{"name": "veris overview", "versions": {"navigator": "4.8.0", "layer": "4.4", "attack": "9.0"}, "sorting": 3, "description": "veris heatmap overview of veris mappings, scores are the number of associated entries", "domain": "enterprise-attack", "techniques": [{"techniqueID": "T1047", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.hacking.vector.Command shell\n\u2022action.malware.vector.Direct install", "metadata": []}, {"techniqueID": "T1053", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1053.001", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1053.002", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1053.003", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1053.004", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1053.005", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1053.006", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1053.007", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1059", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.hacking.vector.Command shell", "metadata": []}, {"techniqueID": "T1059.001", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.hacking.vector.Command shell", "metadata": []}, {"techniqueID": "T1059.002", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.hacking.vector.Command shell", "metadata": []}, {"techniqueID": "T1059.003", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.hacking.vector.Command shell", "metadata": []}, {"techniqueID": "T1059.004", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.hacking.vector.Command shell", "metadata": []}, {"techniqueID": "T1059.005", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.hacking.vector.Command shell\n\u2022action.malware.vector.Email attachment", "metadata": []}, {"techniqueID": "T1059.006", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.hacking.vector.Command shell", "metadata": []}, {"techniqueID": "T1059.007", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.hacking.vector.Command shell\n\u2022action.malware.vector.Email attachment", "metadata": []}, {"techniqueID": "T1059.008", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.hacking.vector.Command shell", "metadata": []}, {"techniqueID": "T1072", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.malware.variety.Adminware\n\u2022action.malware.vector.Software update", "metadata": []}, {"techniqueID": "T1106", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1112", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1127", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.hacking.variety.Unknown", "metadata": []}, {"techniqueID": "T1127.001", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.hacking.variety.Unknown", "metadata": []}, {"techniqueID": "T1129", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1137", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1137.001", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1137.002", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1137.003", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1137.004", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1137.005", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1187", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.hacking.variety.MitM", "metadata": []}, {"techniqueID": "T1202", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1216", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1216.001", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1218", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1218.001", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1218.002", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1218.003", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1218.004", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1218.005", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1218.007", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1218.008", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1218.009", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1218.010", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1218.011", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1218.012", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1220", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1505.001", "score": 4, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.hacking.variety.Use of backdoor or C2\n\u2022action.malware.variety.Backdoor\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1505.002", "score": 4, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.hacking.variety.Use of backdoor or C2\n\u2022action.malware.variety.Backdoor\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1529", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1543", "score": 5, "comment": " Related to: \n \u2022action.malware.variety.Rootkit\n\u2022action.hacking.variety.Use of backdoor or C2\n\u2022action.hacking.variety.Abuse of functionality\n\u2022action.malware.variety.Backdoor\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1543.001", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1543.002", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1543.003", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.malware.variety.RAT", "metadata": []}, {"techniqueID": "T1543.004", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1547", "score": 4, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.malware.variety.Backdoor\n\u2022action.hacking.vector.Backdoor or C2\n\u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1548", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1548.001", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1548.002", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.hacking.variety.Exploit misconfig\n\u2022action.malware.variety.Exploit misconfig", "metadata": []}, {"techniqueID": "T1548.003", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.malware.variety.Client-side attack\n\u2022action.hacking.variety.Exploit misconfig", "metadata": []}, {"techniqueID": "T1548.004", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.hacking.variety.Exploit misconfig", "metadata": []}, {"techniqueID": "T1559", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1559.001", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1559.002", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1563", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.malware.vector.Network propagation", "metadata": []}, {"techniqueID": "T1563.001", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.malware.vector.Network propagation", "metadata": []}, {"techniqueID": "T1563.002", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.malware.vector.Network