detection.wiki

ATT&CK Detection Rule Coverage

16035 detection rules mapped to 655 MITRE ATT&CK techniques and sub-techniques. Click a technique to see every rule written for it, grouped by vendor for easy comparison. Use the vendor chips to show or hide each rule source.

Reconnaissance 8

Active Scanning (3)
Scanning IP Blocks (13) Vulnerability Scanning (16) Wordlist Scanning (9)
Gather Victim Network Information (3)
Domain Properties (2) DNS (2) IP Addresses (4)
Gather Victim Host Information (3)
Hardware (1) Software (1) Client Configurations (5)
Gather Victim Identity Information (3)
Credentials (2) Email Addresses (3) Employee Names (1)
Phishing for Information (1)
Spearphishing Attachment (2)
Gather Victim Org Information (1)
Identify Roles (2)
Search Open Websites/Domains (1)
Code Repositories (2)
Search Open Technical Databases (1)

Resource Development 7

Compromise Accounts (1)
Cloud Accounts (36)
Develop Capabilities (3)
Malware (14) Code Signing Certificates (1) Digital Certificates (1)
Obtain Capabilities (3)
Malware (2) Tool (13) Digital Certificates (1)
Stage Capabilities (3)
Upload Malware (3) Upload Tool (1) Install Digital Certificate (1)
Compromise Infrastructure (2)
Domains (3) DNS Server (1)
Acquire Infrastructure (2)
Domains (1) Web Services (2)
Establish Accounts (1)
Cloud Accounts (1)

Initial Access 10

Valid Accounts (4)
Default Accounts (17) Domain Accounts (35) Local Accounts (23) Cloud Accounts (311)
Exploit Public-Facing Application (549)
Phishing (3)
Spearphishing Attachment (164) Spearphishing Link (78) Spearphishing via Service (2)
External Remote Services (222)
Supply Chain Compromise (2)
Compromise Software Dependencies and Development Tools (21) Compromise Software Supply Chain (56)
Drive-by Compromise (46)
Trusted Relationship (18)
Hardware Additions (15)
Replication Through Removable Media (11)
Content Injection (4)

Execution 17

Command and Scripting Interpreter (12)
PowerShell (551) AppleScript (49) Windows Command Shell (179) Unix Shell (341) Visual Basic (113) Python (88) JavaScript (157) Cloud API (6) AutoHotKey & AutoIT (1) Lua (14) Hypervisor CLI (9) Container CLI/API (1)
User Execution (5)
Malicious Link (31) Malicious File (190) Malicious Image (10) Malicious Copy and Paste (10) Malicious Library (1)
Hijack Execution Flow (12)
DLL (173) Dylib Hijacking (1) Executable Installer File Permissions Weakness (2) Dynamic Linker Hijacking (26) Path Interception by PATH Environment Variable (11) Path Interception by Search Order Hijacking (6) Path Interception by Unquoted Path (4) Services File Permissions Weakness (7) Services Registry Permissions Weakness (17) COR_PROFILER (2) KernelCallbackTable (2) AppDomainManager (1)
Scheduled Task/Job (5)
At (19) Cron (38) Scheduled Task (130) Systemd Timers (6) Container Orchestration Job (4)
Windows Management Instrumentation (140)
Exploitation for Client Execution (129)
System Services (2)
Launchctl (4) Service Execution (87)
Trusted Developer Utilities Proxy Execution (2)
MSBuild (23) ClickOnce (1)
Native API (58)
BITS Jobs (39)
Inter-Process Communication (3)
Component Object Model (19) Dynamic Data Exchange (1) XPC Services (4)
Container Administration Command (36)
Deploy Container (33)
Software Deployment Tools (30)
Cloud Administration Command (27)
Shared Modules (23)
Serverless Execution (17)

