Home
ATT&CK Techniques

ATT&CK Techniques

Techniques represent 'how' an adversary achieves a tactical goal by performing an action. For example, an adversary may dump credentials to achieve credential access.

View information about techniques, how techniques and tactics interact, and the Center for Threat-Informed Defense's mappings coverage of MITRE ATT&CK® techniques in the Mappings Explorer matrix view.

SELECT VERSIONS

ATT&CK Version

ATT&CK Domain

ATT&CK Techniques

ATT&CK ID	ATT&CK Name	Number of Mappings	Number of Subtechniques
T1547.006	Kernel Modules and Extensions	14	0
T1574.012	COR_PROFILER	10	0
T1218.008	Odbcconf	9	0
T1048.002	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	16	0
T1132.002	Non-Standard Encoding	8	0
T1114	Email Collection	15	3
T1087.004	Cloud Account	8	0
T1072	Software Deployment Tools	28	0
T1098.001	Additional Cloud Credentials	20	0
T1525	Implant Internal Image	23	0
T1599	Network Boundary Bridging	20	1
T1055.009	Proc Memory	10	0
T1127.001	MSBuild	7	0
T1563.002	RDP Hijacking	20	0
T1037.002	Logon Script (Mac)	8	0
T1505.002	Transport Agent	25	0
T1219	Remote Access Software	17	0
T1574.001	DLL Search Order Hijacking	15	0
T1218.001	Compiled HTML File	8	0
T1037.005	Startup Items	8	0
T1505.001	SQL Stored Procedures	25	0
T1558.002	Silver Ticket	20	0
T1539	Steal Web Session Cookie	16	0
T1027.002	Software Packing	5	0
T1090.001	Internal Proxy	11	0
T1048.001	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	16	0
T1068	Exploitation for Privilege Escalation	156	0
T1111	Two-Factor Authentication Interception	8	0
T1557.001	LLMNR/NBT-NS Poisoning and SMB Relay	17	0
T1030	Data Transfer Size Limits	8	0
T1003.008	/etc/passwd and /etc/shadow	18	0
T1003.006	DCSync	19	0
T1548.002	Bypass User Account Control	17	0
T1221	Template Injection	15	0
T1021.005	VNC	27	0
T1055.004	Asynchronous Procedure Call	7	0
T1547.009	Shortcut Modification	9	0
T1543.001	Launch Agent	8	0
T1091	Replication Through Removable Media	22	0
T1001	Data Obfuscation	10	3
T1218	Signed Binary Proxy Execution	16	11
T1021.006	Windows Remote Management	20	0
T1546	Event Triggered Execution	9	15
T1567	Exfiltration Over Web Service	5	2
T1564.007	VBA Stomping	6	0
T1566.002	Spearphishing Link	19	0
T1056.003	Web Portal Capture	8	0
T1547.007	Re-opened Applications	12	0
T1001.002	Steganography	8	0
T1053.003	Cron	11	0
T1602.002	Network Device Configuration Dump	27	0
T1059.005	Visual Basic	14	0
T1563.001	SSH Hijacking	19	0
T1104	Multi-Stage Channels	12	0
T1190	Exploit Public-Facing Application	236	0
T1556.001	Domain Controller Authentication	16	0
T1135	Network Share Discovery	4	0
T1574.004	Dylib Hijacking	15	0
T1568.002	Domain Generation Algorithms	10	0
T1112	Modify Registry	3	0
T1055.013	Process Doppelgänging	7	0
T1127	Trusted Developer Utilities Proxy Execution	10	1
T1569.002	Service Execution	15	0
T1195.001	Compromise Software Dependencies and Development Tools	9	0