propagation", "metadata": []}, {"techniqueID": "T1564", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1564.001", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1564.002", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1564.003", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1564.004", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1564.005", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1564.006", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1564.007", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.malware.variety.Trojan", "metadata": []}, {"techniqueID": "T1569", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1569.001", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1569.002", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.malware.vector.Direct install", "metadata": []}, {"techniqueID": "T1578", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality\n\u2022action.hacking.vector.Hypervisor\n\u2022action.hacking.vector.Inter-tenant", "metadata": []}, {"techniqueID": "T1578.001", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1578.002", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1578.003", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1578.004", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1609", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Abuse of functionality", "metadata": []}, {"techniqueID": "T1110", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Brute force\n\u2022action.malware.variety.Brute force", "metadata": []}, {"techniqueID": "T1110.001", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Brute force\n\u2022action.malware.variety.Brute force", "metadata": []}, {"techniqueID": "T1110.002", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Offline cracking\n\u2022action.hacking.variety.Brute force\n\u2022action.malware.variety.Brute force", "metadata": []}, {"techniqueID": "T1110.003", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Brute force\n\u2022action.malware.variety.Brute force", "metadata": []}, {"techniqueID": "T1110.004", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Brute force\n\u2022action.malware.variety.Brute force", "metadata": []}, {"techniqueID": "T1203", "score": 7, "comment": " Related to: \n \u2022action.hacking.variety.HTTP Response Splitting\n\u2022action.hacking.variety.HTTP request smuggling\n\u2022action.hacking.variety.HTTP request splitting\n\u2022action.malware.vector.Email attachment\n\u2022action.malware.variety.Client-side attack\n\u2022action.hacking.variety.Buffer overflow\n\u2022action.hacking.variety.HTTP response smuggling", "metadata": []}, {"techniqueID": "T1600", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Cryptanalysis\n\u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1498", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.DoS\n\u2022action.malware.variety.DoS", "metadata": []}, {"techniqueID": "T1498.001", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.DoS\n\u2022action.malware.variety.DoS", "metadata": []}, {"techniqueID": "T1498.002", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.DoS\n\u2022action.malware.variety.DoS", "metadata": []}, {"techniqueID": "T1499", "score": 6, "comment": " Related to: \n \u2022action.hacking.variety.DoS\n\u2022action.malware.variety.DoS\n\u2022action.hacking.variety.XML external entities\n\u2022action.hacking.variety.Soap array abuse\n\u2022action.hacking.variety.XML entity expansion\n\u2022action.hacking.variety.XML attribute blowup", "metadata": []}, {"techniqueID": "T1499.001", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.DoS\n\u2022action.malware.variety.DoS", "metadata": []}, {"techniqueID": "T1499.002", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.DoS\n\u2022action.malware.variety.DoS", "metadata": []}, {"techniqueID": "T1499.003", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.DoS\n\u2022action.malware.variety.DoS", "metadata": []}, {"techniqueID": "T1499.004", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.DoS\n\u2022action.malware.variety.DoS", "metadata": []}, {"techniqueID": "T1583.005", "score": 4, "comment": " Related to: \n \u2022action.hacking.variety.DoS\n\u2022value_chain.distribution.variety.Botnet\n\u2022action.hacking.variety.Unknown\n\u2022value_chain.development.variety.Bot", "metadata": []}, {"techniqueID": "T1584.005", "score": 4, "comment": " Related to: \n \u2022action.hacking.variety.DoS\n\u2022action.hacking.variety.Unknown\n\u2022value_chain.distribution.variety.Other\n\u2022value_chain.non-distribution services.variety.Other", "metadata": []}, {"techniqueID": "T1068", "score": 8, "comment": " Related to: \n \u2022action.hacking.variety.Integer overflows\n\u2022action.malware.variety.Exploit misconfig\n\u2022action.hacking.variety.Fuzz testing\n\u2022action.hacking.variety.Exploit misconfig\n\u2022action.hacking.variety.Format string attack\n\u2022action.hacking.variety.Insecure deserialization\n\u2022action.hacking.variety.Exploit vuln\n\u2022action.hacking.variety.LDAP injection", "metadata": []}, {"techniqueID": "T1190", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Exploit misconfig\n\u2022action.malware.variety.Exploit vuln", "metadata": []}, {"techniqueID": "T1210", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Exploit misconfig\n\u2022action.malware.variety.Exploit vuln", "metadata": []}, {"techniqueID": "T1212", "score": 7, "comment": " Related to: \n \u2022action.malware.variety.Disable controls\n\u2022action.malware.vector.Web application - drive-by\n\u2022action.malware.variety.Exploit vuln\n\u2022action.hacking.variety.Session fixation\n\u2022action.malware.variety.Password dumper\n\u2022action.hacking.variety.Exploit misconfig\n\u2022action.hacking.variety.Exploit vuln", "metadata": []}, {"techniqueID": "T1558.004", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds\n\u2022action.hacking.variety.Exploit misconfig\n\u2022action.malware.variety.Exploit misconfig", "metadata": []}, {"techniqueID": "T1574.001", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Unknown\n\u2022action.hacking.variety.Exploit misconfig\n\u2022action.hacking.variety.Exploit vuln", "metadata": []}, {"techniqueID": "T1574.002", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Unknown\n\u2022action.hacking.variety.Exploit misconfig\n\u2022action.hacking.variety.Exploit vuln", "metadata": []}, {"techniqueID": "T1574.005", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Unknown\n\u2022action.hacking.variety.Exploit misconfig", "metadata": []}, {"techniqueID": "T1574.010", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Exploit misconfig", "metadata": []}, {"techniqueID": "T1574.011", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Exploit misconfig", "metadata": []}, {"techniqueID": "T1574.004", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Unknown\n\u2022action.hacking.variety.Exploit vuln", "metadata": []}, {"techniqueID": "T1595.002", "score": 4, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.malware.variety.Scan