Technique Matrix

Initial Access	Drive-by Compromise	Exploit Public-Facing Application	Exploitation of Remote Services	External Remote Services	Internet Accessible Device	Remote Services	Replication Through Removable Media	Rogue Master	Spearphishing Attachment	Supply Chain Compromise	Transient Cyber Asset	Wireless Compromise
Execution	Change Operating Mode	Command-Line Interface	Execution through API	Graphical User Interface	Hooking	Modify Controller Tasking	Native API	Scripting	User Execution
Persistence	Modify Program	Module Firmware	Project File Infection	System Firmware	Valid Accounts
Privilege Escalation	Exploitation for Privilege Escalation	Hooking
Evasion	Change Operating Mode	Exploitation for Evasion	Indicator Removal on Host	Masquerading	Rootkit	Spoof Reporting Message
Discovery	Network Connection Enumeration	Network Sniffing	Remote System Discovery	Remote System Information Discovery	Wireless Sniffing
Lateral Movement	Default Credentials	Exploitation of Remote Services	Lateral Tool Transfer	Program Download	Remote Services	Valid Accounts
Collection	Automated Collection	Data from Information Repositories	Detect Operating Mode	I/O Image	Man in the Middle	Monitor Process State	Point & Tag Identification	Program Upload	Screen Capture	Wireless Sniffing
Command and Control	Commonly Used Port	Connection Proxy	Standard Application Layer Protocol
Inhibit Response Function	Activate Firmware Update Mode	Alarm Suppression	Block Command Message	Block Reporting Message	Block Serial COM	Data Destruction	Denial of Service	Device Restart/Shutdown	Manipulate I/O Image	Modify Alarm Settings	Rootkit	Service Stop	System Firmware
Impair Process Control	Brute Force I/O	Modify Parameter	Module Firmware	Spoof Reporting Message	Unauthorized Command Message
Impact	Damage to Property	Denial of Control	Denial of View	Loss of Availability	Loss of Control	Loss of Productivity and Revenue	Loss of Protection	Loss of Safety	Loss of View	Manipulation of Control	Manipulation of View	Theft of Operational Information