Spearphishing Link
Process Discovery
Windows Host Firewall
Remote Data Staging
Disable or Modify Tools
Domain Account
System Language Discovery
Gather Victim Org Information
Proxy
Clear Windows Event Logs
Remote Desktop Protocol
Malware
File Deletion
Security Account Manager
File and Directory Discovery
Domain Trust Discovery
Impersonation
Tool
LSASS Memory
Malicious File
Remote System Discovery
System Network Configuration Discovery
Code Signing
Data from Local System
Windows Command Shell
Spearphishing Attachment
Visual Basic
System Service Discovery
System Information Discovery
Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
DLL
SMB/Windows Admin Shares
File Transfer Protocols
Exploit Public-Facing Application
Masquerade File Type
NTDS
Archive via Utility
Template Injection
Password Filter DLL
Windows Management Instrumentation
Local Email Collection
Encrypted/Encoded File
System Owner/User Discovery