1200KM / tag
subtechnique — level tag
540 related reference pages for level: subtechnique.
Meaning and evidence boundary
Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.
Related pages
- T0843.001 Download All · simulation
- T0843.002 Online Edit · simulation
- T0843.003 Program Append · simulation
- T0846.001 Port Scan · simulation
- T0846.002 Broadcast Discovery · simulation
- T0846.003 Multicast Discovery · simulation
- T0873.001 Siemens Project File Format · simulation
- T1001.001 Junk Data · simulation
- T1001.002 Steganography · simulation
- T1001.003 Protocol or Service Impersonation · simulation
- T1003.001 LSASS Memory · simulation
- T1003.002 Security Account Manager · simulation
- T1003.003 NTDS · simulation
- T1003.004 LSA Secrets · simulation
- T1003.005 Cached Domain Credentials · simulation
- T1003.006 DCSync · simulation
- T1003.007 Proc Filesystem · simulation
- T1003.008 /etc/passwd and /etc/shadow · simulation
- T1011.001 Exfiltration Over Bluetooth · simulation
- T1016.001 Internet Connection Discovery · simulation
- T1016.002 Wi-Fi Discovery · simulation
- T1020.001 Traffic Duplication · simulation
- T1021.001 Remote Desktop Protocol · simulation
- T1021.002 SMB/Windows Admin Shares · simulation
- T1021.003 Distributed Component Object Model · simulation
- T1021.004 SSH · simulation
- T1021.005 VNC · simulation
- T1021.006 Windows Remote Management · simulation
- T1021.007 Cloud Services · simulation
- T1021.008 Direct Cloud VM Connections · simulation
- T1027.001 Binary Padding · simulation
- T1027.002 Software Packing · simulation
- T1027.003 Steganography · simulation
- T1027.004 Compile After Delivery · simulation
- T1027.005 Indicator Removal from Tools · simulation
- T1027.006 HTML Smuggling · simulation
- T1027.007 Dynamic API Resolution · simulation
- T1027.008 Stripped Payloads · simulation
- T1027.009 Embedded Payloads · simulation
- T1027.010 Command Obfuscation · simulation
- T1027.011 Fileless Storage · simulation
- T1027.012 LNK Icon Smuggling · simulation
- T1027.013 Encrypted/Encoded File · simulation
- T1027.014 Polymorphic Code · simulation
- T1027.015 Compression · simulation
- T1027.016 Junk Code Insertion · simulation
- T1027.017 SVG Smuggling · simulation
- T1027.018 Invisible Unicode · simulation
- T1036.001 Invalid Code Signature · simulation
- T1036.002 Right-to-Left Override · simulation
- T1036.003 Rename Legitimate Utilities · simulation
- T1036.004 Masquerade Task or Service · simulation
- T1036.005 Match Legitimate Resource Name or Location · simulation
- T1036.006 Space after Filename · simulation
- T1036.007 Double File Extension · simulation
- T1036.008 Masquerade File Type · simulation
- T1036.009 Break Process Trees · simulation
- T1036.010 Masquerade Account Name · simulation
- T1036.011 Overwrite Process Arguments · simulation
- T1036.012 Browser Fingerprint · simulation
- T1037.001 Logon Script (Windows) · simulation
- T1037.002 Login Hook · simulation
- T1037.003 Network Logon Script · simulation
- T1037.004 RC Scripts · simulation
- T1037.005 Startup Items · simulation
- T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 Protocol · simulation
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol · simulation
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol · simulation
- T1052.001 Exfiltration over USB · simulation
- T1053.002 At · simulation
- T1053.003 Cron · simulation
- T1053.005 Scheduled Task · simulation
- T1053.006 Systemd Timers · simulation
