Tactics and Techniques
----------------------

.. contents::
   :depth: 2
   :local:

Tactics
^^^^^^^

.. _mitre_tactic_collection:

Collection
""""""""""

`Mitre Description <https://attack.mitre.org/tactics/TA0009>`__

.. _mitre_tactic_command_and_control:

Command and Control
"""""""""""""""""""

`Mitre Description <https://attack.mitre.org/tactics/TA0011>`__

.. _mitre_tactic_credential_access:

Credential Access
"""""""""""""""""

`Mitre Description <https://attack.mitre.org/tactics/TA0006>`__

.. _mitre_tactic_defense_evasion:

Defense Evasion
"""""""""""""""

`Mitre Description <https://attack.mitre.org/tactics/TA0005>`__

.. _mitre_tactic_discovery:

Discovery
"""""""""

`Mitre Description <https://attack.mitre.org/tactics/TA0007>`__

.. _mitre_tactic_execution:

Execution
"""""""""

`Mitre Description <https://attack.mitre.org/tactics/TA0002>`__

.. _mitre_tactic_exfiltration:

Exfiltration
""""""""""""

`Mitre Description <https://attack.mitre.org/tactics/TA0010>`__

.. _mitre_tactic_impact:

Impact
""""""

`Mitre Description <https://attack.mitre.org/tactics/TA0040>`__

.. _mitre_tactic_initial_access:

Initial Access
""""""""""""""

`Mitre Description <https://attack.mitre.org/tactics/TA0001>`__

.. _mitre_tactic_lateral_movement:

Lateral Movement
""""""""""""""""

`Mitre Description <https://attack.mitre.org/tactics/TA0008>`__

.. _mitre_tactic_persistence:

Persistence
"""""""""""

`Mitre Description <https://attack.mitre.org/tactics/TA0003>`__

.. _mitre_tactic_privilege_escalation:

Privilege Escalation
""""""""""""""""""""

`Mitre Description <https://attack.mitre.org/tactics/TA0004>`__

.. _mitre_tactic_reconnaissance:

Reconnaissance
""""""""""""""

`Mitre Description <https://attack.mitre.org/tactics/TA0043>`__

.. _mitre_tactic_resource_development:

Resource Development
""""""""""""""""""""

`Mitre Description <https://attack.mitre.org/tactics/TA0042>`__

Techniques
^^^^^^^^^^

.. _mitre_technique_abuse_elevation_control_mechanism:

Abuse Elevation Control Mechanism
"""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`, :ref:`mitre_tactic_privilege_escalation`

`Mitre Description <https://attack.mitre.org/techniques/T1548>`__

.. _mitre_technique_access_token_manipulation:

Access Token Manipulation
"""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`, :ref:`mitre_tactic_privilege_escalation`

`Mitre Description <https://attack.mitre.org/techniques/T1134>`__

.. _mitre_technique_account_access_removal:

Account Access Removal
""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_impact`

`Mitre Description <https://attack.mitre.org/techniques/T1531>`__

.. _mitre_technique_account_discovery:

Account Discovery
"""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1087>`__

.. _mitre_technique_account_manipulation:

Account Manipulation
""""""""""""""""""""

Tactics: :ref:`mitre_tactic_persistence`

`Mitre Description <https://attack.mitre.org/techniques/T1098>`__

.. _mitre_technique_acquire_infrastructure:

Acquire Infrastructure
""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_resource_development`

`Mitre Description <https://attack.mitre.org/techniques/T1583>`__

.. _mitre_technique_active_scanning:

Active Scanning
"""""""""""""""

Tactics: :ref:`mitre_tactic_reconnaissance`

`Mitre Description <https://attack.mitre.org/techniques/T1595>`__

.. _mitre_technique_adversary_in_the_middle:

Adversary-in-the-Middle
"""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_collection`, :ref:`mitre_tactic_credential_access`

`Mitre Description <https://attack.mitre.org/techniques/T1557>`__

.. _mitre_technique_application_layer_protocol:

Application Layer Protocol
""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_command_and_control`

`Mitre Description <https://attack.mitre.org/techniques/T1071>`__

.. _mitre_technique_application_window_discovery:

Application Window Discovery
""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1010>`__

.. _mitre_technique_archive_collected_data:

Archive Collected Data
""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_collection`

`Mitre Description <https://attack.mitre.org/techniques/T1560>`__

.. _mitre_technique_audio_capture:

Audio Capture
"""""""""""""

Tactics: :ref:`mitre_tactic_collection`

`Mitre Description <https://attack.mitre.org/techniques/T1123>`__

.. _mitre_technique_automated_collection:

