TA0002 5
Execution
T1047Windows Management Instrumentation
T1059Command and Scripting Interpreter
T1064Scripting
T1106Native API
T1129Shared Modules
TA0003 1
Persistence
T1543.003Windows Services
TA0004 0
Privilege Escalation
TA0005 12
Defense Evasion
T1027Obfuscated Files or Information
T1027.005Indicator Removal from Tools
T1027.009Embedded Payloads
T1036Masquerading
T1064Scripting
T1070.001Clear Windows Event Logs
T1070.004File Deletion
T1202Indirect Command Execution
T1222File and Directory Permissions Modification
T1548Abuse Elevation Control Mechanism
T1562.001Disable or Modify Tools
T1564.003Hidden Window
TA0006 1
Credential Access
T1056Input Capture
TA0007 9
Discovery
T1007System Service Discovery
T1010Application Window Discovery
T1016System Network Configuration Discovery
T1018Remote System Discovery
T1057Process Discovery
T1082System Information Discovery
T1083File and Directory Discovery
T1135Network Share Discovery
T1518.001Security Software Discovery
TA0009 2
Collection
T1074Data Staged
T1119Automated Collection
TA0011 0
Command & Control
TA0040 4
Impact
T1485Data Destruction
T1486Data Encrypted for Impact
T1489Service Stop
T1490Inhibit System Recovery