- T1053.007 Container Orchestration Job · simulation
- T1055.001 Dynamic-link Library Injection · simulation
- T1055.002 Portable Executable Injection · simulation
- T1055.003 Thread Execution Hijacking · simulation
- T1055.004 Asynchronous Procedure Call · simulation
- T1055.005 Thread Local Storage · simulation
- T1055.008 Ptrace System Calls · simulation
- T1055.009 Proc Memory · simulation
- T1055.011 Extra Window Memory Injection · simulation
- T1055.012 Process Hollowing · simulation
- T1055.013 Process Doppelgänging · simulation
- T1055.014 VDSO Hijacking · simulation
- T1055.015 ListPlanting · simulation
- T1056.001 Keylogging · simulation
- T1056.002 GUI Input Capture · simulation
- T1056.003 Web Portal Capture · simulation
- T1056.004 Credential API Hooking · simulation
- T1059.001 PowerShell · simulation
- T1059.002 AppleScript · simulation
- T1059.003 Windows Command Shell · simulation
- T1059.004 Unix Shell · simulation
- T1059.005 Visual Basic · simulation
- T1059.006 Python · simulation
- T1059.007 JavaScript · simulation
- T1059.008 Network Device CLI · simulation
- T1059.009 Cloud API · simulation
- T1059.010 AutoHotKey & AutoIT · simulation
- T1059.011 Lua · simulation
- T1059.012 Hypervisor CLI · simulation
- T1059.013 Container CLI/API · simulation
- T1069.001 Local Groups · simulation
- T1069.002 Domain Groups · simulation
- T1069.003 Cloud Groups · simulation
- T1070.003 Clear Command History · simulation
- T1070.004 File Deletion · simulation
- T1070.005 Network Share Connection Removal · simulation
- T1070.006 Timestomp · simulation
- T1070.007 Clear Network Connection History and Configurations · simulation
- T1070.008 Clear Mailbox Data · simulation
- T1070.009 Clear Persistence · simulation
- T1070.010 Relocate Malware · simulation
- T1071.001 Web Protocols · simulation
- T1071.002 File Transfer Protocols · simulation
- T1071.003 Mail Protocols · simulation
- T1071.004 DNS · simulation
- T1071.005 Publish/Subscribe Protocols · simulation
- T1074.001 Local Data Staging · simulation
- T1074.002 Remote Data Staging · simulation
- T1078.001 Default Accounts · simulation
- T1078.002 Domain Accounts · simulation
- T1078.003 Local Accounts · simulation
- T1078.004 Cloud Accounts · simulation
- T1087.001 Local Account · simulation
- T1087.002 Domain Account · simulation
- T1087.003 Email Account · simulation
- T1087.004 Cloud Account · simulation
- T1090.001 Internal Proxy · simulation
- T1090.002 External Proxy · simulation
- T1090.003 Multi-hop Proxy · simulation
- T1090.004 Domain Fronting · simulation
- T1098.001 Additional Cloud Credentials · simulation
- T1098.002 Additional Email Delegate Permissions · simulation
- T1098.003 Additional Cloud Roles · simulation
- T1098.004 SSH Authorized Keys · simulation
- T1098.005 Device Registration · simulation
- T1098.006 Additional Container Cluster Roles · simulation
- T1098.007 Additional Local or Domain Groups · simulation
- T1102.001 Dead Drop Resolver · simulation
- T1102.002 Bidirectional Communication · simulation
- T1102.003 One-Way Communication · simulation
- T1110.001 Password Guessing · simulation
- T1110.002 Password Cracking · simulation
- T1110.003 Password Spraying · simulation
- T1110.004 Credential Stuffing · simulation
- T1114.001 Local Email Collection · simulation
- T1114.002 Remote Email Collection · simulation
- T1114.003 Email Forwarding Rule · simulation
- T1127.001 MSBuild · simulation
- T1127.002 ClickOnce · simulation
- T1127.003 JamPlus · simulation
