Valid Accounts
Exfiltration Over Unencrypted Non-C2 Protocol
System Owner/User Discovery
Security Software Discovery
Remote Desktop Protocol
LSASS Memory
Tool
Malicious File
Code Signing Certificates
Exploitation for Privilege Escalation
Windows Management Instrumentation Event Subscription
Spearphishing Link
Scheduled Task
Malicious Link
Web Service
Command Obfuscation
File Deletion
Spearphishing Attachment
Web Protocols
SMB/Windows Admin Shares
Clear Windows Event Logs
Archive via Utility
Remote Data Staging
Ingress Tool Transfer
System Information Discovery
PowerShell
Windows Command Shell
Asymmetric Cryptography
Asynchronous Procedure Call
Remote System Discovery
Data Encrypted for Impact
Domain Trust Discovery
Modify Registry
Token Impersonation/Theft
Internet Connection Discovery
Windows Management Instrumentation