1. Home
  2. Matrices
  3. Enterprise
  4. Windows

Windows Matrix

Below are the tactics and techniques representing the MITRE ATT&CK® Windows platform. The techniques below are known to target hosts running Microsoft Windows operating systems. The Matrix contains information for the Windows platform.

View on the ATT&CK® Navigator
Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
14 techniques 7 techniques 21 techniques 24 techniques 12 techniques 11 techniques 29 techniques 17 techniques 32 techniques 11 techniques 18 techniques 16 techniques 13 techniques 19 techniques
Active Scanning of Provider Infrastructure
G2S Eavesdropping
G2U Eavesdropping
Gather Customer Network Information
Gather Customer Org Information
Gather Ground Station Communications Information
Gather Ground Station Logical and Cloud Design Information
Gather Ground Station Physical Architecture Information
Gather Mission Profile Configuration
Gather Mission Schedule / LEOP Timeline
Gather Mission that uses GSaaS Information
Gather Provider Org Information
Gather Supply Chain Information (4)
=
Phishing for Information (6)
=
Acquire Access
Acquire or Build Infrastructure (4)
=
Compromise Infrastructure (14)
=
Compromise or Establish Accounts
Develop or Obtain Cyber Capabilities
Develop or Obtain Non-Cyber Capabilities
Stage Capabilities (8)
=
Assembly, Test, and Launch Operation Compromise
Content Injection
Direct Attack to Space Communication Links (1)
=
Drive-by Compromise
Exploit Public-Facing Application
Ground Segment Compromise (2)
=
Hardware Additions
Internet Accessible Device
Phishing (4)
=
Remote Services Compromise
Remote Services Exploitation
Replication Through Removable Media
Rogue Master
Secondary/Backup Communication Channel Compromise
Software Defined Radio Compromise
Spacecraft Compromise
Supply Chain Compromise
Transient Cyber Asset
Trusted Relationship Exploitation
Valid Accounts Exploitation
Wireless Compromise
Autorun Image
Cloud Administration Command
Cloud API execution
Code Flaws Exploit
Command and Scripting Interpreter (13)
=
Encryption Disable/Bypass
Exploit Hardware/Firmware Corruption (2)
=
Flooding (2)
=
Hooking
Input Injection
Jamming (2)
=
Kinetic Physical Attack
Malicious Code (4)
=
Modify Authentication Process (9)
=
Modify Controller Tasking
Non-Kinetic Physical Attack (3)
=
Replay (1)
=
Scheduled Task/Job (5)
=
Serverless Execution
Side-Channel Attack
Software Deployment Tools
Spoofing (2)
=
System Services (3)
=
User Execution (5)
=
Backdoor (2)
=
Cloud Application Integration
Cloud Scheduled Task / Jobs
Event Triggered Execution (18)
=
External Remote Services
Implant Internal Image
Infrastructure File Infection
Modify Authentication Process (9)
=
Server Software Component (6)
=
Software Extentions (3)
=
Traffic Signaling (2)
=
Valid Credentialed Persistence
Abuse Elevation Control Mechanism (6)
=
Access Token Manipulation (5)
=
Account Manipulation (7)
=
Domain or Tenant Policy Modification (2)
=
Escape to Host (1)
=
Event Triggered Execution (18)
=
Exploitation for Privilege Escalation
Hooking
Process Injection (12)
=
Scheduled Task/job
Valid Accounts (4)
=
Abuse Elevation Control Mechanism (6)
=
Access Token Manipulation (5)
=
Build Image on Host
Component Collusion
Debugger Evasion
Delay Execution
Deobfuscate/Decode Files or Information
Deploy Container
Domain or Tenant Policy Modification (2)
=
Execution Guardrails (2)
=
Exploitation for Defense Evasion
File and Directory Permission Modification (2)
=
Hide Artifacts (14)
=
Impair Defenses (13)
=
Impersonation
Indicator Removal (10)
=
Masquerading (12)
=