- T1132.001 Standard Encoding · simulation
- T1132.002 Non-Standard Encoding · simulation
- T1134.001 Token Impersonation/Theft · simulation
- T1134.002 Create Process with Token · simulation
- T1134.003 Make and Impersonate Token · simulation
- T1134.004 Parent PID Spoofing · simulation
- T1134.005 SID-History Injection · simulation
- T1136.001 Local Account · simulation
- T1136.002 Domain Account · simulation
- T1136.003 Cloud Account · simulation
- T1137.001 Office Template Macros · simulation
- T1137.002 Office Test · simulation
- T1137.003 Outlook Forms · simulation
- T1137.004 Outlook Home Page · simulation
- T1137.005 Outlook Rules · simulation
- T1137.006 Add-ins · simulation
- T1176.001 Browser Extensions · simulation
- T1176.002 IDE Extensions · simulation
- T1195.001 Compromise Software Dependencies and Development Tools · simulation
- T1195.002 Compromise Software Supply Chain · simulation
- T1195.003 Compromise Hardware Supply Chain · simulation
- T1204.001 Malicious Link · simulation
- T1204.002 Malicious File · simulation
- T1204.003 Malicious Image · simulation
- T1204.004 Malicious Copy and Paste · simulation
- T1204.005 Malicious Library · simulation
- T1205.001 Port Knocking · simulation
- T1205.002 Socket Filters · simulation
- T1213.001 Confluence · simulation
- T1213.002 Sharepoint · simulation
- T1213.003 Code Repositories · simulation
- T1213.004 Customer Relationship Management Software · simulation
- T1213.005 Messaging Applications · simulation
- T1213.006 Databases · simulation
- T1216.001 PubPrn · simulation
- T1216.002 SyncAppvPublishingServer · simulation
- T1218.001 Compiled HTML File · simulation
- T1218.002 Control Panel · simulation
- T1218.003 CMSTP · simulation
- T1218.004 InstallUtil · simulation
- T1218.005 Mshta · simulation
- T1218.007 Msiexec · simulation
- T1218.008 Odbcconf · simulation
- T1218.009 Regsvcs/Regasm · simulation
- T1218.010 Regsvr32 · simulation
- T1218.011 Rundll32 · simulation
- T1218.012 Verclsid · simulation
- T1218.013 Mavinject · simulation
- T1218.014 MMC · simulation
- T1218.015 Electron Applications · simulation
- T1219.001 IDE Tunneling · simulation
- T1219.002 Remote Desktop Software · simulation
- T1219.003 Remote Access Hardware · simulation
- T1222.001 Windows Permissions · simulation
- T1222.002 Linux and Mac Permissions · simulation
- T1406.001 Steganography · simulation
- T1406.002 Software Packing · simulation
- T1417.001 Keylogging · simulation
- T1417.002 GUI Input Capture · simulation
- T1418.001 Security Software Discovery · simulation
- T1422.001 Internet Connection Discovery · simulation
- T1422.002 Wi-Fi Discovery · simulation
- T1430.001 Remote Device Management Services · simulation
- T1430.002 Impersonate SS7 Nodes · simulation
- T1437.001 Web Protocols · simulation
- T1474.001 Compromise Software Dependencies and Development Tools · simulation
- T1474.002 Compromise Hardware Supply Chain · simulation
- T1474.003 Compromise Software Supply Chain · simulation
- T1480.001 Environmental Keying · simulation
- T1480.002 Mutual Exclusion · simulation
- T1481.001 Dead Drop Resolver · simulation
- T1481.002 Bidirectional Communication · simulation
- T1481.003 One-Way Communication · simulation
- T1484.001 Group Policy Modification · simulation
- T1484.002 Trust Modification · simulation
- T1485.001 Lifecycle-Triggered Deletion · simulation
- T1491.001 Internal Defacement · simulation
- T1491.002 External Defacement · simulation
- T1496.001 Compute Hijacking · simulation
