windows-matrix.md

Windows Atomic Tests by ATT&CK Tactic & Technique

initial-access	execution	persistence	privilege-escalation	defense-evasion	credential-access	discovery	lateral-movement	collection	exfiltration	command-and-control
Drive-by Compromise CONTRIBUTE A TEST	CMSTP	Accessibility Features	Access Token Manipulation	Access Token Manipulation	Account Manipulation	Account Discovery	Application Deployment Software CONTRIBUTE A TEST	Audio Capture	Automated Exfiltration CONTRIBUTE A TEST	Commonly Used Port CONTRIBUTE A TEST
Exploit Public-Facing Application CONTRIBUTE A TEST	Command-Line Interface	Account Manipulation	Accessibility Features	BITS Jobs	Brute Force	Application Window Discovery	Component Object Model and Distributed COM CONTRIBUTE A TEST	Automated Collection	Data Compressed	Communication Through Removable Media CONTRIBUTE A TEST
External Remote Services CONTRIBUTE A TEST	Compiled HTML File	AppCert DLLs CONTRIBUTE A TEST	AppCert DLLs CONTRIBUTE A TEST	Binary Padding	Credential Dumping	Browser Bookmark Discovery	Exploitation of Remote Services CONTRIBUTE A TEST	Clipboard Data	Data Encrypted	Connection Proxy
Hardware Additions CONTRIBUTE A TEST	Component Object Model and Distributed COM CONTRIBUTE A TEST	AppInit DLLs	AppInit DLLs	Bypass User Account Control	Credentials from Web Browsers CONTRIBUTE A TEST	Domain Trust Discovery	Internal Spearphishing CONTRIBUTE A TEST	Data Staged	Data Transfer Size Limits	Custom Command and Control Protocol CONTRIBUTE A TEST
Replication Through Removable Media CONTRIBUTE A TEST	Control Panel Items	Application Shimming	Application Shimming	CMSTP	Credentials in Files	File and Directory Discovery	Logon Scripts	Data from Information Repositories CONTRIBUTE A TEST	Exfiltration Over Alternative Protocol	Custom Cryptographic Protocol CONTRIBUTE A TEST
Spearphishing Attachment	Dynamic Data Exchange	Authentication Package CONTRIBUTE A TEST	Bypass User Account Control	Code Signing CONTRIBUTE A TEST	Credentials in Registry	Network Service Scanning	Pass the Hash	Data from Local System	Exfiltration Over Command and Control Channel CONTRIBUTE A TEST	Data Encoding
Spearphishing Link CONTRIBUTE A TEST	Execution through API CONTRIBUTE A TEST	BITS Jobs	DLL Search Order Hijacking	Compile After Delivery	Exploitation for Credential Access CONTRIBUTE A TEST	Network Share Discovery	Pass the Ticket	Data from Network Shared Drive CONTRIBUTE A TEST	Exfiltration Over Other Network Medium CONTRIBUTE A TEST	Data Obfuscation CONTRIBUTE A TEST
Spearphishing via Service CONTRIBUTE A TEST	Execution through Module Load CONTRIBUTE A TEST	Bootkit CONTRIBUTE A TEST	Exploitation for Privilege Escalation CONTRIBUTE A TEST	Compiled HTML File	Forced Authentication CONTRIBUTE A TEST	Network Sniffing	Remote Desktop Protocol	Data from Removable Media CONTRIBUTE A TEST	Exfiltration Over Physical Medium CONTRIBUTE A TEST	Domain Fronting CONTRIBUTE A TEST
Supply Chain Compromise CONTRIBUTE A TEST	Exploitation for Client Execution CONTRIBUTE A TEST	Browser Extensions	Extra Window Memory Injection CONTRIBUTE A TEST	Component Firmware CONTRIBUTE A TEST	Hooking	Password Policy Discovery	Remote File Copy	Email Collection	Scheduled Transfer CONTRIBUTE A TEST	Domain Generation Algorithms CONTRIBUTE A TEST
Trusted Relationship CONTRIBUTE A TEST	Graphical User Interface CONTRIBUTE A TEST	Change Default File Association	File System Permissions Weakness	Component Object Model Hijacking CONTRIBUTE A TEST	Input Capture	Peripheral Device Discovery CONTRIBUTE A TEST	Remote Services CONTRIBUTE A TEST	Input Capture		Fallback Channels CONTRIBUTE A TEST
Valid Accounts CONTRIBUTE A TEST	InstallUtil	Component Firmware CONTRIBUTE A TEST	Hooking	Connection Proxy	Input Prompt	Permission Groups Discovery	Replication Through Removable Media CONTRIBUTE A TEST	Man in the Browser CONTRIBUTE A TEST		Multi-Stage Channels CONTRIBUTE A TEST