Automated Collection
""""""""""""""""""""

Tactics: :ref:`mitre_tactic_collection`

`Mitre Description <https://attack.mitre.org/techniques/T1119>`__

.. _mitre_technique_automated_exfiltration:

Automated Exfiltration
""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_exfiltration`

`Mitre Description <https://attack.mitre.org/techniques/T1020>`__

.. _mitre_technique_bits_jobs:

BITS Jobs
"""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`, :ref:`mitre_tactic_persistence`

`Mitre Description <https://attack.mitre.org/techniques/T1197>`__

.. _mitre_technique_boot_or_logon_autostart_execution:

Boot or Logon Autostart Execution
"""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_persistence`, :ref:`mitre_tactic_privilege_escalation`

`Mitre Description <https://attack.mitre.org/techniques/T1547>`__

.. _mitre_technique_boot_or_logon_initialization_scripts:

Boot or Logon Initialization Scripts
""""""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_persistence`, :ref:`mitre_tactic_privilege_escalation`

`Mitre Description <https://attack.mitre.org/techniques/T1037>`__

.. _mitre_technique_browser_bookmark_discovery:

Browser Bookmark Discovery
""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1217>`__

.. _mitre_technique_browser_extensions:

Browser Extensions
""""""""""""""""""

Tactics: :ref:`mitre_tactic_persistence`

`Mitre Description <https://attack.mitre.org/techniques/T1176>`__

.. _mitre_technique_browser_session_hijacking:

Browser Session Hijacking
"""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_collection`

`Mitre Description <https://attack.mitre.org/techniques/T1185>`__

.. _mitre_technique_brute_force:

Brute Force
"""""""""""

Tactics: :ref:`mitre_tactic_credential_access`

`Mitre Description <https://attack.mitre.org/techniques/T1110>`__

.. _mitre_technique_build_image_on_host:

Build Image on Host
"""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1612>`__

.. _mitre_technique_clipboard_data:

Clipboard Data
""""""""""""""

Tactics: :ref:`mitre_tactic_collection`

`Mitre Description <https://attack.mitre.org/techniques/T1115>`__

.. _mitre_technique_cloud_infrastructure_discovery:

Cloud Infrastructure Discovery
""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1580>`__

.. _mitre_technique_cloud_service_dashboard:

Cloud Service Dashboard
"""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1538>`__

.. _mitre_technique_cloud_service_discovery:

Cloud Service Discovery
"""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1526>`__

.. _mitre_technique_cloud_storage_object_discovery:

Cloud Storage Object Discovery
""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1619>`__

.. _mitre_technique_command_and_scripting_interpreter:

Command and Scripting Interpreter
"""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_execution`

`Mitre Description <https://attack.mitre.org/techniques/T1059>`__

.. _mitre_technique_communication_through_removable_media:

Communication Through Removable Media
"""""""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_command_and_control`

`Mitre Description <https://attack.mitre.org/techniques/T1092>`__

.. _mitre_technique_compromise_accounts:

Compromise Accounts
"""""""""""""""""""

Tactics: :ref:`mitre_tactic_resource_development`

`Mitre Description <https://attack.mitre.org/techniques/T1586>`__

.. _mitre_technique_compromise_client_software_binary:

Compromise Client Software Binary
"""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_persistence`

`Mitre Description <https://attack.mitre.org/techniques/T1554>`__

.. _mitre_technique_compromise_infrastructure:

Compromise Infrastructure
"""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_resource_development`

`Mitre Description <https://attack.mitre.org/techniques/T1584>`__

.. _mitre_technique_container_administration_command:

Container Administration Command
""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_execution`

`Mitre Description <https://attack.mitre.org/techniques/T1609>`__

.. _mitre_technique_container_and_resource_discovery:

Container and Resource Discovery
""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1613>`__

.. _mitre_technique_create_account:

Create Account
""""""""""""""

Tactics: :ref:`mitre_tactic_persistence`

`Mitre Description <https://attack.mitre.org/techniques/T1136>`__

.. _mitre_technique_create_or_modify_system_process:

Create or Modify System Process
"""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_persistence`, :ref:`mitre_tactic_privilege_escalation`

`Mitre Description <https://attack.mitre.org/techniques/T1543>`__

.. _mitre_technique_credentials_from_password_stores:

Credentials from Password Stores
""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_credential_access`

`Mitre Description <https://attack.mitre.org/techniques/T1555>`__

.. _mitre_technique_data_destruction:

Data Destruction
""""""""""""""""

Tactics: :ref:`mitre_tactic_impact`

`Mitre Description <https://attack.mitre.org/techniques/T1485>`__

.. _mitre_technique_data_encoding:

Data Encoding
"""""""""""""

Tactics: :ref:`mitre_tactic_command_and_control`

`Mitre Description <https://attack.mitre.org/techniques/T1132>`__

.. _mitre_technique_data_encrypted_for_impact:

Data Encrypted for Impact
"""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_impact`

`Mitre Description <https://attack.mitre.org/techniques/T1486>`__

.. _mitre_technique_data_manipulation:

Data Manipulation
"""""""""""""""""

Tactics: :ref:`mitre_tactic_impact`

`Mitre Description <https://attack.mitre.org/techniques/T1565>`__

.. _mitre_technique_data_obfuscation:

Data Obfuscation
""""""""""""""""

Tactics: :ref:`mitre_tactic_command_and_control`

`Mitre Description <https://attack.mitre.org/techniques/T1001>`__

.. _mitre_technique_data_staged:

Data Staged
"""""""""""

Tactics: :ref:`mitre_tactic_collection`

`Mitre Description <https://attack.mitre.org/techniques/T1074>`__

.. _mitre_technique_data_transfer_size_limits:

Data Transfer Size Limits
"""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_exfiltration`

`Mitre Description <https://attack.mitre.org/techniques/T1030>`__

.. _mitre_technique_data_from_cloud_storage:

Data from Cloud Storage
"""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_collection`

`Mitre Description <https://attack.mitre.org/techniques/T1530>`__

.. _mitre_technique_data_from_configuration_repository:

Data from Configuration Repository
""""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_collection`

`Mitre Description <https://attack.mitre.org/techniques/T1602>`__

.. _mitre_technique_data_from_information_repositories:

Data from Information Repositories
""""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_collection`

`Mitre Description <https://attack.mitre.org/techniques/T1213>`__

.. _mitre_technique_data_from_local_system:

Data from Local System
""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_collection`

`Mitre Description <https://attack.mitre.org/techniques/T1005>`__

.. _mitre_technique_data_from_network_shared_drive:

Data from Network Shared Drive
""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_collection`

`Mitre Description <https://attack.mitre.org/techniques/T1039>`__

.. _mitre_technique_data_from_removable_media:

Data from Removable Media
"""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_collection`

`Mitre Description <https://attack.mitre.org/techniques/T1025>`__

.. _mitre_technique_debugger_evasion:

Debugger Evasion
""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`, :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1622>`__

.. _mitre_technique_defacement:

Defacement
""""""""""

Tactics: :ref:`mitre_tactic_impact`

`Mitre Description <https://attack.mitre.org/techniques/T1491>`__

.. _mitre_technique_deobfuscate_decode_files_or_information:

Deobfuscate/Decode Files or Information
"""""""""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1140>`__

.. _mitre_technique_deploy_container:

Deploy Container
""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`, :ref:`mitre_tactic_execution`

`Mitre Description <https://attack.mitre.org/techniques/T1610>`__

.. _mitre_technique_develop_capabilities:

Develop Capabilities
""""""""""""""""""""

Tactics: :ref:`mitre_tactic_resource_development`

`Mitre Description <https://attack.mitre.org/techniques/T1587>`__

.. _mitre_technique_direct_volume_access:

Direct Volume Access
""""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1006>`__

.. _mitre_technique_disk_wipe:

Disk Wipe
"""""""""

Tactics: :ref:`mitre_tactic_impact`

`Mitre Description <https://attack.mitre.org/techniques/T1561>`__

.. _mitre_technique_domain_policy_modification:

Domain Policy Modification
""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`, :ref:`mitre_tactic_privilege_escalation`

`Mitre Description <https://attack.mitre.org/techniques/T1484>`__

.. _mitre_technique_domain_trust_discovery:

Domain Trust Discovery
""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1482>`__

.. _mitre_technique_drive_by_compromise:

Drive-by Compromise
"""""""""""""""""""

Tactics: :ref:`mitre_tactic_initial_access`

`Mitre Description <https://attack.mitre.org/techniques/T1189>`__

.. _mitre_technique_dynamic_resolution:

Dynamic Resolution
""""""""""""""""""

Tactics: :ref:`mitre_tactic_command_and_control`

`Mitre Description <https://attack.mitre.org/techniques/T1568>`__

.. _mitre_technique_email_collection:

Email Collection
""""""""""""""""

Tactics: :ref:`mitre_tactic_collection`

`Mitre Description <https://attack.mitre.org/techniques/T1114>`__

.. _mitre_technique_encrypted_channel:

Encrypted Channel
"""""""""""""""""