Discovery 33

Account Discovery (4)
Local Account (48) Domain Account (104) Email Account (1) Cloud Account (32)
System Information Discovery (167)
Permission Groups Discovery (3)
Local Groups (46) Domain Groups (78) Cloud Groups (13)
Network Service Discovery (101)
Remote System Discovery (86)
System Owner/User Discovery (84)
System Network Configuration Discovery (1)
Internet Connection Discovery (9)
File and Directory Discovery (71)
Domain Trust Discovery (66)
Container and Resource Discovery (54)
Cloud Service Discovery (48)
Software Discovery (1)
Security Software Discovery (21)
Cloud Infrastructure Discovery (42)
System Network Connections Discovery (36)
Process Discovery (36)
Network Share Discovery (36)
Query Registry (34)
Password Policy Discovery (32)
System Service Discovery (25)
Network Sniffing (25)
Virtualization/Sandbox Evasion (2)
System Checks (9) Time Based Checks (4)
Group Policy Discovery (11)
Cloud Storage Object Discovery (7)
System Time Discovery (6)
Browser Information Discovery (6)
System Location Discovery (1)
System Language Discovery (4)
Peripheral Device Discovery (5)
Cloud Service Dashboard (4)
Virtual Machine Discovery (4)
Log Enumeration (3)
Application Window Discovery (2)
Debugger Evasion (2)
Device Driver Discovery (1)

Credential Access 17

OS Credential Dumping (8)
LSASS Memory (176) Security Account Manager (66) NTDS (60) LSA Secrets (26) Cached Domain Credentials (19) DCSync (26) Proc Filesystem (9) /etc/passwd and /etc/shadow (17)
Brute Force (4)
Password Guessing (48) Password Cracking (3) Password Spraying (85) Credential Stuffing (32)
Unsecured Credentials (8)
Credentials In Files (103) Credentials in Registry (10) Shell History (4) Private Keys (31) Cloud Instance Metadata API (18) Group Policy Preferences (10) Container API (33) Chat Messages (2)
Modify Authentication Process (7)
Password Filter DLL (6) Pluggable Authentication Modules (6) Network Device Authentication (2) Multi-Factor Authentication (33) Hybrid Identity (6) Network Provider DLL (1) Conditional Access Policies (14)
Credentials from Password Stores (5)
Keychain (20) Credentials from Web Browsers (32) Windows Credential Manager (27) Password Managers (4) Cloud Secrets Management Stores (8)
Steal or Forge Kerberos Tickets (5)
Golden Ticket (14) Silver Ticket (7) Kerberoasting (44) AS-REP Roasting (10) Ccache Files (4)
Steal Application Access Token (80)
Adversary-in-the-Middle (3)
Name Resolution Poisoning and SMB Relay (28) ARP Cache Poisoning (3) DHCP Spoofing (2)
Input Capture (3)
Keylogging (17) GUI Input Capture (9) Credential API Hooking (3)
Steal Web Session Cookie (34)
Steal or Forge Authentication Certificates (34)
Multi-Factor Authentication Request Generation (31)
Forced Authentication (30)
Network Sniffing (25)
Exploitation for Credential Access (23)
Forge Web Credentials (2)
Web Cookies (1) SAML Tokens (2)
Multi-Factor Authentication Interception (4)

Privilege Escalation 13

Valid Accounts (4)
Default Accounts (17) Domain Accounts (35) Local Accounts (23) Cloud Accounts (311)
Account Manipulation (7)
Additional Cloud Credentials (59) Additional Email Delegate Permissions (8) Additional Cloud Roles (111) SSH Authorized Keys (13) Device Registration (27) Additional Container Cluster Roles (23) Additional Local or Domain Groups (9)
Abuse Elevation Control Mechanism (6)
Setuid and Setgid (44) Bypass User Account Control (137) Sudo and Sudo Caching (60) Elevated Execution with Prompt (3) Temporary Elevated Cloud Access (7) TCC Manipulation (7)
Process Injection (9)
Dynamic-link Library Injection (20) Portable Executable Injection (7) Thread Execution Hijacking (4) Asynchronous Procedure Call (4) Ptrace System Calls (4) Proc Memory (15) Extra Window Memory Injection (1) Process Hollowing (11) Process Doppelgänging (2)
Boot or Logon Autostart Execution (13)
Registry Run Keys / Startup Folder (115) Authentication Package (9) Time Providers (3) Winlogon Helper DLL (9) Security Support Provider (8) Kernel Modules and Extensions (37) LSASS Driver (4) Shortcut Modification (15) Port Monitors (11) Print Processors (8) XDG Autostart Entries (5) Active Setup (4) Login Items (2)
Create or Modify System Process (5)
Launch Agent (15) Systemd Service (20) Windows Service (134) Launch Daemon (11) Container Service (2)
Event Triggered Execution (17)
Change Default File Association (8) Screensaver (9) Windows Management Instrumentation Event Subscription (24) Unix Shell Configuration Modification (17) Trap (1) Netsh Helper DLL (7) Accessibility Features (22) AppCert DLLs (6) AppInit DLLs (3) Application Shimming (11) Image File Execution Options Injection (12) PowerShell Profile (4) Emond (4) Component Object Model Hijacking (27) Installer Packages (15) Udev Rules (3) Python Startup Hooks (2)
Exploitation for Privilege Escalation (231)
Scheduled Task/Job (5)
At (19) Cron (38) Scheduled Task (130) Systemd Timers (6) Container Orchestration Job (4)
Access Token Manipulation (5)
Token Impersonation/Theft (31) Create Process with Token (30) Make and Impersonate Token (8) Parent PID Spoofing (12) SID-History Injection (6)
Domain or Tenant Policy Modification (2)
Group Policy Modification (29) Trust Modification (17)
Escape to Host (62)
Boot or Logon Initialization Scripts (4)
Logon Script (Windows) (7) Login Hook (3) RC Scripts (12) Startup Items (3)