T1053.006	Systemd Timers	11	0
T1020.001	Traffic Duplication	15	0
T1098	Account Manipulation	27	4
T1055.014	VDSO Hijacking	7	0
T1557	Man-in-the-Middle	67	2
T1561.001	Disk Content Wipe	13	0
T1543.002	Systemd Service	18	0
T1059.002	AppleScript	13	0
T1498.001	Direct Network Flood	14	0
T1201	Password Policy Discovery	6	0
T1070.001	Clear Windows Event Logs	23	0
T1134.002	Create Process with Token	8	0
T1098.003	Add Office 365 Global Administrator Role	12	0
T1485	Data Destruction	43	0
T1553.006	Code Signing Policy Modification	14	0
T1561	Disk Wipe	13	2
T1098.004	SSH Authorized Keys	11	0
T1498.002	Reflection Amplification	14	0
T1011.001	Exfiltration Over Bluetooth	9	0
T1558.003	Kerberoasting	20	0
T1218.012	Verclsid	14	0
T1036.001	Invalid Code Signature	6	0
T1137	Office Application Startup	11	5
T1548.004	Elevated Execution with Prompt	13	0
T1059.008	Network Device CLI	13	0
T1197	BITS Jobs	16	0
T1573.002	Asymmetric Cryptography	13	0
T1090.003	Multi-hop Proxy	13	0
T1553.001	Gatekeeper Bypass	7	0
T1195.003	Compromise Hardware Supply Chain	12	0
T1537	Transfer Data to Cloud Account	21	0
T1566.003	Spearphishing via Service	11	0
T1047	Windows Management Instrumentation	11	0
T1056.002	GUI Input Capture	5	0
T1564.002	Hidden Users	4	0
T1053.001	At (Linux)	11	0
T1574	Hijack Execution Flow	75	11
T1599.001	Network Address Translation Traversal	20	0
T1542.001	System Firmware	26	0
T1222	File and Directory Permissions Modification	13	2
T1090.004	Domain Fronting	2	0
T1114.001	Local Email Collection	10	0
T1037.001	Logon Script (Windows)	3	0
T1105	Ingress Tool Transfer	13	0
T1090.002	External Proxy	13	0
T1546.010	AppInit DLLs	6	0
T1195	Supply Chain Compromise	10	3
T1574.007	Path Interception by PATH Environment Variable	16	0
T1555.001	Keychain	4	0
T1021.002	SMB/Windows Admin Shares	20	0
T1110.001	Password Guessing	24	0
T1546.009	AppCert DLLs	4	0
T1598	Phishing for Information	14	3
T1087.002	Domain Account	4	0
T1036	Masquerading	27	6
T1542.005	TFTP Boot	27	0
T1563	Remote Service Session Hijacking	29	2
T1562.007	Disable or Modify Cloud Firewall	9	0
T1499.002	Service Exhaustion Flood	16	0
T1601.002	Downgrade System Image	27	0
T1204	User Execution	17	3
T1555	Credentials from Password Stores	5	5
T1572	Protocol Tunneling	15	0
T1574.011	Services Registry Permissions Weakness	3	0
T1546.008	Accessibility Features	7	0
T1609	Container Administration Command	11	0
T1134.005	SID-History Injection	13	0
T1059.004	Unix Shell	13	0
T1552.003	Bash History	5	0
T1021.004	SSH	20	0
T1543	Create or Modify System Process	27	4
T1204.003	Malicious Image	23	0
T1562	Impair Defenses	28	7
T1087	Account Discovery	6	4
T1530	Data from Cloud Storage Object	41	0
T1070.003	Clear Command History	12	0
T1218.007	Msiexec	10	0
T1102.003	One-Way Communication	9	0
T1548.001	Setuid and Setgid	4	0
T1078.003	Local Accounts	21	0
T1565.001	Stored Data Manipulation	46	0