Tactics: :ref:`mitre_tactic_command_and_control`

`Mitre Description <https://attack.mitre.org/techniques/T1573>`__

.. _mitre_technique_endpoint_denial_of_service:

Endpoint Denial of Service
""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_impact`

`Mitre Description <https://attack.mitre.org/techniques/T1499>`__

.. _mitre_technique_escape_to_host:

Escape to Host
""""""""""""""

Tactics: :ref:`mitre_tactic_privilege_escalation`

`Mitre Description <https://attack.mitre.org/techniques/T1611>`__

.. _mitre_technique_establish_accounts:

Establish Accounts
""""""""""""""""""

Tactics: :ref:`mitre_tactic_resource_development`

`Mitre Description <https://attack.mitre.org/techniques/T1585>`__

.. _mitre_technique_event_triggered_execution:

Event Triggered Execution
"""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_persistence`, :ref:`mitre_tactic_privilege_escalation`

`Mitre Description <https://attack.mitre.org/techniques/T1546>`__

.. _mitre_technique_execution_guardrails:

Execution Guardrails
""""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1480>`__

.. _mitre_technique_exfiltration_over_alternative_protocol:

Exfiltration Over Alternative Protocol
""""""""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_exfiltration`

`Mitre Description <https://attack.mitre.org/techniques/T1048>`__

.. _mitre_technique_exfiltration_over_c2_channel:

Exfiltration Over C2 Channel
""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_exfiltration`

`Mitre Description <https://attack.mitre.org/techniques/T1041>`__

.. _mitre_technique_exfiltration_over_other_network_medium:

Exfiltration Over Other Network Medium
""""""""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_exfiltration`

`Mitre Description <https://attack.mitre.org/techniques/T1011>`__

.. _mitre_technique_exfiltration_over_physical_medium:

Exfiltration Over Physical Medium
"""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_exfiltration`

`Mitre Description <https://attack.mitre.org/techniques/T1052>`__

.. _mitre_technique_exfiltration_over_web_service:

Exfiltration Over Web Service
"""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_exfiltration`

`Mitre Description <https://attack.mitre.org/techniques/T1567>`__

.. _mitre_technique_exploit_public_facing_application:

Exploit Public-Facing Application
"""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_initial_access`

`Mitre Description <https://attack.mitre.org/techniques/T1190>`__

.. _mitre_technique_exploitation_for_client_execution:

Exploitation for Client Execution
"""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_execution`

`Mitre Description <https://attack.mitre.org/techniques/T1203>`__

.. _mitre_technique_exploitation_for_credential_access:

Exploitation for Credential Access
""""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_credential_access`

`Mitre Description <https://attack.mitre.org/techniques/T1212>`__

.. _mitre_technique_exploitation_for_defense_evasion:

Exploitation for Defense Evasion
""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1211>`__

.. _mitre_technique_exploitation_for_privilege_escalation:

Exploitation for Privilege Escalation
"""""""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_privilege_escalation`

`Mitre Description <https://attack.mitre.org/techniques/T1068>`__

.. _mitre_technique_exploitation_of_remote_services:

Exploitation of Remote Services
"""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_lateral_movement`

`Mitre Description <https://attack.mitre.org/techniques/T1210>`__

.. _mitre_technique_external_remote_services:

External Remote Services
""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_initial_access`, :ref:`mitre_tactic_persistence`

`Mitre Description <https://attack.mitre.org/techniques/T1133>`__

.. _mitre_technique_fallback_channels:

Fallback Channels
"""""""""""""""""

Tactics: :ref:`mitre_tactic_command_and_control`

`Mitre Description <https://attack.mitre.org/techniques/T1008>`__

.. _mitre_technique_file_and_directory_discovery:

File and Directory Discovery
""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1083>`__

.. _mitre_technique_file_and_directory_permissions_modification:

File and Directory Permissions Modification
"""""""""""""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1222>`__

.. _mitre_technique_firmware_corruption:

Firmware Corruption
"""""""""""""""""""

Tactics: :ref:`mitre_tactic_impact`

`Mitre Description <https://attack.mitre.org/techniques/T1495>`__

.. _mitre_technique_forced_authentication:

Forced Authentication
"""""""""""""""""""""

Tactics: :ref:`mitre_tactic_credential_access`

`Mitre Description <https://attack.mitre.org/techniques/T1187>`__

.. _mitre_technique_forge_web_credentials:

Forge Web Credentials
"""""""""""""""""""""

Tactics: :ref:`mitre_tactic_credential_access`

`Mitre Description <https://attack.mitre.org/techniques/T1606>`__

.. _mitre_technique_gather_victim_host_information:

Gather Victim Host Information
""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_reconnaissance`

