T1092 |
Communication Through Removable Media |
9 |
0 |
T1564.006 |
Run Virtual Instance |
11 |
0 |
T1134.003 |
Make and Impersonate Token |
8 |
0 |
T1078 |
Valid Accounts |
25 |
4 |
T1213.003 |
Code Repositories |
15 |
0 |
T1598.001 |
Spearphishing Service |
9 |
0 |
T1568 |
Dynamic Resolution |
13 |
3 |
T1005 |
Data from Local System |
15 |
0 |
T1218.005 |
Mshta |
12 |
0 |
T1059 |
Command and Scripting Interpreter |
27 |
8 |
T1048.003 |
Exfiltration Over Unencrypted Non-C2 Protocol |
26 |
0 |
T1491.001 |
Internal Defacement |
12 |
0 |
T1580 |
Cloud Infrastructure Discovery |
6 |
0 |
T1568.002 |
Domain Generation Algorithms |
11 |
0 |
T1553.006 |
Code Signing Policy Modification |
14 |
0 |
T1573 |
Encrypted Channel |
15 |
2 |
T1550.001 |
Application Access Token |
17 |
0 |
T1573.002 |
Asymmetric Cryptography |
14 |
0 |
T1647 |
Plist File Modification |
15 |
0 |
T1552.001 |
Credentials In Files |
20 |
0 |
T1566.001 |
Spearphishing Attachment |
16 |
0 |
T1132.002 |
Non-Standard Encoding |
10 |
0 |
T1211 |
Exploitation for Defense Evasion |
26 |
0 |
T1106 |
Native API |
8 |
0 |
T1218.011 |
Rundll32 |
5 |
0 |
T1546.008 |
Accessibility Features |
7 |
0 |
T1021.005 |
VNC |
25 |
0 |
T1218.009 |
Regsvcs/Regasm |
12 |
0 |
T1558.003 |
Kerberoasting |
20 |
0 |
T1584.007 |
Serverless |
2 |
0 |
T1070.001 |
Clear Windows Event Logs |
23 |
0 |
T1562.003 |
Impair Command History Logging |
6 |
0 |
T1195.002 |
Compromise Software Supply Chain |
10 |
0 |
T1563.002 |
RDP Hijacking |
21 |
0 |
T1137.003 |
Outlook Forms |
8 |
0 |
T1542.005 |
TFTP Boot |
25 |
0 |
T1087.004 |
Cloud Account |
6 |
0 |
T1565.002 |
Transmitted Data Manipulation |
13 |
0 |
T1110.002 |
Password Cracking |
17 |
0 |
T1546 |
Event Triggered Execution |
10 |
16 |
T1218.002 |
Control Panel |
12 |
0 |
T1003.005 |
Cached Domain Credentials |
21 |
0 |
T1071 |
Application Layer Protocol |
20 |
4 |
T1059.003 |
Windows Command Shell |
14 |
0 |
T1218.013 |
Mavinject |
12 |
0 |
T1037.003 |
Network Logon Script |
8 |
0 |
T1137.006 |
Add-ins |
6 |
0 |
T1562.008 |
Disable Cloud Logs |
8 |
0 |
T1547.013 |
XDG Autostart Entries |
16 |
0 |
T1485 |
Data Destruction |
13 |
0 |
T1537 |
Transfer Data to Cloud Account |
22 |
0 |
T1001 |
Data Obfuscation |
9 |
3 |
T1195.001 |
Compromise Software Dependencies and Development Tools |
10 |
0 |
T1204.003 |
Malicious Image |
25 |
0 |
T1606.001 |
Web Cookies |
6 |
0 |
T1561 |
Disk Wipe |
14 |
2 |
T1555.005 |
Password Managers |
8 |
0 |
T1562.007 |
Disable or Modify Cloud Firewall |
8 |
0 |
T1218.012 |
Verclsid |
17 |
0 |
T1555.002 |
Securityd Memory |
6 |
0 |
T1090.004 |
Domain Fronting |
3 |
0 |
T1011.001 |
Exfiltration Over Bluetooth |
10 |
0 |
T1598.002 |
Spearphishing Attachment |
14 |
0 |
T1542.004 |
ROMMONkit |
21 |
0 |
T1562.004 |
Disable or Modify System Firewall |
15 |
0 |
T1011 |
Exfiltration Over Other Network Medium |
6 |
1 |
T1070.009 |
Clear Persistence |
10 |
0 |
T1583.007 |
Serverless |
2 |
0 |
T1027.009 |
Embedded Payloads |
4 |
0 |
T1571 |
Non-Standard Port |
11 |
0 |
T1564.010 |
