` | [  ↳ Bidirectional Communication](https://attack.mitre.org/techniques/T1102/002) | Adversaries may use an existing, legitimate external Web service as a means for sending commands to ... |
| `T1102.003` | [  ↳ One-Way Communication](https://attack.mitre.org/techniques/T1102/003) | Adversaries may use an existing, legitimate external Web service as a means for sending commands to ... |
| `T1104` | [Multi-Stage Channels](https://attack.mitre.org/techniques/T1104) | Adversaries may create multiple stages for command and control that are employed under different con... |
| `T1105` | [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) | Adversaries may transfer tools or other files from an external system into a compromised environment... |
| `T1132` | [Data Encoding](https://attack.mitre.org/techniques/T1132) | Adversaries may encode data to make the content of command and control traffic more difficult to det... |
| `T1132.001` | [  ↳ Standard Encoding](https://attack.mitre.org/techniques/T1132/001) | Adversaries may encode data with a standard data encoding system to make the content of command and ... |
| `T1132.002` | [  ↳ Non-Standard Encoding](https://attack.mitre.org/techniques/T1132/002) | Adversaries may encode data with a non-standard data encoding system to make the content of command ... |
| `T1205` | [Traffic Signaling](https://attack.mitre.org/techniques/T1205) | Adversaries may use traffic signaling to hide open ports or other malicious functionality used for p... |
| `T1205.001` | [  ↳ Port Knocking](https://attack.mitre.org/techniques/T1205/001) | Adversaries may use port knocking to hide open ports used for persistence or command and control. To... |
| `T1205.002` | [  ↳ Socket Filters](https://attack.mitre.org/techniques/T1205/002) | Adversaries may attach filters to a network socket to monitor then activate backdoors used for persi... |
| `T1219` | [Remote Access Tools](https://attack.mitre.org/techniques/T1219) | An adversary may use legitimate remote access tools to establish an interactive command and control ... |
| `T1219.001` | [  ↳ IDE Tunneling](https://attack.mitre.org/techniques/T1219/001) | Adversaries may abuse Integrated Development Environment (IDE) software with remote development feat... |
| `T1219.002` | [  ↳ Remote Desktop Software](https://attack.mitre.org/techniques/T1219/002) | An adversary may use legitimate desktop support software to establish an interactive command and con... |
| `T1219.003` | [  ↳ Remote Access Hardware](https://attack.mitre.org/techniques/T1219/003) | An adversary may use legitimate remote access hardware to establish an interactive command and contr... |
| `T1568` | [Dynamic Resolution](https://attack.mitre.org/techniques/T1568) | Adversaries may dynamically establish connections to command and control infrastructure to evade com... |
| `T1568.001` | [  ↳ Fast Flux DNS](https://attack.mitre.org/techniques/T1568/001) | Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly c... |
| `T1568.002` | [  ↳ Domain Generation Algorithms](https://attack.mitre.org/techniques/T1568/002) | Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destinatio... |
| `T1568.003` | [  ↳ DNS Calculation](https://attack.mitre.org/techniques/T1568/003) | Adversaries may perform calculations on addresses returned in DNS results to determine which port an... |
| `T1571` | [Non-Standard Port](https://attack.mitre.org/techniques/T1571) | Adversaries may communicate using a protocol and port pairing that are typically not associated. For... |
| `T1572` | [Protocol Tunneling](https://attack.mitre.org/techniques/T1572) | Adversaries may tunnel network communications to and from a victim system within a separate protocol... |
| `T1573` | [Encrypted Channel](https://attack.mitre.org/techniques/T1573) | Adversaries may employ an encryption algorithm to conceal command and control traffic rather than re... |
| `T1573.001` | [  ↳ Symmetric Cryptography](https://attack.mitre.org/techniques/T1573/001) | Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic... |
| `T1573.002` | [  ↳ Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002) | Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffi... |
| `T1659` | [Content Injection](https://attack.mitre.org/techniques/T1659) | Adversaries may gain access and continuously communicate with victims by injecting malicious content... |
| `T1665` | [Hide Infrastructure](https://attack.mitre.org/techniques/T1665) | Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastr... |