- T1496.002 Bandwidth Hijacking · simulation
- T1496.003 SMS Pumping · simulation
- T1496.004 Cloud Service Hijacking · simulation
- T1497.001 System Checks · simulation
- T1497.002 User Activity Based Checks · simulation
- T1497.003 Time Based Checks · simulation
- T1498.001 Direct Network Flood · simulation
- T1498.002 Reflection Amplification · simulation
- T1499.001 OS Exhaustion Flood · simulation
- T1499.002 Service Exhaustion Flood · simulation
- T1499.003 Application Exhaustion Flood · simulation
- T1499.004 Application or System Exploitation · simulation
- T1505.001 SQL Stored Procedures · simulation
- T1505.002 Transport Agent · simulation
- T1505.003 Web Shell · simulation
- T1505.004 IIS Components · simulation
- T1505.005 Terminal Services DLL · simulation
- T1505.006 vSphere Installation Bundles · simulation
- T1518.001 Security Software Discovery · simulation
- T1518.002 Backup Software Discovery · simulation
- T1521.001 Symmetric Cryptography · simulation
- T1521.002 Asymmetric Cryptography · simulation
- T1521.003 SSL Pinning · simulation
- T1542.001 System Firmware · simulation
- T1542.002 Component Firmware · simulation
- T1542.003 Bootkit · simulation
- T1542.004 ROMMONkit · simulation
- T1542.005 TFTP Boot · simulation
- T1543.001 Launch Agent · simulation
- T1543.002 Systemd Service · simulation
- T1543.003 Windows Service · simulation
- T1543.004 Launch Daemon · simulation
- T1543.005 Container Service · simulation
- T1546.001 Change Default File Association · simulation
- T1546.002 Screensaver · simulation
- T1546.003 Windows Management Instrumentation Event Subscription · simulation
- T1546.004 Unix Shell Configuration Modification · simulation
- T1546.005 Trap · simulation
- T1546.006 LC_LOAD_DYLIB Addition · simulation
- T1546.007 Netsh Helper DLL · simulation
- T1546.008 Accessibility Features · simulation
- T1546.009 AppCert DLLs · simulation
- T1546.010 AppInit DLLs · simulation
- T1546.011 Application Shimming · simulation
- T1546.012 Image File Execution Options Injection · simulation
- T1546.013 PowerShell Profile · simulation
- T1546.014 Emond · simulation
- T1546.015 Component Object Model Hijacking · simulation
- T1546.016 Installer Packages · simulation
- T1546.017 Udev Rules · simulation
- T1546.018 Python Startup Hooks · simulation
- T1547.001 Registry Run Keys / Startup Folder · simulation
- T1547.002 Authentication Package · simulation
- T1547.003 Time Providers · simulation
- T1547.004 Winlogon Helper DLL · simulation
- T1547.005 Security Support Provider · simulation
- T1547.006 Kernel Modules and Extensions · simulation
- T1547.007 Re-opened Applications · simulation
- T1547.008 LSASS Driver · simulation
- T1547.009 Shortcut Modification · simulation
- T1547.010 Port Monitors · simulation
- T1547.012 Print Processors · simulation
- T1547.013 XDG Autostart Entries · simulation
- T1547.014 Active Setup · simulation
- T1547.015 Login Items · simulation
- T1548.001 Setuid and Setgid · simulation
- T1548.002 Bypass User Account Control · simulation
- T1548.003 Sudo and Sudo Caching · simulation
- T1548.004 Elevated Execution with Prompt · simulation
- T1548.005 Temporary Elevated Cloud Access · simulation
- T1548.006 TCC Manipulation · simulation
- T1550.001 Application Access Token · simulation
- T1550.002 Pass the Hash · simulation
- T1550.003 Pass the Ticket · simulation
- T1550.004 Web Session Cookie · simulation
- T1552.001 Credentials In Files · simulation