Modify Authentication Process (9)
=
Modify Cloud Compute Infrastructure (5)
=
Modify Cloud Resource Hierarchy
Modify Whitelist
Obfuscated Files or Information (17)
=
Rootkit
Spoof Reporting Message
Subvert Trust Controls (6)
=
Traffic Signaling (2)
=
Trusted Developer Utilities Proxy Execution (3)
=
Use Alternate Authentication Material (4)
=
Valid Accounts Evasion
Adversary in the Middle (7)
=
Brute Force (5)
=
Credentials from Password Stores (6)
=
Exploitation for Credential Access
Forced Authentication
Forge Web Credentials (2)
=
Input Capture (4)
=
Modify Authentication Process (9)
=
Multi-Factor Authentication Interception
Multi-Factor Authentication Request Generation
Network Sniffing
OS Credential Dumping (8)
=
Phishing for credentials
Steal Application Access Token
Steal or Forge Authentication Certificates
Steal Web Session Cookie
Unsecured Credentials (8)
=
Account Discovery (4)
=
Browser Information Discovery
Cloud Infrastructure Discovery
Cloud Service Dashboard
Cloud Service Discovery
Cloud Storage Object Discovery
Cloud/Organization Policy Discovery
Container and Resource Discovery
Device Driver Discovery
File and Directory Discovery
Ground Network Sniffing
Key Management Policy Discovery
Link segment Sniffing
Local Storage Discovery
Log Enumeration
Network Service Discovery
Network Share Discovery
Password Policy Discovery
Peripheral Device Discovery
Permission Groups Discovery (3)
=
Process Discovery
Remote System Discovery
Remote System Information Discovery
Software Discovery (2)
=
System Information Discovery
System Location Discovery (1)
=
System Network Configuration Discovery (2)
=
System Network Connections Discovery
System Owner/User Discovery
System Service Discovery
Trust Relationships Discovery
Virtual Machine Discovery
Default Credentials
Hardcoded Credentials
Internal Spearphishing
Lateral Tool Transfer
Remote Service Session Hijacking (2)
=
Software Deployment Tools
Taint Shared Content
Use Alternate Authentication Material (4)
=
Use/Exploitation of Remote Services
Valid Accounts (4)
=
Virtualization Escape
Adversary in the Middle (7)
=
Archive Collected Data (3)
=
Audio Capture
Automated Collection
Browser Session Hijacking
Clipboard Data
Data from Cloud Storage
Data from Configuration Repository (2)
=
Data from Information Repositories (6)
=
Data from link eavesdropping (3)
=
Data from Local System
Data from Network Shared Drive
Data Staged (2)
=
Email Collection (3)
=
Input Capture (4)
=
Screen Capture
Video Capture
Wireless Sniffing
Content Injection
Data Encoding (2)
=
Data Obfuscation (3)
=
Dynamic Resolution (3)
=
Encrypted Channel (2)
=
Fallback Channels
Hide Infrastructure
Ingress Tool Transfer
Multi-Stage Channels
Non-Application Layer Protocol
Protocol Tunnelling
Proxy (4)
=
Remote Access Tools (3)
=
Standard Application Layer Protocol
Traffic Signaling (2)
=
Web Service (3)
=
Automated Exfiltration (1)
=
Data Transfer Size Limits
Exfiltration Over Alternative Protocol (3)
=
Exfiltration Over C2 Channel
Exfiltration Over Other Network Medium (1)
=
Exfiltration Over Payload Channel
Exfiltration Over Web Service (4)
=
Modify Communications Configuration (2)
=
Physical Layer Exfiltration
Replay Exfiltration
Scheduled Transfer
Side-Channel Exfiltration (4)
=
Transfer Data to Cloud Account
Account Access Removal
Data Destruction (1)
=
Data Encrypted for Impact
Data Manipulation (3)
=
Defacement (2)
=
Degradation of infrastructure
Denial of Service
Endpoint Denial of Service (4)
=
Financial Theft
Inhibit System Recovery
KMS Key Disablement / Replacement
Loss of Control