network\n\u2022action.malware.variety.Exploit vuln\n\u2022action.hacking.variety.Exploit vuln", "metadata": []}, {"techniqueID": "T1007", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1012", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1057", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1069", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1069.001", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1069.002", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1069.003", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1082", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1087", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1087.001", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1087.002", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1087.003", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1087.004", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1119", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.Capture stored data\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1120", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1124", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1201", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1480", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1480.001", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1518", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1518.001", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1526", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1538", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1580", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1589", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting\n\u2022value_chain.targeting.variety.Personal Information", "metadata": []}, {"techniqueID": "T1589.001", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting\n\u2022value_chain.targeting.variety.Personal Information\n\u2022value_chain.targeting.variety.Lost or stolen credentials", "metadata": []}, {"techniqueID": "T1589.002", "score": 3, "comment": " Related to: \n \u2022value_chain.targeting.variety.Email addresses\n\u2022action.hacking.variety.Footprinting\n\u2022value_chain.targeting.variety.Personal Information", "metadata": []}, {"techniqueID": "T1589.003", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting\n\u2022value_chain.targeting.variety.Personal Information", "metadata": []}, {"techniqueID": "T1590", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1590.001", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1590.002", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1590.003", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1590.004", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1590.005", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1590.006", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1591", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1591.001", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1591.002", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1591.003", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1591.004", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1592", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1592.001", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1592.002", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1592.003", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1592.004", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1593", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1593.001", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1593.002", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1594", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1596", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1596.001", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1596.002", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1596.003", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1596.004", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1596.005", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1597", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1597.001", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1597.002", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1602", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.Capture stored data\n\u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1602.001", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1602.002", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1613", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1614", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Footprinting", "metadata": []}, {"techniqueID": "T1539", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Forced browsing\n\u2022action.malware.variety.Capture app data\n\u2022action.hacking.variety.MitM", "metadata": []}, {"techniqueID": "T1583.003", "score": 4, "comment": " Related to: \n \u2022action.hacking.variety.Forced browsing\n\u2022action.hacking.variety.Unknown\n\u2022value_chain.distribution.variety.Other\n\u2022value_chain.non-distribution services.variety.Other", "metadata": []}, {"techniqueID": "T1583.004", "score": 4, "comment": " Related to: \n \u2022action.hacking.variety.Forced browsing\n\u2022action.hacking.variety.Unknown\n\u2022value_chain.distribution.variety.Other\n\u2022value_chain.non-distribution services.variety.Other", "metadata": []}, {"techniqueID": "T1583.006", "score": 6, "comment": " Related to: \n \u2022value_chain.non-distribution services.variety.Other\n\u2022action.malware.variety.C2\n\u2022action.hacking.variety.Unknown\n\u2022value_chain.distribution.variety.Other\n\u2022action.hacking.variety.Forced browsing\n\u2022value_chain.development.variety.Website", "metadata": []}, {"techniqueID": "T1185", "score": 7, "comment": " Related to: \n \u2022action.hacking.variety.HTTP Response Splitting\n\u2022action.hacking.variety.HTTP request smuggling\n\u2022action.hacking.variety.Session fixation\n\u2022action.hacking.variety.HTTP request splitting\n\u2022action.malware.variety.Capture app data\n\u2022action.hacking.variety.MitM\n\u2022action.hacking.variety.HTTP response smuggling", "metadata": []}, {"techniqueID": "T1557", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Routing detour\n\u2022action.hacking.variety.MitM", "metadata": []}, {"techniqueID": "T1557.001", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.MitM", "metadata": []}, {"techniqueID": "T1557.002", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.MitM", "metadata": []}, {"techniqueID": "T1550.002", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds\n\u2022action.hacking.variety.Pass-the-hash\n\u2022action.malware.variety.Password dumper", "metadata": []}, {"techniqueID": "T1001", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Use