| T1550.003 | Pass the Ticket | | Defense Evasion, Lateral Movement | MITRE ATT&CK |
| T1552.002 | Credentials in Registry | | Credential Access | MITRE ATT&CK |
| T1574.009 | Path Interception by Unquoted Path | | Persistence, Privilege Escalation, Defense Evasion | MITRE ATT&CK |
| T1580 | Cloud Infrastructure Discovery | | Discovery | MITRE ATT&CK |
| T1615 | Group Policy Discovery | | Discovery | MITRE ATT&CK |
| T1592.002_PRE | Gather Victim Host Information: Software | PRE | Reconnaissance | MITRE ATT&CK |
| T1592.002 | Software | | Reconnaissance | MITRE ATT&CK |
| T0846_ICS | Remote System Discovery | OT | Discovery | MITRE ATT&CK |
| T1012_Windows | Query Registry | Windows | Discovery | MITRE ATT&CK |
| T1048.003_Windows | Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol (Windows) | Windows | Exfiltration | MITRE ATT&CK |
| T1059.003_Windows | Command and Scripting Interpreter: Windows Command Shell | Windows | Execution | MITRE ATT&CK |
| T1069.003_Azure | Permission Groups Discovery:Cloud Groups(Azure) | Entra ID | Discovery | MITRE ATT&CK |
| T1078.003_Windows | Valid Accounts: Local Accounts | Windows | Defense Evasion, Persistence, Privilege Escalation, Initial Access | MITRE ATT&CK |
| T1134.005_Windows | Access Token Manipulation: SID-History Injection | Windows | Defense Evasion, Privilege Escalation | MITRE ATT&CK |
| T1203_Windows | Exploitation for Client Execution (Windows) | Windows | Execution | MITRE ATT&CK |
| T1495_Windows | Firmware Corruption | Windows | Impact | MITRE ATT&CK |
| T1558.004_Windows | Steal or Forge Kerberos Tickets: AS-REP Roasting | Windows | Credential Access | MITRE ATT&CK |
| T1574.011_Windows | Hijack Execution Flow: Services Registry Permissions Weakness | Windows | Persistence, Privilege Escalation, Defense Evasion | MITRE ATT&CK |
| T1530_AWS | Data from Cloud Storage Object (AWS) | AWS | Collection | MITRE ATT&CK |
| T1003.006 | DCSync | | Credential Access | MITRE ATT&CK |
| T1021.002 | SMB/Windows Admin Shares | | Lateral Movement | MITRE ATT&CK |
| T1048.001 | Exfiltration Over Symmetric Encrypted Non-C2 Protocol | | Exfiltration | MITRE ATT&CK |
| T1059.009 | Cloud API | | Execution | MITRE ATT&CK |
| T1098.001 | Additional Cloud Credentials | | Persistence | MITRE ATT&CK |
| T1110.001 | Password Guessing | | Credential Access | MITRE ATT&CK |
| T1110.003 | Password Spraying | | Credential Access | MITRE ATT&CK |
| T1135 | Network Share Discovery | | Discovery | MITRE ATT&CK |
| T1195.002 | Compromise Software Supply Chain | | Initial Access | MITRE ATT&CK |
| T1210 | Exploitation of Remote Services | | Lateral Movement | MITRE ATT&CK |
| T1482 | Domain Trust Discovery | | Discovery | MITRE ATT&CK |
| T1530 | Data from Cloud Storage | | Collection | MITRE ATT&CK |
| T1537 | Transfer Data to Cloud Account | | Exfiltration | MITRE ATT&CK |
| T1548.005 | Temporary Elevated Cloud Access | | Defense Evasion, Privilege Escalation | MITRE ATT&CK |
| T1548 | Abuse Elevation Control Mechanism | | Privilege Escalation, Defense Evasion | MITRE ATT&CK |
| T1555.006 | Cloud Secrets Management Stores | | Credential Access | MITRE ATT&CK |
| T1556.001 | Domain Controller Authentication | | Credential Access, Defense Evasion, Persistence | MITRE ATT&CK |
| T1574.011 | Services Registry Permissions Weakness | | Persistence, Privilege Escalation, Defense Evasion | MITRE ATT&CK |
| T1606.002 | SAML Tokens | | Credential Access | MITRE ATT&CK |
| T1648 | Serverless Execution | | Execution | MITRE ATT&CK |
| T1003.001_Windows | OS Credential Dumping: LSASS Memory | Windows | Credential Access | MITRE ATT&CK |
| T1003.002_Windows | OS Credential Dumping: Security Account Manager | Windows | Credential Access | MITRE ATT&CK |
| T1021.002_Windows | Remote Services: SMB/Windows Admin Shares | Windows | Lateral Movement | MITRE ATT&CK |
| T1047_Windows | Windows Management Instrumentation | Windows | Execution | MITRE ATT&CK |
| T1048.002_Windows | Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol (Windows) | Windows | Exfiltration | MITRE ATT&CK |
| T1053.005_Windows | Scheduled Task/Job: Scheduled Task | Windows | Execution, Persistence, Privilege Escalation | MITRE ATT&CK |
| T1059.001_Windows | Command and Scripting Interpreter: PowerShell (Windows) | Windows | Execution | MITRE ATT&CK |
| T1110.001_Windows | Brute Force: Password Guessing (Windows) | Windows | Credential Access | MITRE ATT&CK |
| T1110.003_Windows | Brute Force: Password Spraying (Windows) | Windows | Credential Access | MITRE ATT&CK |
| T1211_Windows | Exploitation for Defense Evasion (Windows) | Windows | Defense Evasion | MITRE ATT&CK |
| T1482_Windows | Domain Trust Discovery | Windows | Discovery | MITRE ATT&CK |