windows-matrix.md

Windows Atomic Tests by ATT&CK Tactic & Technique

initial-access	execution	persistence	privilege-escalation	defense-evasion	credential-access	discovery	lateral-movement	collection	exfiltration	command-and-control	impact
Compromise Hardware Supply Chain CONTRIBUTE A TEST	At (Windows)	Accessibility Features	Abuse Elevation Control Mechanism CONTRIBUTE A TEST	Abuse Elevation Control Mechanism CONTRIBUTE A TEST	Brute Force CONTRIBUTE A TEST	Account Discovery CONTRIBUTE A TEST	Component Object Model and Distributed COM CONTRIBUTE A TEST	Archive Collected Data	Automated Exfiltration	Application Layer Protocol CONTRIBUTE A TEST	Account Access Removal
Compromise Software Dependencies and Development Tools CONTRIBUTE A TEST	Command and Scripting Interpreter CONTRIBUTE A TEST	Account Manipulation	Access Token Manipulation CONTRIBUTE A TEST	Access Token Manipulation CONTRIBUTE A TEST	Cached Domain Credentials CONTRIBUTE A TEST	Application Window Discovery	Distributed Component Object Model	Archive via Custom Method CONTRIBUTE A TEST	Data Transfer Size Limits CONTRIBUTE A TEST	Asymmetric Cryptography CONTRIBUTE A TEST	Application Exhaustion Flood CONTRIBUTE A TEST
Compromise Software Supply Chain CONTRIBUTE A TEST	Component Object Model CONTRIBUTE A TEST	Add-ins CONTRIBUTE A TEST	Accessibility Features	Asynchronous Procedure Call	Credential API Hooking	Browser Bookmark Discovery	Exploitation of Remote Services CONTRIBUTE A TEST	Archive via Library CONTRIBUTE A TEST	Exfiltration Over Alternative Protocol CONTRIBUTE A TEST	Bidirectional Communication CONTRIBUTE A TEST	Application or System Exploitation CONTRIBUTE A TEST
Default Accounts	Component Object Model and Distributed COM CONTRIBUTE A TEST	AppCert DLLs CONTRIBUTE A TEST	AppCert DLLs CONTRIBUTE A TEST	BITS Jobs	Credential Stuffing CONTRIBUTE A TEST	Domain Account	Internal Spearphishing CONTRIBUTE A TEST	Archive via Utility	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol CONTRIBUTE A TEST	Commonly Used Port CONTRIBUTE A TEST	Data Destruction
Domain Accounts CONTRIBUTE A TEST	Dynamic Data Exchange	AppInit DLLs	AppInit DLLs	Binary Padding CONTRIBUTE A TEST	Credentials In Files	Domain Groups	Lateral Tool Transfer CONTRIBUTE A TEST	Audio Capture	Exfiltration Over Bluetooth CONTRIBUTE A TEST	Communication Through Removable Media CONTRIBUTE A TEST	Data Encrypted for Impact CONTRIBUTE A TEST
Drive-by Compromise CONTRIBUTE A TEST	Exploitation for Client Execution CONTRIBUTE A TEST	Application Shimming	Application Shimming	Bootkit CONTRIBUTE A TEST	Credentials from Password Stores CONTRIBUTE A TEST	Domain Trust Discovery	Pass the Hash	Automated Collection	Exfiltration Over C2 Channel CONTRIBUTE A TEST	DNS	Data Manipulation CONTRIBUTE A TEST
Exploit Public-Facing Application CONTRIBUTE A TEST	Graphical User Interface CONTRIBUTE A TEST	At (Windows)	Asynchronous Procedure Call	Bypass User Access Control	Credentials from Web Browsers	Email Account CONTRIBUTE A TEST	Pass the Ticket	Clipboard Data	Exfiltration Over Other Network Medium CONTRIBUTE A TEST	DNS Calculation CONTRIBUTE A TEST	Defacement CONTRIBUTE A TEST
External Remote Services CONTRIBUTE A TEST	Inter-Process Communication CONTRIBUTE A TEST	Authentication Package CONTRIBUTE A TEST	At (Windows)	CMSTP	Credentials in Registry	File and Directory Discovery	RDP Hijacking	Credential API Hooking	Exfiltration Over Physical Medium CONTRIBUTE A TEST	Data Encoding CONTRIBUTE A TEST	Direct Network Flood CONTRIBUTE A TEST