of backdoor or C2\n\u2022action.malware.variety.Unknown\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1008", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Use of backdoor or C2\n\u2022action.malware.variety.C2\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1071", "score": 4, "comment": " Related to: \n \u2022action.hacking.variety.Use of backdoor or C2\n\u2022action.malware.variety.C2\n\u2022action.malware.variety.Unknown\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1078", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Use of backdoor or C2\n\u2022action.hacking.variety.Use of stolen creds\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1090", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Use of backdoor or C2\n\u2022action.malware.variety.C2\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1095", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Use of backdoor or C2\n\u2022action.malware.variety.C2\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1102", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Use of backdoor or C2\n\u2022action.malware.variety.C2\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1104", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Use of backdoor or C2\n\u2022action.malware.variety.C2\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1105", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Use of backdoor or C2\n\u2022action.hacking.variety.Unknown\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1132", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Use of backdoor or C2\n\u2022action.malware.variety.C2\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1133", "score": 9, "comment": " Related to: \n \u2022action.malware.vector.Web application\n\u2022action.hacking.vector.3rd party desktop\n\u2022action.hacking.variety.Use of backdoor or C2\n\u2022action.hacking.variety.Use of stolen creds\n\u2022action.malware.variety.Exploit vuln\n\u2022action.hacking.vector.Desktop sharing software\n\u2022action.malware.vector.Remote injection\n\u2022action.malware.variety.Backdoor\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1205", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Use of backdoor or C2\n\u2022action.malware.variety.C2\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1505", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Use of backdoor or C2\n\u2022action.malware.variety.Backdoor\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1505.003", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Use of backdoor or C2\n\u2022action.malware.variety.Backdoor\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1525", "score": 5, "comment": " Related to: \n \u2022action.malware.variety.RAT\n\u2022action.malware.variety.Unknown\n\u2022action.hacking.variety.Use of backdoor or C2\n\u2022action.malware.variety.Backdoor\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1568", "score": 4, "comment": " Related to: \n \u2022action.hacking.variety.Use of backdoor or C2\n\u2022action.malware.variety.C2\n\u2022action.malware.vector.Download by malware\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1571", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Use of backdoor or C2\n\u2022action.malware.variety.C2\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1572", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Use of backdoor or C2\n\u2022action.malware.variety.C2\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1573", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Use of backdoor or C2\n\u2022action.malware.variety.C2\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1573.001", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Use of backdoor or C2\n\u2022action.malware.variety.C2", "metadata": []}, {"techniqueID": "T1573.002", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Use of backdoor or C2\n\u2022action.malware.variety.C2", "metadata": []}, {"techniqueID": "T1021", "score": 2, "comment": " Related to: \n \u2022action.malware.vector.Network propagation\n\u2022action.hacking.variety.Use of stolen creds", "metadata": []}, {"techniqueID": "T1021.001", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds\n\u2022action.hacking.vector.Desktop sharing software", "metadata": []}, {"techniqueID": "T1021.002", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds\n\u2022action.hacking.vector.Command shell", "metadata": []}, {"techniqueID": "T1021.003", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds\n\u2022action.hacking.vector.Command shell", "metadata": []}, {"techniqueID": "T1021.004", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds\n\u2022action.hacking.vector.Command shell", "metadata": []}, {"techniqueID": "T1021.005", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds\n\u2022action.hacking.vector.Desktop sharing software", "metadata": []}, {"techniqueID": "T1021.006", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds\n\u2022action.hacking.vector.Command shell", "metadata": []}, {"techniqueID": "T1078.001", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds", "metadata": []}, {"techniqueID": "T1078.002", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds", "metadata": []}, {"techniqueID": "T1078.003", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds", "metadata": []}, {"techniqueID": "T1078.004", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds", "metadata": []}, {"techniqueID": "T1134", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds", "metadata": []}, {"techniqueID": "T1134.001", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds", "metadata": []}, {"techniqueID": "T1134.002", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds", "metadata": []}, {"techniqueID": "T1134.003", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds", "metadata": []}, {"techniqueID": "T1134.004", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds", "metadata": []}, {"techniqueID": "T1134.005", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds", "metadata": []}, {"techniqueID": "T1550", "score": 2, "comment": " Related to: \n \u2022action.malware.vector.Network propagation\n\u2022action.hacking.variety.Use of stolen creds", "metadata": []}, {"techniqueID": "T1550.001", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds", "metadata": []}, {"techniqueID": "T1550.003", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds", "metadata": []}, {"techniqueID": "T1550.004", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds", "metadata": []}, {"techniqueID": "T1558", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds", "metadata": []}, {"techniqueID": "T1558.001", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds", "metadata": []}, {"techniqueID": "T1558.002", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds", "metadata": []}, {"techniqueID": "T1558.003", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds", "metadata": []}, {"techniqueID": "T1586", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds", "metadata": []}, {"techniqueID": "T1586.001", "score": 