ATT&CK Tactics Matrix

This information is provided by Crocodyli & Ransomware.live
Execution	Persistence	Privilege Escalation	Defense Evasion	Stealth	Defense Impairment	Credential Access	Discovery	Lateral Movement	Collection	Impact
T1047 Windows Management Instrumentation	T1037 Boot or Logon Initialization Scripts	T1053 Scheduled Task/Job	T1014 Rootkit	T1027 Obfuscated Files or Information	T1112 Modify Registry	T1003 OS Credential Dumping	T1007 System Service Discovery	T1021 Remote Services	T1005 Data from Local System	T1485 Data Destruction
T1053 Scheduled Task/Job	T1053 Scheduled Task/Job	T1053.005 Scheduled Task/Job: Scheduled Task	T1021.001 Remote Services: Remote Desktop Protocol	T1027.001 Obfuscated Files or Information: Binary Padding	T1484.001 Domain or Tenant Policy Modification: Group Policy Modification	T1003.001 OS Credential Dumping: LSASS Memory	T1010 Application Window Discovery	T1021.001 Remote Services: Remote Desktop Protocol	T1039 Data from Network Shared Drive	T1486 Data Encrypted for Impact
T1053.005 Scheduled Task/Job: Scheduled Task	T1053.003 Scheduled Task/Job: Cron	T1055 Process Injection	T1027 Obfuscated Files or Information	T1027.002 Obfuscated Files or Information: Software Packing	T1553.002 Subvert Trust Controls: Code Signing	T1003.002 OS Credential Dumping: Security Account Manager	T1012 Query Registry	T1021.001 Remote Desktop Protocol	T1056 Input Capture	T1489 Service Stop
T1059 Command and Scripting Interpreter	T1053.005 Scheduled Task/Job: Scheduled Task	T1055.003 Thread Execution Hijacking	T1027.002 Software Packing	T1027.007 Obfuscated Files or Information: Dynamic API Resolution	T1578.002 Modify Cloud Compute Infrastructure: Create Cloud Instance	T1003.003 OS Credential Dumping: NTDS	T1016 System Network Configuration Discovery	T1021.002 Remote Services: SMB/Windows Admin Shares	T1074 Data Staged	T1490 Inhibit System Recovery
T1059.001 Command and Scripting Interpreter: PowerShell	T1078 Valid Accounts	T1055.012 Process Injection: Process Hollowing	T1027.002 Obfuscated Files or Information: Software Packing	T1027.010 Obfuscated Files or Information: Command Obfuscation	T1578.003 Modify Cloud Compute Infrastructure: Delete Cloud Instance	T1003.006 OS Credential Dumping: DCSync	T1016.001 Network Configuration Discovery: Network Connection Enumeration	T1021.002 SMB/Windows Admin Shares	T1074.001 Data Staged: Local Data Staging	T1491 Defacement
T1059.001 PowerShell	T1078.002 Valid Accounts: Domain Accounts	T1068 Exploitation for Privilege Escalation	T1027.005 Indicator Removal from Tools	T1027.013 Obfuscated Files or Information: Encrypted/Encoded File	T1685 Disable or Modify Tools	T1003.008 OS Credential Dumping: /etc/passwd and /etc/shadow	T1016.001 Internet Connection Discovery	T1021.004 Remote Services: SSH	T1113 Screen Capture	T1491.001 Defacement: Internal Defacement
T1059.002 System Services: Service Execution	T1078.003 Valid Accounts: Local Accounts	T1078 Valid Accounts	T1027.005 Obfuscated Files or Information: Indicator Removal from Tools	T1027.015 Obfuscated Files or Information: Compression	T1685.005 Disable or Modify Tools: Clear Windows Event Logs	T1021.002 Remote Services: External Remote Services	T1018 Remote System Discovery	T1047 Windows Management Instrumentation	T1114 Email Collection	T1498 Network Denial of Service
T1059.003 Command and Scripting Interpreter: Windows Command Shell	T1078.004 Valid Accounts: Cloud Accounts	T1078.002 Valid Accounts: Domain Accounts	T1027.006 Obfuscated Files or Information: HTML Smuggling	T1036 Masquerading	T1686 Disable or Modify System Firewall	T1040 Network Sniffing	T1033 System Owner/User Discovery	T1072 Software Deployment Tools	T1114.002 Email Collection: Remote Email Collection	T1529 System Shutdown/Reboot
