TA0002 3
Execution
T1053Scheduled Task/Job
T1059Command and Scripting Interpreter
T1129Shared Modules
TA0003 3
Persistence
T1053Scheduled Task/Job
T1547Boot or Logon Autostart Execution
T1547.001Registry Run Keys/Startup Folder
TA0004 4
Privilege Escalation
T1053Scheduled Task/Job
T1134.001Token Impersonation/Theft
T1547Boot or Logon Autostart Execution
T1547.001Registry Run Keys/Startup Files
TA0005 9
Defense Evasion
T1027Obfuscated Files or Information
T1027.002Software Packing
T1036Masquerading
T1070.004File Deletion
T1112Modify Registry
T1202Indirect Command Execution
T1497Virtualization/Sandbox Evasion
T1562.001Disable or Modify Tools
T1564.001Hidden Files and Directories
TA0006 2
Credential Access
T1003OS Credential Dumping
T1056Input Capture
TA0007 6
Discovery
T1057Process Discovery
T1082System Information Discovery
T1083File and Directory Discovery
T1135Network Share Discovery
T1497Virtualization/Sandbox Evasion
T1518.001Security Software Discovery
TA0008 1
Lateral Movement
T1080Taint Shared Content
TA0009 3
Collection
T1005Data from Local System
T1056Input Capture
T1074Data Staged
TA0011 0
Command & Control
TA0040 3
Impact
T1485Data Destruction
T1486Data Encrypted for Impact
T1490Inhibit System Recovery