T1055.002	Portable Executable Injection	7	0
T1578.001	Create Snapshot	12	0
T1570	Lateral Tool Transfer	13	0
T1482	Domain Trust Discovery	11	0
T1059	Command and Scripting Interpreter	115	8
T1200	Hardware Additions	8	0
T1189	Drive-by Compromise	119	0
T1553	Subvert Trust Controls	23	6
T1204.001	Malicious Link	42	0
T1176	Browser Extensions	17	0
T1484	Domain Policy Modification	14	2
T1134.001	Token Impersonation/Theft	9	0
T1564.003	Hidden Window	4	0
T1070.002	Clear Linux or Mac System Logs	24	0
T1070	Indicator Removal on Host	23	6
T1003.003	NTDS	20	0
T1110.003	Password Spraying	23	0
T1185	Man in the Browser	41	0
T1611	Escape to Host	22	0
T1564.006	Run Virtual Instance	8	0
T1552.004	Private Keys	28	0
T1106	Native API	2	0
T1102.002	Bidirectional Communication	9	0
T1538	Cloud Service Dashboard	9	0
T1557.002	ARP Cache Poisoning	24	0
T1574.008	Path Interception by Search Order Hijacking	19	0
T1087.001	Local Account	4	0
T1195.002	Compromise Software Supply Chain	9	0
T1566	Phishing	41	3
T1052	Exfiltration Over Physical Medium	11	1
T1491.002	External Defacement	15	0
T1555.004	Windows Credential Manager	6	0
T1499.003	Application Exhaustion Flood	16	0
T1110.002	Password Cracking	20	0
T1053.002	At (Windows)	15	0
T1136.001	Local Account	12	0
T1205.001	Port Knocking	12	0
T1008	Fallback Channels	13	0
T1547.004	Winlogon Helper DLL	12	0
T1578	Modify Cloud Compute Infrastructure	14	4
T1133	External Remote Services	69	0
T1098.002	Exchange Email Delegate Permissions	12	0
T1528	Steal Application Access Token	28	0
T1213.002	Sharepoint	25	0
T1001.003	Protocol Impersonation	8	0
T1055.005	Thread Local Storage	7	0
T1212	Exploitation for Credential Access	42	0
T1556.004	Network Device Authentication	15	0
T1059.007	JavaScript	48	0
T1114.003	Email Forwarding Rule	11	0
T1574.002	DLL Side-Loading	13	0
T1036.003	Rename System Utilities	10	0
T1553.005	Mark-of-the-Web Bypass	7	0
T1612	Build Image on Host	12	0
T1565.002	Transmitted Data Manipulation	19	0
T1059.006	Python	13	0
T1542	Pre-OS Boot	23	5
T1580	Cloud Infrastructure Discovery	9	0
T1558	Steal or Forge Kerberos Tickets	20	4
T1055.003	Thread Execution Hijacking	7	0
T1027	Obfuscated Files or Information	5	5
T1132	Data Encoding	10	2
T1071.004	DNS	22	0
T1041	Exfiltration Over C2 Channel	9	0
T1218.003	CMSTP	9	0
T1560	Archive Collected Data	6	3
T1573.001	Symmetric Cryptography	13	0
T1546.003	Windows Management Instrumentation Event Subscription	8	0
T1071.001	Web Protocols	20	0
T1055.008	Ptrace System Calls	13	0
T1565.003	Runtime Data Manipulation	14	0
T1137.002	Office Test	7	0
T1204.002	Malicious File	83	0
T1003	OS Credential Dumping	24	8
T1053.004	Launchd	10	0
T1003.001	LSASS Memory	18	0
T1556.003	Pluggable Authentication Modules	14	0
T1003.004	LSA Secrets	16	0
T1205	Traffic Signaling	14	1
T1055.011	Extra Window Memory Injection	7	0
T1601.001	Patch System Image	27	0
T1546.013	PowerShell Profile	11	0
