Techniques
How an adversary achieves a tactical goal.
227 entries (top-level; sub-techniques are listed on each technique).
- T1480 Execution Guardrails +2 sub
- T1482 Domain Trust Discovery
- T1484 Domain or Tenant Policy Modification +2 sub
- T1485 Data Destruction +1 sub
- T1486 Data Encrypted for Impact
- T1489 Service Stop
- T1490 Inhibit System Recovery
- T1491 Defacement +2 sub
- T1495 Firmware Corruption
- T1496 Resource Hijacking +4 sub
- T1497 Virtualization/Sandbox Evasion +3 sub
- T1498 Network Denial of Service +2 sub
- T1499 Endpoint Denial of Service +4 sub
- T1505 Server Software Component +6 sub
- T1518 Software Discovery +2 sub
- T1525 Implant Internal Image
- T1526 Cloud Service Discovery
- T1528 Steal Application Access Token
- T1529 System Shutdown/Reboot
- T1530 Data from Cloud Storage
- T1531 Account Access Removal
- T1534 Internal Spearphishing
- T1535 Unused/Unsupported Cloud Regions
- T1537 Transfer Data to Cloud Account
- T1538 Cloud Service Dashboard
- T1539 Steal Web Session Cookie
- T1542 Pre-OS Boot +5 sub
- T1543 Create or Modify System Process +5 sub
- T1546 Event Triggered Execution +18 sub
- T1547 Boot or Logon Autostart Execution +14 sub
- T1548 Abuse Elevation Control Mechanism +6 sub
- T1550 Use Alternate Authentication Material +4 sub
- T1552 Unsecured Credentials +8 sub
- T1553 Subvert Trust Controls +6 sub
- T1554 Compromise Host Software Binary
- T1555 Credentials from Password Stores +6 sub
- T1556 Modify Authentication Process +9 sub
- T1557 Adversary-in-the-Middle +4 sub
- T1558 Steal or Forge Kerberos Tickets +5 sub
- T1559 Inter-Process Communication +3 sub
- T1560 Archive Collected Data +3 sub
- T1561 Disk Wipe +2 sub
- T1563 Remote Service Session Hijacking +2 sub
- T1564 Hide Artifacts +14 sub
- T1565 Data Manipulation +3 sub
- T1566 Phishing +4 sub
- T1567 Exfiltration Over Web Service +4 sub
- T1568 Dynamic Resolution +3 sub
- T1569 System Services +3 sub
- T1570 Lateral Tool Transfer