`Mitre Description <https://attack.mitre.org/techniques/T1592>`__

.. _mitre_technique_gather_victim_identity_information:

Gather Victim Identity Information
""""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_reconnaissance`

`Mitre Description <https://attack.mitre.org/techniques/T1589>`__

.. _mitre_technique_gather_victim_network_information:

Gather Victim Network Information
"""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_reconnaissance`

`Mitre Description <https://attack.mitre.org/techniques/T1590>`__

.. _mitre_technique_gather_victim_org_information:

Gather Victim Org Information
"""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_reconnaissance`

`Mitre Description <https://attack.mitre.org/techniques/T1591>`__

.. _mitre_technique_group_policy_discovery:

Group Policy Discovery
""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1615>`__

.. _mitre_technique_hardware_additions:

Hardware Additions
""""""""""""""""""

Tactics: :ref:`mitre_tactic_initial_access`

`Mitre Description <https://attack.mitre.org/techniques/T1200>`__

.. _mitre_technique_hide_artifacts:

Hide Artifacts
""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1564>`__

.. _mitre_technique_hijack_execution_flow:

Hijack Execution Flow
"""""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`, :ref:`mitre_tactic_persistence`, :ref:`mitre_tactic_privilege_escalation`

`Mitre Description <https://attack.mitre.org/techniques/T1574>`__

.. _mitre_technique_impair_defenses:

Impair Defenses
"""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1562>`__

.. _mitre_technique_implant_internal_image:

Implant Internal Image
""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_persistence`

`Mitre Description <https://attack.mitre.org/techniques/T1525>`__

.. _mitre_technique_indicator_removal:

Indicator Removal
"""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1070>`__

.. _mitre_technique_indirect_command_execution:

Indirect Command Execution
""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1202>`__

.. _mitre_technique_ingress_tool_transfer:

Ingress Tool Transfer
"""""""""""""""""""""

Tactics: :ref:`mitre_tactic_command_and_control`

`Mitre Description <https://attack.mitre.org/techniques/T1105>`__

.. _mitre_technique_inhibit_system_recovery:

Inhibit System Recovery
"""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_impact`

`Mitre Description <https://attack.mitre.org/techniques/T1490>`__

.. _mitre_technique_input_capture:

Input Capture
"""""""""""""

Tactics: :ref:`mitre_tactic_collection`, :ref:`mitre_tactic_credential_access`

`Mitre Description <https://attack.mitre.org/techniques/T1056>`__

.. _mitre_technique_inter_process_communication:

Inter-Process Communication
"""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_execution`

`Mitre Description <https://attack.mitre.org/techniques/T1559>`__

.. _mitre_technique_internal_spearphishing:

Internal Spearphishing
""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_lateral_movement`

`Mitre Description <https://attack.mitre.org/techniques/T1534>`__

.. _mitre_technique_lateral_tool_transfer:

Lateral Tool Transfer
"""""""""""""""""""""

Tactics: :ref:`mitre_tactic_lateral_movement`

`Mitre Description <https://attack.mitre.org/techniques/T1570>`__

.. _mitre_technique_masquerading:

Masquerading
""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1036>`__

.. _mitre_technique_modify_authentication_process:

Modify Authentication Process
"""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_credential_access`, :ref:`mitre_tactic_defense_evasion`, :ref:`mitre_tactic_persistence`

`Mitre Description <https://attack.mitre.org/techniques/T1556>`__

.. _mitre_technique_modify_cloud_compute_infrastructure:

Modify Cloud Compute Infrastructure
"""""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1578>`__

.. _mitre_technique_modify_registry:

Modify Registry
"""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1112>`__

.. _mitre_technique_modify_system_image:

Modify System Image
"""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1601>`__

.. _mitre_technique_multi_factor_authentication_interception:

Multi-Factor Authentication Interception
""""""""""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_credential_access`

`Mitre Description <https://attack.mitre.org/techniques/T1111>`__

.. _mitre_technique_multi_factor_authentication_request_generation:

Multi-Factor Authentication Request Generation
""""""""""""""""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_credential_access`

`Mitre Description <https://attack.mitre.org/techniques/T1621>`__

.. _mitre_technique_multi_stage_channels:

Multi-Stage Channels
""""""""""""""""""""

Tactics: :ref:`mitre_tactic_command_and_control`

`Mitre Description <https://attack.mitre.org/techniques/T1104>`__

.. _mitre_technique_native_api:

Native API
""""""""""

Tactics: :ref:`mitre_tactic_execution`

`Mitre Description <https://attack.mitre.org/techniques/T1106>`__

.. _mitre_technique_network_boundary_bridging:

Network Boundary Bridging
"""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1599>`__

.. _mitre_technique_network_denial_of_service:

Network Denial of Service
"""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_impact`

`Mitre Description <https://attack.mitre.org/techniques/T1498>`__

.. _mitre_technique_network_service_discovery:

Network Service Discovery
"""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1046>`__

.. _mitre_technique_network_share_discovery:

Network Share Discovery
"""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1135>`__

.. _mitre_technique_network_sniffing:

Network Sniffing
""""""""""""""""

Tactics: :ref:`mitre_tactic_credential_access`, :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1040>`__

.. _mitre_technique_non_application_layer_protocol:

Non-Application Layer Protocol
""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_command_and_control`

`Mitre Description <https://attack.mitre.org/techniques/T1095>`__

.. _mitre_technique_non_standard_port:

Non-Standard Port
"""""""""""""""""

Tactics: :ref:`mitre_tactic_command_and_control`

`Mitre Description <https://attack.mitre.org/techniques/T1571>`__

.. _mitre_technique_os_credential_dumping:

OS Credential Dumping
"""""""""""""""""""""

Tactics: :ref:`mitre_tactic_credential_access`

`Mitre Description <https://attack.mitre.org/techniques/T1003>`__

.. _mitre_technique_obfuscated_files_or_information:

Obfuscated Files or Information
"""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1027>`__

.. _mitre_technique_obtain_capabilities:

Obtain Capabilities
"""""""""""""""""""

Tactics: :ref:`mitre_tactic_resource_development`

`Mitre Description <https://attack.mitre.org/techniques/T1588>`__

.. _mitre_technique_office_application_startup:

Office Application Startup
""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_persistence`

`Mitre Description <https://attack.mitre.org/techniques/T1137>`__

.. _mitre_technique_password_policy_discovery:

Password Policy Discovery
"""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1201>`__

.. _mitre_technique_peripheral_device_discovery:

Peripheral Device Discovery
"""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1120>`__

.. _mitre_technique_permission_groups_discovery:

Permission Groups Discovery
"""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1069>`__

.. _mitre_technique_phishing:

Phishing
""""""""

Tactics: :ref:`mitre_tactic_initial_access`

`Mitre Description <https://attack.mitre.org/techniques/T1566>`__

.. _mitre_technique_phishing_for_information:

Phishing for Information
""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_reconnaissance`

`Mitre Description <https://attack.mitre.org/techniques/T1598>`__

.. _mitre_technique_plist_file_modification:

Plist File Modification
"""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1647>`__

.. _mitre_technique_pre_os_boot:

Pre-OS Boot
"""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`, :ref:`mitre_tactic_persistence`

`Mitre Description <https://attack.mitre.org/techniques/T1542>`__

.. _mitre_technique_process_discovery:

Process Discovery
"""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1057>`__

.. _mitre_technique_process_injection:

Process Injection
"""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`, :ref:`mitre_tactic_privilege_escalation`

`Mitre Description <https://attack.mitre.org/techniques/T1055>`__

.. _mitre_technique_protocol_tunneling:

Protocol Tunneling
""""""""""""""""""

Tactics: :ref:`mitre_tactic_command_and_control`

`Mitre Description <https://attack.mitre.org/techniques/T1572>`__

.. _mitre_technique_proxy:

Proxy
"""""

Tactics: :ref:`mitre_tactic_command_and_control`

`Mitre Description <https://attack.mitre.org/techniques/T1090>`__

.. _mitre_technique_query_registry:

Query Registry
""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1012>`__

.. _mitre_technique_reflective_code_loading:

Reflective Code Loading
"""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1620>`__

.. _mitre_technique_remote_access_software:

Remote Access Software
""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_command_and_control`

`Mitre Description <https://attack.mitre.org/techniques/T1219>`__

.. _mitre_technique_remote_service_session_hijacking:

Remote Service Session Hijacking
""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_lateral_movement`

`Mitre Description <https://attack.mitre.org/techniques/T1563>`__

.. _mitre_technique_remote_services:

Remote Services
"""""""""""""""

Tactics: :ref:`mitre_tactic_lateral_movement`

`Mitre Description <https://attack.mitre.org/techniques/T1021>`__

.. _mitre_technique_remote_system_discovery:

Remote System Discovery
"""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1018>`__

.. _mitre_technique_replication_through_removable_media:

Replication Through Removable Media
"""""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_initial_access`, :ref:`mitre_tactic_lateral_movement`

`Mitre Description <https://attack.mitre.org/techniques/T1091>`__

.. _mitre_technique_resource_hijacking:

Resource Hijacking
""""""""""""""""""

