TA0001 1
Initial Access
T1189Drive-by Compromise
TA0002 3
Execution
T1059Command and Scripting Interpreter
T1059.001Command and Scripting Interpreter: PowerShell
T1204.002User Execution: Malicious File
TA0003 2
Persistence
T1053Scheduled Task/Job
T1053.005Scheduled Task/Job: Scheduled Task
TA0004 1
Privilege Escalation
T1068Exploitation for Privilege Escalation
TA0005 2
Defense Evasion
T1027Obfuscated Files or Information
T1218System Binary Proxy Execution
TA0006 1
Credential Access
T1003.001OS Credential Dumping: LSASS Memory
TA0007 2
Discovery
T1007System Service Discovery
T1057Process Discovery
TA0008 2
Lateral Movement
T1021.001Remote Services: Remote Desktop Protocol
T1021.002Remote Services: SMB/Windows Admin Shares
TA0009 1
Collection
T1119Automated Collection
TA0010 2
Exfiltration
T1020Automated Exfiltration
T1041Exfiltration Over C2 Channel
TA0011 2
Command & Control
T1071Application Layer Protocol
T1071.001Application Layer Protocol: Web Protocols