TA0043: Reconnaissance TA0042: Resource Development TA0001: Initial Access
T1595: Active Scanning T1650: Acquire Access T1189: Drive-by Compromise
T1592: Gather Victim Host Informati T1583: Acquire Infrastructure T1190: Exploit Public-Facing Applicat
T1589: Gather Victim Identity Inform T1586: Compromise Accounts T1133: External Remote Services
T1590: Gather Victim Network InformT1584: Compromise Infrastructure T1200: Hardware Additions
T1591: Gather Victim Org Informatio T1587: Develop Capabilities T1566: Phishing
T1598: Phishing for Information T1585: Establish Accounts T1091: Replication Through Removab
T1597: Search Closed Sources T1588: Obtain Capabilities T1195: Supply Chain Compromise
T1596: Search Open Technical DatabaT1608: Stage Capabilities T1199: Trusted Relationship
T1593: Search Open Websites/Domains T1078: Valid Accounts
T1594: Search Victim-Owned Websites
TA0002: Execution TA0003: Persistence TA0004: Privilege Escalation
T1651: Cloud Administration Comma T1098: Account Manipulation T1548: Abuse Elevation Control Mec
T1059: Command and Scripting InterpT1197: BITS Jobs T1134: Access Token Manipulation
T1609: Container Administration C T1547: Boot or Logon Autostart ExecuT1547: Boot or Logon Autostart Execu
T1610: Deploy Container T1037: Boot or Logon Initialization ScrT1037: Boot or Logon Initialization Scr
T1203: Exploitation for Client Executi T1176: Browser Extensions T1543: Create or Modify System Proc
T1559: Inter-Process CommunicationT1554: Compromise Client Software BT1484: Domain Policy Modification
T1106: Native API T1136: Create Account T1611: Escape to Host
T1053: Scheduled Task/Job T1543: Create or Modify System ProcT1546: Event Triggered Execution
T1648: Serverless Execution T1546: Event Triggered Execution T1068: Exploitation for Privilege Esca
T1129: Shared Modules T1133: External Remote Services T1574: Hijack Execution Flow
T1072: Software Deployment Tools T1574: Hijack Execution Flow T1055: Process Injection
T1569: System Services T1525: Implant Internal Image T1053: Scheduled Task/Job
T1204: User Execution T1556: Modify Authentication ProcesT1078: Valid Accounts
T1047: Windows Management InstruT1137: Office Application Startup
T1542: Pre-OS Boot
T1053: Scheduled Task/Job
T1505: Server Software Component
T1205: Traffic Signaling
T1078: Valid Accounts
TA0005: Defense Evasion TA0006: Credential Access TA0007: Discovery
T1548: Abuse Elevation Control Mec T1557: Adversary-in-the-Middle T1087: Account Discovery
T1134: Access Token Manipulation T1110: Brute Force T1010: Application Window Discover
T1197: BITS Jobs T1555: Credentials from Password St T1217: Browser Information Discover
T1612: Build Image on Host T1212: Exploitation for Credential Ac T1580: Cloud Infrastructure Discover
T1622: Debugger Evasion T1187: Forced Authentication T1538: Cloud Service Dashboard
T1140: Deobfuscate/Decode Files oT1606: Forge Web Credentials T1526: Cloud Service Discovery
T1610: Deploy Container T1056: Input Capture T1619: Cloud Storage Object Discove
T1006: Direct Volume Access T1556: Modify Authentication ProcesT1613: Container and Resource Disco
T1484: Domain Policy Modification T1111: Multi-Factor Authentication I T1622: Debugger Evasion
T1480: Execution Guardrails T1621: Multi-Factor Authentication T1652: Device Driver Discovery
T1211: Exploitation for Defense EvasiT1040: Network Sniffing T1482: Domain Trust Discovery
T1222: File and Directory PermissionsT1003: OS Credential Dumping T1083: File and Directory Discovery
T1564: Hide Artifacts T1528: Steal Application Access Toke T1615: Group Policy Discovery
