Grandoreiro

Execution

Persistence

Privilege Escalation

Credential Access

Discovery

Collection

Command and Control

Command and Scripting Interpreter

Account Manipulation

Abuse Elevation Control Mechanism

Adversary-in-the-Middle

Account Discovery

Adversary-in-the-Middle

Application Layer Protocol

Container Administration Command

BITS Jobs

Access Token Manipulation

Brute Force

Application Window Discovery

Archive Collected Data

Communication Through Removable Media

Deploy Container

Boot or Logon Autostart Execution

Boot or Logon Autostart Execution

Credentials from Password Stores

Browser Bookmark Discovery

Audio Capture

Data Encoding

Exploitation for Client Execution

Boot or Logon Initialization Scripts

Boot or Logon Initialization Scripts

Exploitation for Credential Access

Cloud Infrastructure Discovery

Automated Collection

Data Obfuscation

Inter-Process Communication

Browser Extensions

Create or Modify System Process

Forced Authentication

Cloud Service Dashboard

Browser Session Hijacking

Dynamic Resolution

Native API

Compromise Client Software Binary

Domain Policy Modification

Forge Web Credentials

Cloud Service Discovery

Clipboard Data

Encrypted Channel

Scheduled Task/Job

Create Account

Escape to Host

Input Capture

Cloud Storage Object Discovery

Data from Cloud Storage Object

Fallback Channels

Shared Modules

Create or Modify System Process

Event Triggered Execution

Modify Authentication Process

Container and Resource Discovery

Data from Configuration Repository

Ingress Tool Transfer

Software Deployment Tools

Event Triggered Execution

Exploitation for Privilege Escalation

Multi-Factor Authentication Interception

Debugger Evasion

Data from Information Repositories

Multi-Stage Channels

System Services

External Remote Services

Hijack Execution Flow

Multi-Factor Authentication Request Generation

Domain Trust Discovery

Data from Local System

Non-Application Layer Protocol

User Execution

Hijack Execution Flow

Process Injection

Network Sniffing

File and Directory Discovery

Data from Network Shared Drive

Non-Standard Port

Windows Management Instrumentation

Implant Internal Image

Scheduled Task/Job

OS Credential Dumping

Group Policy Discovery

Data from Removable Media

Protocol Tunneling

Modify Authentication Process

Valid Accounts

Steal Application Access Token

Network Service Discovery

Data Staged

Proxy

Office Application Startup

Steal or Forge Kerberos Tickets

Network Share Discovery

Email Collection

Remote Access Software

Pre-OS Boot

Steal Web Session Cookie

Network Sniffing

Input Capture

Traffic Signaling

Scheduled Task/Job

Unsecured Credentials

Password Policy Discovery

Screen Capture

Web Service

Server Software Component

Peripheral Device Discovery

Video Capture

Traffic Signaling

Permission Groups Discovery

Valid Accounts

Process Discovery

Query Registry

Remote System Discovery

Software Discovery

System Information Discovery

System Location Discovery

System Network Configuration Discovery

System Network Connections Discovery

System Owner/User Discovery

System Service Discovery

System Time Discovery

Virtualization/Sandbox Evasion