Techniques
How an adversary achieves a tactical goal.
227 entries (top-level; sub-techniques are listed on each technique).
- T1001 Data Obfuscation +3 sub
- T1003 OS Credential Dumping +8 sub
- T1005 Data from Local System
- T1006 Direct Volume Access
- T1007 System Service Discovery
- T1008 Fallback Channels
- T1010 Application Window Discovery
- T1011 Exfiltration Over Other Network Medium +1 sub
- T1012 Query Registry
- T1014 Rootkit
- T1016 System Network Configuration Discovery +2 sub
- T1018 Remote System Discovery
- T1020 Automated Exfiltration +1 sub
- T1021 Remote Services +8 sub
- T1025 Data from Removable Media
- T1027 Obfuscated Files or Information +18 sub
- T1029 Scheduled Transfer
- T1030 Data Transfer Size Limits
- T1033 System Owner/User Discovery
- T1036 Masquerading +12 sub
- T1037 Boot or Logon Initialization Scripts +5 sub
- T1039 Data from Network Shared Drive
- T1040 Network Sniffing
- T1041 Exfiltration Over C2 Channel
- T1046 Network Service Discovery
- T1047 Windows Management Instrumentation
- T1048 Exfiltration Over Alternative Protocol +3 sub
- T1049 System Network Connections Discovery
- T1052 Exfiltration Over Physical Medium +1 sub
- T1053 Scheduled Task/Job +5 sub
- T1055 Process Injection +12 sub
- T1056 Input Capture +4 sub
- T1057 Process Discovery
- T1059 Command and Scripting Interpreter +13 sub
- T1068 Exploitation for Privilege Escalation
- T1069 Permission Groups Discovery +3 sub
- T1070 Indicator Removal +8 sub
- T1071 Application Layer Protocol +5 sub
- T1072 Software Deployment Tools
- T1074 Data Staged +2 sub
- T1078 Valid Accounts +4 sub
- T1080 Taint Shared Content
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1087 Account Discovery +4 sub
- T1090 Proxy +4 sub
- T1091 Replication Through Removable Media
- T1092 Communication Through Removable Media
- T1095 Non-Application Layer Protocol
- T1098 Account Manipulation +7 sub