Lateral Movement 9

Remote Services (8)
Remote Desktop Protocol (82) SMB/Windows Admin Shares (122) Distributed Component Object Model (48) SSH (46) VNC (4) Windows Remote Management (38) Cloud Services (19) Direct Cloud VM Connections (5)
Use Alternate Authentication Material (4)
Application Access Token (60) Pass the Hash (16) Pass the Ticket (14) Web Session Cookie (8)
Exploitation of Remote Services (83)
Lateral Tool Transfer (47)
Software Deployment Tools (30)
Remote Service Session Hijacking (2)
SSH Hijacking (10) RDP Hijacking (8)
Replication Through Removable Media (11)
Taint Shared Content (4)
Internal Spearphishing (4)

Persistence 21

Valid Accounts (4)
Default Accounts (17) Domain Accounts (35) Local Accounts (23) Cloud Accounts (311)
Account Manipulation (7)
Additional Cloud Credentials (59) Additional Email Delegate Permissions (8) Additional Cloud Roles (111) SSH Authorized Keys (13) Device Registration (27) Additional Container Cluster Roles (23) Additional Local or Domain Groups (9)
Modify Registry (307)
Boot or Logon Autostart Execution (13)
Registry Run Keys / Startup Folder (115) Authentication Package (9) Time Providers (3) Winlogon Helper DLL (9) Security Support Provider (8) Kernel Modules and Extensions (37) LSASS Driver (4) Shortcut Modification (15) Port Monitors (11) Print Processors (8) XDG Autostart Entries (5) Active Setup (4) Login Items (2)
Create or Modify System Process (5)
Launch Agent (15) Systemd Service (20) Windows Service (134) Launch Daemon (11) Container Service (2)
Event Triggered Execution (17)
Change Default File Association (8) Screensaver (9) Windows Management Instrumentation Event Subscription (24) Unix Shell Configuration Modification (17) Trap (1) Netsh Helper DLL (7) Accessibility Features (22) AppCert DLLs (6) AppInit DLLs (3) Application Shimming (11) Image File Execution Options Injection (12) PowerShell Profile (4) Emond (4) Component Object Model Hijacking (27) Installer Packages (15) Udev Rules (3) Python Startup Hooks (2)
Scheduled Task/Job (5)
At (19) Cron (38) Scheduled Task (130) Systemd Timers (6) Container Orchestration Job (4)
External Remote Services (222)
Create Account (3)
Local Account (48) Domain Account (18) Cloud Account (56)
Modify Authentication Process (7)
Password Filter DLL (6) Pluggable Authentication Modules (6) Network Device Authentication (2) Multi-Factor Authentication (33) Hybrid Identity (6) Network Provider DLL (1) Conditional Access Policies (14)
Server Software Component (6)
SQL Stored Procedures (20) Transport Agent (8) Web Shell (86) IIS Components (22) Terminal Services DLL (1) vSphere Installation Bundles (1)
Boot or Logon Initialization Scripts (4)
Logon Script (Windows) (7) Login Hook (3) RC Scripts (12) Startup Items (3)
BITS Jobs (39)
Compromise Host Software Binary (39)
Office Application Startup (6)
Office Template Macros (2) Office Test (3) Outlook Forms (1) Outlook Home Page (2) Outlook Rules (3) Add-ins (8)
Pre-OS Boot (3)
System Firmware (6) Bootkit (5) TFTP Boot (1)
Software Extensions (1)
Browser Extensions (10)
Implant Internal Image (5)
Redundant Access (3)
Traffic Signaling (1)
Port Knocking (1)
Power Settings (1)

