macos-matrix.md

macOS Atomic Tests by ATT&CK Tactic & Technique

initial-access	execution	persistence	privilege-escalation	defense-evasion	credential-access	discovery	lateral-movement	collection	exfiltration	command-and-control
Drive-by Compromise CONTRIBUTE A TEST	AppleScript	.bash_profile and .bashrc	Dylib Hijacking CONTRIBUTE A TEST	Binary Padding CONTRIBUTE A TEST	Bash History	Account Discovery	AppleScript	Audio Capture	Automated Exfiltration CONTRIBUTE A TEST	Commonly Used Port CONTRIBUTE A TEST
Exploit Public-Facing Application CONTRIBUTE A TEST	Command-Line Interface	Browser Extensions	Exploitation for Privilege Escalation CONTRIBUTE A TEST	Clear Command History	Brute Force	Application Window Discovery CONTRIBUTE A TEST	Application Deployment Software CONTRIBUTE A TEST	Automated Collection	Data Compressed	Communication Through Removable Media CONTRIBUTE A TEST
Hardware Additions CONTRIBUTE A TEST	Exploitation for Client Execution CONTRIBUTE A TEST	Create Account	Launch Daemon	Code Signing CONTRIBUTE A TEST	Credentials in Files	Browser Bookmark Discovery CONTRIBUTE A TEST	Exploitation of Remote Services CONTRIBUTE A TEST	Clipboard Data	Data Encrypted	Connection Proxy CONTRIBUTE A TEST
Spearphishing Attachment CONTRIBUTE A TEST	Graphical User Interface CONTRIBUTE A TEST	Dylib Hijacking CONTRIBUTE A TEST	Plist Modification	Disabling Security Tools	Exploitation for Credential Access CONTRIBUTE A TEST	File and Directory Discovery	Logon Scripts	Data Staged	Data Transfer Size Limits	Custom Command and Control Protocol CONTRIBUTE A TEST
Spearphishing Link CONTRIBUTE A TEST	Launchctl	Hidden Files and Directories	Process Injection	Exploitation for Defense Evasion CONTRIBUTE A TEST	Input Capture	Network Service Scanning	Remote File Copy	Data from Information Repositories CONTRIBUTE A TEST	Exfiltration Over Alternative Protocol	Custom Cryptographic Protocol CONTRIBUTE A TEST
Spearphishing via Service CONTRIBUTE A TEST	Local Job Scheduling	Kernel Modules and Extensions CONTRIBUTE A TEST	Setuid and Setgid	File Deletion	Input Prompt	Network Share Discovery	Remote Services CONTRIBUTE A TEST	Data from Local System CONTRIBUTE A TEST	Exfiltration Over Command and Control Channel CONTRIBUTE A TEST	Data Encoding CONTRIBUTE A TEST
Supply Chain Compromise CONTRIBUTE A TEST	Scripting CONTRIBUTE A TEST	LC_LOAD_DYLIB Addition CONTRIBUTE A TEST	Startup Items	Gatekeeper Bypass	Keychain	Password Policy Discovery	SSH Hijacking CONTRIBUTE A TEST	Data from Network Shared Drive CONTRIBUTE A TEST	Exfiltration Over Other Network Medium CONTRIBUTE A TEST	Data Obfuscation CONTRIBUTE A TEST
Trusted Relationship CONTRIBUTE A TEST	Source CONTRIBUTE A TEST	Launch Agent	Sudo CONTRIBUTE A TEST	HISTCONTROL	Network Sniffing	Permission Groups Discovery	Third-party Software CONTRIBUTE A TEST	Data from Removable Media CONTRIBUTE A TEST	Exfiltration Over Physical Medium CONTRIBUTE A TEST	Domain Fronting CONTRIBUTE A TEST
Valid Accounts CONTRIBUTE A TEST	Space after Filename	Launch Daemon	Sudo Caching CONTRIBUTE A TEST	Hidden Files and Directories	Private Keys	Process Discovery		Input Capture	Scheduled Transfer CONTRIBUTE A TEST	Fallback Channels CONTRIBUTE A TEST
	Third-party Software CONTRIBUTE A TEST	Launchctl	Valid Accounts CONTRIBUTE A TEST	Hidden Users	Securityd Memory CONTRIBUTE A TEST	Remote System Discovery		Screen Capture		Multi-Stage Channels CONTRIBUTE A TEST
	Trap	Local Job Scheduling	Web Shell CONTRIBUTE A TEST	Hidden Window CONTRIBUTE A TEST	Two-Factor Authentication Interception CONTRIBUTE A TEST	Security Software Discovery		Video Capture CONTRIBUTE A TEST		Multi-hop Proxy CONTRIBUTE A TEST
	User Execution CONTRIBUTE A TEST	Login Item CONTRIBUTE A TEST		Indicator Removal from Tools CONTRIBUTE A TEST		System Information Discovery				Multiband Communication CONTRIBUTE A TEST
		Logon Scripts		Indicator Removal on Host		System Network Configuration Discovery				Multilayer Encryption CONTRIBUTE A TEST
		Plist Modification		Install Root Certificate		System Network Connections Discovery CONTRIBUTE A TEST				Port Knocking CONTRIBUTE A TEST
		Port Knocking CONTRIBUTE A TEST		LC_MAIN Hijacking CONTRIBUTE A TEST		System Owner/User Discovery				Remote Access Tools CONTRIBUTE A TEST
		Rc.common		Launchctl						Remote File Copy
		Re-opened Applications		Masquerading CONTRIBUTE A TEST						Standard Application Layer Protocol CONTRIBUTE A TEST
		Redundant Access CONTRIBUTE A TEST		Obfuscated Files or Information CONTRIBUTE A TEST						Standard Cryptographic Protocol CONTRIBUTE A TEST
		Startup Items		Plist Modification						Standard Non-Application Layer Protocol CONTRIBUTE A TEST
		Trap		Port Knocking CONTRIBUTE A TEST						Uncommonly Used Port
		Valid Accounts CONTRIBUTE A TEST		Process Injection						Web Service CONTRIBUTE A TEST
		Web Shell CONTRIBUTE A TEST		Redundant Access CONTRIBUTE A TEST
				Rootkit
				Scripting CONTRIBUTE A TEST
				Space after Filename
				Valid Accounts CONTRIBUTE A TEST
				Web Service CONTRIBUTE A TEST