Hardware Additions CONTRIBUTE A TEST	JavaScript/JScript CONTRIBUTE A TEST	BITS Jobs	Authentication Package CONTRIBUTE A TEST	COR_PROFILER	DCSync CONTRIBUTE A TEST	Local Account	Remote Desktop Protocol	Data Staged CONTRIBUTE A TEST	Exfiltration Over Symmetric Encrypted Non-C2 Protocol CONTRIBUTE A TEST	Data Obfuscation CONTRIBUTE A TEST	Disk Content Wipe CONTRIBUTE A TEST
Local Accounts CONTRIBUTE A TEST	Malicious File	Boot or Logon Autostart Execution CONTRIBUTE A TEST	Boot or Logon Autostart Execution CONTRIBUTE A TEST	Clear Windows Event Logs	Domain Controller Authentication CONTRIBUTE A TEST	Local Groups	Remote Service Session Hijacking CONTRIBUTE A TEST	Data from Information Repositories CONTRIBUTE A TEST	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	Dead Drop Resolver CONTRIBUTE A TEST	Disk Structure Wipe CONTRIBUTE A TEST
Phishing CONTRIBUTE A TEST	Malicious Link CONTRIBUTE A TEST	Boot or Logon Initialization Scripts CONTRIBUTE A TEST	Boot or Logon Initialization Scripts CONTRIBUTE A TEST	Code Signing CONTRIBUTE A TEST	Exploitation for Credential Access CONTRIBUTE A TEST	Network Service Scanning	Remote Services CONTRIBUTE A TEST	Data from Local System CONTRIBUTE A TEST	Exfiltration Over Web Service CONTRIBUTE A TEST	Domain Fronting CONTRIBUTE A TEST	Disk Wipe CONTRIBUTE A TEST
Replication Through Removable Media CONTRIBUTE A TEST	Native API	Bootkit CONTRIBUTE A TEST	Bypass User Access Control	Compile After Delivery	Forced Authentication CONTRIBUTE A TEST	Network Share Discovery	Replication Through Removable Media CONTRIBUTE A TEST	Data from Network Shared Drive CONTRIBUTE A TEST	Exfiltration over USB CONTRIBUTE A TEST	Domain Generation Algorithms CONTRIBUTE A TEST	Endpoint Denial of Service CONTRIBUTE A TEST
Spearphishing Attachment	PowerShell	Browser Extensions	COR_PROFILER	Compiled HTML File	GUI Input Capture	Network Sniffing	SMB/Windows Admin Shares	Data from Removable Media CONTRIBUTE A TEST	Exfiltration to Cloud Storage CONTRIBUTE A TEST	Dynamic Resolution CONTRIBUTE A TEST	External Defacement CONTRIBUTE A TEST
Spearphishing Link CONTRIBUTE A TEST	Python CONTRIBUTE A TEST	COR_PROFILER	Change Default File Association	Component Firmware CONTRIBUTE A TEST	Golden Ticket CONTRIBUTE A TEST	Password Policy Discovery	Shared Webroot CONTRIBUTE A TEST	Email Collection CONTRIBUTE A TEST	Exfiltration to Code Repository CONTRIBUTE A TEST	Encrypted Channel	Firmware Corruption CONTRIBUTE A TEST
Spearphishing via Service CONTRIBUTE A TEST	Scheduled Task	Change Default File Association	Component Object Model Hijacking CONTRIBUTE A TEST	Control Panel	Group Policy Preferences	Peripheral Device Discovery CONTRIBUTE A TEST	Software Deployment Tools CONTRIBUTE A TEST	Email Forwarding Rule CONTRIBUTE A TEST	Scheduled Transfer CONTRIBUTE A TEST	External Proxy CONTRIBUTE A TEST	Inhibit System Recovery
Supply Chain Compromise CONTRIBUTE A TEST	Scheduled Task/Job CONTRIBUTE A TEST	Component Firmware CONTRIBUTE A TEST	Create Process with Token CONTRIBUTE A TEST	Create Process with Token CONTRIBUTE A TEST	Input Capture CONTRIBUTE A TEST	Permission Groups Discovery CONTRIBUTE A TEST	Taint Shared Content CONTRIBUTE A TEST	GUI Input Capture		Fallback Channels CONTRIBUTE A TEST	Internal Defacement CONTRIBUTE A TEST