Process Argument Spoofing |
3 |
0 |
T1200 |
Hardware Additions |
6 |
0 |
T1216.001 |
PubPrn |
7 |
0 |
T1037.002 |
Login Hook |
8 |
0 |
T1562.006 |
Indicator Blocking |
18 |
0 |
T1498.002 |
Reflection Amplification |
12 |
0 |
T1547.012 |
Print Processors |
9 |
0 |
T1543.003 |
Windows Service |
11 |
0 |
T1090 |
Proxy |
16 |
4 |
T1001.001 |
Junk Data |
11 |
0 |
T1556.002 |
Password Filter DLL |
6 |
0 |
T1137.004 |
Outlook Home Page |
8 |
0 |
T1205.002 |
Socket Filters |
3 |
0 |
T1557 |
Adversary-in-the-Middle |
28 |
3 |
T1080 |
Taint Shared Content |
13 |
0 |
T1548.002 |
Bypass User Account Control |
15 |
0 |
T1547.009 |
Shortcut Modification |
9 |
0 |
T1201 |
Password Policy Discovery |
6 |
0 |
T1071.001 |
Web Protocols |
18 |
0 |
T1585.003 |
Cloud Accounts |
2 |
0 |
T1547.003 |
Time Providers |
11 |
0 |
T1547.002 |
Authentication Package |
6 |
0 |
T1003.007 |
Proc Filesystem |
17 |
0 |
T1578 |
Modify Cloud Compute Infrastructure |
14 |
4 |
T1578.002 |
Create Cloud Instance |
12 |
0 |
T1008 |
Fallback Channels |
12 |
0 |
T1059.002 |
AppleScript |
19 |
0 |
T1622 |
Debugger Evasion |
18 |
0 |
T1612 |
Build Image on Host |
12 |
0 |
T1574.009 |
Path Interception by Unquoted Path |
16 |
0 |
T1187 |
Forced Authentication |
13 |
0 |
T1021.002 |
SMB/Windows Admin Shares |
18 |
0 |
T1055.001 |
Dynamic-link Library Injection |
7 |
0 |
T1574.012 |
COR_PROFILER |
10 |
0 |
T1036.005 |
Match Legitimate Name or Location |
13 |
0 |
T1562.001 |
Disable or Modify Tools |
15 |
0 |
T1555 |
Credentials from Password Stores |
5 |
5 |
T1558.004 |
AS-REP Roasting |
23 |
0 |
T1552.004 |
Private Keys |
24 |
0 |
T1574.001 |
DLL Search Order Hijacking |
13 |
0 |
T1098 |
Account Manipulation |
17 |
5 |
T1036.001 |
Invalid Code Signature |
6 |
0 |
T1561.001 |
Disk Content Wipe |
13 |
0 |
T1072 |
Software Deployment Tools |
28 |
0 |
T1195 |
Supply Chain Compromise |
11 |
3 |
T1547.004 |
Winlogon Helper DLL |
14 |
0 |
T1220 |
XSL Script Processing |
7 |
0 |
T1078.001 |
Default Accounts |
15 |
0 |
T1190 |
Exploit Public-Facing Application |
31 |
0 |
T1136.003 |
Cloud Account |
16 |
0 |
T1569 |
System Services |
15 |
2 |
T1562.002 |
Disable Windows Event Logging |
15 |
0 |
T1557.003 |
DHCP Spoofing |
16 |
0 |
T1484 |
Domain Policy Modification |
14 |
2 |
T1609 |
Container Administration Command |
12 |
0 |
T1136 |
Create Account |
19 |
3 |
T1606 |
Forge Web Credentials |
8 |
2 |
T1567.002 |
Exfiltration to Cloud Storage |
5 |
0 |
T1619 |
Cloud Storage Object Discovery |
7 |
0 |
T1055.008 |
Ptrace System Calls |
13 |
0 |
T1222.002 |
Linux and Mac File and Directory Permissions Modification |
12 |
0 |
T1203 |
Exploitation for Client Execution |
22 |
0 |
T1489 |
Service Stop |
16 |
0 |
T1137 |
Office Application Startup |
14 |
6 |
T1218.007 |
Msiexec |
10 |
0 |
T1003.004 |
LSA Secrets |
17 |
0 |
T1056.003 |
Web Portal Capture |
10 |
0 |
T1134.001 |
Token Impersonation/Theft |
8 |
0 |
T1498.001 |
Direct Network Flood |
12 |
0 |
T1505.002 |
Transport Agent |
26 |
0 |
T1197 |
BITS Jobs |
15 |
0 |
T1037 |