- T1552.002 Credentials in Registry · simulation
- T1552.003 Shell History · simulation
- T1552.004 Private Keys · simulation
- T1552.005 Cloud Instance Metadata API · simulation
- T1552.006 Group Policy Preferences · simulation
- T1552.007 Container API · simulation
- T1552.008 Chat Messages · simulation
- T1553.001 Gatekeeper Bypass · simulation
- T1553.002 Code Signing · simulation
- T1553.003 SIP and Trust Provider Hijacking · simulation
- T1553.004 Install Root Certificate · simulation
- T1553.005 Mark-of-the-Web Bypass · simulation
- T1553.006 Code Signing Policy Modification · simulation
- T1555.001 Keychain · simulation
- T1555.002 Securityd Memory · simulation
- T1555.003 Credentials from Web Browsers · simulation
- T1555.004 Windows Credential Manager · simulation
- T1555.005 Password Managers · simulation
- T1555.006 Cloud Secrets Management Stores · simulation
- T1556.001 Domain Controller Authentication · simulation
- T1556.002 Password Filter DLL · simulation
- T1556.003 Pluggable Authentication Modules · simulation
- T1556.004 Network Device Authentication · simulation
- T1556.005 Reversible Encryption · simulation
- T1556.006 Multi-Factor Authentication · simulation
- T1556.007 Hybrid Identity · simulation
- T1556.008 Network Provider DLL · simulation
- T1556.009 Conditional Access Policies · simulation
- T1557.001 Name Resolution Poisoning and SMB Relay · simulation
- T1557.002 ARP Cache Poisoning · simulation
- T1557.003 DHCP Spoofing · simulation
- T1557.004 Evil Twin · simulation
- T1558.001 Golden Ticket · simulation
- T1558.002 Silver Ticket · simulation
- T1558.003 Kerberoasting · simulation
- T1558.004 AS-REP Roasting · simulation
- T1558.005 Ccache Files · simulation
- T1559.001 Component Object Model · simulation
- T1559.002 Dynamic Data Exchange · simulation
- T1559.003 XPC Services · simulation
- T1560.001 Archive via Utility · simulation
- T1560.002 Archive via Library · simulation
- T1560.003 Archive via Custom Method · simulation
- T1561.001 Disk Content Wipe · simulation
- T1561.002 Disk Structure Wipe · simulation
- T1563.001 SSH Hijacking · simulation
- T1563.002 RDP Hijacking · simulation
- T1564.001 Hidden Files and Directories · simulation
- T1564.002 Hidden Users · simulation
- T1564.003 Hidden Window · simulation
- T1564.004 NTFS File Attributes · simulation
- T1564.005 Hidden File System · simulation
- T1564.006 Run Virtual Instance · simulation
- T1564.007 VBA Stomping · simulation
- T1564.008 Email Hiding Rules · simulation
- T1564.009 Resource Forking · simulation
- T1564.010 Process Argument Spoofing · simulation
- T1564.011 Ignore Process Interrupts · simulation
- T1564.012 File/Path Exclusions · simulation
- T1564.013 Bind Mounts · simulation
- T1564.014 Extended Attributes · simulation
- T1565.001 Stored Data Manipulation · simulation
- T1565.002 Transmitted Data Manipulation · simulation
- T1565.003 Runtime Data Manipulation · simulation
- T1566.001 Spearphishing Attachment · simulation
- T1566.002 Spearphishing Link · simulation
- T1566.003 Spearphishing via Service · simulation
- T1566.004 Spearphishing Voice · simulation
- T1567.001 Exfiltration to Code Repository · simulation
- T1567.002 Exfiltration to Cloud Storage · simulation
- T1567.003 Exfiltration to Text Storage Sites · simulation
- T1567.004 Exfiltration Over Webhook · simulation
- T1568.001 Fast Flux DNS · simulation
- T1568.002 Domain Generation Algorithms · simulation
- T1568.003 DNS Calculation · simulation
- T1569.001 Launchctl · simulation