T1059.004 Command and Scripting Interpreter: Unix Shell	T1098 Account Manipulation	T1078.002 Domain Accounts	T1027.007 Obfuscated Files or Information: Dynamic API Resolution	T1036.004 Masquerading: Masquerade Task or Service	T1686.003 Disable or Modify System Firewall: Windows Host Firewall	T1056 Input Capture	T1046 Network Service Discovery	T1078.002 Valid Accounts: Domain Accounts	T1114.003 Email Collection: Email Forwarding Rule	T1531 Account Access Removal
T1059.005 Command and Scripting Interpreter: Visual Basic	T1098.003 Account Manipulation: Additional Cloud Credentials	T1078.003 Valid Accounts: Local Accounts	T1027.009 Embedded Payloads	T1036.005 Masquerading: Match Legitimate Resource Name or Location	T1690 Prevent Command History Logging	T1056.001 Input Capture: Keylogging	T1046 Network Service Scanning	T1080 Taint Shared Content	T1119 Automated Collection	T1561 Disk Wipe
T1059.006 Command and Scripting Interpreter: Python	T1098.003 Account Manipulation: Additional Cloud Roles	T1078.004 Valid Accounts: Cloud Accounts	T1027.009 Obfuscated Files or Information: Embedded Payloads	T1036.008 Masquerading: Masquerade File Type		T1110 Brute Force	T1049 System Network Connections Discovery	T1091 Replication Through Removable Media	T1123 Audio Capture	T1561.001 Disk Wipe: Disk Content Wipe
T1064 Scripting	T1098.004 Account Manipulation: SSH Authorized Keys	T1098 Account Manipulation	T1027.011 Obfuscated Files or Information: Fileless Storage	T1055 Process Injection		T1110.001 Brute Force: Password Guessing	T1057 Process Discovery	T1210 Exploitation of Remote Services	T1125 Video Capture	T1561.002 Disk Wipe: Disk Structure Wipe
T1072 Software Deployment Tools	T1112 Modify Registry	T1098.003 Account Manipulation: Additional Cloud Roles	T1027.013 Obfuscated Files or Information: Encrypted/Encoded File	T1055.012 Process Injection: Process Hollowing		T1110.002 Brute Force: Password Cracking	T1069 Permission Groups Discovery	T1333 External Remote Services	T1213 Data from Information Repositories	T1657 Financial Theft
T1106 Native API	T1133 External Remote Services	T1134 Access Token Manipulation	T1027.016 Obfuscated Files or Information: Junk Code Insertion	T1070.003 Indicator Removal: Clear Command History		T1110.003 Brute Force: Password Spraying	T1069.002 Permission Groups Discovery: Domain Groups	T1534 Internal Spearphishing	T1213.001 Data from Information Repositories: Confluence
T1129 Shared Modules	T1136 Create Account	T1134.001 Token Impersonation/Theft	T1036 Masquerading	T1070.004 Indicator Removal: File Deletion		T1110.004 Brute Force: Credential Stuffing	T1082 System Information Discovery	T1550.002 Use Alternate Authentication Material: Pass the Hash	T1213.002 Data from Information Repositories: Sharepoint
T1203 Exploitation for Client Execution	T1136.001 Create Account: Local Account	T1134.002 Access Token Manipulation: Create Process with Token	T1036.001 Masquerading: invalid code signature	T1070.004 File Deletion		T1111 Multi-Factor Authentication Interception	T1083 File and Directory Discovery	T1563 Remote Service Session Hijacking	T1213.003 Data from Information Repositories: Code Repositories
T1204 User Execution	T1136.002 Create Account: Domain Account	T1134.003 Access Token Manipulation: Make and Impersonate Token	T1036.003 Masquerading: Rename Legitimate Utilities	T1078 Valid Accounts		T1212 Exploitation for Credential Access	T1087 Account Discovery	T1570 Lateral Tool Transfer	T1213.005 Data from Information Repositories: Messaging Applications