Boot or Logon Initialization Scripts |
14 |
5 |
T1218 |
System Binary Proxy Execution |
19 |
13 |
T1499.003 |
Application Exhaustion Flood |
13 |
0 |
T1574.005 |
Executable Installer File Permissions Weakness |
15 |
0 |
T1070 |
Indicator Removal |
22 |
9 |
T1530 |
Data from Cloud Storage |
35 |
0 |
T1548.001 |
Setuid and Setgid |
4 |
0 |
T1573.001 |
Symmetric Cryptography |
14 |
0 |
T1078.004 |
Cloud Accounts |
23 |
0 |
T1574 |
Hijack Execution Flow |
22 |
12 |
T1055.012 |
Process Hollowing |
7 |
0 |
T1048.002 |
Exfiltration Over Asymmetric Encrypted Non-C2 Protocol |
25 |
0 |
T1114 |
Email Collection |
16 |
3 |
T1546.002 |
Screensaver |
10 |
0 |
T1052.001 |
Exfiltration over USB |
21 |
0 |
T1559.003 |
XPC Services |
7 |
0 |
T1110.004 |
Credential Stuffing |
16 |
0 |
T1599.001 |
Network Address Translation Traversal |
19 |
0 |
T1565.003 |
Runtime Data Manipulation |
14 |
0 |
T1525 |
Implant Internal Image |
22 |
0 |
T1550.003 |
Pass the Ticket |
12 |
0 |
T1029 |
Scheduled Transfer |
9 |
0 |
T1003.003 |
NTDS |
21 |
0 |
T1556.005 |
Reversible Encryption |
4 |
0 |
T1499.002 |
Service Exhaustion Flood |
13 |
0 |
T1105 |
Ingress Tool Transfer |
10 |
0 |
T1195.003 |
Compromise Hardware Supply Chain |
13 |
0 |
T1505.001 |
SQL Stored Procedures |
17 |
0 |
T1055.015 |
ListPlanting |
1 |
0 |
T1565 |
Data Manipulation |
27 |
3 |
T1543 |
Create or Modify System Process |
28 |
4 |
T1040 |
Network Sniffing |
15 |
0 |
T1538 |
Cloud Service Dashboard |
6 |
0 |
T1021 |
Remote Services |
14 |
6 |
T1127.001 |
MSBuild |
7 |
0 |
T1564.007 |
VBA Stomping |
9 |
0 |
T1136.001 |
Local Account |
12 |
0 |
T1087.001 |
Local Account |
4 |
0 |
T1218.004 |
InstallUtil |
12 |
0 |
T1556.007 |
Hybrid Identity |
8 |
0 |
T1543.004 |
Launch Daemon |
10 |
0 |
T1578.001 |
Create Snapshot |
12 |
0 |
T1210 |
Exploitation of Remote Services |
32 |
0 |
T1558.001 |
Golden Ticket |
10 |
0 |
T1037.004 |
RC Scripts |
8 |
0 |
T1556.003 |
Pluggable Authentication Modules |
14 |
0 |
T1134.005 |
SID-History Injection |
13 |
0 |
T1563.001 |
SSH Hijacking |
20 |
0 |
T1601 |
Modify System Image |
28 |
2 |
T1205.001 |
Port Knocking |
12 |
0 |
T1553 |
Subvert Trust Controls |
23 |
6 |
T1132 |
Data Encoding |
10 |
2 |
T1553.004 |
Install Root Certificate |
7 |
0 |
T1102.001 |
Dead Drop Resolver |
10 |
0 |
T1649 |
Steal or Forge Authentication Certificates |
3 |
0 |
T1218.014 |
MMC |
12 |
0 |
T1098.002 |
Additional Email Delegate Permissions |
12 |
0 |
T1213.001 |
Confluence |
26 |
0 |
T1068 |
Exploitation for Privilege Escalation |
33 |
0 |
T1547.007 |
Re-opened Applications |
12 |
0 |
T1499.004 |
Application or System Exploitation |
13 |
0 |
T1055.003 |
Thread Execution Hijacking |
7 |
0 |
T1505.005 |
Terminal Services DLL |
11 |
0 |
T1036 |
Masquerading |
17 |
7 |
T1546.010 |
AppInit DLLs |
6 |
0 |
T1574.013 |
KernelCallbackTable |
7 |
0 |
T1567 |
Exfiltration Over Web Service |
19 |
2 |
T1090.001 |
Internal Proxy |
10 |
0 |
T1036.007 |
Double File Extension |
6 |
0 |
T1221 |
Template Injection |
15 |
0 |
T1574.010 |
Services File Permissions Weakness |
