MITRE ATT&CK Integration for LinPEAS and WinPEAS (#614)

* feat: MITRE ATT&CK integration for LinPEAS and WinPEAS

- Add -T T1234,T5678 flag to LinPEAS to filter checks by technique
- Add mitre=T1234,T5678 argument to WinPEAS for technique-based filtering
- Annotate every check title with MITRE technique ID(s) displayed in grey
- Add $_mitre_tag to Generated Global Variables in 0_variables_base.sh
- Add check_mitre_filter() shell function with prefix-match support
- Add MitreAttackIds property to ISystemCheck interface (C#)
- Update MainPrint/GreatPrint in Beaprint.cs to accept optional mitreIds
- Tag all 158 LinPEAS check modules with # Mitre: metadata
- Tag all 16 WinPEAS check classes with MitreAttackIds property
- Update linpeasModule.py to parse # Mitre: metadata field
- Update linpeasBaseBuilder.py to emit check_mitre_filter wrappers
- Add 3 MITRE argument parsing tests to ArgumentParsingTests.cs

* test: add MITRE filter coverage for LinPEAS builder and WinPEAS

LinPEAS (test_builder.py):
- test_mitre_flag_present_in_getopts: -T: must appear in getopts string
- test_mitre_flag_present_in_help_text: -T must appear in built help text
- test_mitre_filter_function_present: check_mitre_filter() must be in built script

WinPEAS (ArgumentParsingTests.cs):
- PassesMitreFilter_EmptyFilter_AllChecksPass: no filter -> all checks run
- PassesMitreFilter_ExactMatch_Passes: T1082 filter matches T1082 check
- PassesMitreFilter_NoMatch_Fails: T1082 filter rejects T1057 check
- PassesMitreFilter_PrefixMatch_Passes: T1552 filter matches T1552.001/T1552.005
- PassesMitreFilter_SubtechniqueDoesNotMatchDifferentBase_Fails: T1548 != T1552.001

* chore: ignore .github/instructions/ and untrack todos.instructions.md

* fix: complete and accurate MITRE ATT&CK mappings for LinPEAS and WinPEAS

gitignore:
- Add .github/instructions/ to .gitignore and untrack todos.instructions.md

LinPEAS — corrected mappings:
- 29_Interesting_environment_variables.sh: add missing T1552.007,T1082
- 3_USBCreator.sh: T1548 → T1548.003,T1068 (polkit bypass + CVE-class exploit)
- 9_Doas.sh: T1548 → T1548.003 (doas is a sudo/sudo-caching equivalent)
- 10_Pkexec.sh: T1548 → T1548.003,T1548.004,T1068 per-section specificity
- 2_Process_cred_in_memory.sh: T1003,T1055 → T1003.007 (Proc Filesystem, drop wrong T1055)
- 11_Superusers.sh: T1087.001,T1548 → T1087.001 (discovery only, no elevation abuse)
- 14/15/16 writable files: T1574 → T1574.009,T1574.010 (specific sub-techniques)

WinPEAS — corrected mappings:
- SystemInfo: class expanded to full technique union; WSUS T1195→T1072,T1068;
  KrbRelayUp T1558→T1187,T1558; Object Manager T1548→T1068;
  Named Pipes T1559.001→T1559; Low-priv pipes T1559.001→T1134.001,T1559
- EventsInfo: class expanded with T1078.003,T1552.001,T1059.001,T1082
- UserInfo: class expanded; Token privileges T1134→T1134.001
- ProcessInfo: Leaked Handlers T1134.003→T1134.001 (token impersonation, not make-token)
- ServicesInfo: class adds T1574.011,T1068
- ApplicationsInfo: class adds T1010,T1014
- NetworkInfo: class adds T1018,T1090
- ActiveDirectoryInfo: T1484→T1484.001; class adds T1003
- WindowsCreds: class sub-techniques T1552→T1552.001,T1552.002, T1555→T1555.003,T1555.004;
  SSClient T1059→T1552.001 (wrong technique entirely)
- FilesInfo: class expanded with T1552.002,T1552.004,T1552.006,T1564.001,T1574.001,
  T1059.004,T1114.001,T1218,T1649; Cloud Credentials T1552.005→T1552.001
- SoapClientInfo: T1059,T1071→T1559,T1071.001 (IPC/Web protocol, not scripting)

* fix: add missing T1613 and T1562.001 to SystemInfo class-level MitreAttackIds; label AD object enumeration with T1087.002 and T1018

* fix: correct linpeas mitre filter matching logic

* fix: MITRE code bugs — pass-through for untagged checks, remove dead OR in section gate

- PassesMitreFilter (Checks.cs): when MitreAttackIds is null or empty and a filter
  is active, return true (pass-through) instead of false.  Previously any future
  ISystemCheck added without MITRE IDs would be silently excluded by an active filter.
- linpeasBaseBuilder.py: remove redundant '|| [ -z "$MITRE_FILTER" ]' from the
  generated section-level gate.  check_mitre_filter already returns 0 immediately
  when MITRE_FILTER is empty, so the OR branch was unreachable and inconsistent with
  the check-level gate which uses the same function without the extra guard.
- ArgumentParsingTests.cs: add PassesMitreFilter_NullMitreAttackIds_PassesThrough
  and PassesMitreFilter_EmptyMitreAttackIds_PassesThrough regression tests.

* fix(mitre): 4 bugs — dead arg parser, wait logic, subprocess forks, cleanup race

Checks.cs: max-regex-file-size used string.Equals which requires exact match,
so 'max-regex-file-size=500000' could never match and MaxRegexFileSize was stuck
at 1000000 forever. Fixed to arg.StartsWith.

Checks.cs RunChecks: wait compared loop index i against
_systemCheckSelectedKeysHashSet.Count, which is 0 when all checks run (so
i < -1 is always false) and semantically wrong when a key subset is selected.
Replaced with a pre-count of checks that pass both filters and a running counter.

0_variables_base.sh check_mitre_filter: replaced two $(echo ... | tr ...)
subprocess forks per call with pure parameter-expansion while-loops. Zero
process forks, POSIX-compliant, ~632 fork()s saved per full filtered run.
Declares _mitre_tags_left and _mitre_filters_left in Generated Global Variables.

linpeas_builder.py: os.remove of the shared temp file raised FileNotFoundError
when multiple sequential builder invocations ran (the second saw the file
already deleted by the first). Wrapped in try/except FileNotFoundError.

Tests: Added PassesMitreFilter_SubtechniqueFilter_DoesNotMatchParentOnlyTag
and MaxRegexFileSize_ArgParsed_Correctly regression tests (16 total).

* ci: add manual build-artifacts workflow (winPEAS.exe + linpeas.sh)

* fix(linpeas): getopts silent mode — clear error when -T given without argument

Switch getopts to silent mode (leading ':') so the shell does not emit its
own terse 'No arg for -T option' message. Add explicit :) case that prints
  ERROR: -T requires an argument (e.g. -T T1082,T1552)
and then dumps the help text before exiting 1. Add *) case for unrecognised
flags with the same pattern. Behaviour for all valid flags is unchanged.

* chore: untrack build-artifacts workflow, add to .gitignore

winPEAS/winPEASexe/Tests/ArgumentParsingTests.cs

@@ -16,6 +16,23 @@ namespace winPEAS.Tests
             return (bool)method.Invoke(null, new object[] { arg });
         }
 
+        private static bool InvokePassesMitreFilter(string[] checkIds)
+        {
+            // Build a minimal ISystemCheck stub whose MitreAttackIds returns checkIds.
+            var stub = new MitreCheckStub(checkIds);
+            var method = typeof(winPEAS.Checks.Checks).GetMethod("PassesMitreFilter", BindingFlags.NonPublic | BindingFlags.Static);
+            Assert.IsNotNull(method, "PassesMitreFilter method not found.");
+            return (bool)method.Invoke(null, new object[] { stub });
+        }
+
+        /// <summary>Minimal ISystemCheck stub for PassesMitreFilter reflection tests.</summary>
+        private sealed class MitreCheckStub : winPEAS.Checks.ISystemCheck
+        {
+            public MitreCheckStub(string[] ids) { MitreAttackIds = ids; }
+            public string[] MitreAttackIds { get; }
+            public void PrintInfo(bool isDebug) { }
+        }
+
         /// <summary>
         /// Resets all public static Checks fields that arg parsing can mutate, then
         /// invokes Program.Main with the supplied args followed by "--help" so execution
@@ -37,6 +54,7 @@ namespace winPEAS.Tests
             winPEAS.Checks.Checks.PortScannerPorts    = null;
             winPEAS.Checks.Checks.LinpeasUrl          = "https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh";
             winPEAS.Checks.Checks.MaxRegexFileSize    = 1000000;
+            winPEAS.Checks.Checks.MitreFilter.Clear();
 
