linux-matrix.md

Linux Atomic Tests by ATT&CK Tactic & Technique

initial-access	execution	persistence	privilege-escalation	defense-evasion	credential-access	discovery	lateral-movement	collection	exfiltration	command-and-control
Drive-by Compromise CONTRIBUTE A TEST	Command-Line Interface	.bash_profile and .bashrc	Exploitation for Privilege Escalation CONTRIBUTE A TEST	Binary Padding CONTRIBUTE A TEST	Bash History	Account Discovery	Application Deployment Software CONTRIBUTE A TEST	Audio Capture	Automated Exfiltration CONTRIBUTE A TEST	Commonly Used Port CONTRIBUTE A TEST
Exploit Public-Facing Application CONTRIBUTE A TEST	Exploitation for Client Execution CONTRIBUTE A TEST	Bootkit CONTRIBUTE A TEST	Process Injection	Clear Command History	Brute Force	Browser Bookmark Discovery CONTRIBUTE A TEST	Exploitation of Remote Services CONTRIBUTE A TEST	Automated Collection	Data Compressed	Communication Through Removable Media CONTRIBUTE A TEST
Hardware Additions CONTRIBUTE A TEST	Graphical User Interface CONTRIBUTE A TEST	Browser Extensions	Setuid and Setgid	Disabling Security Tools	Credentials in Files	File and Directory Discovery	Remote File Copy	Clipboard Data	Data Encrypted	Connection Proxy CONTRIBUTE A TEST
Spearphishing Attachment	Local Job Scheduling	Create Account	Sudo	Exploitation for Defense Evasion CONTRIBUTE A TEST	Exploitation for Credential Access CONTRIBUTE A TEST	Network Service Scanning	Remote Services CONTRIBUTE A TEST	Data Staged	Data Transfer Size Limits	Custom Command and Control Protocol CONTRIBUTE A TEST
Spearphishing Link CONTRIBUTE A TEST	Scripting CONTRIBUTE A TEST	Hidden Files and Directories	Sudo Caching CONTRIBUTE A TEST	File Deletion	Input Capture	Password Policy Discovery	SSH Hijacking CONTRIBUTE A TEST	Data from Information Repositories CONTRIBUTE A TEST	Exfiltration Over Alternative Protocol	Custom Cryptographic Protocol CONTRIBUTE A TEST
Spearphishing via Service CONTRIBUTE A TEST	Source CONTRIBUTE A TEST	Kernel Modules and Extensions CONTRIBUTE A TEST	Valid Accounts CONTRIBUTE A TEST	HISTCONTROL	Network Sniffing	Permission Groups Discovery	Third-party Software CONTRIBUTE A TEST	Data from Local System CONTRIBUTE A TEST	Exfiltration Over Command and Control Channel CONTRIBUTE A TEST	Data Encoding
Supply Chain Compromise CONTRIBUTE A TEST	Space after Filename	Local Job Scheduling	Web Shell CONTRIBUTE A TEST	Hidden Files and Directories	Private Keys	Process Discovery		Data from Network Shared Drive CONTRIBUTE A TEST	Exfiltration Over Other Network Medium CONTRIBUTE A TEST	Data Obfuscation CONTRIBUTE A TEST
Trusted Relationship CONTRIBUTE A TEST	Third-party Software CONTRIBUTE A TEST	Port Knocking CONTRIBUTE A TEST		Indicator Removal from Tools CONTRIBUTE A TEST	Two-Factor Authentication Interception CONTRIBUTE A TEST	Remote System Discovery		Data from Removable Media CONTRIBUTE A TEST	Exfiltration Over Physical Medium CONTRIBUTE A TEST	Domain Fronting CONTRIBUTE A TEST
Valid Accounts CONTRIBUTE A TEST	Trap	Redundant Access CONTRIBUTE A TEST		Indicator Removal on Host		System Information Discovery		Input Capture	Scheduled Transfer CONTRIBUTE A TEST	Fallback Channels CONTRIBUTE A TEST
	User Execution CONTRIBUTE A TEST	Trap		Install Root Certificate		System Network Configuration Discovery		Screen Capture		Multi-Stage Channels CONTRIBUTE A TEST
		Valid Accounts CONTRIBUTE A TEST		Masquerading CONTRIBUTE A TEST		System Network Connections Discovery				Multi-hop Proxy CONTRIBUTE A TEST
		Web Shell CONTRIBUTE A TEST		Obfuscated Files or Information CONTRIBUTE A TEST		System Owner/User Discovery				Multiband Communication CONTRIBUTE A TEST
				Port Knocking CONTRIBUTE A TEST						Multilayer Encryption CONTRIBUTE A TEST
				Process Injection						Port Knocking CONTRIBUTE A TEST
				Redundant Access CONTRIBUTE A TEST						Remote Access Tools CONTRIBUTE A TEST
				Rootkit						Remote File Copy
				Scripting CONTRIBUTE A TEST						Standard Application Layer Protocol CONTRIBUTE A TEST
				Space after Filename						Standard Cryptographic Protocol CONTRIBUTE A TEST
				Timestomp						Standard Non-Application Layer Protocol CONTRIBUTE A TEST
				Valid Accounts CONTRIBUTE A TEST						Uncommonly Used Port
				Web Service CONTRIBUTE A TEST						Web Service CONTRIBUTE A TEST