	LSASS Driver CONTRIBUTE A TEST	Component Object Model Hijacking CONTRIBUTE A TEST	Image File Execution Options Injection	Control Panel Items	Kerberoasting	Process Discovery	Shared Webroot CONTRIBUTE A TEST	Screen Capture		Multi-hop Proxy CONTRIBUTE A TEST
	Mshta	Create Account	New Service	DCShadow	LLMNR/NBT-NS Poisoning and Relay CONTRIBUTE A TEST	Query Registry	Taint Shared Content CONTRIBUTE A TEST	Video Capture CONTRIBUTE A TEST		Multiband Communication CONTRIBUTE A TEST
	PowerShell	DLL Search Order Hijacking	Parent PID Spoofing	DLL Search Order Hijacking	Network Sniffing	Remote System Discovery	Third-party Software CONTRIBUTE A TEST			Multilayer Encryption CONTRIBUTE A TEST
	Regsvcs/Regasm	External Remote Services CONTRIBUTE A TEST	Path Interception CONTRIBUTE A TEST	DLL Side-Loading	Password Filter DLL	Security Software Discovery	Windows Admin Shares			Remote Access Tools
	Regsvr32	File System Permissions Weakness	Port Monitors CONTRIBUTE A TEST	Deobfuscate/Decode Files or Information	Private Keys	Software Discovery	Windows Remote Management			Remote File Copy
	Rundll32	Hidden Files and Directories	PowerShell Profile	Disabling Security Tools	Steal Web Session Cookie CONTRIBUTE A TEST	System Information Discovery				Standard Application Layer Protocol
	Scheduled Task	Hooking	Process Injection	Execution Guardrails CONTRIBUTE A TEST	Two-Factor Authentication Interception CONTRIBUTE A TEST	System Network Configuration Discovery				Standard Cryptographic Protocol
	Scripting	Hypervisor	SID-History Injection CONTRIBUTE A TEST	Exploitation for Defense Evasion CONTRIBUTE A TEST		System Network Connections Discovery				Standard Non-Application Layer Protocol
	Service Execution	Image File Execution Options Injection	Scheduled Task	Extra Window Memory Injection CONTRIBUTE A TEST		System Owner/User Discovery				Uncommonly Used Port
	Signed Binary Proxy Execution	LSASS Driver CONTRIBUTE A TEST	Service Registry Permissions Weakness	File Deletion		System Service Discovery				Web Service
	Signed Script Proxy Execution	Logon Scripts	Valid Accounts CONTRIBUTE A TEST	File System Logical Offsets CONTRIBUTE A TEST		System Time Discovery
	Third-party Software CONTRIBUTE A TEST	Modify Existing Service	Web Shell	File and Directory Permissions Modification		Virtualization/Sandbox Evasion CONTRIBUTE A TEST
	Trusted Developer Utilities	Netsh Helper DLL		Group Policy Modification CONTRIBUTE A TEST
	User Execution	New Service		Hidden Files and Directories
	Windows Management Instrumentation	Office Application Startup		Hidden Window
	Windows Remote Management	Path Interception CONTRIBUTE A TEST		Image File Execution Options Injection
	XSL Script Processing	Port Monitors CONTRIBUTE A TEST		Indicator Blocking CONTRIBUTE A TEST
		PowerShell Profile		Indicator Removal from Tools CONTRIBUTE A TEST
		Redundant Access CONTRIBUTE A TEST		Indicator Removal on Host
		Registry Run Keys / Startup Folder		Indirect Command Execution
		SIP and Trust Provider Hijacking CONTRIBUTE A TEST		Install Root Certificate
		Scheduled Task		InstallUtil
		Screensaver		Masquerading
		Security Support Provider		Modify Registry
		Server Software Component		Mshta
		Service Registry Permissions Weakness		NTFS File Attributes
		Shortcut Modification		Network Share Connection Removal
		System Firmware CONTRIBUTE A TEST		Obfuscated Files or Information
		Time Providers CONTRIBUTE A TEST		Parent PID Spoofing
		Valid Accounts CONTRIBUTE A TEST		Process Doppelgänging CONTRIBUTE A TEST
		Web Shell		Process Hollowing
		Windows Management Instrumentation Event Subscription		Process Injection
		Winlogon Helper DLL		Redundant Access CONTRIBUTE A TEST
				Regsvcs/Regasm
				Regsvr32
				Rootkit
				Rundll32
				SIP and Trust Provider Hijacking CONTRIBUTE A TEST
				Scripting
				Signed Binary Proxy Execution
				Signed Script Proxy Execution
				Software Packing CONTRIBUTE A TEST
				Template Injection CONTRIBUTE A TEST
				Timestomp
				Trusted Developer Utilities
				Valid Accounts CONTRIBUTE A TEST
				Virtualization/Sandbox Evasion CONTRIBUTE A TEST
				Web Service
				XSL Script Processing