- T1222.002 Linux and Mac Permissions
- T1685.001 Disable or Modify Windows Event Log
- T1685.005 Clear Windows Event Logs
- T1112 Modify Registry (index only)
- T1207 Rogue Domain Controller (index only)
- T1222 File and Directory Permissions Modification (index only)
- T1222.001 Windows Permissions (index only)
- T1484 Domain or Tenant Policy Modification (index only)
- T1484.001 Group Policy Modification (index only)
- T1484.002 Trust Modification (index only)
- T1553 Subvert Trust Controls (index only)
- T1553.001 Gatekeeper Bypass (index only)
- T1553.002 Code Signing (index only)
- T1553.003 SIP and Trust Provider Hijacking (index only)
- T1553.004 Install Root Certificate (index only)
- T1553.005 Mark-of-the-Web Bypass (index only)
- T1553.006 Code Signing Policy Modification (index only)
- T1556 Modify Authentication Process (index only)
- T1556.001 Domain Controller Authentication (index only)
- T1556.002 Password Filter DLL (index only)
- T1556.003 Pluggable Authentication Modules (index only)
- T1556.004 Network Device Authentication (index only)
- T1556.005 Reversible Encryption (index only)
- T1556.006 Multi-Factor Authentication (index only)
- T1556.007 Hybrid Identity (index only)
- T1556.008 Network Provider DLL (index only)
- T1556.009 Conditional Access Policies (index only)
- T1578 Modify Cloud Compute Infrastructure (index only)
- T1578.001 Create Snapshot (index only)
- T1578.002 Create Cloud Instance (index only)
- T1578.003 Delete Cloud Instance (index only)
- T1578.004 Revert Cloud Instance (index only)
- T1578.005 Modify Cloud Compute Configurations (index only)
- T1599 Network Boundary Bridging (index only)
- T1599.001 Network Address Translation Traversal (index only)
- T1600 Weaken Encryption (index only)
- T1600.001 Reduce Key Space (index only)
- T1600.002 Disable Crypto Hardware (index only)
- T1601 Modify System Image (index only)
- T1601.001 Patch System Image (index only)
- T1601.002 Downgrade System Image (index only)
- T1647 Plist File Modification (index only)
- T1666 Modify Cloud Resource Hierarchy (index only)
- T1685 Disable or Modify Tools (index only)
- T1685.002 Disable or Modify Cloud Log (index only)
- T1685.003 Modify or Spoof Tool UI (index only)
- T1685.004 Disable or Modify Linux Audit System Log (index only)
- T1685.006 Clear Linux or Mac System Logs (index only)
- T1686 Disable or Modify System Firewall (index only)
- T1686.001 Cloud Firewall (index only)
- T1686.002 Network Device Firewall (index only)
- T1686.003 Windows Host Firewall (index only)
- T1687 Exploitation for Defense Impairment (index only)
- T1688 Safe Mode Boot (index only)
- T1689 Downgrade Attack (index only)
- T1690 Prevent Command History Logging (index only)