Loss of Intellectual property/proprietary data
Loss of Productivity and Revenue
Loss of Protection
Loss of View
Physical Destruction
Resource Hijacking (3)
=
Unauthorized Command Message
Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
14 techniques 7 techniques 21 techniques 24 techniques 12 techniques 11 techniques 29 techniques 17 techniques 32 techniques 11 techniques 18 techniques 16 techniques 13 techniques 19 techniques
Active Scanning of Provider Infrastructure
G2S Eavesdropping
G2U Eavesdropping
Gather Customer Network Information
Gather Customer Org Information
Gather Ground Station Communications Information
Gather Ground Station Logical and Cloud Design Information
Gather Ground Station Physical Architecture Information
Gather Mission Profile Configuration
Gather Mission Schedule / LEOP Timeline
Gather Mission that uses GSaaS Information
Gather Provider Org Information
=
Gather Supply Chain Information (4)
=
Phishing for Information (6)
Acquire Access
=
Acquire or Build Infrastructure (4)
=
Compromise Infrastructure (14)
Compromise or Establish Accounts
Develop or Obtain Cyber Capabilities
Develop or Obtain Non-Cyber Capabilities
=
Stage Capabilities (8)
Assembly, Test, and Launch Operation Compromise
Content Injection
=
Direct Attack to Space Communication Links (1)
Drive-by Compromise
Exploit Public-Facing Application
=
Ground Segment Compromise (2)
Hardware Additions
Internet Accessible Device
=
Phishing (4)
Remote Services Compromise
Remote Services Exploitation
Replication Through Removable Media
Rogue Master
Secondary/Backup Communication Channel Compromise
Software Defined Radio Compromise
Spacecraft Compromise
Supply Chain Compromise
Transient Cyber Asset
Trusted Relationship Exploitation
Valid Accounts Exploitation
Wireless Compromise
Autorun Image
Cloud Administration Command
Cloud API execution
Code Flaws Exploit
=
Command and Scripting Interpreter (13)
Encryption Disable/Bypass
=
Exploit Hardware/Firmware Corruption (2)
=
Flooding (2)
Hooking
Input Injection
=
Jamming (2)
Kinetic Physical Attack
=
Malicious Code (4)
=
Modify Authentication Process (9)
Modify Controller Tasking
=
Non-Kinetic Physical Attack (3)
=
Replay (1)
=
Scheduled Task/Job (5)
Serverless Execution
Side-Channel Attack
Software Deployment Tools
=
Spoofing (2)
=
System Services (3)
=
User Execution (5)
=
Backdoor (2)
Cloud Application Integration
Cloud Scheduled Task / Jobs
=
Event Triggered Execution (18)
External Remote Services
Implant Internal Image
Infrastructure File Infection
=
Modify Authentication Process (9)
=
Server Software Component (6)
=
Software Extentions (3)
=
Traffic Signaling (2)
Valid Credentialed Persistence
=
Abuse Elevation Control Mechanism (6)
=
Access Token Manipulation (5)
=
Account Manipulation (7)
=
Domain or Tenant Policy Modification (2)
=
Escape to Host (1)
=
Event Triggered Execution (18)
Exploitation for Privilege Escalation
Hooking
=
Process Injection (12)
Scheduled Task/job
=
Valid Accounts (4)
=
Abuse Elevation Control Mechanism (6)
=
Access Token Manipulation (5)
Build Image on Host
Component Collusion
Debugger Evasion
Delay Execution
Deobfuscate/Decode Files or Information
Deploy Container
=
Domain or Tenant Policy Modification (2)
=
Execution Guardrails (2)
Exploitation for Defense Evasion
=
File and Directory Permission Modification (2)
=
Hide Artifacts (14)
=
Impair Defenses (13)
Impersonation
=
Indicator Removal (10)
=
Masquerading (12)
=
Modify Authentication Process (9)
=
Modify Cloud Compute Infrastructure (5)
Modify Cloud Resource Hierarchy
Modify Whitelist
=
Obfuscated Files or Information (17)
