- T1027 Obfuscated Files or Information
- T1036.003 Rename System Utilities
- T1036.005 Match Legitimate Resource Name or Location
- T1055 Process Injection
- T1078 Valid Accounts
- T1078.002 Domain Accounts
- T1078.003 Local Accounts
- T1218.005 Mshta
- T1218.011 Rundll32
- T1006 Direct Volume Access (index only)
- T1014 Rootkit (index only)
- T1027.001 Binary Padding (index only)
- T1027.002 Software Packing (index only)
- T1027.003 Steganography (index only)
- T1027.004 Compile After Delivery (index only)
- T1027.005 Indicator Removal from Tools (index only)
- T1027.006 HTML Smuggling (index only)
- T1027.007 Dynamic API Resolution (index only)
- T1027.008 Stripped Payloads (index only)
- T1027.009 Embedded Payloads (index only)
- T1027.010 Command Obfuscation (index only)
- T1027.011 Fileless Storage (index only)
- T1027.012 LNK Icon Smuggling (index only)
- T1027.013 Encrypted/Encoded File (index only)
- T1027.014 Polymorphic Code (index only)
- T1027.015 Compression (index only)
- T1027.016 Junk Code Insertion (index only)
- T1027.017 SVG Smuggling (index only)
- T1027.018 Invisible Unicode (index only)
- T1036 Masquerading (index only)
- T1036.001 Invalid Code Signature (index only)
- T1036.002 Right-to-Left Override (index only)
- T1036.004 Masquerade Task or Service (index only)
- T1036.006 Space after Filename (index only)
- T1036.007 Double File Extension (index only)
- T1036.008 Masquerade File Type (index only)
- T1036.009 Break Process Trees (index only)
- T1036.010 Masquerade Account Name (index only)
- T1036.011 Overwrite Process Arguments (index only)
- T1036.012 Browser Fingerprint (index only)
- T1055.001 Dynamic-link Library Injection (index only)
- T1055.002 Portable Executable Injection (index only)
- T1055.003 Thread Execution Hijacking (index only)
- T1055.004 Asynchronous Procedure Call (index only)
- T1055.005 Thread Local Storage (index only)
- T1055.008 Ptrace System Calls (index only)
- T1055.009 Proc Memory (index only)
- T1055.011 Extra Window Memory Injection (index only)
- T1055.012 Process Hollowing (index only)
- T1055.013 Process Doppelgänging (index only)
- T1055.014 VDSO Hijacking (index only)
- T1055.015 ListPlanting (index only)
- T1070 Indicator Removal (index only)
- T1070.001 Indicator Removal: Clear Windows Event Logs (index only)
- T1070.003 Clear Command History (index only)
- T1070.004 File Deletion (index only)
- T1070.005 Network Share Connection Removal (index only)
- T1070.006 Timestomp (index only)
- T1070.007 Clear Network Connection History and Configurations (index only)
- T1070.008 Clear Mailbox Data (index only)
- T1070.009 Clear Persistence (index only)
- T1070.010 Relocate Malware (index only)
- T1078.001 Default Accounts (index only)
- T1078.004 Cloud Accounts (index only)
- T1127 Trusted Developer Utilities Proxy Execution (index only)
- T1127.001 MSBuild (index only)
- T1127.002 ClickOnce (index only)
- T1127.003 JamPlus (index only)
- T1134 Access Token Manipulation (index only)
- T1134.001 Token Impersonation/Theft (index only)
- T1134.002 Create Process with Token (index only)
- T1134.003 Make and Impersonate Token (index only)
- T1134.004 Parent PID Spoofing (index only)
- T1134.005 SID-History Injection (index only)
- T1140 Deobfuscate/Decode Files or Information (index only)
- T1197 BITS Jobs (index only)
- T1202 Indirect Command Execution (index only)
- T1205 Traffic Signaling (index only)
- T1205.001 Port Knocking (index only)
- T1205.002 Socket Filters (index only)
- T1211 Exploitation for Stealth (index only)
- T1216 System Script Proxy Execution (index only)
- T1216.001 PubPrn (index only)
- T1216.002 SyncAppvPublishingServer (index only)
- T1218 System Binary Proxy Execution (index only)
- T1218.001 Compiled HTML File (index only)
- T1218.002 Control Panel (index only)
- T1218.003 CMSTP (index only)
- T1218.004 InstallUtil (index only)
- T1218.007 Msiexec (index only)
- T1218.008 Odbcconf (index only)
- T1218.009 Regsvcs/Regasm (index only)
- T1218.010 Regsvr32 (index only)
- T1218.012 Verclsid (index only)
- T1218.013 Mavinject (index only)
- T1218.014 MMC (index only)
- T1218.015 Electron Applications (index only)
- T1220 XSL Script Processing (index only)
- T1221 Template Injection (index only)
- T1480 Execution Guardrails (index only)
- T1480.001 Environmental Keying (index only)
- T1480.002 Mutual Exclusion (index only)
- T1497 Virtualization/Sandbox Evasion (index only)
- T1497.001 System Checks (index only)
- T1497.002 User Activity Based Checks (index only)
- T1497.003 Time Based Checks (index only)
- T1535 Unused/Unsupported Cloud Regions (index only)
- T1542 Pre-OS Boot (index only)
- T1542.001 System Firmware (index only)
- T1542.002 Component Firmware (index only)
- T1542.003 Bootkit (index only)
- T1542.004 ROMMONkit (index only)
- T1542.005 TFTP Boot (index only)
- T1564 Hide Artifacts (index only)
- T1564.001 Hidden Files and Directories (index only)
- T1564.002 Hidden Users (index only)
- T1564.003 Hidden Window (index only)
- T1564.004 NTFS File Attributes (index only)
- T1564.005 Hidden File System (index only)
- T1564.006 Run Virtual Instance (index only)
- T1564.007 VBA Stomping (index only)
- T1564.008 Email Hiding Rules (index only)
- T1564.009 Resource Forking (index only)
- T1564.010 Process Argument Spoofing (index only)
- T1564.011 Ignore Process Interrupts (index only)
- T1564.012 File/Path Exclusions (index only)
- T1564.013 Bind Mounts (index only)
- T1564.014 Extended Attributes (index only)
- T1574 Hijack Execution Flow (index only)
- T1574.001 DLL (index only)
- T1574.004 Dylib Hijacking (index only)
- T1574.005 Executable Installer File Permissions Weakness (index only)
- T1574.006 Dynamic Linker Hijacking (index only)
- T1574.007 Path Interception by PATH Environment Variable (index only)
- T1574.008 Path Interception by Search Order Hijacking (index only)
- T1574.009 Path Interception by Unquoted Path (index only)
- T1574.010 Services File Permissions Weakness (index only)
- T1574.011 Services Registry Permissions Weakness (index only)
- T1574.012 COR_PROFILER (index only)
- T1574.013 KernelCallbackTable (index only)
- T1574.014 AppDomainManager (index only)
- T1612 Build Image on Host (index only)
- T1620 Reflective Code Loading (index only)
- T1622 Debugger Evasion (index only)
- T1678 Delay Execution (index only)
- T1679 Selective Exclusion (index only)
- T1684 Social Engineering (index only)
- T1684.001 Impersonation (index only)
- T1684.002 Email Spoofing (index only)