Scheduled Task
Multi-Stage Channels
Password Cracking
Hidden Window
Credentials from Web Browsers
Windows Command Shell
System Network Configuration Discovery
System Network Connections Discovery
External Proxy
Rundll32
Obfuscated Files or Information
Spearphishing Link
Additional Local or Domain Groups
Malicious Link
Exfiltration Over C2 Channel
Credentials In Files
Local Data Staging
Domain Accounts
Data from Local System
Exploitation for Client Execution
SMB/Windows Admin Shares
DLL
Local Account
File Deletion
File and Directory Discovery
Accessibility Features
Archive via Utility
System Information Discovery
PowerShell
Windows Service
LSASS Memory
Registry Run Keys / Startup Folder
Remote Desktop Protocol
Process Discovery
Non-Application Layer Protocol
Permission Groups Discovery
Remote System Discovery
Keylogging
Masquerade Account Name
Software Packing
Local Account
Ingress Tool Transfer
System Owner/User Discovery
Indicator Removal from Tools