             var argsWithHelp = args.Concat(new[] { "--help" }).ToArray();
             Program.Main(argsWithHelp);
@@ -101,5 +119,126 @@ namespace winPEAS.Tests
             Assert.IsNotNull(ports, "PortScannerPorts should not be null");
             CollectionAssert.AreEquivalent(new List<int> { 80, 443 }, ports);
         }
+
+        [TestMethod]
+        public void MitreFlag_SingleTechnique_ParsedIntoFilter()
+        {
+            ParseOnly("mitre=T1082");
+            Assert.AreEqual(1, winPEAS.Checks.Checks.MitreFilter.Count,
+                "mitre=T1082 should add exactly one technique to MitreFilter");
+            Assert.IsTrue(winPEAS.Checks.Checks.MitreFilter.Contains("T1082"),
+                "MitreFilter should contain T1082");
+        }
+
+        [TestMethod]
+        public void MitreFlag_MultipleIds_AllParsedIntoFilter()
+        {
+            ParseOnly("mitre=T1082,T1548.002,T1057");
+            Assert.AreEqual(3, winPEAS.Checks.Checks.MitreFilter.Count,
+                "mitre=T1082,T1548.002,T1057 should add three techniques to MitreFilter");
+            Assert.IsTrue(winPEAS.Checks.Checks.MitreFilter.Contains("T1082"));
+            Assert.IsTrue(winPEAS.Checks.Checks.MitreFilter.Contains("T1548.002"));
+            Assert.IsTrue(winPEAS.Checks.Checks.MitreFilter.Contains("T1057"));
+        }
+
+        [TestMethod]
+        public void MitreFlag_CaseInsensitive_IsRecognised()
+        {
+            ParseOnly("MITRE=t1082");
+            Assert.AreEqual(1, winPEAS.Checks.Checks.MitreFilter.Count,
+                "MITRE= (upper-case) should be accepted case-insensitively");
+            // HashSet uses OrdinalIgnoreCase so both casing variants should be found
+            Assert.IsTrue(winPEAS.Checks.Checks.MitreFilter.Contains("T1082") ||
+                          winPEAS.Checks.Checks.MitreFilter.Contains("t1082"));
+        }
+
+        [TestMethod]
+        public void PassesMitreFilter_EmptyFilter_AllChecksPass()
+        {
+            winPEAS.Checks.Checks.MitreFilter.Clear();
+            Assert.IsTrue(InvokePassesMitreFilter(new[] { "T1082" }),
+                "An empty MitreFilter should pass every check.");
+            Assert.IsTrue(InvokePassesMitreFilter(new string[0]),
+                "An empty MitreFilter should pass a check with no IDs.");
+        }
+
+        [TestMethod]
+        public void PassesMitreFilter_ExactMatch_Passes()
+        {
+            winPEAS.Checks.Checks.MitreFilter.Clear();
+            winPEAS.Checks.Checks.MitreFilter.Add("T1082");
+            Assert.IsTrue(InvokePassesMitreFilter(new[] { "T1082" }),
+                "A check tagged T1082 should pass when filter contains T1082.");
+        }
+
+        [TestMethod]
+        public void PassesMitreFilter_NoMatch_Fails()
+        {
+            winPEAS.Checks.Checks.MitreFilter.Clear();
+            winPEAS.Checks.Checks.MitreFilter.Add("T1082");
+            Assert.IsFalse(InvokePassesMitreFilter(new[] { "T1057" }),
+                "A check tagged T1057 should not pass when filter only contains T1082.");
+        }
+
+        [TestMethod]
+        public void PassesMitreFilter_PrefixMatch_Passes()
+        {
+            // Filter on base technique T1552 should match sub-technique T1552.001
+            winPEAS.Checks.Checks.MitreFilter.Clear();
+            winPEAS.Checks.Checks.MitreFilter.Add("T1552");
+            Assert.IsTrue(InvokePassesMitreFilter(new[] { "T1552.001" }),
+                "Filter on T1552 should match a check tagged T1552.001 (prefix match).");
+            Assert.IsTrue(InvokePassesMitreFilter(new[] { "T1552.005" }),
+                "Filter on T1552 should match a check tagged T1552.005 (prefix match).");
+        }
+
+        [TestMethod]
+        public void PassesMitreFilter_SubtechniqueDoesNotMatchDifferentBase_Fails()
+        {
+            winPEAS.Checks.Checks.MitreFilter.Clear();
+            winPEAS.Checks.Checks.MitreFilter.Add("T1548");
+            Assert.IsFalse(InvokePassesMitreFilter(new[] { "T1552.001" }),
+                "Filter on T1548 must not match T1552.001.");
+        }
+
+        [TestMethod]
+        public void PassesMitreFilter_NullMitreAttackIds_PassesThrough()
+        {
+            // A check with null MitreAttackIds should NOT be silently excluded
+            // when a filter is active — it simply has no metadata to match against.
+            winPEAS.Checks.Checks.MitreFilter.Clear();
+            winPEAS.Checks.Checks.MitreFilter.Add("T1082");
+            Assert.IsTrue(InvokePassesMitreFilter(null),
+                "A check with null MitreAttackIds should pass through (return true) when a filter is active.");
+        }
+
+        [TestMethod]
+        public void PassesMitreFilter_EmptyMitreAttackIds_PassesThrough()
+        {
+            // A check that declares string[0] should also pass through, not be silently excluded.
+            winPEAS.Checks.Checks.MitreFilter.Clear();
+            winPEAS.Checks.Checks.MitreFilter.Add("T1082");
+            Assert.IsTrue(InvokePassesMitreFilter(new string[0]),
+                "A check with empty MitreAttackIds should pass through (return true) when a filter is active.");
+        }
+
+        [TestMethod]
+        public void PassesMitreFilter_SubtechniqueFilter_DoesNotMatchParentOnlyTag()
+        {
+            // filter=T1552.001 (child) must NOT match a check tagged only with T1552 (parent).
+            // Parent filters may broaden to children, but never the reverse.
+            winPEAS.Checks.Checks.MitreFilter.Clear();
+            winPEAS.Checks.Checks.MitreFilter.Add("T1552.001");
+            Assert.IsFalse(InvokePassesMitreFilter(new[] { "T1552" }),
+                "A sub-technique filter (T1552.001) must not match a check tagged with only the parent (T1552).");
+        }
+
+        [TestMethod]
+        public void MaxRegexFileSize_ArgParsed_Correctly()
+        {
+            ParseOnly("max-regex-file-size=500000");
+            Assert.AreEqual(500000, winPEAS.Checks.Checks.MaxRegexFileSize,
+                "max-regex-file-size=500000 should set MaxRegexFileSize to 500000.");
+        }
     }
 }

winPEAS/winPEASexe/winPEAS/Checks/ActiveDirectoryInfo.cs

@@ -14,9 +14,11 @@ namespace winPEAS.Checks
     // Lightweight AD-oriented checks for common escalation paths (gMSA readable password, AD CS template control)
     internal class ActiveDirectoryInfo : ISystemCheck
     {
+        public string[] MitreAttackIds { get; } = new[] { "T1018", "T1087.002", "T1558.003", "T1484.001", "T1649", "T1003" };
+
         public void PrintInfo(bool isDebug)
         {
-            Beaprint.GreatPrint("Active Directory Quick Checks");
+            Beaprint.GreatPrint("Active Directory Quick Checks", "T1018,T1087.002,T1558.003,T1484.001,T1649,T1003");
 
             new List<Action>
             {
@@ -79,7 +81,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("AD object control surfaces");
+                Beaprint.MainPrint("AD object control surfaces", "T1484.001,T1087.002,T1018");
                 Beaprint.LinkPrint(
                     "https://book.hacktricks.wiki/en/windows-hardening/active-directory-methodology/index.html#acl-abuse",
                     "Look for objects where you have GenericAll/GenericWrite/attribute rights for ACL abuse (password reset, SPN/UAC/RBCD, sidHistory, delegation, DCSync).");
@@ -669,7 +671,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("gMSA readable managed passwords");
+                Beaprint.MainPrint("gMSA readable managed passwords", "T1003");
                 Beaprint.LinkPrint(
                     "https://book.hacktricks.wiki/en/windows-hardening/active-directory-methodology/gmsa.html",
                     "Look for Group Managed Service Accounts you can read (msDS-ManagedPassword)");
@@ -757,7 +759,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Kerberoasting / service ticket risks");
+                Beaprint.MainPrint("Kerberoasting / service ticket risks", "T1558.003");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/active-directory-methodology/kerberoast.html",
                     "Enumerate weak SPN accounts and legacy Kerberos crypto");
 
@@ -789,7 +791,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("AD CS misconfigurations for ESC");
+                Beaprint.MainPrint("AD CS misconfigurations for ESC", "T1649");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/active-directory-methodology/ad-certificates.html");
     
                 if (!Checks.IsPartOfDomain)

winPEAS/winPEASexe/winPEAS/Checks/ApplicationsInfo.cs

@@ -7,9 +7,11 @@ namespace winPEAS.Checks
 {
     internal class ApplicationsInfo : ISystemCheck
     {
+        public string[] MitreAttackIds { get; } = new[] { "T1518", "T1547.001", "T1053.005", "T1010", "T1014" };
+
         public void PrintInfo(bool isDebug)
         {
-            Beaprint.GreatPrint("Applications Information");
+            Beaprint.GreatPrint("Applications Information", "T1518,T1547.001,T1053.005,T1010,T1014");
 
             new List<Action>
             {
@@ -25,7 +27,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Current Active Window Application");
+                Beaprint.MainPrint("Current Active Window Application", "T1010");
                 string title = ApplicationInfoHelper.GetActiveWindowTitle();
                 List<string> permsFile = PermissionsHelper.GetPermissionsFile(title, Checks.CurrentUserSiDs);
                 List<string> permsFolder = PermissionsHelper.GetPermissionsFolder(title, Checks.CurrentUserSiDs);
@@ -55,7 +57,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Installed Applications --Via Program Files/Uninstall registry--");
+                Beaprint.MainPrint("Installed Applications --Via Program Files/Uninstall registry--", "T1518");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#applications", "Check if you can modify installed software");
                 SortedDictionary<string, Dictionary<string, string>> installedAppsPerms = InstalledApps.GetInstalledAppsPerms();
                 string format = "    ==>  {0} ({1})";
@@ -101,7 +103,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Autorun Applications");
+                Beaprint.MainPrint("Autorun Applications", "T1547.001");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html", "Check if you can modify other users AutoRuns binaries (Note that is normal that you can modify HKCU registry and binaries indicated there)");
                 List<Dictionary<string, string>> apps = AutoRuns.GetAutoRuns(Checks.CurrentUserSiDs);
 
@@ -188,7 +190,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Scheduled Applications --Non Microsoft--");
+                Beaprint.MainPrint("Scheduled Applications --Non Microsoft--", "T1053.005");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.html", "Check if you can modify other users scheduled binaries");
                 List<Dictionary<string, string>> scheduled_apps = ApplicationInfoHelper.GetScheduledAppsNoMicrosoft();
 