- T1569.002 Service Execution · simulation
- T1569.003 Systemctl · simulation
- T1573.001 Symmetric Cryptography · simulation
- T1573.002 Asymmetric Cryptography · simulation
- T1574.001 DLL · simulation
- T1574.004 Dylib Hijacking · simulation
- T1574.005 Executable Installer File Permissions Weakness · simulation
- T1574.006 Dynamic Linker Hijacking · simulation
- T1574.007 Path Interception by PATH Environment Variable · simulation
- T1574.008 Path Interception by Search Order Hijacking · simulation
- T1574.009 Path Interception by Unquoted Path · simulation
- T1574.010 Services File Permissions Weakness · simulation
- T1574.011 Services Registry Permissions Weakness · simulation
- T1574.012 COR_PROFILER · simulation
- T1574.013 KernelCallbackTable · simulation
- T1574.014 AppDomainManager · simulation
- T1578.001 Create Snapshot · simulation
- T1578.002 Create Cloud Instance · simulation
- T1578.003 Delete Cloud Instance · simulation
- T1578.004 Revert Cloud Instance · simulation
- T1578.005 Modify Cloud Compute Configurations · simulation
- T1583.001 Domains · simulation
- T1583.002 DNS Server · simulation
- T1583.003 Virtual Private Server · simulation
- T1583.004 Server · simulation
- T1583.005 Botnet · simulation
- T1583.006 Web Services · simulation
- T1583.007 Serverless · simulation
- T1583.008 Malvertising · simulation
- T1584.001 Domains · simulation
- T1584.002 DNS Server · simulation
- T1584.003 Virtual Private Server · simulation
- T1584.004 Server · simulation
- T1584.005 Botnet · simulation
- T1584.006 Web Services · simulation
- T1584.007 Serverless · simulation
- T1584.008 Network Devices · simulation
- T1585.001 Social Media Accounts · simulation
- T1585.002 Email Accounts · simulation
- T1585.003 Cloud Accounts · simulation
- T1586.001 Social Media Accounts · simulation
- T1586.002 Email Accounts · simulation
- T1586.003 Cloud Accounts · simulation
- T1587.001 Malware · simulation
- T1587.002 Code Signing Certificates · simulation
- T1587.003 Digital Certificates · simulation
- T1587.004 Exploits · simulation
- T1588.001 Malware · simulation
- T1588.002 Tool · simulation
- T1588.003 Code Signing Certificates · simulation
- T1588.004 Digital Certificates · simulation
- T1588.005 Exploits · simulation
- T1588.006 Vulnerabilities · simulation
- T1588.007 Artificial Intelligence · simulation
- T1589.001 Credentials · simulation
- T1589.002 Email Addresses · simulation
- T1589.003 Employee Names · simulation
- T1590.001 Domain Properties · simulation
- T1590.002 DNS · simulation
- T1590.003 Network Trust Dependencies · simulation
- T1590.004 Network Topology · simulation
- T1590.005 IP Addresses · simulation
- T1590.006 Network Security Appliances · simulation
- T1591.001 Determine Physical Locations · simulation
- T1591.002 Business Relationships · simulation
- T1591.003 Identify Business Tempo · simulation
- T1591.004 Identify Roles · simulation
- T1592.001 Hardware · simulation
- T1592.002 Software · simulation
- T1592.003 Firmware · simulation
- T1592.004 Client Configurations · simulation
- T1593.001 Social Media · simulation
- T1593.002 Search Engines · simulation
- T1593.003 Code Repositories · simulation
- T1595.001 Scanning IP Blocks · simulation
- T1595.002 Vulnerability Scanning · simulation
- T1595.003 Wordlist Scanning · simulation
- T1596.001 DNS/Passive DNS · simulation
- T1596.002 WHOIS · simulation
- T1596.003 Digital Certificates · simulation
- T1596.004 CDNs · simulation