Stealth 28

Valid Accounts (4)
Default Accounts (17) Domain Accounts (35) Local Accounts (23) Cloud Accounts (311)
System Binary Proxy Execution (13)
Compiled HTML File (27) Control Panel (14) CMSTP (27) InstallUtil (22) Mshta (79) Msiexec (69) Odbcconf (18) Regsvcs/Regasm (21) Regsvr32 (69) Rundll32 (152) Verclsid (1) Mavinject (3) MMC (25)
Process Injection (9)
Dynamic-link Library Injection (20) Portable Executable Injection (7) Thread Execution Hijacking (4) Asynchronous Procedure Call (4) Ptrace System Calls (4) Proc Memory (15) Extra Window Memory Injection (1) Process Hollowing (11) Process Doppelgänging (2)
Hijack Execution Flow (12)
DLL (173) Dylib Hijacking (1) Executable Installer File Permissions Weakness (2) Dynamic Linker Hijacking (26) Path Interception by PATH Environment Variable (11) Path Interception by Search Order Hijacking (6) Path Interception by Unquoted Path (4) Services File Permissions Weakness (7) Services Registry Permissions Weakness (17) COR_PROFILER (2) KernelCallbackTable (2) AppDomainManager (1)
Masquerading (9)
Invalid Code Signature (19) Right-to-Left Override (7) Rename Legitimate Utilities (60) Masquerade Task or Service (20) Match Legitimate Resource Name or Location (69) Space after Filename (3) Double File Extension (8) Masquerade File Type (9) Break Process Trees (7)
Obfuscated Files or Information (11)
Binary Padding (11) Software Packing (2) Steganography (5) Compile After Delivery (15) Indicator Removal from Tools (6) HTML Smuggling (2) Embedded Payloads (3) Command Obfuscation (40) Fileless Storage (4) Encrypted/Encoded File (9) Compression (3)
Indicator Removal (6)
Clear Command History (21) File Deletion (59) Network Share Connection Removal (6) Timestomp (17) Clear Mailbox Data (10) Clear Persistence (2)
Hide Artifacts (6)
Hidden Files and Directories (39) Hidden Users (11) Hidden Window (18) NTFS File Attributes (35) Run Virtual Instance (10) Email Hiding Rules (9)
Deobfuscate/Decode Files or Information (102)
Access Token Manipulation (5)
Token Impersonation/Theft (31) Create Process with Token (30) Make and Impersonate Token (8) Parent PID Spoofing (12) SID-History Injection (6)
Indirect Command Execution (71)
Trusted Developer Utilities Proxy Execution (2)
MSBuild (23) ClickOnce (1)
Reflective Code Loading (44)
BITS Jobs (39)
Rootkit (37)
Exploitation for Stealth (27)
System Script Proxy Execution (1)
PubPrn (3)
Virtualization/Sandbox Evasion (2)
System Checks (9) Time Based Checks (4)
XSL Script Processing (20)
Pre-OS Boot (3)
System Firmware (6) Bootkit (5) TFTP Boot (1)
Unused/Unsupported Cloud Regions (10)
Direct Volume Access (8)
Redundant Access (3)
Template Injection (2)
Execution Guardrails (2)
Debugger Evasion (2)
Traffic Signaling (1)
Port Knocking (1)
Social Engineering (1)
Impersonation (1)