@@ -237,7 +239,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Device Drivers --Non Microsoft--");
+                Beaprint.MainPrint("Device Drivers --Non Microsoft--", "T1014");
                 // this link is not very specific, but its the best on hacktricks
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#drivers", "Check 3rd party drivers for known vulnerabilities/rootkits.");
 

winPEAS/winPEASexe/winPEAS/Checks/BrowserInfo.cs

@@ -10,9 +10,11 @@ namespace winPEAS.Checks
 {
     internal class BrowserInfo : ISystemCheck
     {
+        public string[] MitreAttackIds { get; } = new[] { "T1217", "T1539", "T1555.003" };
+
         public void PrintInfo(bool isDebug)
         {
-            Beaprint.GreatPrint("Browsers Information");
+            Beaprint.GreatPrint("Browsers Information", "T1217,T1539,T1555.003");
 
             new List<IBrowser>
             {

winPEAS/winPEASexe/winPEAS/Checks/Checks.cs

@@ -52,6 +52,9 @@ namespace winPEAS.Checks
         private static List<SystemCheck> _systemChecks;
         private static readonly HashSet<string> _systemCheckSelectedKeysHashSet = new HashSet<string>();
 
+        /// <summary>MITRE ATT&amp;CK technique IDs to filter checks (empty = run all).</summary>
+        public static readonly HashSet<string> MitreFilter = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
         // github url for Linpeas.sh
         public static string LinpeasUrl = "https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh";
 
@@ -206,7 +209,7 @@ namespace winPEAS.Checks
                     SearchProgramFiles = true;
                 }
 
-                if (string.Equals(arg, "max-regex-file-size", StringComparison.CurrentCultureIgnoreCase))
+                if (arg.StartsWith("max-regex-file-size=", StringComparison.CurrentCultureIgnoreCase))
                 {
                     var parts = arg.Split('=');
                     if (parts.Length >= 2 && !string.IsNullOrEmpty(parts[1]))
@@ -221,6 +224,17 @@ namespace winPEAS.Checks
                     IsLolbas = true;
                 }
 
+                if (arg.StartsWith("mitre=", StringComparison.OrdinalIgnoreCase))
+                {
+                    var mitreList = arg.Substring("mitre=".Length);
+                    foreach (var t in mitreList.Split(','))
+                    {
+                        var trimmed = t.Trim();
+                        if (!string.IsNullOrEmpty(trimmed))
+                            MitreFilter.Add(trimmed);
+                    }
+                }
+
                 if (arg.StartsWith("-linpeas", StringComparison.CurrentCultureIgnoreCase))
                 {
                     IsLinpeas = true;
@@ -404,17 +418,43 @@ namespace winPEAS.Checks
             return false;
         }
 
+        private static bool PassesMitreFilter(ISystemCheck check)
+        {
+            if (MitreFilter.Count == 0) return true;
+            // No MITRE metadata declared → pass through (don't silently exclude untagged checks).
+            if (check.MitreAttackIds == null || check.MitreAttackIds.Length == 0) return true;
+            foreach (var id in check.MitreAttackIds)
+            {
+                if (MitreFilter.Contains(id)) return true;
+                // Also match on just the base technique (e.g. filter "T1552" matches "T1552.001")
+                var dot = id.IndexOf('.');
+                if (dot > 0 && MitreFilter.Contains(id.Substring(0, dot))) return true;
+            }
+            return false;
+        }
+
         private static void RunChecks(bool isAllChecks, bool wait)
         {
+            // Pre-compute how many checks will actually execute so we can prompt between
+            // each one and skip the prompt after the very last executed check.
+            int totalToRun = _systemChecks.Count(sc =>
+                (_systemCheckSelectedKeysHashSet.Contains(sc.Key) || isAllChecks) &&
+                PassesMitreFilter(sc.Check));
+
+            int runCount = 0;
             for (int i = 0; i < _systemChecks.Count; i++)
             {
                 var systemCheck = _systemChecks[i];
 
-                if (_systemCheckSelectedKeysHashSet.Contains(systemCheck.Key) || isAllChecks)
+                bool selectedByKey = _systemCheckSelectedKeysHashSet.Contains(systemCheck.Key) || isAllChecks;
+                bool selectedByMitre = PassesMitreFilter(systemCheck.Check);
+
+                if (selectedByKey && selectedByMitre)
                 {
                     systemCheck.Check.PrintInfo(IsDebug);
+                    runCount++;
 
-                    if ((i < _systemCheckSelectedKeysHashSet.Count - 1) && wait)
+                    if (wait && runCount < totalToRun)
                     {
                         WaitInput();
                     }

winPEAS/winPEASexe/winPEAS/Checks/CloudInfo.cs

@@ -6,9 +6,11 @@ namespace winPEAS.Checks
 {
     internal class CloudInfo : ISystemCheck
     {
+        public string[] MitreAttackIds { get; } = new[] { "T1552.005", "T1580" };
+
         public void PrintInfo(bool isDebug)
         {
-            Beaprint.GreatPrint("Cloud Information");
+            Beaprint.GreatPrint("Cloud Information", "T1552.005,T1580");
 
             Dictionary<string, string> colorsTraining = new Dictionary<string, string>()
                 {
@@ -44,7 +46,7 @@ namespace winPEAS.Checks
             {                
                 if (cloudInfo.IsCloud)
                 {
-                    Beaprint.MainPrint(cloudInfo.Name + " Enumeration");
+                    Beaprint.MainPrint(cloudInfo.Name + " Enumeration", "T1552.005,T1580");
 
                     if (cloudInfo.IsAvailable)
                     {

winPEAS/winPEASexe/winPEAS/Checks/EventsInfo.cs

@@ -11,9 +11,11 @@ namespace winPEAS.Checks
 {
     internal class EventsInfo : ISystemCheck
     {
+        public string[] MitreAttackIds { get; } = new[] { "T1654", "T1078", "T1078.003", "T1552.001", "T1059.001", "T1082" };
+
         public void PrintInfo(bool isDebug)
         {
-            Beaprint.GreatPrint("Interesting Events information");
+            Beaprint.GreatPrint("Interesting Events information", "T1654,T1078,T1078.003,T1552.001,T1059.001,T1082");
 
             new List<Action>
             {
@@ -29,7 +31,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("PowerShell events - script block logs (EID 4104) - searching for sensitive data.\n");
+                Beaprint.MainPrint("PowerShell events - script block logs (EID 4104) - searching for sensitive data.\n", "T1552.001,T1059.001");
                 var powerShellEventInfos = PowerShell.GetPowerShellEventInfos();
 
                 foreach (var info in powerShellEventInfos)
@@ -53,7 +55,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Process creation events - searching logs (EID 4688) for sensitive data.\n");
+                Beaprint.MainPrint("Process creation events - searching logs (EID 4688) for sensitive data.\n", "T1654");
 
                 if (!MyUtils.IsHighIntegrity())
                 {
@@ -82,7 +84,7 @@ namespace winPEAS.Checks
             try
             {
                 var lastDays = 10;
-                Beaprint.MainPrint($"Printing Account Logon Events (4624) for the last {lastDays} days.\n");
+                Beaprint.MainPrint($"Printing Account Logon Events (4624) for the last {lastDays} days.\n", "T1654,T1078");
 
                 if (!MyUtils.IsHighIntegrity())
                 {
@@ -151,7 +153,7 @@ namespace winPEAS.Checks
             {
                 var lastDays = 30;
 
-                Beaprint.MainPrint($"Printing Explicit Credential Events (4648) for last {lastDays} days - A process logged on using plaintext credentials\n");
+                Beaprint.MainPrint($"Printing Explicit Credential Events (4648) for last {lastDays} days - A process logged on using plaintext credentials\n", "T1078.003");
 
                 if (!MyUtils.IsHighIntegrity())
                 {
@@ -198,7 +200,7 @@ namespace winPEAS.Checks
             {
                 var lastDays = 5;
 
-                Beaprint.MainPrint($"Displaying Power off/on events for last {lastDays} days\n");
+                Beaprint.MainPrint($"Displaying Power off/on events for last {lastDays} days\n", "T1082");
 
                 var infos = Power.GetPowerEventInfos(lastDays);
 

winPEAS/winPEASexe/winPEAS/Checks/FileAnalysis.cs

@@ -16,9 +16,11 @@ namespace winPEAS.Checks
     {
         private const int ListFileLimit = 70;
 
+        public string[] MitreAttackIds { get; } = new[] { "T1552.001", "T1083" };
+
         public void PrintInfo(bool isDebug)
         {
-            Beaprint.GreatPrint("File Analysis");
+            Beaprint.GreatPrint("File Analysis", "T1552.001,T1083");
 
             new List<Action>
             {
@@ -140,7 +142,7 @@ namespace winPEAS.Checks
                 {
                     if (!somethingFound)
                     {
-                        Beaprint.MainPrint($"Found {searchName} Files");
+                        Beaprint.MainPrint($"Found {searchName} Files", "T1552.001");
                         somethingFound = true;
                     }
 
@@ -501,7 +503,7 @@ namespace winPEAS.Checks
                         if (item2.Value.Count > limit)
                             msg += $" (limited to {limit})";
 
-                        Beaprint.MainPrint(msg);
+                        Beaprint.MainPrint(msg, "T1552.001");
 
                         int cont = 0;
                         foreach (KeyValuePair<string, List<string>> item3 in item2.Value)

winPEAS/winPEASexe/winPEAS/Checks/FilesInfo.cs

@@ -113,9 +113,11 @@ namespace winPEAS.Checks
         };
 