3, "comment": " Related to: \n \u2022action.social.variety.Phishing\n\u2022action.hacking.variety.Use of stolen creds\n\u2022action.social.variety.Pretexting", "metadata": []}, {"techniqueID": "T1586.002", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Use of stolen creds", "metadata": []}, {"techniqueID": "T1611", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Virtual machine escape", "metadata": []}, {"techniqueID": "T1213", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.Capture stored data\n\u2022action.hacking.variety.XML external entities", "metadata": []}, {"techniqueID": "T1546", "score": 4, "comment": " Related to: \n \u2022action.malware.variety.Backdoor\n\u2022action.hacking.variety.XML injection\n\u2022attribute.integrity.variety.Alter behavior\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1574", "score": 4, "comment": " Related to: \n \u2022action.malware.variety.Backdoor\n\u2022action.hacking.variety.Unknown\n\u2022action.hacking.variety.XML injection\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1010", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.Capture stored data\n\u2022action.hacking.variety.XPath injection", "metadata": []}, {"techniqueID": "T1111", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Unknown", "metadata": []}, {"techniqueID": "T1583", "score": 2, "comment": " Related to: \n \u2022action.malware.vector.Web application - download\n\u2022action.hacking.variety.Unknown", "metadata": []}, {"techniqueID": "T1583.001", "score": 4, "comment": " Related to: \n \u2022action.malware.variety.C2\n\u2022action.hacking.variety.Unknown\n\u2022value_chain.distribution.variety.Other\n\u2022value_chain.non-distribution services.variety.Other", "metadata": []}, {"techniqueID": "T1583.002", "score": 4, "comment": " Related to: \n \u2022action.malware.variety.C2\n\u2022action.hacking.variety.Unknown\n\u2022value_chain.distribution.variety.Other\n\u2022value_chain.non-distribution services.variety.Other", "metadata": []}, {"techniqueID": "T1584", "score": 4, "comment": " Related to: \n \u2022action.malware.vector.Web application - download\n\u2022action.hacking.variety.Unknown\n\u2022value_chain.distribution.variety.Other\n\u2022value_chain.non-distribution services.variety.Other", "metadata": []}, {"techniqueID": "T1584.001", "score": 4, "comment": " Related to: \n \u2022action.social.variety.Pretexting\n\u2022action.hacking.variety.Unknown\n\u2022value_chain.distribution.variety.Other\n\u2022value_chain.non-distribution services.variety.Other", "metadata": []}, {"techniqueID": "T1584.002", "score": 4, "comment": " Related to: \n \u2022value_chain.distribution.variety.Compromised server\n\u2022action.malware.variety.C2\n\u2022action.hacking.variety.Unknown\n\u2022value_chain.non-distribution services.variety.Other", "metadata": []}, {"techniqueID": "T1584.003", "score": 3, "comment": " Related to: \n \u2022value_chain.distribution.variety.Compromised server\n\u2022action.hacking.variety.Unknown\n\u2022value_chain.non-distribution services.variety.Other", "metadata": []}, {"techniqueID": "T1584.004", "score": 3, "comment": " Related to: \n \u2022value_chain.distribution.variety.Compromised server\n\u2022action.hacking.variety.Unknown\n\u2022value_chain.non-distribution services.variety.Other", "metadata": []}, {"techniqueID": "T1584.006", "score": 3, "comment": " Related to: \n \u2022action.hacking.variety.Unknown\n\u2022value_chain.distribution.variety.Other\n\u2022value_chain.non-distribution services.variety.Other", "metadata": []}, {"techniqueID": "T1587", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Unknown\n\u2022value_chain.development.variety.Unknown", "metadata": []}, {"techniqueID": "T1587.001", "score": 6, "comment": " Related to: \n \u2022action.malware.variety.Unknown\n\u2022value_chain.development.variety.Bot\n\u2022value_chain.development.variety.Trojan\n\u2022action.hacking.variety.Unknown\n\u2022value_chain.development.variety.Payload\n\u2022value_chain.development.variety.Ransomware", "metadata": []}, {"techniqueID": "T1587.002", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Unknown\n\u2022value_chain.development.variety.Other", "metadata": []}, {"techniqueID": "T1587.003", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Unknown\n\u2022value_chain.development.variety.Other", "metadata": []}, {"techniqueID": "T1587.004", "score": 4, "comment": " Related to: \n \u2022value_chain.development.variety.Exploit\n\u2022value_chain.development.variety.Exploit Kits\n\u2022action.hacking.variety.Unknown\n\u2022action.malware.variety.Unknown", "metadata": []}, {"techniqueID": "T1588", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Unknown\n\u2022value_chain.development.variety.Unknown", "metadata": []}, {"techniqueID": "T1588.001", "score": 6, "comment": " Related to: \n \u2022action.malware.variety.Unknown\n\u2022value_chain.development.variety.Bot\n\u2022value_chain.development.variety.Trojan\n\u2022action.hacking.variety.Unknown\n\u2022value_chain.development.variety.Payload\n\u2022value_chain.development.variety.Ransomware", "metadata": []}, {"techniqueID": "T1588.002", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Unknown", "metadata": []}, {"techniqueID": "T1588.003", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Unknown\n\u2022value_chain.development.variety.Other", "metadata": []}, {"techniqueID": "T1588.004", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Unknown\n\u2022value_chain.development.variety.Other", "metadata": []}, {"techniqueID": "T1588.005", "score": 4, "comment": " Related to: \n \u2022value_chain.development.variety.Exploit\n\u2022value_chain.development.variety.Exploit Kits\n\u2022action.hacking.variety.Unknown\n\u2022action.malware.variety.Unknown", "metadata": []}, {"techniqueID": "T1588.006", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Unknown\n\u2022action.malware.variety.Unknown", "metadata": []}, {"techniqueID": "T1599", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Unknown", "metadata": []}, {"techniqueID": "T1599.001", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Unknown", "metadata": []}, {"techniqueID": "T1606", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Unknown", "metadata": []}, {"techniqueID": "T1606.001", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Unknown", "metadata": []}, {"techniqueID": "T1606.002", "score": 1, "comment": " Related to: \n \u2022action.hacking.variety.Unknown", "metadata": []}, {"techniqueID": "T1531", "score": 2, "comment": " Related to: \n \u2022action.hacking.variety.Unknown\n\u2022attribute.integrity.variety.Unknown", "metadata": []}, {"techniqueID": "T1037", "score": 3, "comment": " Related to: \n \u2022action.malware.variety.Backdoor\n\u2022action.hacking.vector.Backdoor or C2\n\u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1098", "score": 3, "comment": " Related to: \n \u2022action.malware.variety.Backdoor\n\u2022action.hacking.vector.Backdoor or C2\n\u2022attribute.integrity.variety.Modify privileges", "metadata": []}, {"techniqueID": "T1136", "score": 3, "comment": " Related to: \n \u2022attribute.integrity.variety.Created account\n\u2022action.malware.variety.Modify data\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1197", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.Export data\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1542", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.Rootkit\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1554", "score": 4, "comment": " Related to: \n \u2022action.malware.variety.Adminware\n\u2022action.malware.variety.Backdoor\n\u2022action.malware.variety.Trojan\n\u2022action.hacking.vector.Backdoor or C2", "metadata": []}, {"techniqueID": "T1219", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.Adminware\n\u2022action.hacking.vector.Desktop sharing software", "metadata": []}, {"techniqueID": "T1497", "score": 3, "comment": " Related to: \n \u2022action.hacking.vector.Hypervisor\n\u2022action.hacking.vector.Inter-tenant\n\u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1199", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.Adware\n\u2022action.hacking.vector.Partner", "metadata": []}, {"techniqueID": "T1195", "score": 2, "comment": " Related to: \n \u2022action.malware.vector.Software update\n\u2022action.hacking.vector.Partner", "metadata": []}, {"techniqueID": "T1195.001", "score": 1, "comment": " Related to: \n \u2022action.hacking.vector.Partner", "metadata": []}, {"techniqueID": "T1195.002", "score": 1, "comment": " Related to: \n \u2022action.hacking.vector.Partner", "metadata": []}, {"techniqueID": "T1195.003", "score": 1, "comment": " Related to: \n \u2022action.hacking.vector.Partner", "metadata": []}, {"techniqueID": "T1200", "score": 1, "comment": " Related to: \n \u2022action.hacking.vector.Physical access", "metadata": []}, {"techniqueID": "T1205.001", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.C2\n\u2022action.malware.variety.Backdoor", "metadata": []}, {"techniqueID": "T1001.001", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.C2\n\u2022action.malware.variety.Unknown", "metadata": []}, {"techniqueID": "T1071.001", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.C2\n\u2022action.malware.variety.Unknown", "metadata": []}, {"techniqueID": "T1071.002", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.C2\n\u2022action.malware.variety.Unknown", "metadata": []}, {"techniqueID": "T1071.003", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.C2\n\u2022action.malware.variety.Unknown", "metadata": []}, {"techniqueID": "T1071.004", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.C2\n\u2022action.malware.variety.Unknown", "metadata": []}, {"techniqueID": "T1090.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.C2", "metadata": []}, {"techniqueID": "T1090.002", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.C2", "metadata": []}, {"techniqueID": "T1090.003", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.C2", "metadata": []}, {"techniqueID": "T1090.004", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.C2", "metadata": []}, {"techniqueID": "T1102.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.C2", "metadata": []}, {"techniqueID": "T1102.002", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.C2", "metadata": []}, {"techniqueID": "T1102.003", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.C2", "metadata": []}, {"techniqueID": "T1132.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.C2", "metadata": []}, {"techniqueID": "T1132.002", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.C2", "metadata": []}, {"techniqueID": "T1568.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.C2", "metadata": []}, {"techniqueID": "T1568.002", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.C2", "metadata": []}, {"techniqueID": "T1568.003", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.C2", "metadata": []}, {"techniqueID": "T1056", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Capture app data", "metadata": []}, {"techniqueID": "T1056.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Capture app data", "metadata": []}, {"techniqueID": "T1056.002", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Capture app data", "metadata": []}, {"techniqueID": "T1056.003", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Capture app data", "metadata": []}, {"techniqueID": "T1056.004", "score": 3, "comment": " Related to: \n \u2022action.malware.variety.Spyware/Keylogger\n\u2022action.malware.variety.Capture app data\n\u2022action.malware.variety.Password dumper", "metadata": []}, {"techniqueID": "T1113", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Capture app data", "metadata": []}, {"techniqueID": "T1114", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Capture app data", "metadata": []}, {"techniqueID": "T1114.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Capture app data", "metadata": []}, {"techniqueID": "T1114.002", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Capture app data", "metadata": []}, {"techniqueID": "T1114.003", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.Capture app data\n\u2022attribute.integrity.variety.Alter behavior", "metadata": []}, {"techniqueID": "T1123", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Capture app data", "metadata": []}, {"techniqueID": "T1125", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Capture app data", "metadata": []}, {"techniqueID": "T1176", "score": 2, "comment": " Related to: \n \u2022action.malware.vector.Web application - drive-by\n\u2022action.malware.variety.Capture app data", "metadata": []}, {"techniqueID": "T1207", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Capture app data", "metadata": []}, {"techniqueID": "T1217", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Capture app data", "metadata": []}, {"techniqueID": "T1528", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Capture app data", "metadata": []}, {"techniqueID": "T1003.002", "score": 3, "comment": " Related to: \n \u2022action.malware.variety.Capture stored data\n\u2022action.malware.variety.RAM scraper\n\u2022action.malware.variety.Password dumper", "metadata": []}, {"techniqueID": "T1003.003", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.Capture stored data\n\u2022action.malware.variety.Password dumper", "metadata": []}, {"techniqueID": "T1003.006", "score": 3, "comment": " Related to: \n \u2022action.malware.variety.Capture stored data\n\u2022action.malware.variety.Export data\n\u2022action.malware.variety.Password dumper", "metadata": []}, {"techniqueID": "T1003.008", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.Capture stored data\n\u2022action.malware.variety.Password dumper", "metadata": []}, {"techniqueID": "T1005", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Capture stored data", "metadata": []}, {"techniqueID": "T1025", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Capture stored data", "metadata": []}, {"techniqueID": "T1033", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Capture stored data", "metadata": []}, {"techniqueID": "T1039", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Capture stored data", "metadata": []}, {"techniqueID": "T1083", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Capture stored data", "metadata": []}, {"techniqueID": "T1213.