LSASS Memory
Process Discovery
Data from Local System
Pass the Hash
Domains
Archive via Utility
Automated Collection
Remote Email Collection
Spearphishing Link
System Network Configuration Discovery
Local Email Collection
Malware
System Network Connections Discovery
Email Accounts
Domains
Match Legitimate Resource Name or Location
Local Account
Spearphishing Attachment
Network Share Discovery
Windows Command Shell
Tool
System Service Discovery
Remote Desktop Protocol