 
+        public string[] MitreAttackIds { get; } = new[] { "T1083", "T1552.001", "T1552.002", "T1552.004", "T1552.006", "T1003.002", "T1564.001", "T1574.001", "T1059.004", "T1114.001", "T1218", "T1649" };
+
         public void PrintInfo(bool isDebug)
         {
-            Beaprint.GreatPrint("Interesting files and registry");
+            Beaprint.GreatPrint("Interesting files and registry", "T1083,T1552.001,T1552.002,T1552.004,T1552.006,T1003.002,T1564.001,T1574.001,T1059.004,T1114.001,T1218,T1649");
 
             new List<Action>
             {
@@ -150,7 +152,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Cloud Credentials");
+                Beaprint.MainPrint("Cloud Credentials", "T1552.001");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#files-and-registry-credentials");
                 List<Dictionary<string, string>> could_creds = KnownFileCredsInfo.ListCloudCreds();
                 if (could_creds.Count != 0)
@@ -175,7 +177,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Unattend Files");
+                Beaprint.MainPrint("Unattend Files", "T1552.001");
                 //Beaprint.LinkPrint("");
                 List<string> unattended_files = Unattended.GetUnattendedInstallFiles();
                 foreach (string path in unattended_files)
@@ -195,7 +197,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Looking for common SAM & SYSTEM backups");
+                Beaprint.MainPrint("Looking for common SAM & SYSTEM backups", "T1003.002");
                 List<string> sam_files = InterestingFiles.InterestingFiles.GetSAMBackups();
                 foreach (string path in sam_files)
                 {
@@ -218,7 +220,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Looking for McAfee Sitelist.xml Files");
+                Beaprint.MainPrint("Looking for McAfee Sitelist.xml Files", "T1552.001");
                 var sitelistFilesInfos = McAfee.GetMcAfeeSitelistInfos();
 
                 foreach (var sitelistFilesInfo in sitelistFilesInfos)
@@ -266,7 +268,7 @@ namespace winPEAS.Checks
 
         void PrintWSLDistributions()
         {
-            Beaprint.MainPrint("Looking for Linux shells/distributions - wsl.exe, bash.exe");
+            Beaprint.MainPrint("Looking for Linux shells/distributions - wsl.exe, bash.exe", "T1059.004");
             List<string> linuxShells = InterestingFiles.InterestingFiles.GetLinuxShells();
             string hive = "HKCU";
             string basePath = @"SOFTWARE\Microsoft\Windows\CurrentVersion\Lxss";
@@ -353,7 +355,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Cached GPP Passwords");
+                Beaprint.MainPrint("Cached GPP Passwords", "T1552.006");
                 Dictionary<string, Dictionary<string, string>> gpp_passwords = GPP.GetCachedGPPPassword();
 
                 Dictionary<string, string> gppColors = new Dictionary<string, string>()
@@ -381,7 +383,7 @@ namespace winPEAS.Checks
                 string[] passRegHkcu = new string[] { @"Software\ORL\WinVNC3\Password", @"Software\TightVNC\Server", @"Software\SimonTatham\PuTTY\Sessions" };
                 string[] passRegHklm = new string[] { @"SYSTEM\CurrentControlSet\Services\SNMP" };
 
-                Beaprint.MainPrint("Looking for possible regs with creds");
+                Beaprint.MainPrint("Looking for possible regs with creds", "T1552.002");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#inside-the-registry");
 
                 string winVnc4 = RegistryHelper.GetRegValue("HKLM", @"SOFTWARE\RealVNC\WinVNC4", "password");
@@ -430,7 +432,7 @@ namespace winPEAS.Checks
                     { pattern_color, Beaprint.ansi_color_bad },
                 };
 
-                Beaprint.MainPrint("Looking for possible password files in users homes");
+                Beaprint.MainPrint("Looking for possible password files in users homes", "T1552.001");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#files-and-registry-credentials");
                 var fileInfos = SearchHelper.SearchUserCredsFiles();
 
@@ -469,7 +471,7 @@ namespace winPEAS.Checks
                     { _patternsFileCredsColor + "|.*password.*|.*credential.*", Beaprint.ansi_color_bad },
                 };
 
-                Beaprint.MainPrint("Looking inside the Recycle Bin for creds files");
+                Beaprint.MainPrint("Looking inside the Recycle Bin for creds files", "T1552.001");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#files-and-registry-credentials");
                 List<Dictionary<string, string>> recy_files = InterestingFiles.InterestingFiles.GetRecycleBin();
 
@@ -505,7 +507,7 @@ namespace winPEAS.Checks
                     { _patternsFileCredsColor, Beaprint.ansi_color_bad },
                 };
 
-                Beaprint.MainPrint("Searching known files that can contain creds in home");
+                Beaprint.MainPrint("Searching known files that can contain creds in home", "T1552.001");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#files-and-registry-credentials");
 
                 var files = SearchHelper.SearchUsersInterestingFiles();
@@ -522,7 +524,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Looking for documents --limit 100--");
+                Beaprint.MainPrint("Looking for documents --limit 100--", "T1083");
                 List<string> docFiles = InterestingFiles.InterestingFiles.ListUsersDocs();
                 Beaprint.ListPrint(MyUtils.GetLimitedRange(docFiles, 100));
             }
@@ -536,7 +538,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Recent files --limit 70--");
+                Beaprint.MainPrint("Recent files --limit 70--", "T1083");
                 List<Dictionary<string, string>> recFiles = KnownFileCredsInfo.GetRecentFiles();
 
                 Dictionary<string, string> colorF = new Dictionary<string, string>()
@@ -566,7 +568,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Searching interesting files in other users home directories (can be slow)\n");
+                Beaprint.MainPrint("Searching interesting files in other users home directories (can be slow)\n", "T1552.001");
 
                 // check if admin already, if yes, print a message, if not, try to enumerate all files
                 if (MyUtils.IsHighIntegrity())
@@ -684,7 +686,7 @@ namespace winPEAS.Checks
 
             var systemDrive = Environment.GetEnvironmentVariable("SystemDrive");
 
-            Beaprint.MainPrint($"Searching hidden files or folders in {systemDrive}\\Users home (can be slow)\n");
+            Beaprint.MainPrint($"Searching hidden files or folders in {systemDrive}\\Users home (can be slow)\n", "T1564.001");
 
             foreach (var file in SearchHelper.RootDirUsers)
             {
@@ -726,7 +728,7 @@ namespace winPEAS.Checks
 
         private void PrintExecutablesInNonDefaultFoldersWithWritePermissions()
         {
-            Beaprint.MainPrint($"Searching executable files in non-default folders with write (equivalent) permissions (can be slow)");
+            Beaprint.MainPrint($"Searching executable files in non-default folders with write (equivalent) permissions (can be slow)", "T1574.001");
 
             var systemDrive = $"{Environment.GetEnvironmentVariable("SystemDrive")}\\";
 
@@ -785,7 +787,7 @@ namespace winPEAS.Checks
 
         private static void PrintOracleSQLDeveloperConfigFiles()
         {
-            Beaprint.MainPrint($"Searching for Oracle SQL Developer config files\n");
+            Beaprint.MainPrint($"Searching for Oracle SQL Developer config files\n", "T1552.001");
 
             var userFolders = User.GetUsersFolders();
 
@@ -817,7 +819,7 @@ namespace winPEAS.Checks
 
         private static void PrintMachineAndUserCertificateFiles()
         {
-            Beaprint.MainPrint($"Enumerating machine and user certificate files\n");
+            Beaprint.MainPrint($"Enumerating machine and user certificate files\n", "T1649,T1552.004");
 
             try
             {
@@ -861,7 +863,7 @@ namespace winPEAS.Checks
 
         private static void PrintOutlookDownloads()
         {
-            Beaprint.MainPrint("Enumerating Outlook download files\n");
+            Beaprint.MainPrint("Enumerating Outlook download files\n", "T1114.001");
 
             try
             {
@@ -897,7 +899,7 @@ namespace winPEAS.Checks
         {
             int limit = 50;
 
-            Beaprint.MainPrint($"Office Most Recent Files -- limit {limit}\n");
+            Beaprint.MainPrint($"Office Most Recent Files -- limit {limit}\n", "T1083");
 
             try
             {
@@ -931,7 +933,7 @@ namespace winPEAS.Checks
                 Beaprint.NoColorPrint($"          {mpSub.Key,-40} {mpSub.Value,-50} {formattedDateString}");
             }
 
-            Beaprint.MainPrint("Enumerating Office 365 endpoints synced by OneDrive.\n");
+            Beaprint.MainPrint("Enumerating Office 365 endpoints synced by OneDrive.\n", "T1083");
 
             try
             {
@@ -1007,7 +1009,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Looking for LOL Binaries and Scripts (can be slow)");
+                Beaprint.MainPrint("Looking for LOL Binaries and Scripts (can be slow)", "T1218");
                 Beaprint.LinkPrint("https://lolbas-project.github.io/");
 
                 if (!Checks.IsLolbas)

winPEAS/winPEASexe/winPEAS/Checks/ISystemCheck.cs

@@ -3,5 +3,11 @@
     internal interface ISystemCheck
     {
         void PrintInfo(bool isDebug);
+
+        /// <summary>
+        /// MITRE ATT&amp;CK technique IDs associated with this check category
+        /// (e.g. new[] { "T1082", "T1548.002" }).
+        /// </summary>
+        string[] MitreAttackIds { get; }
     }
 }

winPEAS/winPEASexe/winPEAS/Checks/NetworkInfo.cs

@@ -25,9 +25,11 @@ namespace winPEAS.Checks
             { @"\[\:\:\]", Beaprint.ansi_color_bad },
         };
 
+        public string[] MitreAttackIds { get; } = new[] { "T1016", "T1049", "T1135", "T1046", "T1018", "T1090" };
+
         public void PrintInfo(bool isDebug)
         {
-            Beaprint.GreatPrint("Network Information");
+            Beaprint.GreatPrint("Network Information", "T1016,T1049,T1135,T1046,T1018,T1090");
 
             // Base checklist
             var checks = new List<Action>
@@ -56,7 +58,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Network Shares");
+                Beaprint.MainPrint("Network Shares", "T1135");
                 Dictionary<string, string> colorsN = new Dictionary<string, string>()
                 {
                     { commonShares, Beaprint.ansi_color_good },
@@ -85,7 +87,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Host File");
+                Beaprint.MainPrint("Host File", "T1016");
                 string[] lines = File.ReadAllLines(@Path.GetPathRoot(Environment.SystemDirectory) + @"\windows\system32\drivers\etc\hosts");
 
                 foreach (string line in lines)
@@ -106,7 +108,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Network Ifaces and known hosts");
+                Beaprint.MainPrint("Network Ifaces and known hosts", "T1016,T1018");
                 Beaprint.LinkPrint("", "The masks are only for the IPv4 addresses");
                 foreach (Dictionary<string, string> card in NetworkInfoHelper.GetNetCardInfo())
                 {
@@ -138,7 +140,7 @@ namespace winPEAS.Checks
 
         private void PrintListeningPortsTcp(Dictionary<int, Process> processesByPid)
         {
-            Beaprint.MainPrint("Current TCP Listening Ports");
+            Beaprint.MainPrint("Current TCP Listening Ports", "T1049");
             Beaprint.LinkPrint("", "Check for services restricted from the outside");
 