13 |
0 |
T1560.001 |
Archive via Utility |
6 |
0 |
T1547.005 |
Security Support Provider |
6 |
0 |
T1003.002 |
Security Account Manager |
19 |
0 |
T1543.001 |
Launch Agent |
10 |
0 |
T1027.007 |
Dynamic API Resolution |
4 |
0 |
T1595.003 |
Wordlist Scanning |
1 |
0 |
T1114.001 |
Local Email Collection |
10 |
0 |
T1003.008 |
/etc/passwd and /etc/shadow |
17 |
0 |
T1570 |
Lateral Tool Transfer |
12 |
0 |
T1071.002 |
File Transfer Protocols |
18 |
0 |
T1001.002 |
Steganography |
9 |
0 |
T1021.001 |
Remote Desktop Protocol |
26 |
0 |
T1548.003 |
Sudo and Sudo Caching |
16 |
0 |
T1020.001 |
Traffic Duplication |
18 |
0 |
T1569.001 |
Launchctl |
8 |
0 |
T1185 |
Browser Session Hijacking |
22 |
0 |
T1546.006 |
LC_LOAD_DYLIB Addition |
15 |
0 |
T1078.002 |
Domain Accounts |
13 |
0 |
T1003.006 |
DCSync |
20 |
0 |
T1189 |
Drive-by Compromise |
20 |
0 |
T1552 |
Unsecured Credentials |
34 |
7 |
T1558.002 |
Silver Ticket |
20 |
0 |
T1602.002 |
Network Device Configuration Dump |
27 |
0 |
T1542 |
Pre-OS Boot |
20 |
5 |
T1564.003 |
Hidden Window |
7 |
0 |
T1578.003 |
Delete Cloud Instance |
12 |
0 |
T1552.007 |
Container API |
15 |
0 |
T1222 |
File and Directory Permissions Modification |
12 |
2 |
T1041 |
Exfiltration Over C2 Channel |
20 |
0 |
T1048 |
Exfiltration Over Alternative Protocol |
25 |
3 |
T1562.009 |
Safe Mode Boot |
13 |
0 |
T1204 |
User Execution |
18 |
3 |
T1601.001 |
Patch System Image |
28 |
0 |
T1102 |
Web Service |
12 |
3 |
T1565.001 |
Stored Data Manipulation |
24 |
0 |
T1561.002 |
Disk Structure Wipe |
14 |
0 |
T1137.001 |
Office Template Macros |
11 |
0 |
T1495 |
Firmware Corruption |
20 |
0 |
T1055.013 |
Process Doppelgänging |
7 |
0 |
T1555.001 |
Keychain |
5 |
0 |
T1218.001 |
Compiled HTML File |
11 |
0 |
T1059.007 |
JavaScript |
19 |
0 |
T1574.006 |
Dynamic Linker Hijacking |
4 |
0 |
T1558 |
Steal or Forge Kerberos Tickets |
20 |
4 |
T1559.001 |
Component Object Model |
14 |
0 |
T1599 |
Network Boundary Bridging |
19 |
1 |
T1542.001 |
System Firmware |
19 |
0 |
T1550.002 |
Pass the Hash |
12 |
0 |
T1070.008 |
Clear Mailbox Data |
20 |
0 |
T1553.001 |
Gatekeeper Bypass |
7 |
0 |
T1574.004 |
Dylib Hijacking |
16 |
0 |
T1499 |
Endpoint Denial of Service |
15 |
4 |
T1129 |
Shared Modules |
6 |
0 |
T1574.007 |
Path Interception by PATH Environment Variable |
16 |
0 |
T1557.002 |
ARP Cache Poisoning |
25 |
0 |
T1133 |
External Remote Services |
28 |
0 |
T1546.011 |
Application Shimming |
3 |
0 |
T1598.003 |
Spearphishing Link |
14 |
0 |
T1119 |
Automated Collection |
21 |
0 |
T1556.004 |
Network Device Authentication |
15 |
0 |
T1566.003 |
Spearphishing via Service |
10 |
0 |
T1204.002 |
Malicious File |
18 |
0 |
T1213 |
Data from Information Repositories |
27 |
3 |
T1134.002 |
Create Process with Token |
8 |
0 |
T1137.005 |
Outlook Rules |
8 |
0 |
T1498 |
Network Denial of Service |
12 |
2 |
T1552.006 |
Group Policy Preferences |
15 |
0 |
T1070.007 |
Clear Network Connection History and Configurations |
10 |
0 |
T1059.001 |
PowerShell |
21 |
0 |
T1111 |
