Windows Command Shell
Security Account Manager
Valid Accounts
Scheduled Task
Obfuscated Files or Information
Code Signing
Exfiltration Over C2 Channel
Data from Local System
DLL
Tool
Windows Management Instrumentation
Domain Account
Server
External Remote Services
Software Packing
Web Shell
LSASS Memory
Archive via Utility
PowerShell
Lateral Tool Transfer
Indicator Removal from Tools
External Proxy
System Network Connections Discovery
Local Data Staging
System Owner/User Discovery
Exploit Public-Facing Application
System Network Configuration Discovery
Ingress Tool Transfer
Remote System Discovery
Pass the Hash
Rename Legitimate Utilities