             PrintListeningPortsTcpIPv4(processesByPid);
@@ -214,7 +216,7 @@ namespace winPEAS.Checks
 
         private void PrintListeningPortsUdp(Dictionary<int, Process> processesByPid)
         {
-            Beaprint.MainPrint("Current UDP Listening Ports");
+            Beaprint.MainPrint("Current UDP Listening Ports", "T1049");
             Beaprint.LinkPrint("", "Check for services restricted from the outside");
 
             PrintListeningPortsUdpIPv4(processesByPid);
@@ -298,7 +300,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Firewall Rules");
+                Beaprint.MainPrint("Firewall Rules", "T1016");
                 Beaprint.LinkPrint("", "Showing only DENY rules (too many ALLOW rules always)");
                 Dictionary<string, string> colorsN = new Dictionary<string, string>()
                         {
@@ -345,7 +347,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("DNS cached --limit 70--");
+                Beaprint.MainPrint("DNS cached --limit 70--", "T1016");
                 Beaprint.GrayPrint(string.Format("    {0,-38}{1,-38}{2}", "Entry", "Name", "Data"));
                 List<Dictionary<string, string>> DNScache = NetworkInfoHelper.GetDNSCache();
                 foreach (Dictionary<string, string> entry in MyUtils.GetLimitedRange(DNScache, 70))
@@ -363,7 +365,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Enumerate Network Mapped Drives (WMI)");
+                Beaprint.MainPrint("Enumerate Network Mapped Drives (WMI)", "T1135");
 
                 using (var wmiData = new ManagementObjectSearcher(@"root\cimv2", "SELECT * FROM win32_networkconnection"))
                 {
@@ -394,7 +396,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Enumerating Internet settings, zone and proxy configuration");
+                Beaprint.MainPrint("Enumerating Internet settings, zone and proxy configuration", "T1090");
 
                 var info = InternetSettings.GetInternetSettingsInfo();
 
@@ -444,7 +446,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Internet Connectivity");
+                Beaprint.MainPrint("Internet Connectivity", "T1016");
                 Beaprint.LinkPrint("", "Checking if internet access is possible via different methods");
 
                 var connectivityInfo = InternetConnectivity.CheckConnectivity();
@@ -499,7 +501,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Hostname Resolution");
+                Beaprint.MainPrint("Hostname Resolution", "T1016");
                 Beaprint.LinkPrint("", "Checking if the hostname can be resolved externally");
 
                 var resolutionInfo = HostnameResolution.TryExternalCheck();
@@ -524,7 +526,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Network Scan");
+                Beaprint.MainPrint("Network Scan", "T1046");
                 Beaprint.LinkPrint("", "Scanning for alive hosts and open TCP ports (this may take some time)");
 
                 var scanner = new NetworkScanner(Checks.NetworkScanOptions, Checks.PortScannerPorts);

winPEAS/winPEASexe/winPEAS/Checks/NetworkScanCheck.cs

@@ -12,6 +12,8 @@ namespace winPEAS.Checks
     /// </summary>
     internal class NetworkScanCheck : ISystemCheck
     {
+        public string[] MitreAttackIds { get; } = new[] { "T1046" };
+
         public void PrintInfo(bool isDebug)
         {
             if (!Checks.IsNetworkScan)

winPEAS/winPEASexe/winPEAS/Checks/ProcessInfo.cs

@@ -8,9 +8,11 @@ namespace winPEAS.Checks
 {
     internal class ProcessInfo : ISystemCheck
     {
+        public string[] MitreAttackIds { get; } = new[] { "T1057", "T1134.001" };
+
         public void PrintInfo(bool isDebug)
         {
-            Beaprint.GreatPrint("Processes Information");
+            Beaprint.GreatPrint("Processes Information", "T1057,T1134.001");
 
             new List<Action>
             {
@@ -23,7 +25,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Interesting Processes -non Microsoft-");
+                Beaprint.MainPrint("Interesting Processes -non Microsoft-", "T1057");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#running-processes", "Check if any interesting processes for memory dump or if you could overwrite some binary running");
                 List<Dictionary<string, string>> processesInfo = ProcessesInfo.GetProcInfo();
 
@@ -92,7 +94,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Vulnerable Leaked Handlers");
+                Beaprint.MainPrint("Vulnerable Leaked Handlers", "T1134.001");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#leaked-handlers");
 
                 List<Dictionary<string, string>> vulnHandlers = new List<Dictionary<string, string>>(); 

winPEAS/winPEASexe/winPEAS/Checks/RegistryInfo.cs

@@ -39,9 +39,11 @@ namespace winPEAS.Checks
             @"SYSTEM\ControlSet001\Control",
         };
 
+        public string[] MitreAttackIds { get; } = new[] { "T1012", "T1574.011", "T1056.001" };
+
         public void PrintInfo(bool isDebug)
         {
-            Beaprint.GreatPrint("Registry permissions for hive exploitation");
+            Beaprint.GreatPrint("Registry permissions for hive exploitation", "T1012,T1574.011,T1056.001");
 
             new List<Action>
             {
@@ -53,7 +55,7 @@ namespace winPEAS.Checks
 
         private void PrintTypingInsightsPermissions()
         {
-            Beaprint.MainPrint("Cross-user TypingInsights key (HKCU/HKU)");
+            Beaprint.MainPrint("Cross-user TypingInsights key (HKCU/HKU)", "T1056.001");
 
             var matches = new List<RegistryWritableKeyInfo>();
             var seen = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
@@ -92,7 +94,7 @@ namespace winPEAS.Checks
 
         private void PrintKnownSystemWritableKeys()
         {
-            Beaprint.MainPrint("Known HKLM descendants writable by standard users");
+            Beaprint.MainPrint("Known HKLM descendants writable by standard users", "T1574.011");
 
             var matches = new List<RegistryWritableKeyInfo>();
             foreach (var path in KnownWritableSystemKeyCandidates)
@@ -114,7 +116,7 @@ namespace winPEAS.Checks
 
         private void PrintHeuristicWritableKeys()
         {
-            Beaprint.MainPrint("Sample of additional writable HKLM keys (depth-limited scan)");
+            Beaprint.MainPrint("Sample of additional writable HKLM keys (depth-limited scan)", "T1574.011");
 
             var matches = RegistryAclScanner.ScanWritableKeys("HKLM", ScanBasePaths, maxDepth: 3, maxResults: 25);
             if (matches.Count == 0)

winPEAS/winPEASexe/winPEAS/Checks/ServicesInfo.cs

@@ -12,9 +12,11 @@ namespace winPEAS.Checks
     {
         Dictionary<string, string> modifiableServices = new Dictionary<string, string>();
 
+        public string[] MitreAttackIds { get; } = new[] { "T1007", "T1543.003", "T1574.001", "T1574.011", "T1014", "T1068" };
+
         public void PrintInfo(bool isDebug)
         {
-            Beaprint.GreatPrint("Services Information");
+            Beaprint.GreatPrint("Services Information", "T1007,T1543.003,T1574.001,T1574.011,T1014,T1068");
 
             /// Start finding Modifiable services so any function could use them
 
@@ -46,7 +48,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Interesting Services -non Microsoft-");
+                Beaprint.MainPrint("Interesting Services -non Microsoft-", "T1007");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#services", "Check if you can overwrite some service binary or perform a DLL hijacking, also check for unquoted paths");
 
                 List<Dictionary<string, string>> services_info = ServicesInfoHelper.GetNonstandardServices();
@@ -125,7 +127,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Modifiable Services");
+                Beaprint.MainPrint("Modifiable Services", "T1543.003");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#services", "Check if you can modify any service");
                 if (modifiableServices.Count > 0)
                 {
@@ -162,7 +164,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Looking if you can modify any service registry");
+                Beaprint.MainPrint("Looking if you can modify any service registry", "T1574.011");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#services-registry-modify-permissions", "Check if you can modify the registry of a service");
                 List<Dictionary<string, string>> regPerms = ServicesInfoHelper.GetWriteServiceRegs(Checks.CurrentUserSiDs);
 
@@ -190,7 +192,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Checking write permissions in PATH folders (DLL Hijacking)");
+                Beaprint.MainPrint("Checking write permissions in PATH folders (DLL Hijacking)", "T1574.001");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#dll-hijacking", "Check for DLL Hijacking in PATH folders");
                 Dictionary<string, string> path_dllhijacking = ServicesInfoHelper.GetPathDLLHijacking();
                 foreach (KeyValuePair<string, string> entry in path_dllhijacking)
@@ -215,7 +217,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("OEM privileged utilities & risky components");
+                Beaprint.MainPrint("OEM privileged utilities & risky components", "T1068");
                 var findings = OemSoftwareHelper.GetPotentiallyVulnerableComponents(Checks.CurrentUserSiDs);
 
                 if (findings.Count == 0)
@@ -261,7 +263,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Kernel drivers with weak/legacy signatures");
+                Beaprint.MainPrint("Kernel drivers with weak/legacy signatures", "T1014");
                 Beaprint.LinkPrint("https://research.checkpoint.com/2025/cracking-valleyrat-from-builder-secrets-to-kernel-rootkits/",
                     "Legacy cross-signed drivers (pre-July-2015) can still grant kernel execution on modern Windows");
 
@@ -330,7 +332,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("KernelQuick / ValleyRAT rootkit indicators");
+                Beaprint.MainPrint("KernelQuick / ValleyRAT rootkit indicators", "T1014");
 
                 bool found = false;
 

winPEAS/winPEASexe/winPEAS/Checks/SoapClientInfo.cs

@@ -7,9 +7,11 @@ namespace winPEAS.Checks
 {
     internal class SoapClientInfo : ISystemCheck
     {
+        public string[] MitreAttackIds { get; } = new[] { "T1559", "T1071.001" };
+
         public void PrintInfo(bool isDebug)
         {
-            Beaprint.GreatPrint(".NET SOAP Client Proxies (SOAPwn)");
+            Beaprint.GreatPrint(".NET SOAP Client Proxies (SOAPwn)", "T1559,T1071.001");
 