Multi-Factor Authentication Interception |
8 |
0 |
T1021.004 |
SSH |
17 |
0 |
T1490 |
Inhibit System Recovery |
15 |
0 |
T1550 |
Use Alternate Authentication Material |
10 |
4 |
T1505 |
Server Software Component |
25 |
5 |
T1114.002 |
Remote Email Collection |
15 |
0 |
T1090.002 |
External Proxy |
10 |
0 |
T1486 |
Data Encrypted for Impact |
14 |
0 |
T1222.001 |
Windows File and Directory Permissions Modification |
12 |
0 |
T1572 |
Protocol Tunneling |
15 |
0 |
T1132.001 |
Standard Encoding |
10 |
0 |
T1554 |
Compromise Client Software Binary |
15 |
0 |
T1110 |
Brute Force |
16 |
4 |
T1091 |
Replication Through Removable Media |
13 |
0 |
T1027.002 |
Software Packing |
5 |
0 |
T1557.001 |
LLMNR/NBT-NS Poisoning and SMB Relay |
17 |
0 |
T1055.005 |
Thread Local Storage |
7 |
0 |
T1087 |
Account Discovery |
4 |
3 |
T1110.001 |
Password Guessing |
16 |
0 |
T1095 |
Non-Application Layer Protocol |
14 |
0 |
T1059.008 |
Network Device CLI |
17 |
0 |
T1070.002 |
Clear Linux or Mac System Logs |
23 |
0 |
T1539 |
Steal Web Session Cookie |
14 |
0 |
T1001.003 |
Protocol Impersonation |
9 |
0 |
T1598 |
Phishing for Information |
13 |
3 |
T1136.002 |
Domain Account |
16 |
0 |
T1601.002 |
Downgrade System Image |
27 |
0 |
T1566 |
Phishing |
15 |
3 |
T1606.002 |
SAML Tokens |
4 |
0 |
T1027 |
Obfuscated Files or Information |
8 |
8 |
T1199 |
Trusted Relationship |
12 |
0 |
T1098.004 |
SSH Authorized Keys |
16 |
0 |
T1098.003 |
Additional Cloud Roles |
12 |
0 |
T1569.002 |
Service Execution |
15 |
0 |
T1213.002 |
Sharepoint |
26 |
0 |
T1087.002 |
Domain Account |
3 |
0 |
T1053.003 |
Cron |
10 |
0 |
T1482 |
Domain Trust Discovery |
10 |
0 |
T1055.009 |
Proc Memory |
10 |
0 |
T1547.008 |
LSASS Driver |
8 |
0 |
T1218.010 |
Regsvr32 |
5 |
0 |
T1491.002 |
External Defacement |
12 |
0 |
T1602.001 |
SNMP (MIB Dump) |
27 |
0 |
T1611 |
Escape to Host |
20 |
0 |
T1021.003 |
Distributed Component Object Model |
21 |
0 |
T1556.006 |
Multi-Factor Authentication |
8 |
0 |
T1610 |
Deploy Container |
11 |
0 |
T1564.002 |
Hidden Users |
7 |
0 |
T1219 |
Remote Access Software |
15 |
0 |
T1562 |
Impair Defenses |
22 |
9 |
T1102.002 |
Bidirectional Communication |
10 |
0 |
T1055 |
Process Injection |
13 |
12 |
T1546.016 |
Installer Packages |
8 |
0 |
T1574.011 |
Services Registry Permissions Weakness |
3 |
0 |
T1134 |
Access Token Manipulation |
8 |
5 |
T1048.001 |
Exfiltration Over Symmetric Encrypted Non-C2 Protocol |
14 |
0 |
T1098.005 |
Device Registration |
7 |
0 |
T1135 |
Network Share Discovery |
5 |
0 |
T1564.008 |
Email Hiding Rules |
8 |
0 |
T1505.004 |
IIS Components |
24 |
0 |
T1102.003 |
One-Way Communication |
10 |
0 |
T1542.003 |
Bootkit |
19 |
0 |
T1114.003 |
Email Forwarding Rule |
14 |
0 |
T1056.002 |
GUI Input Capture |
6 |
0 |
T1552.003 |
Bash History |
6 |
0 |
T1564.009 |
Resource Forking |
13 |
0 |
T1602 |
Data from Configuration Repository |
28 |
2 |
T1564.004 |
NTFS File Attributes |
10 |
0 |
T1071.004 |
DNS |
21 |
0 |
T1090.003 |
Multi-hop Proxy |
10 |
0 |
T1059.005 |
Visual Basic |