T1559	Inter-Process Communication	20	2
T1505	Server Software Component	25	3
T1029	Scheduled Transfer	9	0
T1222.002	Linux and Mac File and Directory Permissions Modification	13	0
T1080	Taint Shared Content	13	0
T1598.001	Spearphishing Service	10	0
T1573	Encrypted Channel	14	2
T1560.001	Archive via Utility	6	0
T1021.001	Remote Desktop Protocol	28	0
T1562.003	Impair Command History Logging	6	0
T1003.005	Cached Domain Credentials	20	0
T1210	Exploitation of Remote Services	48	0
T1555.005	Password Managers	7	0
T1037.004	RC Scripts	9	0
T1114.002	Remote Email Collection	14	0
T1552	Unsecured Credentials	56	7
T1578.003	Delete Cloud Instance	12	0
T1071	Application Layer Protocol	23	4
T1090	Proxy	19	4
T1055.012	Process Hollowing	7	0
T1137.004	Outlook Home Page	3	0
T1040	Network Sniffing	27	0
T1555.002	Securityd Memory	5	0
T1550.004	Web Session Cookie	4	0
T1021.003	Distributed Component Object Model	22	0
T1569.001	Launchctl	8	0
T1048.003	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	17	0
T1211	Exploitation for Defense Evasion	47	0
T1547.013	XDG Autostart Entries	16	0
T1218.009	Regsvcs/Regasm	9	0
T1218.002	Control Panel	10	0
T1550.002	Pass the Hash	12	0
T1137.005	Outlook Rules	3	0
T1546.004	Unix Shell Configuration Modification	9	0
T1037	Boot or Logon Initialization Scripts	13	5
T1569	System Services	16	2
T1003.007	Proc Filesystem	17	0
T1092	Communication Through Removable Media	9	0
T1495	Firmware Corruption	17	0
T1213	Data from Information Repositories	28	2
T1546.011	Application Shimming	3	0
T1136	Create Account	42	3
T1053	Scheduled Task/Job	19	7
T1546.006	LC_LOAD_DYLIB Addition	15	0
T1567.001	Exfiltration to Code Repository	5	0
T1542.003	Bootkit	19	0
T1110	Brute Force	40	4
T1546.014	Emond	7	0
T1542.004	ROMMONkit	23	0
T1552.006	Group Policy Preferences	14	0
T1548	Abuse Elevation Control Mechanism	30	4
T1021	Remote Services	17	6
T1071.003	Mail Protocols	19	0
T1553.003	SIP and Trust Provider Hijacking	11	0
T1562.004	Disable or Modify System Firewall	15	0
T1571	Non-Standard Port	14	0
T1486	Data Encrypted for Impact	16	0
T1216.001	PubPrn	7	0
T1136.002	Domain Account	16	0
T1137.003	Outlook Forms	3	0
T1547.003	Time Providers	11	0
T1489	Service Stop	21	0
T1001.001	Junk Data	9	0
T1078.004	Cloud Accounts	33	0
T1558.001	Golden Ticket	11	0
T1562.006	Indicator Blocking	16	0
T1613	Container and Resource Discovery	12	0
T1220	XSL Script Processing	7	0
T1499.004	Application or System Exploitation	108	0
T1562.008	Disable Cloud Logs	12	0
T1498	Network Denial of Service	15	2
T1048	Exfiltration Over Alternative Protocol	17	3
T1046	Network Service Scanning	20	0
T1499.001	OS Exhaustion Flood	16	0
T1547.005	Security Support Provider	6	0
T1187	Forced Authentication	13	0
T1564.004	NTFS File Attributes	7	0
T1059.001	PowerShell	20	0
T1218.010	Regsvr32	5	0
T1574.006	Dynamic Linker Hijacking	4	0
T1562.002	Disable Windows Event Logging	14	0
T1554	Compromise Client Software Binary	14	0