Defense Impairment 17

Disable or Modify Tools (5)
Disable or Modify Windows Event Log (53) Disable or Modify Cloud Log (91) Disable or Modify Linux Audit System Log (4) Clear Windows Event Logs (28) Clear Linux or Mac System Logs (13)
Modify Registry (307)
Modify Authentication Process (7)
Password Filter DLL (6) Pluggable Authentication Modules (6) Network Device Authentication (2) Multi-Factor Authentication (33) Hybrid Identity (6) Network Provider DLL (1) Conditional Access Policies (14)
Disable or Modify System Firewall (3)
Cloud Firewall (66) Network Device Firewall (2) Windows Host Firewall (20)
Domain or Tenant Policy Modification (2)
Group Policy Modification (29) Trust Modification (17)
File and Directory Permissions Modification (2)
Windows Permissions (45) Linux and Mac Permissions (23)
Subvert Trust Controls (6)
Gatekeeper Bypass (13) Code Signing (6) SIP and Trust Provider Hijacking (7) Install Root Certificate (17) Mark-of-the-Web Bypass (14) Code Signing Policy Modification (2)
Modify Cloud Compute Infrastructure (5)
Create Snapshot (1) Create Cloud Instance (5) Delete Cloud Instance (2) Revert Cloud Instance (1) Modify Cloud Compute Configurations (19)
Plist File Modification (14)
Rogue Domain Controller (13)
Network Boundary Bridging (1)
Network Address Translation Traversal (1)
Downgrade Attack (7)
Prevent Command History Logging (4)
Weaken Encryption (1)
Reduce Key Space (2)
Modify System Image (1)
Patch System Image (2)
Modify Cloud Resource Hierarchy (1)
Safe Mode Boot (1)

Collection 16

Data from Cloud Storage (83)
Data from Local System (77)
Email Collection (3)
Local Email Collection (14) Remote Email Collection (19) Email Forwarding Rule (16)
Adversary-in-the-Middle (3)
Name Resolution Poisoning and SMB Relay (28) ARP Cache Poisoning (3) DHCP Spoofing (2)
Data from Information Repositories (3)
Sharepoint (4) Code Repositories (14) Databases (3)
Archive Collected Data (3)
Archive via Utility (35) Archive via Library (3) Archive via Custom Method (1)
Data Staged (2)
Local Data Staging (27) Remote Data Staging (4)
Automated Collection (41)
Input Capture (3)
Keylogging (17) GUI Input Capture (9) Credential API Hooking (3)
Screen Capture (27)
Clipboard Data (21)
Browser Session Hijacking (17)
Data from Network Shared Drive (15)
Audio Capture (11)
Video Capture (10)
Data from Removable Media (5)

Command & Control 15

Application Layer Protocol (4)
Web Protocols (126) File Transfer Protocols (8) Mail Protocols (7) DNS (63)
Ingress Tool Transfer (339)
Remote Access Tools (1)
Remote Desktop Software (53)
Protocol Tunneling (96)
Proxy (4)
Internal Proxy (10) External Proxy (9) Multi-hop Proxy (13) Domain Fronting (1)
Web Service (3)
Dead Drop Resolver (9) Bidirectional Communication (22) One-Way Communication (4)
Non-Application Layer Protocol (46)
Dynamic Resolution (2)
Fast Flux DNS (1) Domain Generation Algorithms (15)
Encrypted Channel (1)
Asymmetric Cryptography (9)
Non-Standard Port (26)
Fallback Channels (17)
Data Encoding (1)
Standard Encoding (7)
Data Obfuscation (1)
Protocol or Service Impersonation (3)
Content Injection (4)
Traffic Signaling (1)
Port Knocking (1)

Exfiltration 9

Exfiltration Over Web Service (4)
Exfiltration to Code Repository (12) Exfiltration to Cloud Storage (46) Exfiltration to Text Storage Sites (4) Exfiltration Over Webhook (1)
Exfiltration Over Alternative Protocol (3)
Exfiltration Over Symmetric Encrypted Non-C2 Protocol (2) Exfiltration Over Asymmetric Encrypted Non-C2 Protocol (4) Exfiltration Over Unencrypted Non-C2 Protocol (33)
Exfiltration Over C2 Channel (82)
Transfer Data to Cloud Account (56)
Automated Exfiltration (1)
Traffic Duplication (1)
Data Transfer Size Limits (27)
Exfiltration Over Physical Medium (1)
Exfiltration over USB (4)
Exfiltration Over Other Network Medium (1)
Exfiltration Over Bluetooth (1)
Scheduled Transfer (3)

Impact 14

Data Destruction (1)
Lifecycle-Triggered Deletion (5)
Inhibit System Recovery (115)
Data Encrypted for Impact (86)
Service Stop (85)
Data Manipulation (2)
Stored Data Manipulation (28) Transmitted Data Manipulation (3)
Account Access Removal (66)
Resource Hijacking (2)
Compute Hijacking (2) Cloud Service Hijacking (5)
Network Denial of Service (2)
Direct Network Flood (1) Reflection Amplification (1)
Endpoint Denial of Service (4)
OS Exhaustion Flood (1) Service Exhaustion Flood (3) Application Exhaustion Flood (2) Application or System Exploitation (4)
System Shutdown/Reboot (35)
Defacement (2)
Internal Defacement (4) External Defacement (1)
Disk Wipe (2)
Disk Content Wipe (2) Disk Structure Wipe (3)
Financial Theft (3)
Firmware Corruption (2)

MITRE ATT&CK Mobile

Network Effects 0

No techniques tracked.