20 |
0 |
T1052 |
Exfiltration Over Physical Medium |
21 |
1 |
T1563 |
Remote Service Session Hijacking |
22 |
2 |
T1552.002 |
Credentials in Registry |
20 |
0 |
T1053.007 |
Container Orchestration Job |
8 |
0 |
T1216 |
System Script Proxy Execution |
7 |
1 |
T1548 |
Abuse Elevation Control Mechanism |
22 |
4 |
T1071.003 |
Mail Protocols |
18 |
0 |
T1621 |
Multi-Factor Authentication Request Generation |
6 |
0 |
T1555.004 |
Windows Credential Manager |
7 |
0 |
T1546.004 |
Unix Shell Configuration Modification |
9 |
0 |
T1550.004 |
Web Session Cookie |
5 |
0 |
T1098.001 |
Additional Cloud Credentials |
16 |
0 |
T1212 |
Exploitation for Credential Access |
31 |
0 |
T1586.003 |
Cloud Accounts |
2 |
0 |
T1176 |
Browser Extensions |
17 |
0 |
T1546.013 |
PowerShell Profile |
11 |
0 |
T1552.005 |
Cloud Instance Metadata API |
15 |
0 |
T1567.001 |
Exfiltration to Code Repository |
5 |
0 |
T1055.004 |
Asynchronous Procedure Call |
7 |
0 |
T1218.003 |
CMSTP |
12 |
0 |
T1559.002 |
Dynamic Data Exchange |
15 |
0 |
T1547.006 |
Kernel Modules and Extensions |
19 |
0 |
T1546.014 |
Emond |
7 |
0 |
T1053.006 |
Systemd Timers |
10 |
0 |
T1003.001 |
LSASS Memory |
22 |
0 |
T1593.003 |
Code Repositories |
3 |
0 |
T1027.008 |
Stripped Payloads |
4 |
0 |
T1025 |
Data from Removable Media |
17 |
0 |
T1112 |
Modify Registry |
3 |
0 |
T1574.002 |
DLL Side-Loading |
13 |
0 |
T1037.005 |
Startup Items |
8 |
0 |
T1528 |
Steal Application Access Token |
20 |
0 |
T1137.002 |
Office Test |
11 |
0 |
T1613 |
Container and Resource Discovery |
11 |
0 |
T1046 |
Network Service Discovery |
13 |
0 |
T1566.002 |
Spearphishing Link |
14 |
0 |
T1562.010 |
Downgrade Attack |
4 |
0 |
T1218.008 |
Odbcconf |
12 |
0 |
T1574.008 |
Path Interception by Search Order Hijacking |
16 |
0 |
T1127 |
Trusted Developer Utilities Proxy Execution |
10 |
1 |
T1036.003 |
Rename System Utilities |
10 |
0 |
T1055.002 |
Portable Executable Injection |
7 |
0 |
T1546.009 |
AppCert DLLs |
4 |
0 |
T1053 |
Scheduled Task/Job |
18 |
5 |
T1053.002 |
At |
15 |
0 |
T1078.003 |
Local Accounts |
20 |
0 |
T1559 |
Inter-Process Communication |
20 |
3 |
T1021.006 |
Windows Remote Management |
18 |
0 |
T1546.003 |
Windows Management Instrumentation Event Subscription |
13 |
0 |
T1553.003 |
SIP and Trust Provider Hijacking |
11 |
0 |
T1560 |
Archive Collected Data |
6 |
3 |
T1505.003 |
Web Shell |
10 |
0 |
T1205 |
Traffic Signaling |
12 |
2 |
T1003 |
OS Credential Dumping |
24 |
8 |
T1053.005 |
Scheduled Task |
15 |
0 |
T1556.001 |
Domain Controller Authentication |
16 |
0 |
T1110.003 |
Password Spraying |
16 |
0 |
T1204.001 |
Malicious Link |
17 |
0 |
T1535 |
Unused/Unsupported Cloud Regions |
2 |
0 |
T1037.001 |
Logon Script (Windows) |
3 |
0 |
T1491 |
Defacement |
12 |
2 |
T1648 |
Serverless Execution |
8 |
0 |
T1055.014 |
VDSO Hijacking |
7 |
0 |
T1070.003 |
Clear Command History |
11 |
0 |
T1059.004 |
Unix Shell |
14 |
0 |
T1059.006 |
Python |
17 |
0 |
T1047 |
Windows Management Instrumentation |
21 |
0 |
T1055.011 |
Extra Window Memory Injection |