T1204.001 User Execution: Malicious Link	T1136.003 Create Account: Cloud Account	T1134.004 Parent PID Spoofing	T1036.004 Masquerading: Masquerade Task or Service	T1078.002 Valid Accounts: Domain Accounts		T1539 Steal Web Session Cookie	T1087.001 Account Discovery: Local Account	T1570 Tool Transfer	T1530 Data from Cloud Storage
T1204.002 User Execution: Malicious File	T1505.003 Server Software Component: Web Shell	T1134.004 Access Token Manipulation: Parent PID Spoofing	T1036.005 Masquerading: Match Legitimate Name or Location	T1078.003 Valid Accounts: Local Accounts		T1552 Unsecured Credentials	T1087.002 Account Discovery: Domain Account		T1560 Archive Collected Data
T1204.004 User Execution: Malicious Copy and Paste	T1505.004 Server Software Component: IIS Components	T1136 Create Account: Cloud Account	T1036.007 Masquerading: Double File Extension	T1078.004 Valid Accounts: Cloud Accounts		T1552.001 Unsecured Credentials: Credentials In Files	T1119 Automated Collection		T1560.001 Archive Collected Data: Archive via Utility
T1218.007 Signed Binary Proxy Execution: Msiexec	T1542.003 Pre-OS Boot: Bootkit	T1187 Forced Authentication	T1036.008 Masquerading: Masquerade File Type	T1112 Modify Registry		T1552.002 Unsecured Credentials: Credentials in Registry	T1120 Peripheral Device Discovery		T1560.002 Archive Collected Data: Archive via Library
T1559.001 Inter-Process Communication: Component Object Model	T1543 Create or Modify System Process	T1484.001 Domain Policy Modification: Group Policy Modification	T1055 Process Injection	T1134.003 Access Token Manipulation: Make and Impersonate Token		T1552.008 Unsecured Credentials: Chat Messages	T1124 Time Discovery		T1560.003 Archive Collected Data: Archive via Custom Method
T1569 System Services	T1543.003 Create or Modify System Process: Windows Service	T1484.001 Domain or Tenant Policy Modification: Group Policy Modification	T1055.001 Process injection: DLL injection	T1140 Deobfuscate/Decode Files or Information		T1555 Credentials from Password Stores	T1135 Network Share Discovery		T1602.002 Network Device Configuration Dump
T1651 Cloud Administration Command	T1543.003 Windows Services	T1543 Create or Modify System Process	T1055.003 Thread Execution Hijacking	T1218.014 System Binary Proxy Execution: MMC		T1555.003 Credentials from Web Browsers	T1482 Domain Trust Discovery
	T1547 Boot or Logon Autostart Execution	T1543.003 Create or Modify System Process: Windows Service	T1055.012 Process Injection: Process Hollowing	T1480 Execution Guardrails		T1555.003 Credentials from Password Stores: Credentials from Web Browsers	T1497 Virtualization/Sandbox Evasion
	T1547 Server Software Component	T1543.003 Service Execution	T1064 Scripting	T1564 Hide Artifacts		T1555.005 Credentials from Password Stores: Password Managers	T1518 Software Discovery
	T1547.001 Boot or Logon Autostart Execution: Registry Run Keys	T1547 Boot or Logon Autostart Execution	T1068 Exploitation for Privilege Escalation	T1564.003 Hide Artifacts: Hidden Window		T1557.001 Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning	T1518.001 Security Software Discovery
	T1547.001 Registry Run Keys/Startup Folder	T1547.001 Registry Run Keys/Startup Files	T1070 Indicator Removal	T1622 Debugger Evasion		T1558 Steal or Forge Kerberos Tickets	T1518.001 Software Discovery: Security Software Discovery
	T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	T1070.001 Indicator Removal: Clear Windows Event Logs	T1679 Selective Exclusion		T1621 Multi-Factor Authentication Request Generation	T1526 Cloud Service Discovery