             CheckRunner.Run(PrintSoapClientFindings, isDebug);
         }
@@ -18,7 +20,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Potential SOAPwn / HttpWebClientProtocol abuse surfaces");
+                Beaprint.MainPrint("Potential SOAPwn / HttpWebClientProtocol abuse surfaces", "T1559,T1071.001");
                 Beaprint.LinkPrint(
                     "https://labs.watchtowr.com/soapwn-pwning-net-framework-applications-through-http-client-proxies-and-wsdl/",
                     "Look for .NET services that let attackers control SoapHttpClientProtocol URLs or WSDL imports to coerce NTLM or drop files.");

winPEAS/winPEASexe/winPEAS/Checks/SystemInfo.cs

@@ -51,9 +51,11 @@ namespace winPEAS.Checks
             { "be9ba2d9-53ea-4cdc-84e5-9b1eeee46550" , "Block executable content from email client and webmail"},
         };
 
+        public string[] MitreAttackIds { get; } = new[] { "T1082", "T1068", "T1548.002", "T1003.001", "T1003.004", "T1003.005", "T1059.001", "T1552.001", "T1552.002", "T1562.001", "T1562.002", "T1518.001", "T1557.001", "T1558", "T1559", "T1134.001", "T1547.005", "T1484.001", "T1613", "T1654", "T1072", "T1187" };
+
         public void PrintInfo(bool isDebug)
         {
-            Beaprint.GreatPrint("System Information");
+            Beaprint.GreatPrint("System Information", "T1082,T1068,T1548.002,T1003.001,T1003.004,T1003.005,T1059.001,T1552.001,T1552.002,T1562.001,T1562.002,T1518.001,T1557.001,T1558,T1559,T1134.001,T1547.005,T1484.001,T1613,T1654,T1072,T1187");
 
             new List<Action>
             {
@@ -104,7 +106,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Basic System Information");
+                Beaprint.MainPrint("Basic System Information", "T1082");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#version-exploits", "Check if the Windows versions is vulnerable to some known exploit");
                 Dictionary<string, string> basicDictSystem = Info.SystemInfo.SystemInfo.GetBasicOSInfo();
                 _basicSystemInfo = new Dictionary<string, string>(basicDictSystem);
@@ -126,7 +128,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Windows Version Vulnerabilities");
+                Beaprint.MainPrint("Windows Version Vulnerabilities", "T1082,T1068");
 
                 var basicInfo = _basicSystemInfo ?? Info.SystemInfo.SystemInfo.GetBasicOSInfo();
                 var report = WindowsVersionVulns.GetVulnerabilityReport(basicInfo);
@@ -187,7 +189,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Showing All Microsoft Updates");
+                Beaprint.MainPrint("Showing All Microsoft Updates", "T1082");
 
                 var searcher = Type.GetTypeFromProgID("Microsoft.Update.Searcher");
                 var searcherObj = Activator.CreateInstance(searcher);
@@ -247,7 +249,7 @@ namespace winPEAS.Checks
                     { "PS history file: .+", Beaprint.ansi_color_bad },
                     { "PS history size: .+", Beaprint.ansi_color_bad }
                 };
-                Beaprint.MainPrint("PowerShell Settings");
+                Beaprint.MainPrint("PowerShell Settings", "T1059.001");
                 Dictionary<string, string> PSs = Info.SystemInfo.SystemInfo.GetPowerShellSettings();
                 Beaprint.DictPrint(PSs, colorsPSI, false);
             }
@@ -261,7 +263,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("PS default transcripts history");
+                Beaprint.MainPrint("PS default transcripts history", "T1552.001");
                 Beaprint.InfoPrint("Read the PS history inside these files (if any)");
                 string drive = Path.GetPathRoot(Environment.SystemDirectory);
                 string transcriptsPath = drive + @"transcripts\";
@@ -330,7 +332,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Audit Settings");
+                Beaprint.MainPrint("Audit Settings", "T1562.002");
                 Beaprint.LinkPrint("", "Check what is being logged");
                 Dictionary<string, string> auditDict = Info.SystemInfo.SystemInfo.GetAuditSettings();
                 Beaprint.DictPrint(auditDict, false);
@@ -345,7 +347,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Audit Policy Settings - Classic & Advanced");
+                Beaprint.MainPrint("Audit Policy Settings - Classic & Advanced", "T1562.002");
 
                 var policies = AuditPolicies.GetAuditPoliciesInfos();
 
@@ -373,7 +375,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("WEF Settings");
+                Beaprint.MainPrint("WEF Settings", "T1562.002");
                 Beaprint.LinkPrint("", "Windows Event Forwarding, is interesting to know were are sent the logs");
                 Dictionary<string, string> weftDict = Info.SystemInfo.SystemInfo.GetWEFSettings();
                 Beaprint.DictPrint(weftDict, false);
@@ -388,7 +390,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("LAPS Settings");
+                Beaprint.MainPrint("LAPS Settings", "T1003.004");
                 Beaprint.LinkPrint("", "If installed, local administrator password is changed frequently and is restricted by ACL");
                 Dictionary<string, string> lapsDict = Info.SystemInfo.SystemInfo.GetLapsSettings();
                 Dictionary<string, string> colorsSI = new Dictionary<string, string>()
@@ -405,7 +407,7 @@ namespace winPEAS.Checks
 
         static void PrintWdigest()
         {
-            Beaprint.MainPrint("Wdigest");
+            Beaprint.MainPrint("Wdigest", "T1003.001");
             Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#wdigest", "If enabled, plain-text crds could be stored in LSASS");
             string useLogonCredential = RegistryHelper.GetRegValue("HKLM", @"SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest", "UseLogonCredential");
             if (useLogonCredential == "1")
@@ -416,7 +418,7 @@ namespace winPEAS.Checks
 
         static void PrintLSAProtection()
         {
-            Beaprint.MainPrint("LSA Protection");
+            Beaprint.MainPrint("LSA Protection", "T1003.001");
             Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#lsa-protection", "If enabled, a driver is needed to read LSASS memory (If Secure Boot or UEFI, RunAsPPL cannot be disabled by deleting the registry key)");
             string useLogonCredential = RegistryHelper.GetRegValue("HKLM", @"SYSTEM\CurrentControlSet\Control\LSA", "RunAsPPL");
             if (useLogonCredential == "1")
@@ -427,7 +429,7 @@ namespace winPEAS.Checks
 
         static void PrintCredentialGuard()
         {
-            Beaprint.MainPrint("Credentials Guard");
+            Beaprint.MainPrint("Credentials Guard", "T1003.001");
             Beaprint.LinkPrint("https://book.hacktricks.wiki/windows-hardening/stealing-credentials/credentials-protections#credentials-guard", "If enabled, a driver is needed to read LSASS memory");
             string lsaCfgFlags = RegistryHelper.GetRegValue("HKLM", @"System\CurrentControlSet\Control\LSA", "LsaCfgFlags");
 
@@ -452,7 +454,7 @@ namespace winPEAS.Checks
         static void PrintCachedCreds()
         {
             try{
-                Beaprint.MainPrint("Cached Creds");
+                Beaprint.MainPrint("Cached Creds", "T1003.005");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#cached-credentials", "If > 0, credentials will be cached in the registry and accessible by SYSTEM user");
                 string cachedlogonscount = RegistryHelper.GetRegValue("HKLM", @"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon", "CACHEDLOGONSCOUNT");
                 if (!string.IsNullOrEmpty(cachedlogonscount))
@@ -478,7 +480,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("User Environment Variables");
+                Beaprint.MainPrint("User Environment Variables", "T1082");
                 Beaprint.LinkPrint("", "Check for some passwords or keys in the env variables");
                 Dictionary<string, string> userEnvDict = Info.SystemInfo.SystemInfo.GetUserEnvVariables();
                 Dictionary<string, string> colorsSI = new Dictionary<string, string>()
@@ -497,7 +499,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("System Environment Variables");
+                Beaprint.MainPrint("System Environment Variables", "T1082");
                 Beaprint.LinkPrint("", "Check for some passwords or keys in the env variables");
                 Dictionary<string, string> sysEnvDict = Info.SystemInfo.SystemInfo.GetSystemEnvVariables();
                 Dictionary<string, string> colorsSI = new Dictionary<string, string>()
@@ -521,11 +523,11 @@ namespace winPEAS.Checks
                     { "ProxyServer.*", Beaprint.ansi_color_bad }
                 };
 
-                Beaprint.MainPrint("HKCU Internet Settings");
+                Beaprint.MainPrint("HKCU Internet Settings", "T1082");
                 Dictionary<string, string> HKCUDict = Info.SystemInfo.SystemInfo.GetInternetSettings("HKCU");
                 Beaprint.DictPrint(HKCUDict, colorsSI, true);
 
-                Beaprint.MainPrint("HKLM Internet Settings");
+                Beaprint.MainPrint("HKLM Internet Settings", "T1082");
                 Dictionary<string, string> HKMLDict = Info.SystemInfo.SystemInfo.GetInternetSettings("HKLM");
                 Beaprint.DictPrint(HKMLDict, colorsSI, true);
             }
@@ -539,7 +541,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Drives Information");
+                Beaprint.MainPrint("Drives Information", "T1082");
                 Beaprint.LinkPrint("", "Remember that you should search more info inside the other drives");
                 Dictionary<string, string> colorsSI = new Dictionary<string, string>()
                 {
@@ -575,7 +577,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("AV Information");
+                Beaprint.MainPrint("AV Information", "T1518.001");
                 Dictionary<string, string> AVInfo = Info.SystemInfo.SystemInfo.GetAVInfo();
                 if (AVInfo.ContainsKey("Name") && AVInfo["Name"].Length > 0)
                     Beaprint.GoodPrint("    Some AV was detected, search for bypasses");
@@ -594,7 +596,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("UAC Status");
+                Beaprint.MainPrint("UAC Status", "T1548.002");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#from-administrator-medium-to-high-integrity-level--uac-bypasss", "If you are in the Administrators group check how to bypass the UAC");
                 Dictionary<string, string> uacDict = Info.SystemInfo.SystemInfo.GetUACSystemPolicies();
 
