- AR3
 - -PR027
 - -PR027.003
 
Physical Impersonation Through Dress, Uniforms, or Appearance - AR3
Contributor: The ITM Team @  - Subsection PR027.003
- AR3
 - -PR027
 - -PR027.004
 
Cloning or Forging ID Cards for Physical Access - AR3
Contributor: The ITM Team @  - Subsection PR027.004
- AR5
 - -AF022
 - -AF022.001
 
Use of a Virtual Machine - AR5
Contributor: The ITM Team @  - Subsection AF022.001
- AR5
 - -AF022
 - -AF022.003
 
Portable Hypervisors - AR5
Contributor: The ITM Team @  - Subsection AF022.003
- AR5
 - -AF022
 - -AF022.004
 
Snapshots and Rollbacks to Remove Evidence - AR5
Contributor: The ITM Team @  - Subsection AF022.004
- AR4
 - -IF022
 - -IF022.005
 
Media Leak - AR4
Contributor: The ITM Team @  - Subsection IF022.005
- AR2
 - -ME024
 - -ME024.006
 
Access to Sensitive Organization Data - AR2
Contributor: The ITM Team @  - Subsection ME024.006
- AR3
 - -PR028
 - -PR028.001
 
Capture via Screenshot - AR3
Contributor: The ITM Team @  - Subsection PR028.001
- AR3
 - -PR028
 - -PR028.002
 
Capture via Screen Recording - AR3
Contributor: The ITM Team @  - Subsection PR028.002
- AR5
 - -AF001
 - -AF001.003
 
PYTHONHISTORY Environment Variable Null - AR5
Contributor: The ITM Team @  - Subsection AF001.003