T1559.001	Component Object Model	14	0
T1601	Modify System Image	27	2
T1119	Automated Collection	20	0
T1547.011	Plist Modification	13	0
T1003.002	Security Account Manager	18	0
T1598.002	Spearphishing Attachment	15	0
T1137.001	Office Template Macros	7	0
T1568	Dynamic Resolution	13	3
T1059.003	Windows Command Shell	6	0
T1053.005	Scheduled Task	16	0
T1078	Valid Accounts	85	4
T1562.001	Disable or Modify Tools	18	0
T1550	Use Alternate Authentication Material	11	4
T1053.007	Container Orchestration Job	9	0
T1566.001	Spearphishing Attachment	18	0
T1490	Inhibit System Recovery	17	0
T1556	Modify Authentication Process	18	4
T1222.001	Windows File and Directory Permissions Modification	12	0
T1213.001	Confluence	25	0
T1547.012	Print Processors	9	0
T1548.003	Sudo and Sudo Caching	18	0
T1218.004	InstallUtil	9	0
T1052.001	Exfiltration over USB	11	0
T1110.004	Credential Stuffing	23	0
T1610	Deploy Container	12	0
T1491	Defacement	17	2
T1535	Unused/Unsupported Cloud Regions	2	0
T1132.001	Standard Encoding	8	0
T1055.001	Dynamic-link Library Injection	8	0
T1129	Shared Modules	6	0
T1102.001	Dead Drop Resolver	9	0
T1491.001	Internal Defacement	14	0
T1565	Data Manipulation	65	3
T1203	Exploitation for Client Execution	196	0
T1553.004	Install Root Certificate	8	0
T1037.003	Network Logon Script	8	0
T1134	Access Token Manipulation	9	5
T1199	Trusted Relationship	11	0
T1578.002	Create Cloud Instance	12	0
T1136.003	Cloud Account	17	0
T1055	Process Injection	19	11
T1078.001	Default Accounts	25	0
T1036.005	Match Legitimate Name or Location	14	0
T1543.004	Launch Daemon	8	0
T1550.001	Application Access Token	19	0
T1218.011	Rundll32	5	0
T1216	Signed Script Proxy Execution	7	1
T1547.008	LSASS Driver	8	0
T1134.003	Make and Impersonate Token	8	0
T1095	Non-Application Layer Protocol	17	0
T1559.002	Dynamic Data Exchange	15	0
T1598.003	Spearphishing Link	15	0
T1556.002	Password Filter DLL	6	0
T1102	Web Service	11	3
T1546.002	Screensaver	10	0
T1218.005	Mshta	9	0
T1561.002	Disk Structure Wipe	13	0
T1543.003	Windows Service	17	0
T1552.002	Credentials in Registry	20	0
T1552.001	Credentials In Files	31	0
T1602.001	SNMP (MIB Dump)	27	0
T1567.002	Exfiltration to Cloud Storage	5	0
T1547.002	Authentication Package	6	0
T1071.002	File Transfer Protocols	19	0
T1574.005	Executable Installer File Permissions Weakness	14	0
T1558.004	AS-REP Roasting	23	0
T1011	Exfiltration Over Other Network Medium	5	1
T1602	Data from Configuration Repository	28	2
T1552.005	Cloud Instance Metadata API	16	0
T1550.003	Pass the Ticket	12	0
T1499	Endpoint Denial of Service	37	4
T1552.007	Container API	15	0
T1078.002	Domain Accounts	14	0
T1574.009	Path Interception by Unquoted Path	16	0
T1574.010	Services File Permissions Weakness	13	0
T1533		1	0
T0816		1	0
T1190		2	0
T0875		1	0
T0833		1	0
T1518	Software Discovery	2	1
T1409		1	0
T1134.001.		1	0
T0860		1	0
T0812		1	0
T1036		1	0