@@ -627,7 +629,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Checking WSUS");
+                Beaprint.MainPrint("Checking WSUS", "T1072,T1068");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#wsus");
                 string policyPath = "Software\\Policies\\Microsoft\\Windows\\WindowsUpdate";
                 string policyAUPath = "Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU";
@@ -727,7 +729,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Checking KrbRelayUp");
+                Beaprint.MainPrint("Checking KrbRelayUp", "T1187,T1558");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#krbrelayup");
 
                 if (Checks.CurrentAdDomainName.Length > 0)
@@ -750,7 +752,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Checking If Inside Container");
+                Beaprint.MainPrint("Checking If Inside Container", "T1613");
                 Beaprint.LinkPrint("", "If the binary cexecsvc.exe or associated service exists, you are inside Docker");
                 Dictionary<string, object> regVal = RegistryHelper.GetRegValues("HKLM", @"System\CurrentControlSet\Services\cexecsvc");
                 bool cexecsvcExist = File.Exists(Environment.SystemDirectory + @"\cexecsvc.exe");
@@ -773,7 +775,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Checking AlwaysInstallElevated");
+                Beaprint.MainPrint("Checking AlwaysInstallElevated", "T1548.002");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#alwaysinstallelevated");
                 string path = "Software\\Policies\\Microsoft\\Windows\\Installer";
                 string HKLM_AIE = RegistryHelper.GetRegValue("HKLM", path, "AlwaysInstallElevated");
@@ -804,7 +806,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Object Manager race-window amplification primitives");
+                Beaprint.MainPrint("Object Manager race-window amplification primitives", "T1068");
                 Beaprint.LinkPrint("https://projectzero.google/2025/12/windows-exploitation-techniques.html", "Project Zero write-up:");
 
                 if (ObjectManagerHelper.TryCreateSessionEvent(out var objectName, out var error))
@@ -827,7 +829,7 @@ namespace winPEAS.Checks
 
         private static void PrintNtlmSettings()
         {
-            Beaprint.MainPrint($"Enumerating NTLM Settings");
+            Beaprint.MainPrint($"Enumerating NTLM Settings", "T1557.001");
 
             try
             {
@@ -903,7 +905,7 @@ namespace winPEAS.Checks
 
         private static void PrintPrintNightmarePointAndPrint()
         {
-            Beaprint.MainPrint("PrintNightmare PointAndPrint Policies");
+            Beaprint.MainPrint("PrintNightmare PointAndPrint Policies", "T1068");
             Beaprint.LinkPrint("https://itm4n.github.io/printnightmare-exploitation/", "Check PointAndPrint policy hardening");
 
             try
@@ -936,7 +938,7 @@ namespace winPEAS.Checks
 
         private static void PrintPrintersWMIInfo()
         {
-            Beaprint.MainPrint("Enumerating Printers (WMI)");
+            Beaprint.MainPrint("Enumerating Printers (WMI)", "T1082");
 
             try
             {
@@ -958,7 +960,7 @@ namespace winPEAS.Checks
 
         private static void PrintNamedPipes()
         {
-            Beaprint.MainPrint("Enumerating Named Pipes");
+            Beaprint.MainPrint("Enumerating Named Pipes", "T1559");
 
             try
             {
@@ -985,7 +987,7 @@ namespace winPEAS.Checks
 
         private static void PrintNamedPipeAbuseCandidates()
         {
-            Beaprint.MainPrint("Named Pipes with Low-Priv Write Access to Privileged Servers");
+            Beaprint.MainPrint("Named Pipes with Low-Priv Write Access to Privileged Servers", "T1134.001,T1559");
 
             try
             {
@@ -1026,7 +1028,7 @@ namespace winPEAS.Checks
 
         private void PrintAMSIProviders()
         {
-            Beaprint.MainPrint("Enumerating AMSI registered providers");
+            Beaprint.MainPrint("Enumerating AMSI registered providers", "T1562.001");
 
             try
             {
@@ -1055,7 +1057,7 @@ namespace winPEAS.Checks
 
         private void PrintSysmonConfiguration()
         {
-            Beaprint.MainPrint("Enumerating Sysmon configuration");
+            Beaprint.MainPrint("Enumerating Sysmon configuration", "T1518.001");
 
             Dictionary<string, string> colors = new Dictionary<string, string>
             {
@@ -1088,7 +1090,7 @@ namespace winPEAS.Checks
 
         private void PrintSysmonEventLogs()
         {
-            Beaprint.MainPrint("Enumerating Sysmon process creation logs (1)");
+            Beaprint.MainPrint("Enumerating Sysmon process creation logs (1)", "T1654");
 
             try
             {
@@ -1114,7 +1116,7 @@ namespace winPEAS.Checks
 
         private static void PrintWindowsDefenderInfo()
         {
-            Beaprint.MainPrint("Windows Defender configuration");
+            Beaprint.MainPrint("Windows Defender configuration", "T1518.001");
 
             void DisplayDefenderSettings(WindowsDefenderSettings settings)
             {
@@ -1213,7 +1215,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Installed .NET versions\n");
+                Beaprint.MainPrint("Installed .NET versions\n", "T1082");
 
                 var info = DotNet.GetDotNetInfo();
 
@@ -1269,7 +1271,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("System Last Shutdown Date/time (from Registry)\n");
+                Beaprint.MainPrint("System Last Shutdown Date/time (from Registry)\n", "T1082");
 
                 var shutdownBytes = RegistryHelper.GetRegValueBytes("HKLM", "SYSTEM\\ControlSet001\\Control\\Windows", "ShutdownTime");
                 if (shutdownBytes != null)
@@ -1289,7 +1291,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Enumerate LSA settings - auth packages included\n");
+                Beaprint.MainPrint("Enumerate LSA settings - auth packages included\n", "T1547.005");
 
                 var settings = RegistryHelper.GetRegValues("HKLM", "SYSTEM\\CurrentControlSet\\Control\\Lsa");
 
@@ -1342,7 +1344,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Display Local Group Policy settings - local users/machine");
+                Beaprint.MainPrint("Display Local Group Policy settings - local users/machine", "T1082");
 
                 var infos = GroupPolicy.GetLocalGroupPolicyInfos();
 
@@ -1369,7 +1371,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Potential GPO abuse vectors (applied domain GPOs writable by current user)");
+                Beaprint.MainPrint("Potential GPO abuse vectors (applied domain GPOs writable by current user)", "T1484.001");
 
                 if (!Checks.IsPartOfDomain)
                 {
@@ -1457,7 +1459,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Enumerating PowerShell Session Settings using the registry");
+                Beaprint.MainPrint("Enumerating PowerShell Session Settings using the registry", "T1059.001");
 
                 if (!MyUtils.IsHighIntegrity())
                 {
@@ -1488,7 +1490,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Enumerating saved credentials in Registry (CurrentPass)");
+                Beaprint.MainPrint("Enumerating saved credentials in Registry (CurrentPass)", "T1552.002");
                 string currentPass = "CurrentPass";
                 var hive = "HKLM";
                 var path = "System";

winPEAS/winPEASexe/winPEAS/Checks/UserInfo.cs

@@ -34,9 +34,11 @@ namespace winPEAS.Checks
         static readonly string _badPasswd = "NotChange|NotExpi";
         static readonly string _badPrivileges = "SeImpersonatePrivilege|SeAssignPrimaryPrivilege|SeTcbPrivilege|SeBackupPrivilege|SeRestorePrivilege|SeCreateTokenPrivilege|SeLoadDriverPrivilege|SeTakeOwnershipPrivilege|SeDebugPrivilege";
 
+        public string[] MitreAttackIds { get; } = new[] { "T1087.001", "T1087.004", "T1033", "T1134.001", "T1115", "T1563.002", "T1083", "T1552.002", "T1201" };
+
         public void PrintInfo(bool isDebug)
         {
-            Beaprint.GreatPrint("Users Information");
+            Beaprint.GreatPrint("Users Information", "T1087.001,T1087.004,T1033,T1134.001,T1115,T1563.002,T1083,T1552.002,T1201");
 
             new List<Action>
             {
@@ -77,7 +79,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Users");
+                Beaprint.MainPrint("Users", "T1087.001");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#users--groups", "Check if you have some admin equivalent privileges");
 
                 List<string> usersGrps = User.GetMachineUsers(false, false, false, false, true);
@@ -108,7 +110,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Current Token privileges");
+                Beaprint.MainPrint("Current Token privileges", "T1134.001");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#token-manipulation", "Check if you can escalate privilege using some enabled token");
                 Dictionary<string, string> tokenPrivs = Token.GetTokenGroupPrivs();
                 Beaprint.DictPrint(tokenPrivs, ColorsU(), false);
@@ -123,7 +125,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Clipboard text");
+                Beaprint.MainPrint("Clipboard text", "T1115");
                 string clipboard = UserInfoHelper.GetClipboardText();
                 if (!string.IsNullOrEmpty(clipboard))
                 {
@@ -140,7 +142,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Logged users");
+                Beaprint.MainPrint("Logged users", "T1033");
                 List<string> loggedUsers = User.GetLoggedUsers();
 