- T1596.005 Scan Databases · simulation
- T1597.001 Threat Intel Vendors · simulation
- T1597.002 Purchase Technical Data · simulation
- T1598.001 Spearphishing Service · simulation
- T1598.002 Spearphishing Attachment · simulation
- T1598.003 Spearphishing Link · simulation
- T1598.004 Spearphishing Voice · simulation
- T1599.001 Network Address Translation Traversal · simulation
- T1600.001 Reduce Key Space · simulation
- T1600.002 Disable Crypto Hardware · simulation
- T1601.001 Patch System Image · simulation
- T1601.002 Downgrade System Image · simulation
- T1602.001 SNMP (MIB Dump) · simulation
- T1602.002 Network Device Configuration Dump · simulation
- T1606.001 Web Cookies · simulation
- T1606.002 SAML Tokens · simulation
- T1608.001 Upload Malware · simulation
- T1608.002 Upload Tool · simulation
- T1608.003 Install Digital Certificate · simulation
- T1608.004 Drive-by Target · simulation
- T1608.005 Link Target · simulation
- T1608.006 SEO Poisoning · simulation
- T1614.001 System Language Discovery · simulation
- T1623.001 Unix Shell · simulation
- T1624.001 Broadcast Receivers · simulation
- T1625.001 System Runtime API Hijacking · simulation
- T1626.001 Device Administrator Permissions · simulation
- T1627.001 Geofencing · simulation
- T1628.001 Suppress Application Icon · simulation
- T1628.002 User Evasion · simulation
- T1628.003 Conceal Multimedia Files · simulation
- T1629.001 Prevent Application Removal · simulation
- T1629.002 Device Lockout · simulation
- T1629.003 Disable or Modify Tools · simulation
- T1630.001 Uninstall Malicious Application · simulation
- T1630.002 File Deletion · simulation
- T1630.003 Disguise Root/Jailbreak Indicators · simulation
- T1631.001 Ptrace System Calls · simulation
- T1632.001 Code Signing Policy Modification · simulation
- T1633.001 System Checks · simulation
- T1634.001 Keychain · simulation
- T1635.001 URI Hijacking · simulation
- T1636.001 Calendar Entries · simulation
- T1636.002 Call Log · simulation
- T1636.003 Contact List · simulation
- T1636.004 SMS Messages · simulation
- T1636.005 Accounts · simulation
- T1637.001 Domain Generation Algorithms · simulation
- T1639.001 Exfiltration Over Unencrypted Non-C2 Protocol · simulation
- T1641.001 Transmitted Data Manipulation · simulation
- T1655.001 Match Legitimate Name or Location · simulation
- T1683.001 Written Content · simulation
- T1683.002 Audio-Visual Content · simulation
- T1684.001 Impersonation · simulation
- T1684.002 Email Spoofing · simulation
- T1685.001 Disable or Modify Windows Event Log · simulation
- T1685.002 Disable or Modify Cloud Log · simulation
- T1685.003 Modify or Spoof Tool UI · simulation
- T1685.004 Disable or Modify Linux Audit System Log · simulation
- T1685.005 Clear Windows Event Logs · simulation
- T1685.006 Clear Linux or Mac System Logs · simulation
- T1686.001 Cloud Firewall · simulation
- T1686.002 Network Device Firewall · simulation
- T1686.003 Windows Host Firewall · simulation
- T1691.001 Command Message · simulation
- T1691.002 Reporting Message · simulation
- T1692.001 Command Message · simulation
- T1692.002 Reporting Message · simulation
- T1693.001 System Firmware · simulation
- T1693.002 Module Firmware · simulation
- T1694.001 Default Credentials · simulation
- T1694.002 Hardcoded Credentials · simulation
- T1695.001 Serial COM · simulation
- T1695.002 Ethernet · simulation
- T1695.003 Wi-Fi · simulation
Connected ecosystem references
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.