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Capture stored data", "metadata": []}, {"techniqueID": "T1213.002", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Capture stored data", "metadata": []}, {"techniqueID": "T1530", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Capture stored data", "metadata": []}, {"techniqueID": "T1496", "score": 3, "comment": " Related to: \n \u2022action.malware.variety.Click fraud\n\u2022action.malware.variety.Click fraud and cryptocurrency mining\n\u2022action.malware.variety.Cryptocurrency mining", "metadata": []}, {"techniqueID": "T1221", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Client-side attack", "metadata": []}, {"techniqueID": "T1070", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Destroy data", "metadata": []}, {"techniqueID": "T1070.001", "score": 2, "comment": " Related to: \n \u2022attribute.integrity.variety.Log tampering\n\u2022action.malware.variety.Destroy data", "metadata": []}, {"techniqueID": "T1070.002", "score": 2, "comment": " Related to: \n \u2022attribute.integrity.variety.Log tampering\n\u2022action.malware.variety.Destroy data", "metadata": []}, {"techniqueID": "T1070.003", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Destroy data", "metadata": []}, {"techniqueID": "T1070.004", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Destroy data", "metadata": []}, {"techniqueID": "T1070.005", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Destroy data", "metadata": []}, {"techniqueID": "T1070.006", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Destroy data", "metadata": []}, {"techniqueID": "T1485", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Destroy data", "metadata": []}, {"techniqueID": "T1495", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Destroy data", "metadata": []}, {"techniqueID": "T1561", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Destroy data", "metadata": []}, {"techniqueID": "T1561.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Destroy data", "metadata": []}, {"techniqueID": "T1561.002", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Destroy data", "metadata": []}, {"techniqueID": "T1006", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1027", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1027.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1027.002", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1027.003", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1027.004", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1027.005", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1036", "score": 2, "comment": " Related to: \n \u2022action.malware.vector.Email attachment\n\u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1036.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1036.002", "score": 3, "comment": " Related to: \n \u2022action.social.variety.Phishing\n\u2022action.social.variety.Forgery\n\u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1036.003", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.Rootkit\n\u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1036.004", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1036.005", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1036.006", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1222", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1222.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1222.002", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1490", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.Ransomware\n\u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1497.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1497.002", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1497.003", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1553", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1553.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1553.002", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1553.003", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1553.004", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1553.005", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1553.006", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1562", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.Modify data\n\u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1562.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1562.002", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1562.003", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1562.004", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1562.006", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1562.007", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1562.008", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1574.012", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1600.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1600.002", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1601", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1601.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1601.002", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Disable controls", "metadata": []}, {"techniqueID": "T1489", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.DoS", "metadata": []}, {"techniqueID": "T1211", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Exploit vuln", "metadata": []}, {"techniqueID": "T1011", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Export data", "metadata": []}, {"techniqueID": "T1011.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Export data", "metadata": []}, {"techniqueID": "T1020", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Export data", "metadata": []}, {"techniqueID": "T1020.