T1057	Process Discovery	2	0
T1461		1	0
T1478		1	0
T1478		6	0
T1552		1	0
T0803		1	0
T1059		1	0
T1078		4	0
T0804		1	0
T1531	Account Access Removal	5	0
T0880		1	0
T1608	Stage Capabilities	29	5
T1068		1	0
T1565.001		2	0
T1005	Data from Local System	82	0
T0814		1	0
T1575		4	0
T1553.002	Code Signing	3	0
T1149		1	0
T0859		1	0
T0836		1	0
T0855		4	0
T1505.003	Web Shell	16	0
T1480		1	0
T1456		1	0
T0873		1	0
T0826		2	0
T1202	Indirect Command Execution	5	0
T0828		6	0
T1005		1	0
T1496	Resource Hijacking	9	0
T1404		3	0
T1066		1	0
T1589	Gather Victim Identity Information	4	3
T0842		2	0
T1133		1	0
T1497	Virtualization/Sandbox Evasion	10	3
T1588.004	Digital Certificates	5	0
T1529	System Shutdown/Reboot	7	0
T1600	Weaken Encryption	3	2
T1480	Execution Guardrails	2	1
T1518.001	Security Software Discovery	2	0
T1477		3	0
T1083	File and Directory Discovery	9	0
T1204.001.		1	0
T1036.		1	0
T1217	Browser Bookmark Discovery	1	0
T1012	Query Registry	1	0
T1583	Acquire Infrastructure	2	6
T1010	Application Window Discovery	2	0
T1036.006	Space after Filename	1	0
T1020	Automated Exfiltration	4	1
T1036.004	Masquerade Task or Service	1	0
T1583.005	Botnet	4	0
T1588.006	Vulnerabilities	2	0
T1033	System Owner/User Discovery	1	0
T1593	Search Open Websites/Domains	2	2
T1207	Rogue Domain Controller	1	0
T1594	Search Victim-Owned Websites	2	0
T1587.004	Exploits	4	0
T1591.003	Identify Business Tempo	3	0
T1583.006	Web Services	6	0
T1590.002	DNS	3	0
T1590.001	Domain Properties	5	0
T1564.005	Hidden File System	1	0
T1595.001	Scanning IP Blocks	7	0
T1590.003	Network Trust Dependencies	3	0
T1608.001	Upload Malware	2	0
T1608.004	Drive-by Target	2	0
T1585	Establish Accounts	2	2
T1596.001	DNS/Passive DNS	2	0
T1006	Direct Volume Access	1	0
T1588.001	Malware	6	0
T1591.001	Determine Physical Locations	3	0
T1113	Screen Capture	1	0
T1125	Video Capture	1	0
T1584	Compromise Infrastructure	4	6
T1588	Obtain Capabilities	4	6
T1596	Search Open Technical Databases	2	5
T1124	System Time Discovery	1	0
T1587	Develop Capabilities	2	4
T1564.001	Hidden Files and Directories	1	0
T1014	Rootkit	1	0
T1547	Boot or Logon Autostart Execution	4	14
T1584.004	Server	3	0
T1484.001	Group Policy Modification	1	0
T1074.001	Local Data Staging	1	0
T1585.002	Email Accounts	2	0
T1608.005	Link Target	1	0
T1082	System Information Discovery	1	0
T1597.001	Threat Intel Vendors	2	0
T1480.001	Environmental Keying	1	0
T1087.003	Email Account	1	0
T1587.002	Code Signing Certificates	2	0
T1564	Hide Artifacts	1	7
T1546.005	Trap	1	0
T1027.003	Steganography	1	0
T1039	Data from Network Shared Drive	1	0
T1597.002	Purchase Technical Data	2	0
T1560.003	Archive via Custom Method	1	0
T1534	Internal Spearphishing	2	0
T1584.005	Botnet	4	0
T1027.005	Indicator Removal from Tools	1	0
T1589.003	Employee Names	3	0
T1027.004	Compile After Delivery	1	0
T1586.002	Email Accounts	1	0
T1589.001	Credentials	4	0
T1497.003	Time Based Evasion	1	0
