TA0001 4
Initial Access
T1078Valid Accounts
T1190Exploit Public-Facing Application
T1566Phishing
T1566.003Phishing: Spearphishing via Service
TA0002 4
Execution
T1059.001Command and Scripting Interpreter: PowerShell
T1059.004Command and Scripting Interpreter: Unix Shell
T1569System Services
T1569.002System Services: Service Execution
TA0003 6
Persistence
T1037Boot or Logon Initialization Scripts
T1053Scheduled Task/Job
T1053.005Scheduled Task/Job: Scheduled Task
T1098.004Account Manipulation: SSH Authorized Keys
T1136Create Account
T1547Boot or Logon Autostart Execution
TA0004 1
Privilege Escalation
T1068Exploitation for Privilege Escalation
TA0005 11
Defense Evasion
T1027Obfuscated Files or Information
T1036.001Masquerading: Invalid Code Signature
T1134.004Access Token Manipulation: Parent PID Spoofing
T1211Exploitation for Defense Evasion
T1480Execution Guardrails
T1497.001Virtualization/Sandbox Evasion: System Checks
T1553.002Subvert Trust Controls: Code Signing
T1562.001Disable or Modify Tools
T1562.004Impair Defenses: Disable or Modify System Firewall
T1564Hidden Artifacts
T1564.003Hidden Artifacts: Hidden Window
TA0006 4
Credential Access
T1003.001OS Credential Dumping: LSASS Memory
T1040Network Sniffing
T1110.002Brute Force: Password Cracking
T1555.003Credentials from Web Browsers
TA0007 4
Discovery
T1012Query Registry
T1046Network Service Discovery
T1082System Information Discovery
T1614System Location Discovery
TA0008 5
Lateral Movement
T1021Remote Services
T1021.001Remote Services: Remote Desktop Protocol
T1021.002Remote Services: SMB/Windows Admin Shares
T1021.004Remote Services: SSH
T1570Lateral Tool Transfer
TA0009 2
Collection
T1560.001Archive Collected Data: Archive via Utility
T1602.002Network Device Configuration Dump
TA0010 4
Exfiltration
T1011Exfiltration Over Other Network Medium
T1011.001Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth
T1048.003Exfiltration Over Alternative Protocol: Unencrypted Non-C2 Protocol
T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage
TA0011 4
Command & Control
T1001Data Obfuscation
T1001.001Data Obfuscation: Junk Data
T1071.001Application Layer Protocol: Web Protocols
T1572Protocol Tunneling
TA0040 4
Impact
T1486Data Encrypted for Impact
T1490Inhibit System Recovery
T1561Disk Wipe
T1561.001Disk Wipe: Disk Content Wipe