TA0001 5
Initial Access
T1078Valid Accounts
T1078.002Valid Accounts: Domain Accounts
T1133External Remote Services
T1190Exploit Public-Facing Application
T1566Phishing
TA0002 5
Execution
T1047Windows Management Instrumentation
T1059Command and Scripting Interpreter
T1059.001Command and Scripting Interpreter: PowerShell
T1059.003Command and Scripting Interpreter: Windows Command Shell
T1072Software Deployment Tools
TA0003 3
Persistence
T1136Create Account
T1543Create or Modify System Process
T1547Boot or Logon Autostart Execution
TA0004 3
Privilege Escalation
T1068Exploitation for Privilege Escalation
T1187Forced Authentication
T1557Adversary-in-the-Middle
TA0005 7
Defense Evasion
T1027Obfuscated Files or Information
T1070Indicator Removal
T1090Proxy
T1112Modify Registry
T1484.001Domain Policy Modification: Group Policy Modification
T1562Impair Defenses
T1562.001Impair Defenses: Disable or Modify Tools
TA0006 4
Credential Access
T1003OS Credential Dumping
T1110Brute Force
T1552Unsecured Credentials
T1555Credentials from Password Stores
TA0007 7
Discovery
T1018Remote System Discovery
T1046Network Service Discovery
T1069Permission Groups Discovery
T1087Account Discovery
T1087.002Account Discovery: Domain Account
T1482Domain Trust Discovery
T1526Cloud Service Discovery
TA0008 5
Lateral Movement
T1021Remote Services
T1021.001Remote Services: Remote Desktop Protocol
T1021.002Remote Services: SMB/Windows Admin Shares
T1021.004Remote Services: SSH
T1563Remote Service Session Hijacking
TA0009 5
Collection
T1005Data from Local System
T1039Data from Network Shared Drive
T1074Data Staged
T1074.001Data Staged: Local Data Staging
T1114Email Collection
TA0010 3
Exfiltration
T1048Exfiltration Over Alternative Protocol
T1048.001Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol
T1537Transfer Data to Cloud Account
TA0011 5
Command & Control
T1071Application Layer Protocol
T1071.001Application Layer Protocol: Web Protocols
T1219Remote Access Software
T1572Protocol Tunneling
T1573Encrypted Channel
TA0040 4
Impact
T1486Data Encrypted for Impact
T1489Service Stop
T1490Inhibit System Recovery
T1491Defacement