| Valid Accounts | Command-Line Interface1 | Hidden Files and Directories2 | Process Injection1 | Masquerading1 | Credential Dumping | Process Discovery1 | Application Deployment Software | Data from Local System | Data Compressed | Uncommonly Used Port1 | Eavesdrop on Insecure Network Communication | Remotely Track Device Without Authorization | Modify System Partition |
| Replication Through Removable Media | Scripting11 | LC_LOAD_DYLIB Addition1 | Plist Modification2 | Hidden Files and Directories2 | Network Sniffing | Account Discovery2 | Remote Services | Data from Removable Media | Exfiltration Over Other Network Medium | Standard Cryptographic Protocol2 | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Device Lockout |
| External Remote Services | Windows Management Instrumentation | Plist Modification2 | Path Interception | Process Injection1 | Input Capture | File and Directory Discovery1 | Windows Remote Management | Data from Network Shared Drive | Automated Exfiltration | Standard Non-Application Layer Protocol1 | Exploit SS7 to Track Device Location | Obtain Device Cloud Backups | Delete Device Data |
| Drive-by Compromise | Scheduled Task | System Firmware | DLL Search Order Hijacking | Scripting11 | Credentials in Files | System Information Discovery71 | Logon Scripts | Input Capture | Data Encrypted | Standard Application Layer Protocol2 | SIM Card Swap | | Premium SMS Toll Fraud |
| Exploit Public-Facing Application | Command-Line Interface | Shortcut Modification | File System Permissions Weakness | File Deletion1 | Account Manipulation | Remote System Discovery | Shared Webroot | Data Staged | Scheduled Transfer | Standard Cryptographic Protocol | Manipulate Device Communication | | Manipulate App Store Rankings or Ratings |
| Spearphishing Link | Graphical User Interface | Modify Existing Service | New Service | Code Signing2 | Brute Force | System Owner/User Discovery | Third-party Software | Screen Capture | Data Transfer Size Limits | Commonly Used Port | Jamming or Denial of Service | | Abuse Accessibility Features |
| Spearphishing Attachment | Scripting | Path Interception | Scheduled Task | Plist Modification2 | Two-Factor Authentication Interception | Network Sniffing | Pass the Hash | Email Collection | Exfiltration Over Command and Control Channel | Uncommonly Used Port | Rogue Wi-Fi Access Points | | Data Encrypted for Impact |