Remote Service Effects 0

No techniques tracked.

Initial Access 3

Supply Chain Compromise (2)
Drive-By Compromise (1)
Phishing (1)

Execution 1

Command and Scripting Interpreter (1)

Persistence 3

Foreground Persistence (1)
Event Triggered Execution (1)
Hijack Execution Flow (1)

Privilege Escalation 3

Abuse Elevation Control Mechanism (2)
Exploitation for Privilege Escalation (1)
Process Injection (1)

Defense Evasion 11

Impair Defenses (7)
Indicator Removal on Host (2)
Obfuscated Files or Information (1)
Input Injection (1)
Foreground Persistence (1)
Hooking (1)
Execution Guardrails (1)
Hide Artifacts (1)
Process Injection (1)
Virtualization/Sandbox Evasion (1)
Masquerading (1)

Credential Access 5

Input Capture (2)
Steal Application Access Token (2)
Clipboard Data (1)
Access Notifications (1)
Credentials from Password Store (1)

Discovery 5

Software Discovery (3)
Process Discovery (2)
System Network Configuration Discovery (1)
Network Service Scanning (1)
Location Tracking (1)

Lateral Movement 1

Exploitation of Remote Services (1)

Collection 12

Input Capture (2)
Protected User Data (1)
Contact List (1)
Stored Application Data (1)
Clipboard Data (1)
Audio Capture (1)
Location Tracking (1)
Video Capture (1)
Screen Capture (1)
Access Notifications (1)
Archive Collected Data (1)
Call Control (1)
Adversary-in-the-Middle (1)

Command and Control 4

Web Service (1)
Non-Standard Port (1)
Ingress Tool Transfer (1)
Call Control (1)

Exfiltration 1

Exfiltration Over Alternative Protocol (1)

Impact 8

Data Manipulation (2)
Data Encrypted for Impact (1)
Input Injection (1)
SMS Control (1)
Call Control (1)
Account Access Removal (1)
Endpoint Denial of Service (1)
Generate Traffic from Victim (1)

MITRE ATT&CK ICS

Initial Access 8

Spearphishing Attachment (5)
Exploitation of Remote Services (5)
Remote Services (4)
Exploit Public-Facing Application (3)
External Remote Services (1)
Rogue Master (1)
Supply Chain Compromise (1)
Internet Accessible Device (1)

Execution 5

Scripting (7)
Execution through API (5)
Change Operating Mode (4)
User Execution (4)
Native API (1)

Persistence 5

Valid Accounts (7)
Project File Infection (3)
System Firmware (2)
Module Firmware (1)
Modify Program (1)

Privilege Escalation 1

Exploitation for Privilege Escalation (4)

Evasion 2

Change Operating Mode (4)
Rootkit (1)

Discovery 4

Network Sniffing (4)
Network Connection Enumeration (1)
Remote System Discovery (1)
Remote System Information Discovery (1)

Lateral Movement 4

Valid Accounts (7)
Exploitation of Remote Services (5)
Remote Services (4)
Program Download (2)

Collection 1

Program Upload (1)

Command and Control 2

Connection Proxy (1)
Commonly Used Port (1)

Inhibit Response Function 5

System Firmware (2)
Denial of Service (1)
Device Restart/Shutdown (1)
Rootkit (1)
Service Stop (1)

Impair Process Control 4

Unauthorized Command Message (3)
Brute Force I/O (1)
Modify Parameter (1)
Module Firmware (1)

Impact 8

Loss of Availability (4)
Denial of Control (3)
Loss of Control (2)
Loss of Productivity and Revenue (2)
Theft of Operational Information (2)
Manipulation of Control (1)
Loss of Protection (1)
Damage to Property (1)