Trusted Relationship CONTRIBUTE A TEST	Scripting CONTRIBUTE A TEST	Component Object Model Hijacking CONTRIBUTE A TEST	Create or Modify System Process CONTRIBUTE A TEST	DLL Search Order Hijacking	Kerberoasting	Process Discovery	Use Alternate Authentication Material CONTRIBUTE A TEST	Input Capture CONTRIBUTE A TEST		Fast Flux DNS CONTRIBUTE A TEST	Network Denial of Service CONTRIBUTE A TEST
Valid Accounts CONTRIBUTE A TEST	Service Execution	Compromise Client Software Binary CONTRIBUTE A TEST	DLL Search Order Hijacking	DLL Side-Loading	Keylogging	Query Registry	VNC CONTRIBUTE A TEST	Keylogging		File Transfer Protocols CONTRIBUTE A TEST	OS Exhaustion Flood CONTRIBUTE A TEST
	Shared Modules CONTRIBUTE A TEST	Create Account CONTRIBUTE A TEST	DLL Side-Loading	Default Accounts	LLMNR/NBT-NS Poisoning and SMB Relay CONTRIBUTE A TEST	Remote System Discovery	Windows Remote Management	LLMNR/NBT-NS Poisoning and SMB Relay CONTRIBUTE A TEST		Ingress Tool Transfer	Reflection Amplification CONTRIBUTE A TEST
	Software Deployment Tools CONTRIBUTE A TEST	Create or Modify System Process CONTRIBUTE A TEST	Default Accounts	Deobfuscate/Decode Files or Information	LSA Secrets	Security Software Discovery		Local Data Staging		Internal Proxy	Resource Hijacking CONTRIBUTE A TEST
	System Services CONTRIBUTE A TEST	DLL Search Order Hijacking	Domain Accounts CONTRIBUTE A TEST	Direct Volume Access CONTRIBUTE A TEST	LSASS Memory	Software Discovery		Local Email Collection		Junk Data CONTRIBUTE A TEST	Runtime Data Manipulation CONTRIBUTE A TEST
	User Execution CONTRIBUTE A TEST	DLL Side-Loading	Dynamic-link Library Injection CONTRIBUTE A TEST	Disable Windows Event Logging	Man-in-the-Middle CONTRIBUTE A TEST	System Checks CONTRIBUTE A TEST		Man in the Browser CONTRIBUTE A TEST		Mail Protocols CONTRIBUTE A TEST	Service Exhaustion Flood CONTRIBUTE A TEST
	Visual Basic	Default Accounts	Event Triggered Execution CONTRIBUTE A TEST	Disable or Modify System Firewall	Modify Authentication Process CONTRIBUTE A TEST	System Information Discovery		Man-in-the-Middle CONTRIBUTE A TEST		Multi-Stage Channels CONTRIBUTE A TEST	Service Stop
	Windows Command Shell	Domain Account CONTRIBUTE A TEST	Executable Installer File Permissions Weakness CONTRIBUTE A TEST	Disable or Modify Tools	NTDS	System Network Configuration Discovery		Remote Data Staging CONTRIBUTE A TEST		Multi-hop Proxy CONTRIBUTE A TEST	Stored Data Manipulation CONTRIBUTE A TEST
	Windows Management Instrumentation	Domain Accounts CONTRIBUTE A TEST	Exploitation for Privilege Escalation CONTRIBUTE A TEST	Domain Accounts CONTRIBUTE A TEST	Network Sniffing	System Network Connections Discovery		Remote Email Collection CONTRIBUTE A TEST		Multiband Communication CONTRIBUTE A TEST	System Shutdown/Reboot
		Event Triggered Execution CONTRIBUTE A TEST	Extra Window Memory Injection CONTRIBUTE A TEST	Domain Controller Authentication CONTRIBUTE A TEST	OS Credential Dumping	System Owner/User Discovery		Screen Capture CONTRIBUTE A TEST		Non-Application Layer Protocol	Transmitted Data Manipulation CONTRIBUTE A TEST
		Exchange Email Delegate Permissions CONTRIBUTE A TEST	Group Policy Modification CONTRIBUTE A TEST	Dynamic-link Library Injection CONTRIBUTE A TEST	Password Cracking	System Service Discovery		Sharepoint CONTRIBUTE A TEST		Non-Standard Encoding CONTRIBUTE A TEST