## EXFILTRATION ([EXFILTRATION])

| T-Code | Technique Name | Description |
| :--- | :--- | :--- |
| `T1011` | [Exfiltration Over Other Network Medium](https://attack.mitre.org/techniques/T1011) | Adversaries may attempt to exfiltrate data over a different network medium than the command and cont... |
| `T1011.001` | [  ↳ Exfiltration Over Bluetooth](https://attack.mitre.org/techniques/T1011/001) | Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channe... |
| `T1020` | [Automated Exfiltration](https://attack.mitre.org/techniques/T1020) | Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processin... |
| `T1020.001` | [  ↳ Traffic Duplication](https://attack.mitre.org/techniques/T1020/001) | Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised i... |
| `T1029` | [Scheduled Transfer](https://attack.mitre.org/techniques/T1029) | Adversaries may schedule data exfiltration to be performed only at certain times of day or at certai... |
| `T1030` | [Data Transfer Size Limits](https://attack.mitre.org/techniques/T1030) | An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes b... |
| `T1041` | [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) | Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen d... |
| `T1048` | [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048) | Adversaries may steal data by exfiltrating it over a different protocol than that of the existing co... |
| `T1048.001` | [  ↳ Exfiltration Over Symmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/001) | Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other ... |
| `T1048.002` | [  ↳ Exfiltration Over Asymmetric Encrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/002) | Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol othe... |
| `T1048.003` | [  ↳ Exfiltration Over Unencrypted Non-C2 Protocol](https://attack.mitre.org/techniques/T1048/003) | Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that ... |
| `T1052` | [Exfiltration Over Physical Medium](https://attack.mitre.org/techniques/T1052) | Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In cert... |
| `T1052.001` | [  ↳ Exfiltration over USB](https://attack.mitre.org/techniques/T1052/001) | Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumst... |
| `T1537` | [Transfer Data to Cloud Account](https://attack.mitre.org/techniques/T1537) | Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and crea... |
| `T1567` | [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567) | Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than thei... |
| `T1567.001` | [  ↳ Exfiltration to Code Repository](https://attack.mitre.org/techniques/T1567/001) | Adversaries may exfiltrate data to a code repository rather than over their primary command and cont... |
| `T1567.002` | [  ↳ Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) | Adversaries may exfiltrate data to a cloud storage service rather than over their primary command an... |
| `T1567.003` | [  ↳ Exfiltration to Text Storage Sites](https://attack.mitre.org/techniques/T1567/003) | Adversaries may exfiltrate data to text storage sites instead of their primary command and control c... |
| `T1567.004` | [  ↳ Exfiltration Over Webhook](https://attack.mitre.org/techniques/T1567/004) | Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and con... |

## IMPACT ([IMPACT])

| T-Code | Technique Name | Description |
| :--- | :--- | :--- |
| `T1485` | [Data Destruction](https://attack.mitre.org/techniques/T1485) | Adversaries may destroy data and files on specific systems or in large numbers on a network to inter... |
| `T1485.001` | [  ↳ Lifecycle-Triggered Deletion](https://attack.mitre.org/techniques/T1485/001) | Adversaries may modify the lifecycle policies of a cloud storage bucket to destroy all objects store... |
| `T1486` | [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) | Adversaries may encrypt data on target systems or on large numbers of systems in a network to interr... |
| `T1489` | [Service Stop](https://attack.mitre.org/techniques/T1489) | Adversaries may stop or disable services on a system to render those services unavailable to legitim... |
| `T1490` | [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490) | Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery... |
| `T1491` | [Defacement](https://attack.mitre.org/techniques/T1491) | Adversaries may modify visual content available internally or externally to an enterprise network, t... |
