- T1053.003 Cron
- T1053.005 Scheduled Task
- T1078 Valid Accounts
- T1078.002 Domain Accounts
- T1078.003 Local Accounts
- T1098 Account Manipulation
- T1133 External Remote Services
- T1136.001 Local Account
- T1136.002 Domain Account
- T1505.003 Web Shell
- T1543 Create or Modify System Process
- T1543.003 Windows Service
- T1547.001 Registry Run Keys / Startup Folder
- T1554 Compromise Host Software Binary
- T1037 Boot or Logon Initialization Scripts (index only)
- T1037.001 Logon Script (Windows) (index only)
- T1037.002 Login Hook (index only)
- T1037.003 Network Logon Script (index only)
- T1037.004 RC Scripts (index only)
- T1037.005 Startup Items (index only)
- T1053 Scheduled Task/Job (index only)
- T1053.002 At (index only)
- T1053.006 Systemd Timers (index only)
- T1053.007 Container Orchestration Job (index only)
- T1078.001 Default Accounts (index only)
- T1078.004 Cloud Accounts (index only)
- T1098.001 Additional Cloud Credentials (index only)
- T1098.002 Additional Email Delegate Permissions (index only)
- T1098.003 Additional Cloud Roles (index only)
- T1098.004 SSH Authorized Keys (index only)
- T1098.005 Device Registration (index only)
- T1098.006 Additional Container Cluster Roles (index only)
- T1098.007 Additional Local or Domain Groups (index only)
- T1112 Modify Registry (index only)
- T1136 Create Account (index only)
- T1136.003 Cloud Account (index only)
- T1137 Office Application Startup (index only)
- T1137.001 Office Template Macros (index only)
- T1137.002 Office Test (index only)
- T1137.003 Outlook Forms (index only)
- T1137.004 Outlook Home Page (index only)
- T1137.005 Outlook Rules (index only)
- T1137.006 Add-ins (index only)
- T1176 Software Extensions (index only)
- T1176.001 Browser Extensions (index only)
- T1176.002 IDE Extensions (index only)
- T1197 BITS Jobs (index only)
- T1205 Traffic Signaling (index only)
- T1205.001 Port Knocking (index only)
- T1205.002 Socket Filters (index only)
- T1505 Server Software Component (index only)
- T1505.001 SQL Stored Procedures (index only)
- T1505.002 Transport Agent (index only)
- T1505.004 IIS Components (index only)
- T1505.005 Terminal Services DLL (index only)
- T1505.006 vSphere Installation Bundles (index only)
- T1525 Implant Internal Image (index only)
- T1542 Pre-OS Boot (index only)
- T1542.001 System Firmware (index only)
- T1542.002 Component Firmware (index only)
- T1542.003 Bootkit (index only)
- T1542.004 ROMMONkit (index only)
- T1542.005 TFTP Boot (index only)
- T1543.001 Launch Agent (index only)
- T1543.002 Systemd Service (index only)
- T1543.004 Launch Daemon (index only)
- T1543.005 Container Service (index only)
- T1546 Event Triggered Execution (index only)
- T1546.001 Change Default File Association (index only)
- T1546.002 Screensaver (index only)
- T1546.003 Windows Management Instrumentation Event Subscription (index only)
- T1546.004 Unix Shell Configuration Modification (index only)
- T1546.005 Trap (index only)
- T1546.006 LC_LOAD_DYLIB Addition (index only)
- T1546.007 Netsh Helper DLL (index only)
- T1546.008 Accessibility Features (index only)
- T1546.009 AppCert DLLs (index only)
- T1546.010 AppInit DLLs (index only)
- T1546.011 Application Shimming (index only)
- T1546.012 Image File Execution Options Injection (index only)
- T1546.013 PowerShell Profile (index only)
- T1546.014 Emond (index only)
- T1546.015 Component Object Model Hijacking (index only)
- T1546.016 Installer Packages (index only)
- T1546.017 Udev Rules (index only)
- T1546.018 Python Startup Hooks (index only)
- T1547 Boot or Logon Autostart Execution (index only)
- T1547.002 Authentication Package (index only)
- T1547.003 Time Providers (index only)
- T1547.004 Winlogon Helper DLL (index only)
- T1547.005 Security Support Provider (index only)
- T1547.006 Kernel Modules and Extensions (index only)
- T1547.007 Re-opened Applications (index only)
- T1547.008 LSASS Driver (index only)
- T1547.009 Shortcut Modification (index only)
- T1547.010 Port Monitors (index only)
- T1547.012 Print Processors (index only)
- T1547.013 XDG Autostart Entries (index only)
- T1547.014 Active Setup (index only)
- T1547.015 Login Items (index only)
- T1556 Modify Authentication Process (index only)
- T1556.001 Domain Controller Authentication (index only)
- T1556.002 Password Filter DLL (index only)
- T1556.003 Pluggable Authentication Modules (index only)
- T1556.004 Network Device Authentication (index only)
- T1556.005 Reversible Encryption (index only)
- T1556.006 Multi-Factor Authentication (index only)
- T1556.007 Hybrid Identity (index only)
- T1556.008 Network Provider DLL (index only)
- T1556.009 Conditional Access Policies (index only)
- T1653 Power Settings (index only)
- T1668 Exclusive Control (index only)
- T1671 Cloud Application Integration (index only)