		Executable Installer File Permissions Weakness CONTRIBUTE A TEST	Hijack Execution Flow CONTRIBUTE A TEST	Environmental Keying CONTRIBUTE A TEST	Password Filter DLL	System Time Discovery		Video Capture CONTRIBUTE A TEST		Non-Standard Port
		External Remote Services CONTRIBUTE A TEST	Image File Execution Options Injection	Executable Installer File Permissions Weakness CONTRIBUTE A TEST	Password Guessing	Time Based Evasion CONTRIBUTE A TEST		Web Portal Capture CONTRIBUTE A TEST		One-Way Communication CONTRIBUTE A TEST
		Hijack Execution Flow CONTRIBUTE A TEST	LSASS Driver CONTRIBUTE A TEST	Execution Guardrails CONTRIBUTE A TEST	Password Spraying	User Activity Based Checks CONTRIBUTE A TEST				Port Knocking CONTRIBUTE A TEST
		Hypervisor CONTRIBUTE A TEST	Local Accounts CONTRIBUTE A TEST	Exploitation for Defense Evasion CONTRIBUTE A TEST	Private Keys	Virtualization/Sandbox Evasion CONTRIBUTE A TEST				Protocol Impersonation CONTRIBUTE A TEST
		Image File Execution Options Injection	Logon Script (Windows)	Extra Window Memory Injection CONTRIBUTE A TEST	Security Account Manager					Protocol Tunneling CONTRIBUTE A TEST
		LSASS Driver CONTRIBUTE A TEST	Make and Impersonate Token CONTRIBUTE A TEST	File Deletion	Silver Ticket CONTRIBUTE A TEST					Proxy CONTRIBUTE A TEST
		Local Account	Netsh Helper DLL	File and Directory Permissions Modification CONTRIBUTE A TEST	Steal Web Session Cookie CONTRIBUTE A TEST					Remote Access Software
		Local Accounts CONTRIBUTE A TEST	Network Logon Script CONTRIBUTE A TEST	Group Policy Modification CONTRIBUTE A TEST	Steal or Forge Kerberos Tickets CONTRIBUTE A TEST					Standard Encoding CONTRIBUTE A TEST
		Logon Script (Windows)	Parent PID Spoofing	Hidden File System CONTRIBUTE A TEST	Two-Factor Authentication Interception CONTRIBUTE A TEST					Steganography CONTRIBUTE A TEST
		Netsh Helper DLL	Path Interception CONTRIBUTE A TEST	Hidden Files and Directories	Unsecured Credentials CONTRIBUTE A TEST					Symmetric Cryptography CONTRIBUTE A TEST
		Network Logon Script CONTRIBUTE A TEST	Path Interception by PATH Environment Variable CONTRIBUTE A TEST	Hidden Window	Web Portal Capture CONTRIBUTE A TEST					Traffic Signaling CONTRIBUTE A TEST
		Office Application Startup CONTRIBUTE A TEST	Path Interception by Search Order Hijacking CONTRIBUTE A TEST	Hide Artifacts CONTRIBUTE A TEST						Web Protocols
		Office Template Macros CONTRIBUTE A TEST	Path Interception by Unquoted Path	Hijack Execution Flow CONTRIBUTE A TEST						Web Service CONTRIBUTE A TEST
		Office Test CONTRIBUTE A TEST	Port Monitors CONTRIBUTE A TEST	Impair Defenses CONTRIBUTE A TEST
		Outlook Forms CONTRIBUTE A TEST	Portable Executable Injection CONTRIBUTE A TEST	Indicator Blocking CONTRIBUTE A TEST
		Outlook Home Page CONTRIBUTE A TEST	PowerShell Profile	Indicator Removal from Tools CONTRIBUTE A TEST
		Outlook Rules CONTRIBUTE A TEST	Process Doppelgänging CONTRIBUTE A TEST	Indicator Removal on Host
		Path Interception CONTRIBUTE A TEST	Process Hollowing	Indirect Command Execution
		Path Interception by PATH Environment Variable CONTRIBUTE A TEST	Process Injection	Install Root Certificate
		Path Interception by Search Order Hijacking CONTRIBUTE A TEST	Registry Run Keys / Startup Folder	InstallUtil
		Path Interception by Unquoted Path	SID-History Injection CONTRIBUTE A TEST	Invalid Code Signature CONTRIBUTE A TEST
		Port Knocking CONTRIBUTE A TEST	Scheduled Task	Local Accounts CONTRIBUTE A TEST