| `T1491.001` | [  ↳ Internal Defacement](https://attack.mitre.org/techniques/T1491/001) | An adversary may deface systems internal to an organization in an attempt to intimidate or mislead u... |
| `T1491.002` | [  ↳ External Defacement](https://attack.mitre.org/techniques/T1491/002) | An adversary may deface systems external to an organization in an attempt to deliver messaging, inti... |
| `T1495` | [Firmware Corruption](https://attack.mitre.org/techniques/T1495) | Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in d... |
| `T1496` | [Resource Hijacking](https://attack.mitre.org/techniques/T1496) | Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, whi... |
| `T1496.001` | [  ↳ Compute Hijacking](https://attack.mitre.org/techniques/T1496/001) | Adversaries may leverage the compute resources of co-opted systems to complete resource-intensive ta... |
| `T1496.002` | [  ↳ Bandwidth Hijacking](https://attack.mitre.org/techniques/T1496/002) | Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-in... |
| `T1496.003` | [  ↳ SMS Pumping](https://attack.mitre.org/techniques/T1496/003) | Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted s... |
| `T1496.004` | [  ↳ Cloud Service Hijacking](https://attack.mitre.org/techniques/T1496/004) | Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-... |
| `T1498` | [Network Denial of Service](https://attack.mitre.org/techniques/T1498) | Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability... |
| `T1498.001` | [  ↳ Direct Network Flood](https://attack.mitre.org/techniques/T1498/001) | Adversaries may attempt to cause a denial of service (DoS) by directly sending a high-volume of netw... |
| `T1498.002` | [  ↳ Reflection Amplification](https://attack.mitre.org/techniques/T1498/002) | Adversaries may attempt to cause a denial of service (DoS) by reflecting a high-volume of network tr... |
| `T1499` | [Endpoint Denial of Service](https://attack.mitre.org/techniques/T1499) | Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availabilit... |
| `T1499.001` | [  ↳ OS Exhaustion Flood](https://attack.mitre.org/techniques/T1499/001) | Adversaries may launch a denial of service (DoS) attack targeting an endpoint's operating system (OS... |
| `T1499.002` | [  ↳ Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002) | Adversaries may target the different network services provided by systems to conduct a denial of ser... |
| `T1499.003` | [  ↳ Application Exhaustion Flood](https://attack.mitre.org/techniques/T1499/003) | Adversaries may target resource intensive features of applications to cause a denial of service (DoS... |
| `T1499.004` | [  ↳ Application or System Exploitation](https://attack.mitre.org/techniques/T1499/004) | Adversaries may exploit software vulnerabilities that can cause an application or system to crash an... |
| `T1529` | [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) | Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those ... |
| `T1531` | [Account Access Removal](https://attack.mitre.org/techniques/T1531) | Adversaries may interrupt availability of system and network resources by inhibiting access to accou... |
| `T1561` | [Disk Wipe](https://attack.mitre.org/techniques/T1561) | Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network t... |
| `T1561.001` | [  ↳ Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) | Adversaries may erase the contents of storage devices on specific systems or in large numbers in a n... |
| `T1561.002` | [  ↳ Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) | Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system;... |
| `T1565` | [Data Manipulation](https://attack.mitre.org/techniques/T1565) | Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide a... |
| `T1565.001` | [  ↳ Stored Data Manipulation](https://attack.mitre.org/techniques/T1565/001) | Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes o... |
| `T1565.002` | [  ↳ Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002) | Adversaries may alter data en route to storage or other systems in order to manipulate external outc... |
| `T1565.003` | [  ↳ Runtime Data Manipulation](https://attack.mitre.org/techniques/T1565/003) | Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an... |
| `T1657` | [Financial Theft](https://attack.mitre.org/techniques/T1657) | Adversaries may steal monetary resources from targets through extortion, social engineering, technic... |
| `T1667` | [Email Bombing](https://attack.mitre.org/techniques/T1667) | Adversaries may flood targeted email addresses with an overwhelming volume of messages. This may bur... |