Rootkit
Spoof Reporting Message
=
Subvert Trust Controls (6)
=
Traffic Signaling (2)
=
Trusted Developer Utilities Proxy Execution (3)
=
Use Alternate Authentication Material (4)
Valid Accounts Evasion
=
Adversary in the Middle (7)
=
Brute Force (5)
=
Credentials from Password Stores (6)
Exploitation for Credential Access
Forced Authentication
=
Forge Web Credentials (2)
=
Input Capture (4)
=
Modify Authentication Process (9)
Multi-Factor Authentication Interception
Multi-Factor Authentication Request Generation
Network Sniffing
=
OS Credential Dumping (8)
Phishing for credentials
Steal Application Access Token
Steal or Forge Authentication Certificates
Steal Web Session Cookie
=
Unsecured Credentials (8)
=
Account Discovery (4)
Browser Information Discovery
Cloud Infrastructure Discovery
Cloud Service Dashboard
Cloud Service Discovery
Cloud Storage Object Discovery
Cloud/Organization Policy Discovery
Container and Resource Discovery
Device Driver Discovery
File and Directory Discovery
Ground Network Sniffing
Key Management Policy Discovery
Link segment Sniffing
Local Storage Discovery
Log Enumeration
Network Service Discovery
Network Share Discovery
Password Policy Discovery
Peripheral Device Discovery
=
Permission Groups Discovery (3)
Process Discovery
Remote System Discovery
Remote System Information Discovery
=
Software Discovery (2)
System Information Discovery
=
System Location Discovery (1)
=
System Network Configuration Discovery (2)
System Network Connections Discovery
System Owner/User Discovery
System Service Discovery
Trust Relationships Discovery
Virtual Machine Discovery
Default Credentials
Hardcoded Credentials
Internal Spearphishing
Lateral Tool Transfer
=
Remote Service Session Hijacking (2)
Software Deployment Tools
Taint Shared Content
=
Use Alternate Authentication Material (4)
Use/Exploitation of Remote Services
=
Valid Accounts (4)
Virtualization Escape
=
Adversary in the Middle (7)
=
Archive Collected Data (3)
Audio Capture
Automated Collection
Browser Session Hijacking
Clipboard Data
Data from Cloud Storage
=
Data from Configuration Repository (2)
=
Data from Information Repositories (6)
=
Data from link eavesdropping (3)
Data from Local System
Data from Network Shared Drive
=
Data Staged (2)
=
Email Collection (3)
=
Input Capture (4)
Screen Capture
Video Capture
Wireless Sniffing
Content Injection
=
Data Encoding (2)
=
Data Obfuscation (3)
=
Dynamic Resolution (3)
=
Encrypted Channel (2)
Fallback Channels
Hide Infrastructure
Ingress Tool Transfer
Multi-Stage Channels
Non-Application Layer Protocol
Protocol Tunnelling
=
Proxy (4)
=
Remote Access Tools (3)
Standard Application Layer Protocol
=
Traffic Signaling (2)
=
Web Service (3)
=
Automated Exfiltration (1)
Data Transfer Size Limits
=
Exfiltration Over Alternative Protocol (3)
Exfiltration Over C2 Channel
=
Exfiltration Over Other Network Medium (1)
Exfiltration Over Payload Channel
=
Exfiltration Over Web Service (4)
=
Modify Communications Configuration (2)
Physical Layer Exfiltration
Replay Exfiltration
Scheduled Transfer
=
Side-Channel Exfiltration (4)
Transfer Data to Cloud Account
Account Access Removal
=
Data Destruction (1)
Data Encrypted for Impact
=
Data Manipulation (3)
=
Defacement (2)
Degradation of infrastructure
Denial of Service
=
Endpoint Denial of Service (4)
Financial Theft
Inhibit System Recovery
KMS Key Disablement / Replacement
Loss of Control
Loss of Intellectual property/proprietary data
Loss of Productivity and Revenue
Loss of Protection
Loss of View
Physical Destruction
=
Resource Hijacking (3)
Unauthorized Command Message