matrix.md

All Atomic Tests by ATT&CK Tactic & Technique

initial-access	execution	persistence	privilege-escalation	defense-evasion	credential-access	discovery	lateral-movement	collection	exfiltration	command-and-control
Drive-by Compromise CONTRIBUTE A TEST	AppleScript	.bash_profile and .bashrc	Access Token Manipulation	Access Token Manipulation	Account Manipulation	Account Discovery	AppleScript	Audio Capture	Automated Exfiltration CONTRIBUTE A TEST	Commonly Used Port CONTRIBUTE A TEST
Exploit Public-Facing Application CONTRIBUTE A TEST	CMSTP	Accessibility Features	Accessibility Features	BITS Jobs	Bash History	Application Window Discovery	Application Deployment Software CONTRIBUTE A TEST	Automated Collection	Data Compressed	Communication Through Removable Media CONTRIBUTE A TEST
External Remote Services CONTRIBUTE A TEST	Command-Line Interface	Account Manipulation	AppCert DLLs CONTRIBUTE A TEST	Binary Padding	Brute Force	Browser Bookmark Discovery	Distributed Component Object Model CONTRIBUTE A TEST	Clipboard Data	Data Encrypted	Connection Proxy
Hardware Additions CONTRIBUTE A TEST	Compiled HTML File	AppCert DLLs CONTRIBUTE A TEST	AppInit DLLs	Bypass User Account Control	Credential Dumping	Domain Trust Discovery	Exploitation of Remote Services CONTRIBUTE A TEST	Data Staged	Data Transfer Size Limits	Custom Command and Control Protocol CONTRIBUTE A TEST
Replication Through Removable Media CONTRIBUTE A TEST	Control Panel Items	AppInit DLLs	Application Shimming	CMSTP	Credentials in Files	File and Directory Discovery	Logon Scripts	Data from Information Repositories CONTRIBUTE A TEST	Exfiltration Over Alternative Protocol	Custom Cryptographic Protocol CONTRIBUTE A TEST
Spearphishing Attachment	Dynamic Data Exchange	Application Shimming	Bypass User Account Control	Clear Command History	Credentials in Registry	Network Service Scanning	Pass the Hash	Data from Local System	Exfiltration Over Command and Control Channel CONTRIBUTE A TEST	Data Encoding
Spearphishing Link CONTRIBUTE A TEST	Execution through API CONTRIBUTE A TEST	Authentication Package CONTRIBUTE A TEST	DLL Search Order Hijacking	Code Signing CONTRIBUTE A TEST	Exploitation for Credential Access CONTRIBUTE A TEST	Network Share Discovery	Pass the Ticket	Data from Network Shared Drive CONTRIBUTE A TEST	Exfiltration Over Other Network Medium CONTRIBUTE A TEST	Data Obfuscation CONTRIBUTE A TEST
Spearphishing via Service CONTRIBUTE A TEST	Execution through Module Load CONTRIBUTE A TEST	BITS Jobs	Dylib Hijacking CONTRIBUTE A TEST	Compile After Delivery CONTRIBUTE A TEST	Forced Authentication CONTRIBUTE A TEST	Network Sniffing	Remote Desktop Protocol	Data from Removable Media CONTRIBUTE A TEST	Exfiltration Over Physical Medium CONTRIBUTE A TEST	Domain Fronting CONTRIBUTE A TEST
Supply Chain Compromise CONTRIBUTE A TEST	Exploitation for Client Execution CONTRIBUTE A TEST	Bootkit CONTRIBUTE A TEST	Exploitation for Privilege Escalation CONTRIBUTE A TEST	Compiled HTML File	Hooking	Password Policy Discovery	Remote File Copy	Email Collection	Scheduled Transfer CONTRIBUTE A TEST	Domain Generation Algorithms CONTRIBUTE A TEST
Trusted Relationship CONTRIBUTE A TEST	Graphical User Interface CONTRIBUTE A TEST	Browser Extensions	Extra Window Memory Injection CONTRIBUTE A TEST	Component Firmware CONTRIBUTE A TEST	Input Capture	Peripheral Device Discovery CONTRIBUTE A TEST	Remote Services CONTRIBUTE A TEST	Input Capture		Fallback Channels CONTRIBUTE A TEST
Valid Accounts CONTRIBUTE A TEST	InstallUtil	Change Default File Association	File System Permissions Weakness CONTRIBUTE A TEST	Component Object Model Hijacking	Input Prompt	Permission Groups Discovery	Replication Through Removable Media CONTRIBUTE A TEST	Man in the Browser CONTRIBUTE A TEST		Multi-Stage Channels CONTRIBUTE A TEST
	LSASS Driver CONTRIBUTE A TEST	Component Firmware CONTRIBUTE A TEST	Hooking	Control Panel Items	Kerberoasting CONTRIBUTE A TEST	Process Discovery	SSH Hijacking CONTRIBUTE A TEST	Screen Capture		Multi-hop Proxy CONTRIBUTE A TEST
	Launchctl	Component Object Model Hijacking	Image File Execution Options Injection	DCShadow	Keychain	Query Registry	Shared Webroot CONTRIBUTE A TEST	Video Capture CONTRIBUTE A TEST		Multiband Communication CONTRIBUTE A TEST
	Local Job Scheduling	Create Account	Launch Daemon	DLL Search Order Hijacking	LLMNR/NBT-NS Poisoning and Relay CONTRIBUTE A TEST	Remote System Discovery	Taint Shared Content CONTRIBUTE A TEST			Multilayer Encryption CONTRIBUTE A TEST