		Port Monitors CONTRIBUTE A TEST	Scheduled Task/Job CONTRIBUTE A TEST	MSBuild
		PowerShell Profile	Screensaver	Make and Impersonate Token CONTRIBUTE A TEST
		Pre-OS Boot CONTRIBUTE A TEST	Security Support Provider	Masquerade Task or Service CONTRIBUTE A TEST
		Redundant Access CONTRIBUTE A TEST	Services File Permissions Weakness CONTRIBUTE A TEST	Masquerading CONTRIBUTE A TEST
		Registry Run Keys / Startup Folder	Services Registry Permissions Weakness	Match Legitimate Name or Location CONTRIBUTE A TEST
		SQL Stored Procedures CONTRIBUTE A TEST	Shortcut Modification	Modify Authentication Process CONTRIBUTE A TEST
		Scheduled Task	Thread Execution Hijacking CONTRIBUTE A TEST	Modify Registry
		Scheduled Task/Job CONTRIBUTE A TEST	Thread Local Storage CONTRIBUTE A TEST	Mshta
		Screensaver	Time Providers CONTRIBUTE A TEST	Msiexec
		Security Support Provider	Token Impersonation/Theft CONTRIBUTE A TEST	NTFS File Attributes
		Server Software Component CONTRIBUTE A TEST	Valid Accounts CONTRIBUTE A TEST	Network Share Connection Removal
		Services File Permissions Weakness CONTRIBUTE A TEST	Windows Management Instrumentation Event Subscription	Obfuscated Files or Information
		Services Registry Permissions Weakness	Windows Service	Odbcconf
		Shortcut Modification	Winlogon Helper DLL	Parent PID Spoofing
		System Firmware CONTRIBUTE A TEST		Pass the Hash
		Time Providers CONTRIBUTE A TEST		Pass the Ticket
		Traffic Signaling CONTRIBUTE A TEST		Password Filter DLL
		Transport Agent		Path Interception by PATH Environment Variable CONTRIBUTE A TEST
		Valid Accounts CONTRIBUTE A TEST		Path Interception by Search Order Hijacking CONTRIBUTE A TEST
		Web Shell		Path Interception by Unquoted Path
		Windows Management Instrumentation Event Subscription		Port Knocking CONTRIBUTE A TEST
		Windows Service		Portable Executable Injection CONTRIBUTE A TEST
		Winlogon Helper DLL		Pre-OS Boot CONTRIBUTE A TEST
				Process Doppelgänging CONTRIBUTE A TEST
				Process Hollowing
				Process Injection
				PubPrn
				Redundant Access CONTRIBUTE A TEST
				Regsvcs/Regasm
				Regsvr32
				Rename System Utilities
				Right-to-Left Override CONTRIBUTE A TEST
				Rogue Domain Controller
				Rootkit
				Run Virtual Instance CONTRIBUTE A TEST
				Rundll32
				SID-History Injection CONTRIBUTE A TEST
				SIP and Trust Provider Hijacking CONTRIBUTE A TEST
				Scripting CONTRIBUTE A TEST
				Services File Permissions Weakness CONTRIBUTE A TEST
				Services Registry Permissions Weakness
				Signed Binary Proxy Execution
				Signed Script Proxy Execution
				Software Packing CONTRIBUTE A TEST
				Steganography CONTRIBUTE A TEST
				Subvert Trust Controls CONTRIBUTE A TEST
				System Checks CONTRIBUTE A TEST
				System Firmware CONTRIBUTE A TEST
				Template Injection CONTRIBUTE A TEST
				Thread Execution Hijacking CONTRIBUTE A TEST
				Thread Local Storage CONTRIBUTE A TEST
				Time Based Evasion CONTRIBUTE A TEST
				Timestomp
				Token Impersonation/Theft CONTRIBUTE A TEST
				Traffic Signaling CONTRIBUTE A TEST
				Trusted Developer Utilities Proxy Execution CONTRIBUTE A TEST
				Use Alternate Authentication Material CONTRIBUTE A TEST
				User Activity Based Checks CONTRIBUTE A TEST
				Valid Accounts CONTRIBUTE A TEST
				Virtualization/Sandbox Evasion CONTRIBUTE A TEST
				Windows File and Directory Permissions Modification
				XSL Script Processing