- T1047 Windows Management Instrumentation
- T1053.003 Cron
- T1053.005 Scheduled Task
- T1059 Command and Scripting Interpreter
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.004 Unix Shell
- T1204.002 Malicious File
- T1053 Scheduled Task/Job (index only)
- T1053.002 At (index only)
- T1053.006 Systemd Timers (index only)
- T1053.007 Container Orchestration Job (index only)
- T1059.002 AppleScript (index only)
- T1059.005 Visual Basic (index only)
- T1059.006 Python (index only)
- T1059.007 JavaScript (index only)
- T1059.008 Network Device CLI (index only)
- T1059.009 Cloud API (index only)
- T1059.010 AutoHotKey & AutoIT (index only)
- T1059.011 Lua (index only)
- T1059.012 Hypervisor CLI (index only)
- T1059.013 Container CLI/API (index only)
- T1072 Software Deployment Tools (index only)
- T1106 Native API (index only)
- T1127 Trusted Developer Utilities Proxy Execution (index only)
- T1127.001 MSBuild (index only)
- T1127.002 ClickOnce (index only)
- T1127.003 JamPlus (index only)
- T1129 Shared Modules (index only)
- T1197 BITS Jobs (index only)
- T1203 Exploitation for Client Execution (index only)
- T1204 User Execution (index only)
- T1204.001 Malicious Link (index only)
- T1204.003 Malicious Image (index only)
- T1204.004 Malicious Copy and Paste (index only)
- T1204.005 Malicious Library (index only)
- T1559 Inter-Process Communication (index only)
- T1559.001 Component Object Model (index only)
- T1559.002 Dynamic Data Exchange (index only)
- T1559.003 XPC Services (index only)
- T1569 System Services (index only)
- T1569.001 Launchctl (index only)
- T1569.002 Service Execution (index only)
- T1569.003 Systemctl (index only)
- T1574 Hijack Execution Flow (index only)
- T1574.001 DLL (index only)
- T1574.004 Dylib Hijacking (index only)
- T1574.005 Executable Installer File Permissions Weakness (index only)
- T1574.006 Dynamic Linker Hijacking (index only)
- T1574.007 Path Interception by PATH Environment Variable (index only)
- T1574.008 Path Interception by Search Order Hijacking (index only)
- T1574.009 Path Interception by Unquoted Path (index only)
- T1574.010 Services File Permissions Weakness (index only)
- T1574.011 Services Registry Permissions Weakness (index only)
- T1574.012 COR_PROFILER (index only)
- T1574.013 KernelCallbackTable (index only)
- T1574.014 AppDomainManager (index only)
- T1609 Container Administration Command (index only)
- T1610 Deploy Container (index only)
- T1648 Serverless Execution (index only)
- T1651 Cloud Administration Command (index only)
- T1674 Input Injection (index only)
- T1675 ESXi Administration Command (index only)
- T1677 Poisoned Pipeline Execution (index only)