	Mshta	DLL Search Order Hijacking	New Service	DLL Side-Loading CONTRIBUTE A TEST	Network Sniffing	Security Software Discovery	Third-party Software CONTRIBUTE A TEST			Port Knocking CONTRIBUTE A TEST
	PowerShell	Dylib Hijacking CONTRIBUTE A TEST	Path Interception CONTRIBUTE A TEST	Deobfuscate/Decode Files or Information	Password Filter DLL	System Information Discovery	Windows Admin Shares			Remote Access Tools CONTRIBUTE A TEST
	Regsvcs/Regasm	External Remote Services CONTRIBUTE A TEST	Plist Modification	Disabling Security Tools	Private Keys	System Network Configuration Discovery	Windows Remote Management			Remote File Copy
	Regsvr32	File System Permissions Weakness CONTRIBUTE A TEST	Port Monitors CONTRIBUTE A TEST	Execution Guardrails CONTRIBUTE A TEST	Securityd Memory CONTRIBUTE A TEST	System Network Connections Discovery				Standard Application Layer Protocol
	Rundll32	Hidden Files and Directories	Process Injection	Exploitation for Defense Evasion CONTRIBUTE A TEST	Two-Factor Authentication Interception CONTRIBUTE A TEST	System Owner/User Discovery				Standard Cryptographic Protocol CONTRIBUTE A TEST
	Scheduled Task	Hooking	SID-History Injection CONTRIBUTE A TEST	Extra Window Memory Injection CONTRIBUTE A TEST		System Service Discovery				Standard Non-Application Layer Protocol CONTRIBUTE A TEST
	Scripting	Hypervisor	Scheduled Task	File Deletion		System Time Discovery				Uncommonly Used Port
	Service Execution	Image File Execution Options Injection	Service Registry Permissions Weakness CONTRIBUTE A TEST	File Permissions Modification		Virtualization/Sandbox Evasion CONTRIBUTE A TEST				Web Service CONTRIBUTE A TEST
	Signed Binary Proxy Execution	Kernel Modules and Extensions CONTRIBUTE A TEST	Setuid and Setgid	File System Logical Offsets CONTRIBUTE A TEST
	Signed Script Proxy Execution	LC_LOAD_DYLIB Addition CONTRIBUTE A TEST	Startup Items	Gatekeeper Bypass
	Source	LSASS Driver CONTRIBUTE A TEST	Sudo	Group Policy Modification CONTRIBUTE A TEST
	Space after Filename	Launch Agent	Sudo Caching	HISTCONTROL
	Third-party Software CONTRIBUTE A TEST	Launch Daemon	Valid Accounts CONTRIBUTE A TEST	Hidden Files and Directories
	Trap	Launchctl	Web Shell	Hidden Users
	Trusted Developer Utilities	Local Job Scheduling		Hidden Window CONTRIBUTE A TEST
	User Execution CONTRIBUTE A TEST	Login Item CONTRIBUTE A TEST		Image File Execution Options Injection
	Windows Management Instrumentation	Logon Scripts		Indicator Blocking CONTRIBUTE A TEST
	Windows Remote Management	Modify Existing Service		Indicator Removal from Tools CONTRIBUTE A TEST
	XSL Script Processing	Netsh Helper DLL		Indicator Removal on Host
		New Service		Indirect Command Execution
		Office Application Startup		Install Root Certificate
		Path Interception CONTRIBUTE A TEST		InstallUtil
		Plist Modification		LC_MAIN Hijacking CONTRIBUTE A TEST
		Port Knocking CONTRIBUTE A TEST		Launchctl
		Port Monitors CONTRIBUTE A TEST		Masquerading
		Rc.common		Modify Registry
		Re-opened Applications		Mshta
		Redundant Access CONTRIBUTE A TEST		NTFS File Attributes
		Registry Run Keys / Startup Folder		Network Share Connection Removal
		SIP and Trust Provider Hijacking CONTRIBUTE A TEST		Obfuscated Files or Information
		Scheduled Task		Plist Modification
		Screensaver		Port Knocking CONTRIBUTE A TEST
		Security Support Provider		Process Doppelgänging CONTRIBUTE A TEST
		Service Registry Permissions Weakness CONTRIBUTE A TEST		Process Hollowing CONTRIBUTE A TEST
		Setuid and Setgid		Process Injection
		Shortcut Modification CONTRIBUTE A TEST		Redundant Access CONTRIBUTE A TEST
		Startup Items		Regsvcs/Regasm
		System Firmware CONTRIBUTE A TEST		Regsvr32
		Systemd Service		Rootkit
		Time Providers CONTRIBUTE A TEST		Rundll32
		Trap		SIP and Trust Provider Hijacking CONTRIBUTE A TEST
		Valid Accounts CONTRIBUTE A TEST		Scripting
		Web Shell		Signed Binary Proxy Execution
		Windows Management Instrumentation Event Subscription		Signed Script Proxy Execution
		Winlogon Helper DLL		Software Packing CONTRIBUTE A TEST
				Space after Filename
				Template Injection CONTRIBUTE A TEST
				Timestomp
				Trusted Developer Utilities
				Valid Accounts CONTRIBUTE A TEST
				Virtualization/Sandbox Evasion CONTRIBUTE A TEST
				Web Service CONTRIBUTE A TEST
				XSL Script Processing