Command Obfuscation
Account Discovery
File Deletion
Unix Shell
SMB/Windows Admin Shares
Masquerade Task or Service
Dynamic Linker Hijacking
Clear Command History
Windows Service
Pass the Hash
DLL
Remote Desktop Protocol
Data from Local System
Ingress Tool Transfer
System Service Discovery
Log Enumeration
SSH
Modify Registry
Match Legitimate Resource Name or Location
Malware
Security Software Discovery
Windows Command Shell
Disable or Modify Tools
System Owner/User Discovery
Windows Management Instrumentation
Tool
Vulnerability Scanning
LSASS Memory
Remote Services
System Information Discovery
Rundll32
Clear Windows Event Logs
Domain Accounts
Archive via Utility
PowerShell