                 Beaprint.ListPrint(loggedUsers, ColorsU());
@@ -155,7 +157,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("RDP Sessions");
+                Beaprint.MainPrint("RDP Sessions", "T1563.002");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/credentials-mgmt/rdp-sessions", "Disconnected high-privilege RDP sessions keep reusable tokens inside LSASS.");
                 List<Dictionary<string, string>> rdp_sessions = UserInfoHelper.GetRDPSessions();
                 if (rdp_sessions.Count > 0)
@@ -230,7 +232,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Ever logged users");
+                Beaprint.MainPrint("Ever logged users", "T1033");
                 List<string> everLogged = User.GetEverLoggedUsers();
                 Beaprint.ListPrint(everLogged, ColorsU());
             }
@@ -244,7 +246,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Home folders found");
+                Beaprint.MainPrint("Home folders found", "T1083");
                 List<string> user_folders = User.GetUsersFolders();
                 foreach (string ufold in user_folders)
                 {
@@ -269,7 +271,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Looking for AutoLogon credentials");
+                Beaprint.MainPrint("Looking for AutoLogon credentials", "T1552.002");
                 bool ban = false;
                 Dictionary<string, string> autologon = UserInfoHelper.GetAutoLogon();
                 if (autologon.Count > 0)
@@ -307,7 +309,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Password Policies");
+                Beaprint.MainPrint("Password Policies", "T1201");
                 Beaprint.LinkPrint("", "Check for a possible brute-force");
                 List<Dictionary<string, string>> PPy = UserInfoHelper.GetPasswordPolicy();
                 Beaprint.DictPrint(PPy, ColorsU(), false);
@@ -322,7 +324,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Print Logon Sessions");
+                Beaprint.MainPrint("Print Logon Sessions", "T1033");
 
                 var logonSessions = LogonSessions.GetLogonSessions();
 
@@ -355,7 +357,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Current User Idle Time");
+                Beaprint.MainPrint("Current User Idle Time", "T1033");
 
                 var lastInputInfo = new LastInputInfo();
                 lastInputInfo.Size = (uint)Marshal.SizeOf(lastInputInfo);
@@ -380,7 +382,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Display information about local users");
+                Beaprint.MainPrint("Display information about local users", "T1087.001");
 
                 var computerName = Environment.GetEnvironmentVariable("COMPUTERNAME");
 
@@ -433,7 +435,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Display Tenant information (DsRegCmd.exe /status)");
+                Beaprint.MainPrint("Display Tenant information (DsRegCmd.exe /status)", "T1087.004");
 
                 var info = Tenant.GetTenantInfo();
 

winPEAS/winPEASexe/winPEAS/Checks/WindowsCreds.cs

@@ -19,9 +19,11 @@ namespace winPEAS.Checks
 {
     internal class WindowsCreds : ISystemCheck
     {
+        public string[] MitreAttackIds { get; } = new[] { "T1552.001", "T1552.002", "T1555.003", "T1555.004", "T1558", "T1547.005", "T1563.002" };
+
         public void PrintInfo(bool isDebug)
         {
-            Beaprint.GreatPrint("Windows Credentials");
+            Beaprint.GreatPrint("Windows Credentials", "T1552.001,T1552.002,T1555.003,T1555.004,T1558,T1547.005,T1563.002");
 
             new List<Action>
             {
@@ -47,7 +49,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Checking Windows Vault");
+                Beaprint.MainPrint("Checking Windows Vault", "T1555.004");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#credentials-manager--windows-vault");
                 var vaultCreds = VaultCli.DumpVault();
 
@@ -67,7 +69,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Checking Credential manager");
+                Beaprint.MainPrint("Checking Credential manager", "T1555.004");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#credentials-manager--windows-vault");
 
                 var colorsC = new Dictionary<string, string>()
@@ -113,7 +115,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Saved RDP connections");
+                Beaprint.MainPrint("Saved RDP connections", "T1552.002");
 
                 List<Dictionary<string, string>> rdps_info = RemoteDesktop.GetSavedRDPConnections();
                 if (rdps_info.Count > 0)
@@ -138,7 +140,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Recently run commands");
+                Beaprint.MainPrint("Recently run commands", "T1552.002");
                 Dictionary<string, object> recentCommands = KnownFileCredsInfo.GetRecentRunCommands();
                 Beaprint.DictPrint(recentCommands, false);
             }
@@ -152,7 +154,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Checking for DPAPI Master Keys");
+                Beaprint.MainPrint("Checking for DPAPI Master Keys", "T1555.003");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#dpapi");
                 var masterKeys = KnownFileCredsInfo.ListMasterKeys();
 
@@ -180,7 +182,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Checking for DPAPI Credential Files");
+                Beaprint.MainPrint("Checking for DPAPI Credential Files", "T1555.003");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#dpapi");
                 var credFiles = KnownFileCredsInfo.GetCredFiles();
                 Beaprint.DictPrint(credFiles, false);
@@ -200,7 +202,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Checking for RDCMan Settings Files");
+                Beaprint.MainPrint("Checking for RDCMan Settings Files", "T1552.001");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#remote-desktop-credential-manager",
                     "Dump credentials from Remote Desktop Connection Manager");
                 var rdcFiles = RemoteDesktop.GetRDCManFiles();
@@ -221,7 +223,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Looking for Kerberos tickets");
+                Beaprint.MainPrint("Looking for Kerberos tickets", "T1558");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-kerberos-88/index.html");
                 var kerberosTickets = Kerberos.ListKerberosTickets();
 
@@ -237,7 +239,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Looking for Kerberos TGT tickets");
+                Beaprint.MainPrint("Looking for Kerberos TGT tickets", "T1558");
                 var kerberosTgts = Kerberos.GetKerberosTGTData();
                 Beaprint.DictPrint(kerberosTgts, false);
             }
@@ -251,7 +253,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Looking for saved Wifi credentials");
+                Beaprint.MainPrint("Looking for saved Wifi credentials", "T1552.001");
 
                 WlanClient wlanClient = new WlanClient();
 
@@ -306,7 +308,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Looking AppCmd.exe");
+                Beaprint.MainPrint("Looking AppCmd.exe", "T1552.001");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#appcmdexe");
 
                 var appCmdPath = Environment.ExpandEnvironmentVariables(@"%systemroot%\system32\inetsrv\appcmd.exe");
@@ -367,7 +369,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Looking SSClient.exe");
+                Beaprint.MainPrint("Looking SSClient.exe", "T1552.001");
                 Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#scclient--sccm");
 
                 if (File.Exists(Environment.ExpandEnvironmentVariables(@"%systemroot%\Windows\CCM\SCClient.exe")))
@@ -389,7 +391,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Enumerating SSCM - System Center Configuration Manager settings");
+                Beaprint.MainPrint("Enumerating SSCM - System Center Configuration Manager settings", "T1552.001");
 
                 var server = RegistryHelper.GetRegValue("HKLM", @"SOFTWARE\Microsoft\CCMSetup", "LastValidMP");
                 var siteCode = RegistryHelper.GetRegValue("HKLM", @"SOFTWARE\Microsoft\SMS\Mobile Client", "AssignedSiteCode");
@@ -412,7 +414,7 @@ namespace winPEAS.Checks
 
         private static void PrintSecurityPackagesCredentials()
         {
-            Beaprint.MainPrint("Enumerating Security Packages Credentials");
+            Beaprint.MainPrint("Enumerating Security Packages Credentials", "T1547.005");
 
             try
             {
@@ -445,7 +447,7 @@ namespace winPEAS.Checks
         {
             try
             {
-                Beaprint.MainPrint("Remote Desktop Server/Client Settings");
+                Beaprint.MainPrint("Remote Desktop Server/Client Settings", "T1563.002");
 
                 var info = Info.WindowsCreds.RemoteDesktop.GetRDPSettingsInfo();
 

winPEAS/winPEASexe/winPEAS/Helpers/Beaprint.cs

@@ -142,6 +142,7 @@ namespace winPEAS.Helpers
             Console.WriteLine();
             Console.WriteLine(LCYAN + "        quiet" + GRAY + "                Do not print banner" + NOCOLOR);
             Console.WriteLine(LCYAN + "        notcolor" + GRAY + "             Don't use ansi colors (all white)" + NOCOLOR);
+            Console.WriteLine(LCYAN + "        mitre=T1082,T1548" + GRAY + $"   Only run checks matching the specified MITRE ATT&CK technique IDs (comma-separated)" + NOCOLOR);
             Console.WriteLine(LCYAN + "        searchpf" + GRAY + "             Search credentials via regex also in Program Files folders" + NOCOLOR);
             Console.WriteLine(LCYAN + "        wait" + GRAY + "                 Wait for user input between checks" + NOCOLOR);
             Console.WriteLine(LCYAN + "        debug" + GRAY + "                Display debugging information - memory usage, method execution time" + NOCOLOR);
@@ -166,25 +167,22 @@ namespace winPEAS.Helpers
         /////////////////////////////////
         /// DIFFERENT PRINT FUNCTIONS ///
         /////////////////////////////////
-        public static void GreatPrint(string toPrint)
+        public static void GreatPrint(string toPrint, string mitreIds = null)
         {
             // print_title
-
             Console.WriteLine();
             Console.WriteLine();
-            int halfTotal = 60;
-            //Console.WriteLine(LCYAN + "  " + new String('=', halfTotal - toPrint.Length) + "(" + NOCOLOR + YELLOW + toPrint + LCYAN + ")" + new String('=', halfTotal - toPrint.Length) + NOCOLOR);
 
-            Console.WriteLine($"{LCYAN}════════════════════════════════════╣ {GREEN}{toPrint}{LCYAN} ╠════════════════════════════════════{NOCOLOR}");
+            string mitreSuffix = string.IsNullOrEmpty(mitreIds) ? "" : $" {DGRAY}({mitreIds}){LCYAN}";
+            Console.WriteLine($"{LCYAN}════════════════════════════════════╣ {GREEN}{toPrint}{mitreSuffix}{LCYAN} ╠════════════════════════════════════{NOCOLOR}");
         }
 
-        public static void MainPrint(string toPrint)
+        public static void MainPrint(string toPrint, string mitreIds = null)
         {
             // print_2title
-
             Console.WriteLine();
-            //Console.WriteLine(YELLOW + "  [+] " + GREEN + toPrint + NOCOLOR);
-            Console.WriteLine($"{LCYAN}╔══════════╣ {GREEN}{toPrint}{NOCOLOR}");
+            string mitreSuffix = string.IsNullOrEmpty(mitreIds) ? "" : $" {DGRAY}({mitreIds}){NOCOLOR}";
+            Console.WriteLine($"{LCYAN}╔══════════╣ {GREEN}{toPrint}{mitreSuffix}{NOCOLOR}");
         }
 
         public static void LinkPrint(string link, string comment = "")