7 |
0 |
T1104 |
Multi-Stage Channels |
12 |
0 |
T1548.004 |
Elevated Execution with Prompt |
13 |
0 |
T1543.002 |
Systemd Service |
18 |
0 |
T1556 |
Modify Authentication Process |
20 |
7 |
T1553.005 |
Mark-of-the-Web Bypass |
7 |
0 |
T1499.001 |
OS Exhaustion Flood |
13 |
0 |
T1030 |
Data Transfer Size Limits |
9 |
0 |
T1595.001 |
Scanning IP Blocks |
1 |
0 |
T1070.006 |
Timestomp |
1 |
0 |
T1586.002 |
Email Accounts |
1 |
0 |
T1584.005 |
Botnet |
2 |
0 |
T1526 |
Cloud Service Discovery |
1 |
0 |
T1587.003 |
Digital Certificates |
2 |
0 |
T1590.006 |
Network Security Appliances |
1 |
0 |
T1056.004 |
Credential API Hooking |
4 |
0 |
T1564.001 |
Hidden Files and Directories |
4 |
0 |
T1057 |
Process Discovery |
1 |
0 |
T1546.005 |
Trap |
1 |
0 |
T1595 |
Active Scanning |
1 |
3 |
T1588.001 |
Malware |
6 |
0 |
T1069.001 |
Local Groups |
1 |
0 |
T1590.001 |
Domain Properties |
1 |
0 |
T1584.002 |
DNS Server |
3 |
0 |
T1600.002 |
Disable Crypto Hardware |
1 |
0 |
T1608.002 |
Upload Tool |
1 |
0 |
T1588.002 |
Tool |
1 |
0 |
T1553.002 |
Code Signing |
1 |
0 |
T1589.001 |
Credentials |
1 |
0 |
T1583.004 |
Server |
2 |
0 |
T1587.001 |
Malware |
6 |
0 |
T1012 |
Query Registry |
2 |
0 |
T1592 |
Gather Victim Host Information |
1 |
4 |
T1546.007 |
Netsh Helper DLL |
1 |
0 |
T1588 |
Obtain Capabilities |
2 |
6 |
T1585.001 |
Social Media Accounts |
2 |
0 |
T1590.002 |
DNS |
1 |
0 |
T1036.006 |
Space after Filename |
1 |
0 |
T1583.002 |
DNS Server |
3 |
0 |
T1587 |
Develop Capabilities |
2 |
4 |
T1592.002 |
Software |
1 |
0 |
T1584 |
Compromise Infrastructure |
2 |
7 |
T1583.006 |
Web Services |
5 |
0 |
T1578.004 |
Revert Cloud Instance |
1 |
0 |
T1568.003 |
DNS Calculation |
3 |
0 |
T1140 |
Deobfuscate/Decode Files or Information |
1 |
0 |
T1497.002 |
User Activity Based Checks |
1 |
0 |
T1585 |
Establish Accounts |
2 |
3 |
T1202 |
Indirect Command Execution |
1 |
0 |
T1592.004 |
Client Configurations |
1 |
0 |
T1006 |
Direct Volume Access |
1 |
0 |
T1590.003 |
Network Trust Dependencies |
1 |
0 |
T1020 |
Automated Exfiltration |
2 |
1 |
T1070.004 |
File Deletion |
1 |
0 |
T1589.003 |
Employee Names |
1 |
0 |
T1547 |
Boot or Logon Autostart Execution |
6 |
13 |
T1608 |
Stage Capabilities |
1 |
5 |
T1584.001 |
Domains |
2 |
0 |
T1587.004 |
Exploits |
4 |
0 |
T1036.002 |
Right-to-Left Override |
3 |
0 |
T1083 |
File and Directory Discovery |
3 |
0 |
T1027.001 |
Binary Padding |
1 |
0 |
T1036.004 |
Masquerade Task or Service |
1 |
0 |
T1608.004 |
Drive-by Target |
1 |
0 |
T1583.005 |
Botnet |
3 |
0 |
T1497 |
Virtualization/Sandbox Evasion |
3 |
3 |
T1082 |
System Information Discovery |
2 |
0 |
T1484.001 |
Group Policy Modification |
1 |
0 |
T1496 |
Resource Hijacking |
5 |
0 |
T1074.002 |
Remote Data Staging |
1 |
0 |
T1070.005 |
Network Share Connection Removal |
1 |
0 |
T1547.010 |
Port Monitors |
1 |
0 |
T1074 |
Data Staged |
1 |
2 |
T1583.001 |
Domains |
3 |
0 |
T1027.003 |
Steganography |
1 |
0 |
T1592.001 |
Hardware |
1 |
0 |
T1588.005 |
Exploits |
4 |
0 |
T1123 |
Audio Capture |
