Malware
Default Accounts
Protocol Tunneling
Windows Remote Management
External Remote Services
Domain Account
Network Service Discovery
Web Shell
System Information Discovery
System Network Configuration Discovery
Internal Proxy
Data Manipulation
PowerShell
Scheduled Task
Local Account
Security Account Manager
NTDS
Exploit Public-Facing Application
Gather Victim Identity Information
Masquerade Task or Service
SMB/Windows Admin Shares
LSASS Memory
Hidden Files and Directories
Credentials In Files
Financial Theft
Tool
Make and Impersonate Token
Ingress Tool Transfer
Web Protocols
Pass the Hash
Windows Command Shell
Registry Run Keys / Startup Folder
Internet Connection Discovery
Masquerading
Visual Basic
Additional Local or Domain Groups
DLL
Remote Desktop Protocol
Network Topology
Network Share Discovery
Archive via Utility
Deobfuscate/Decode Files or Information
Modify Authentication Process
Windows Management Instrumentation
SSH
Local Data Staging
Keylogging
Match Legitimate Resource Name or Location
System Network Connections Discovery
File and Directory Discovery
Data from Local System
Permission Groups Discovery
Account Discovery