	T1547.001 Registry Run Keys / Startup Folder	T1547.001 Registry Run Keys	T1070.001 Indicator removal on host: clear Windows event logs	T1684.001 Social Engineering: Impersonation		T1649 Steal or Forge Authentication Certificates	T1538 Cloud Service Dashboard
	T1547.004 Boot or Logon Autostart Execution: Winlogon Helper DLL	T1548 Abuse Elevation Control Mechanism	T1070.001 Clear Windows Event Logs				T1580 Cloud Infrastructure Discovery
	T1547.009 Boot or Logon Autostart Execution: Shortcut Modification	T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control	T1070.003 Indicator Removal: Clear Command History				T1614 System Location Discovery
	T1574.001 Hijack Execution Flow: DLL Search Order Hijacking	T1548.002 Abuse Elevation Control Mechanism: Bypass UAC	T1070.004 File Deletion				T1614.001 System Location Discovery: System Language Discovery
		T1548.002 Bypass User Account Control	T1070.004 Indicator Removal: File Deletion				T1615 Group Policy Discovery
		T1557 Adversary-in-the-Middle	T1070.004 Indicator removal on host: file deletion				T1652 Device Driver Discovery
		T1574 Hijack execution flow	T1070.006 Indicator Removal: Timestomp				TA0007 Discovery
		T1574.001 Hijack Execution Flow: DLL Search Order Hijacking	T1078.002 Domain Accounts
		TA0004 Privilege Escalation	T1090 Proxy
			T1112 Modify Registry
			T1119 Automated Collection
			T1134 Access Token Manipulation
			T1134.001 Access Token Manipulation: Token Impersonation/Theft
			T1134.004 Access Token Manipulation: Parent PID Spoofing
			T1140 Deobfuscate/Decode Files or Information
			T1202 Indirect Command Execution
			T1211 Exploitation for Defense Evasion
			T1218 System Binary Proxy Execution
			T1218.004 System Binary Proxy Execution: InstallUtil
			T1218.005 System Binary Proxy Execution: Mshta
			T1218.007 System Binary Proxy Execution: Msiexec
			T1218.010 System Binary Proxy Execution: Regsvr32
			T1218.011 Signed Binary Proxy Execution: Rundll32
			T1218.011 System Binary Proxy Execution: Rundll32
			T1218.014 System Binary Proxy Execution: MMC
			T1220 XSL Script Processing
			T1221 Template Injection
			T1222 File and Directory Permissions Modification
			T1222.001 File and Directory Permissions Modification: Windows Permissions
			T1480 Execution Guardrails
			T1484 Domain or Tenant Policy Modification
			T1484.001 Domain Policy Modification: Group Policy Modification
			T1484.001 Domain or Tenant Policy Modification: Group Policy Modification
			T1497 Virtualization/Sandbox Evasion
			T1497.001 Virtualization/Sandbox Evasion: System Checks
			T1497.003 Virtualization/Sandbox Evasion: Time Based Checks
			T1531 Account Access Removal
			T1548 Abuse Elevation Control Mechanism
			T1550.001 Use Alternate Authentication Material: Application Access Token
			T1550.004 Use Alternate Authentication Material: Web Session Cookie
			T1553.002 Subvert Trust Controls: Code Signing
			T1562 Impair Defenses
			T1562.001 Impair Defenses: Disable or Modify Tools
			T1562.001 Disable or Modify Tools
			T1562.004 Impair Defenses: Disable or Modify System Firewall
			T1562.004 Disable or Modify System Firewall Settings
			T1562.009 Safe Mode Boot
			T1564 Hidden Artifacts
			T1564.001 Hidden Files and Directories
			T1564.001 Hidden Artifacts: Hidden Files and Directories
			T1564.003 Hidden Window
			T1564.003 Hidden Artifacts: Hidden Window
			T1564.004 NTFS File Attributes
			T1574 Hijack Execution Flow
			T1574.013 Hijack Execution Flow: KernelCallbackTable
			T1620 Reflective DLL Injection
			T1622 Debugger Evasion
			T1672 Email Spoofing
			T1678 Delay Execution

ATT&CK Techniques Matrix