2 |
0 |
T1120 |
Peripheral Device Discovery |
1 |
0 |
T1480 |
Execution Guardrails |
2 |
1 |
T1074.001 |
Local Data Staging |
1 |
0 |
T1007 |
System Service Discovery |
2 |
0 |
T1529 |
System Shutdown/Reboot |
2 |
0 |
T1584.004 |
Server |
1 |
0 |
T1608.005 |
Link Target |
1 |
0 |
T1518.001 |
Security Software Discovery |
1 |
0 |
T1546.015 |
Component Object Model Hijacking |
1 |
0 |
T1587.002 |
Code Signing Certificates |
2 |
0 |
T1497.001 |
System Checks |
1 |
0 |
T1560.003 |
Archive via Custom Method |
1 |
0 |
T1010 |
Application Window Discovery |
2 |
0 |
T1049 |
System Network Connections Discovery |
2 |
0 |
T1600.001 |
Reduce Key Space |
1 |
0 |
T1584.003 |
Virtual Private Server |
1 |
0 |
T1583.003 |
Virtual Private Server |
2 |
0 |
T1484.002 |
Domain Trust Modification |
1 |
0 |
T1555.003 |
Credentials from Web Browsers |
2 |
0 |
T1125 |
Video Capture |
2 |
0 |
T1592.003 |
Firmware |
1 |
0 |
T1560.002 |
Archive via Library |
1 |
0 |
T1590.004 |
Network Topology |
1 |
0 |
T1217 |
Browser Bookmark Discovery |
1 |
0 |
T1614 |
System Location Discovery |
1 |
1 |
T1056 |
Input Capture |
2 |
4 |
T1497.003 |
Time Based Evasion |
1 |
0 |
T1564.005 |
Hidden File System |
4 |
0 |
T1586 |
Compromise Accounts |
1 |
3 |
T1115 |
Clipboard Data |
2 |
0 |
T1207 |
Rogue Domain Controller |
1 |
0 |
T1600 |
Weaken Encryption |
2 |
2 |
T1614.001 |
System Language Discovery |
1 |
0 |
T1534 |
Internal Spearphishing |
2 |
0 |
T1584.006 |
Web Services |
1 |
0 |
T1027.005 |
Indicator Removal from Tools |
1 |
0 |
T1016 |
System Network Configuration Discovery |
1 |
1 |
T1595.002 |
Vulnerability Scanning |
2 |
0 |
T1033 |
System Owner/User Discovery |
3 |
0 |
T1589.002 |
Email Addresses |
1 |
0 |
T1586.001 |
Social Media Accounts |
3 |
0 |
T1056.001 |
Keylogging |
2 |
0 |
T1113 |
Screen Capture |
2 |
0 |
T1542.002 |
Component Firmware |
1 |
0 |
T1590 |
Gather Victim Network Information |
1 |
6 |
T1016.001 |
Internet Connection Discovery |
1 |
0 |
T1608.003 |
Install Digital Certificate |
1 |
0 |
T1547.001 |
Registry Run Keys / Startup Folder |
1 |
0 |
T1568.001 |
Fast Flux DNS |
3 |
0 |
T1039 |
Data from Network Shared Drive |
2 |
0 |
T1588.006 |
Vulnerabilities |
2 |
0 |
T1546.001 |
Change Default File Association |
1 |
0 |
T1588.003 |
Code Signing Certificates |
2 |
0 |
T1564 |
Hide Artifacts |
4 |
10 |
T1134.004 |
Parent PID Spoofing |
1 |
0 |
T1480.001 |
Environmental Keying |
2 |
0 |
T1590.005 |
IP Addresses |
1 |
0 |
T1547.014 |
Active Setup |
1 |
0 |
T1583 |
Acquire Infrastructure |
2 |
7 |
T1014 |
Rootkit |
4 |
0 |
T1546.012 |
Image File Execution Options Injection |
1 |
0 |
T1531 |
Account Access Removal |
4 |
0 |
T1018 |
Remote System Discovery |
2 |
0 |
T1518 |
Software Discovery |
1 |
1 |
T1608.001 |
Upload Malware |
1 |
0 |
T1585.002 |
Email Accounts |
2 |
0 |
T1588.004 |
Digital Certificates |
2 |
0 |
T1027.004 |
Compile After Delivery |
1 |
0 |
T1589 |
Gather Victim Identity Information |
1 |
3 |
T1069 |
Permission Groups Discovery |
1 |
1 |
T1124 |
System Time Discovery |
1 |
0 |