T1574: Hijack Execution Flow T1649: Steal or Forge Authentication TC1046: Network Service Discovery
T1562: Impair Defenses T1558: Steal or Forge Kerberos TicketT1135: Network Share Discovery
T1070: Indicator Removal T1539: Steal Web Session Cookie T1040: Network Sniffing
T1202: Indirect Command Execution T1552: Unsecured Credentials T1201: Password Policy Discovery
T1036: Masquerading T1120: Peripheral Device Discovery
T1556: Modify Authentication Process T1069: Permission Groups Discovery
T1578: Modify Cloud Compute Infrastructure T1057: Process Discovery
T1112: Modify Registry T1012: Query Registry
T1601: Modify System Image T1018: Remote System Discovery
T1599: Network Boundary Bridging T1518: Software Discovery
T1027: Obfuscated Files or Information T1082: System Information Discovery
T1647: Plist File Modification T1614: System Location Discovery
T1542: Pre-OS Boot T1016: System Network Configuration Discovery
T1055: Process Injection T1049: System Network Connections Discovery
T1620: Reflective Code Loading T1033: System Owner/User Discovery
T1207: Rogue Domain Controller T1007: System Service Discovery
T1014: Rootkit T1124: System Time Discovery
T1553: Subvert Trust Controls T1497: Virtualization/Sandbox Evasion
T1218: System Binary Proxy Execution
T1216: System Script Proxy Execution
T1221: Template Injection
T1205: Traffic Signaling
T1127: Trusted Developer Utilities Proxy Execution
T1535: Unused/Unsupported Cloud Regions
T1550: Use Alternate Authentication Material
T1078: Valid Accounts
T1497: Virtualization/Sandbox Evasion
T1600: Weaken Encryption
T1220: XSL Script Processing
TA0008: Lateral Movement TA0009: Collection TA0011: Command and Control
T1210: Exploitation of Remote Servic T1557: Adversary-in-the-Middle T1071: Application Layer Protocol
T1534: Internal Spearphishing T1560: Archive Collected Data T1092: Communication Through Rem
T1570: Lateral Tool Transfer T1123: Audio Capture T1132: Data Encoding
T1563: Remote Service Session HijackT1119: Automated Collection T1001: Data Obfuscation
T1021: Remote Services T1185: Browser Session Hijacking T1568: Dynamic Resolution
T1091: Replication Through RemovabT1115: Clipboard Data T1573: Encrypted Channel
T1072: Software Deployment Tools T1530: Data from Cloud Storage T1008: Fallback Channels
T1080: Taint Shared Content T1602: Data from Configuration RepoT1105: Ingress Tool Transfer
T1550: Use Alternate Authentication T1213: Data from Information RepositT1104: Multi-Stage Channels
T1005: Data from Local System T1095: Non-Application Layer Protocol
T1039: Data from Network Shared DrT1571: Non-Standard Port
ry Discovery T1025: Data from Removable Media T1572: Protocol Tunneling
T1074: Data Staged T1090: Proxy
T1114: Email Collection T1219: Remote Access Software
T1056: Input Capture T1205: Traffic Signaling
T1113: Screen Capture T1102: Web Service
T1125: Video Capture
on Discovery
Configuration Discovery
Connections Discovery
er Discovery
dbox Evasion
TA0010: Exfiltration TA0040: Impact
T1020: Automated Exfiltration T1531: Account Access Removal
T1030: Data Transfer Size Limits T1485: Data Destruction
T1048: Exfiltration Over Alternative PT1486: Data Encrypted for Impact
T1041: Exfiltration Over C2 Channel T1565: Data Manipulation
T1011: Exfiltration Over Other Netw T1491: Defacement
T1052: Exfiltration Over Physical Me T1561: Disk Wipe
T1567: Exfiltration Over Web Service T1499: Endpoint Denial of Service
T1029: Scheduled Transfer T1495: Firmware Corruption
T1537: Transfer Data to Cloud AccounT1490: Inhibit System Recovery
ayer Protocol T1498: Network Denial of Service
T1496: Resource Hijacking
T1489: Service Stop
T1529: System Shutdown/Reboot