Tactics: :ref:`mitre_tactic_impact`

`Mitre Description <https://attack.mitre.org/techniques/T1496>`__

.. _mitre_technique_rogue_domain_controller:

Rogue Domain Controller
"""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1207>`__

.. _mitre_technique_rootkit:

Rootkit
"""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1014>`__

.. _mitre_technique_scheduled_task_job:

Scheduled Task/Job
""""""""""""""""""

Tactics: :ref:`mitre_tactic_execution`, :ref:`mitre_tactic_persistence`, :ref:`mitre_tactic_privilege_escalation`

`Mitre Description <https://attack.mitre.org/techniques/T1053>`__

.. _mitre_technique_scheduled_transfer:

Scheduled Transfer
""""""""""""""""""

Tactics: :ref:`mitre_tactic_exfiltration`

`Mitre Description <https://attack.mitre.org/techniques/T1029>`__

.. _mitre_technique_screen_capture:

Screen Capture
""""""""""""""

Tactics: :ref:`mitre_tactic_collection`

`Mitre Description <https://attack.mitre.org/techniques/T1113>`__

.. _mitre_technique_search_closed_sources:

Search Closed Sources
"""""""""""""""""""""

Tactics: :ref:`mitre_tactic_reconnaissance`

`Mitre Description <https://attack.mitre.org/techniques/T1597>`__

.. _mitre_technique_search_open_technical_databases:

Search Open Technical Databases
"""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_reconnaissance`

`Mitre Description <https://attack.mitre.org/techniques/T1596>`__

.. _mitre_technique_search_open_websites_domains:

Search Open Websites/Domains
""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_reconnaissance`

`Mitre Description <https://attack.mitre.org/techniques/T1593>`__

.. _mitre_technique_search_victim_owned_websites:

Search Victim-Owned Websites
""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_reconnaissance`

`Mitre Description <https://attack.mitre.org/techniques/T1594>`__

.. _mitre_technique_server_software_component:

Server Software Component
"""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_persistence`

`Mitre Description <https://attack.mitre.org/techniques/T1505>`__

.. _mitre_technique_serverless_execution:

Serverless Execution
""""""""""""""""""""

Tactics: :ref:`mitre_tactic_execution`

`Mitre Description <https://attack.mitre.org/techniques/T1648>`__

.. _mitre_technique_service_stop:

Service Stop
""""""""""""

Tactics: :ref:`mitre_tactic_impact`

`Mitre Description <https://attack.mitre.org/techniques/T1489>`__

.. _mitre_technique_shared_modules:

Shared Modules
""""""""""""""

Tactics: :ref:`mitre_tactic_execution`

`Mitre Description <https://attack.mitre.org/techniques/T1129>`__

.. _mitre_technique_software_deployment_tools:

Software Deployment Tools
"""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_execution`, :ref:`mitre_tactic_lateral_movement`

`Mitre Description <https://attack.mitre.org/techniques/T1072>`__

.. _mitre_technique_software_discovery:

Software Discovery
""""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1518>`__

.. _mitre_technique_stage_capabilities:

Stage Capabilities
""""""""""""""""""

Tactics: :ref:`mitre_tactic_resource_development`

`Mitre Description <https://attack.mitre.org/techniques/T1608>`__

.. _mitre_technique_steal_application_access_token:

Steal Application Access Token
""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_credential_access`

`Mitre Description <https://attack.mitre.org/techniques/T1528>`__

.. _mitre_technique_steal_web_session_cookie:

Steal Web Session Cookie
""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_credential_access`

`Mitre Description <https://attack.mitre.org/techniques/T1539>`__

.. _mitre_technique_steal_or_forge_authentication_certificates:

Steal or Forge Authentication Certificates
""""""""""""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_credential_access`

`Mitre Description <https://attack.mitre.org/techniques/T1649>`__

.. _mitre_technique_steal_or_forge_kerberos_tickets:

Steal or Forge Kerberos Tickets
"""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_credential_access`

`Mitre Description <https://attack.mitre.org/techniques/T1558>`__

.. _mitre_technique_subvert_trust_controls:

Subvert Trust Controls
""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1553>`__

.. _mitre_technique_supply_chain_compromise:

Supply Chain Compromise
"""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_initial_access`

`Mitre Description <https://attack.mitre.org/techniques/T1195>`__

.. _mitre_technique_system_binary_proxy_execution:

System Binary Proxy Execution
"""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1218>`__

.. _mitre_technique_system_information_discovery:

System Information Discovery
""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1082>`__

.. _mitre_technique_system_location_discovery:

System Location Discovery
"""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1614>`__

