Disable or Modify System Firewall
Data from Local System
Domain Groups
Scheduled Task
Spearphishing via Service
Domain Account
Non-Application Layer Protocol
Domain Accounts
Native API
Process Discovery
Remote System Discovery
System Network Connections Discovery
SMB/Windows Admin Shares
Windows Command Shell
Exploit Public-Facing Application
Exfiltration to Cloud Storage
Security Software Discovery
PowerShell
Hidden Window
File and Directory Discovery
Remote Data Staging
Windows Management Instrumentation
Match Legitimate Resource Name or Location
Local Storage Discovery
Archive via Utility