TA0001 1
Initial Access
T1078Valid Accounts
TA0002 2
Execution
T1059.001Command and Scripting Interpreter: PowerShell
T1059.003Command and Scripting Interpreter: Windows Command Shell
TA0003 1
Persistence
T1053.005Scheduled Task/Job: Scheduled Task
TA0004 0
Privilege Escalation
TA0005 2
Defense Evasion
T1070Indicator Removal
T1218System Binary Proxy Execution
TA0006 0
Credential Access
TA0008 1
Lateral Movement
T1021.001Remote Services: Remote Desktop Protocol
TA0010 1
Exfiltration
T1041Exfiltration Over C2 Channel
TA0011 0
Command & Control
TA0040 2
Impact
T1486Data Encrypted for Impact
T1490Inhibit System Recovery