.. _mitre_technique_system_network_configuration_discovery:

System Network Configuration Discovery
""""""""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1016>`__

.. _mitre_technique_system_network_connections_discovery:

System Network Connections Discovery
""""""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1049>`__

.. _mitre_technique_system_owner_user_discovery:

System Owner/User Discovery
"""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1033>`__

.. _mitre_technique_system_script_proxy_execution:

System Script Proxy Execution
"""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1216>`__

.. _mitre_technique_system_service_discovery:

System Service Discovery
""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1007>`__

.. _mitre_technique_system_services:

System Services
"""""""""""""""

Tactics: :ref:`mitre_tactic_execution`

`Mitre Description <https://attack.mitre.org/techniques/T1569>`__

.. _mitre_technique_system_shutdown_reboot:

System Shutdown/Reboot
""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_impact`

`Mitre Description <https://attack.mitre.org/techniques/T1529>`__

.. _mitre_technique_system_time_discovery:

System Time Discovery
"""""""""""""""""""""

Tactics: :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1124>`__

.. _mitre_technique_taint_shared_content:

Taint Shared Content
""""""""""""""""""""

Tactics: :ref:`mitre_tactic_lateral_movement`

`Mitre Description <https://attack.mitre.org/techniques/T1080>`__

.. _mitre_technique_template_injection:

Template Injection
""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1221>`__

.. _mitre_technique_traffic_signaling:

Traffic Signaling
"""""""""""""""""

Tactics: :ref:`mitre_tactic_command_and_control`, :ref:`mitre_tactic_defense_evasion`, :ref:`mitre_tactic_persistence`

`Mitre Description <https://attack.mitre.org/techniques/T1205>`__

.. _mitre_technique_transfer_data_to_cloud_account:

Transfer Data to Cloud Account
""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_exfiltration`

`Mitre Description <https://attack.mitre.org/techniques/T1537>`__

.. _mitre_technique_trusted_developer_utilities_proxy_execution:

Trusted Developer Utilities Proxy Execution
"""""""""""""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1127>`__

.. _mitre_technique_trusted_relationship:

Trusted Relationship
""""""""""""""""""""

Tactics: :ref:`mitre_tactic_initial_access`

`Mitre Description <https://attack.mitre.org/techniques/T1199>`__

.. _mitre_technique_unsecured_credentials:

Unsecured Credentials
"""""""""""""""""""""

Tactics: :ref:`mitre_tactic_credential_access`

`Mitre Description <https://attack.mitre.org/techniques/T1552>`__

.. _mitre_technique_unused_unsupported_cloud_regions:

Unused/Unsupported Cloud Regions
""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1535>`__

.. _mitre_technique_use_alternate_authentication_material:

Use Alternate Authentication Material
"""""""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`, :ref:`mitre_tactic_lateral_movement`

`Mitre Description <https://attack.mitre.org/techniques/T1550>`__

.. _mitre_technique_user_execution:

User Execution
""""""""""""""

Tactics: :ref:`mitre_tactic_execution`

`Mitre Description <https://attack.mitre.org/techniques/T1204>`__

.. _mitre_technique_valid_accounts:

Valid Accounts
""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`, :ref:`mitre_tactic_initial_access`, :ref:`mitre_tactic_persistence`, :ref:`mitre_tactic_privilege_escalation`

`Mitre Description <https://attack.mitre.org/techniques/T1078>`__

.. _mitre_technique_video_capture:

Video Capture
"""""""""""""

Tactics: :ref:`mitre_tactic_collection`

`Mitre Description <https://attack.mitre.org/techniques/T1125>`__

.. _mitre_technique_virtualization_sandbox_evasion:

Virtualization/Sandbox Evasion
""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`, :ref:`mitre_tactic_discovery`

`Mitre Description <https://attack.mitre.org/techniques/T1497>`__

.. _mitre_technique_weaken_encryption:

Weaken Encryption
"""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1600>`__

.. _mitre_technique_web_service:

Web Service
"""""""""""

Tactics: :ref:`mitre_tactic_command_and_control`

`Mitre Description <https://attack.mitre.org/techniques/T1102>`__

.. _mitre_technique_windows_management_instrumentation:

Windows Management Instrumentation
""""""""""""""""""""""""""""""""""

Tactics: :ref:`mitre_tactic_execution`

`Mitre Description <https://attack.mitre.org/techniques/T1047>`__

.. _mitre_technique_xsl_script_processing:

XSL Script Processing
"""""""""""""""""""""

Tactics: :ref:`mitre_tactic_defense_evasion`

`Mitre Description <https://attack.mitre.org/techniques/T1220>`__