Windows Service
File Deletion
Spearphishing Attachment
Ingress Tool Transfer
Process Discovery
Malicious File
Encrypted Channel
Web Protocols
Hidden Files and Directories
Template Injection
System Owner/User Discovery
Network Service Discovery
System Network Configuration Discovery
Exfiltration over USB
Registry Run Keys / Startup Folder
Web Shell
Asymmetric Cryptography
Windows Command Shell
Native API
DLL
File and Directory Discovery
Encrypted/Encoded File
Match Legitimate Resource Name or Location
Standard Encoding
Local Accounts
Local Storage Discovery
Winlogon Helper DLL
Exploitation for Client Execution
DNS
Automated Collection
Dynamic-link Library Injection
Automated Exfiltration
Network Share Discovery
System Information Discovery
Security Software Discovery
Deobfuscate/Decode Files or Information
System Network Connections Discovery
Steganography
Software Discovery
Replication Through Removable Media