| Winlogon Helper DLL |
T1004 |
| Port Monitors |
T1013 |
| Accessibility Features |
T1015 |
| Shortcut Modification |
T1023 |
| Modify Existing Service |
T1031 |
| DLL Search Order Hijacking |
T1038 |
| Change Default File Association |
T1042 |
| New Service |
T1050 |
| Scheduled Tasks |
T1053 |
| Service Registry Permission Weakness |
T1058 |
| Registry Run Keys |
T1060 |
| WMI Event Subscription |
T1084 |
| Security Support Provider |
T1101 |
| AppInit DLLs |
T1103 |
| Component Object Model Hijacking |
T1122 |
| Netsh Helper DLL |
T1128 |
| Office Application Startup |
T1137 |
| Application Shimming |
T1138 |
| Screensaver |
T1180 |
| Image File Execution Options Injection |
T1183 |
| BITS Jobs |
T1197 |
| Time Providers |
T1209 |
| PowerShell Profile |
T1504 |
| Waitfor |
N/A |
| RID Hijacking |
N/A |
| AMSI |
N/A |
| Print Spooler |
N/A |
| Certificates |
N/A |
| Notepad++ |
N/A |
| Event Log |
N/A |
| DLL Proxy Loading |
N/A |