Attack Matrix

Reconnaissance to Execution

Reconnaissance	Resource Development	Initial Access	Execution
Active Scanning (3)	Acquire Access	Content Injection	Cloud Administration
Gather Victim Host Info (4)	Acquire Infrastructure (8)	Drive-by Compromise	Command & Script Interpreter (13)
Gather Victim Identity Info (3)	Compromise Accounts (3)	Exploit Public-Facing App	Container Administration
Gather Victim Org Info (4)	Compromise Infrastructure (6)	External Remote Services	Deploy Container
Phishing for Info (3)	Develop Capabilities (4)	Hardware Additions	Inter-Process Communication (3)
Search Open Technical Databases (5)	Establish Accounts (5)	Replication Through Removable Media	Native API

Persistence to Credential Access

Persistence	Privilege Escalation	Defense Evasion	Credential Access
Account Manipulation (7)	Abuse Elevation Control (6)	Abuse Elevation Control (6)	Adversary-in-the-Middle (4)
BITS Jobs	Access Token Manipulation (5)	Access Token Manipulation (5)	Brute Force (4)
Boot/Logon Autostart (14)	Account Manipulation (7)	BITS Jobs	Credentials from Password Stores (6)
Browser Extensions (3)	Boot or Logon Autostart (14)	Build Image on Host	Forge Credentials (2)
Create Account (3)	Create or Modify System Process (4)	Debugger Evasion	Input Capture (4)
Create or Modify System Process (4)	Domain Policy Modification (2)	Deception Operation	Modify Authentication Process (9)

Discovery to Command and Control

Discovery	Lateral Movement	Collection	Command and Control
Account Discovery (4)	Exploitation of Remote Services	Adversary-in-the-Middle (4)	Application Layer Protocol (5)
Application Window Discovery	Internal Spearphishing	Archive Collected Data (3)	Communication Through Removable Media
Browser Information Discovery	Lateral Tool Transfer	Audio Capture	Data Encoding (2)
Cloud Infrastructure Discovery	Remote Service Session Hijacking	Automated Collection	Data Obfuscation (2)
Cloud Service Dashboard	Remote Services (8)	Browser Information Discovery	Dynamic Resolution (3)
Cloud Service Discovery	Software Deployment Tools	Clipboard Data	Encrypted Channel (2)

Exfiltration and Impact

Exfiltration	Impact
Automated Exfiltration (1)	Account Access Removal
Data Transfer Size Limits	Data Destruction (1)
Exfiltration Over Alternative Protocol (3)	Data Encrypted for Impact (3)
Exfiltration Over C2 Channel	Data Manipulation (3)
Exfiltration Over Other Network Medium (2)	Defacement (2)
Exfiltration Over Physical Medium	Disk Wipe (2)