T1583.001	Domains	4	0
T1591.004	Identify Roles	3	0
T1497.001	System Checks	1	0
T1547.001	Registry Run Keys / Startup Folder	1	0
T1007	System Service Discovery	1	0
T1596.002	WHOIS	2	0
T1592.002	Software	3	0
T1588.003	Code Signing Certificates	4	0
T1547.010	Port Monitors	1	0
T1016.001	Internet Connection Discovery	1	0
T1546.007	Netsh Helper DLL	1	0
T1123	Audio Capture	1	0
T1070.004	File Deletion	2	0
T1018	Remote System Discovery	3	0
T1592	Gather Victim Host Information	3	4
T1591	Gather Victim Org Information	3	4
T1592.001	Hardware	3	0
T1600.001	Reduce Key Space	1	0
T1120	Peripheral Device Discovery	1	0
T1596.004	CDNs	2	0
T1140	Deobfuscate/Decode Files or Information	1	0
T1590.005	IP Addresses	5	0
T1016	System Network Configuration Discovery	1	1
T1584.006	Web Services	3	0
T1586.001	Social Media Accounts	3	0
T1546.012	Image File Execution Options Injection	1	0
T1074.002	Remote Data Staging	1	0
T1036.002	Right-to-Left Override	3	0
T1070.006	Timestomp	2	0
T1069.001	Local Groups	1	0
T1070.005	Network Share Connection Removal	2	0
T1593.002	Search Engines	2	0
T1056.001	Keylogging	1	0
T1592.003	Firmware	3	0
T1588.005	Exploits	4	0
T1584.002	DNS Server	4	0
T1578.004	Revert Cloud Instance	1	0
T1614	System Location Discovery	1	0
T1056	Input Capture	1	4
T1591.002	Business Relationships	3	0
T1596.005	Scan Databases	2	0
T1546.015	Component Object Model Hijacking	1	0
T1586	Compromise Accounts	1	2
T1596.003	Digital Certificates	2	0
T1555.003	Credentials from Web Browsers	1	0
T1568.001	Fast Flux DNS	1	0
T1547.014	Active Setup	1	0
T1134.004	Parent PID Spoofing	1	0
T1069.003	Cloud Groups	1	0
T1590.006	Network Security Appliances	5	0
T1542.002	Component Firmware	1	0
T1584.001	Domains	4	0
T1590.004	Network Topology	5	0
T1069	Permission Groups Discovery	1	3
T1056.004	Credential API Hooking	3	0
T1584.003	Virtual Private Server	3	0
T1025	Data from Removable Media	1	0
T1606	Forge Web Credentials	1	2
T1583.003	Virtual Private Server	4	0
T1049	System Network Connections Discovery	1	0
T1595.002	Vulnerability Scanning	9	0
T1608.003	Install Digital Certificate	2	0
T1484.002	Domain Trust Modification	1	0
T1583.004	Server	4	0
T1546.001	Change Default File Association	1	0
T1600.002	Disable Crypto Hardware	1	0
T1595	Active Scanning	7	2
T1583.002	DNS Server	4	0
T1069.002	Domain Groups	1	0
T1585.001	Social Media Accounts	2	0
T1593.001	Social Media	2	0
T1560.002	Archive via Library	1	0
T1587.001	Malware	6	0
T1027.001	Binary Padding	1	0
T1606.002	SAML Tokens	1	0
T1497.002	User Activity Based Checks	1	0
T1588.002	Tool	1	0
T1526	Cloud Service Discovery	2	0
T1074	Data Staged	1	2
T1606.001	Web Cookies	1	0
T1592.004	Client Configurations	3	0
T1589.002	Email Addresses	4	0
T1590	Gather Victim Network Information	5	6
T1587.003	Digital Certificates	2	0
T1597	Search Closed Sources	2	2
T1608.002	Upload Tool	2	0
T1115	Clipboard Data	1	0
T1568.003	DNS Calculation	1	0