TA0001 2
Initial Access
T1078Valid Accounts
T1190Exploit Public-Facing Application
TA0002 3
Execution
T1053.005Scheduled Task/Job: Scheduled Task
T1059Command and Scripting Interpreter
T1059.001Command and Scripting Interpreter: PowerShell
TA0004 0
Privilege Escalation
TA0005 6
Defense Evasion
T1027Obfuscated Files or Information
T1070Indicator Removal
T1070.001Indicator Removal: Clear Windows Event Logs
T1484Domain or Tenant Policy Modification
T1484.001Domain or Tenant Policy Modification: Group Policy Modification
T1562.001Disable or Modify Tools
TA0006 4
Credential Access
T1003OS Credential Dumping
T1003.001OS Credential Dumping: LSASS Memory
T1003.003OS Credential Dumping: NTDS
T1552Unsecured Credentials
TA0007 5
Discovery
T1016System Network Configuration Discovery
T1046Network Service Discovery
T1087.002Account Discovery: Domain Account
T1518Software Discovery
T1518.001Software Discovery: Security Software Discovery
TA0008 3
Lateral Movement
T1021.001Remote Services: Remote Desktop Protocol
T1021.002Remote Services: SMB/Windows Admin Shares
T1570Lateral Tool Transfer
TA0009 2
Collection
T1560Archive Collected Data
T1560.001Archive Collected Data: Archive via Utility
TA0010 1
Exfiltration
T1048Exfiltration Over Alternative Protocol
TA0011 1
Command & Control
T1219Remote Access Software
TA0040 4
Impact
T1486Data Encrypted for Impact
T1489Service Stop
T1490Inhibit System Recovery
T1657Financial Theft