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Export data", "metadata": []}, {"techniqueID": "T1029", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Export data", "metadata": []}, {"techniqueID": "T1030", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Export data", "metadata": []}, {"techniqueID": "T1041", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Export data", "metadata": []}, {"techniqueID": "T1048", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Export data", "metadata": []}, {"techniqueID": "T1048.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Export data", "metadata": []}, {"techniqueID": "T1048.002", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Export data", "metadata": []}, {"techniqueID": "T1048.003", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Export data", "metadata": []}, {"techniqueID": "T1052", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Export data", "metadata": []}, {"techniqueID": "T1052.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Export data", "metadata": []}, {"techniqueID": "T1074", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Export data", "metadata": []}, {"techniqueID": "T1074.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Export data", "metadata": []}, {"techniqueID": "T1074.002", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Export data", "metadata": []}, {"techniqueID": "T1537", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Export data", "metadata": []}, {"techniqueID": "T1560", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Export data", "metadata": []}, {"techniqueID": "T1560.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Export data", "metadata": []}, {"techniqueID": "T1560.002", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Export data", "metadata": []}, {"techniqueID": "T1560.003", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Export data", "metadata": []}, {"techniqueID": "T1567", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Export data", "metadata": []}, {"techniqueID": "T1567.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Export data", "metadata": []}, {"techniqueID": "T1567.002", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Export data", "metadata": []}, {"techniqueID": "T1003.007", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.In-memory\n\u2022action.malware.variety.Password dumper", "metadata": []}, {"techniqueID": "T1055", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.In-memory", "metadata": []}, {"techniqueID": "T1055.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.In-memory", "metadata": []}, {"techniqueID": "T1055.002", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.In-memory", "metadata": []}, {"techniqueID": "T1055.003", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.In-memory", "metadata": []}, {"techniqueID": "T1055.004", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.In-memory", "metadata": []}, {"techniqueID": "T1055.005", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.In-memory", "metadata": []}, {"techniqueID": "T1055.008", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.In-memory", "metadata": []}, {"techniqueID": "T1055.009", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.In-memory", "metadata": []}, {"techniqueID": "T1055.011", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.In-memory", "metadata": []}, {"techniqueID": "T1055.012", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.In-memory", "metadata": []}, {"techniqueID": "T1055.013", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.In-memory", "metadata": []}, {"techniqueID": "T1055.014", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.In-memory", "metadata": []}, {"techniqueID": "T1115", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.In-memory", "metadata": []}, {"techniqueID": "T1040", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.Packet sniffer\n\u2022action.malware.variety.Scan network", "metadata": []}, {"techniqueID": "T1003", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Password dumper", "metadata": []}, {"techniqueID": "T1003.001", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.RAM scraper\n\u2022action.malware.variety.Password dumper", "metadata": []}, {"techniqueID": "T1003.004", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.RAM scraper\n\u2022action.malware.variety.Password dumper", "metadata": []}, {"techniqueID": "T1003.005", "score": 3, "comment": " Related to: \n \u2022action.malware.vector.Email link\n\u2022action.malware.variety.RAM scraper\n\u2022action.malware.variety.Password dumper", "metadata": []}, {"techniqueID": "T1552.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Password dumper", "metadata": []}, {"techniqueID": "T1552.002", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Password dumper", "metadata": []}, {"techniqueID": "T1552.003", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Password dumper", "metadata": []}, {"techniqueID": "T1552.004", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Password dumper", "metadata": []}, {"techniqueID": "T1552.005", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Password dumper", "metadata": []}, {"techniqueID": "T1552.006", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Password dumper", "metadata": []}, {"techniqueID": "T1555", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Password dumper", "metadata": []}, {"techniqueID": "T1555.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Password dumper", "metadata": []}, {"techniqueID": "T1555.002", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.RAM scraper\n\u2022action.malware.variety.Password dumper", "metadata": []}, {"techniqueID": "T1555.003", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Password dumper", "metadata": []}, {"techniqueID": "T1555.004", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Password dumper", "metadata": []}, {"techniqueID": "T1555.005", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Password dumper", "metadata": []}, {"techniqueID": "T1486", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Ransomware", "metadata": []}, {"techniqueID": "T1014", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Rootkit", "metadata": []}, {"techniqueID": "T1542.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Rootkit", "metadata": []}, {"techniqueID": "T1542.002", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Rootkit", "metadata": []}, {"techniqueID": "T1542.003", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Rootkit", "metadata": []}, {"techniqueID": "T1542.004", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Rootkit", "metadata": []}, {"techniqueID": "T1542.005", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Rootkit", "metadata": []}, {"techniqueID": "T1016", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Scan network", "metadata": []}, {"techniqueID": "T1016.001", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Scan network", "metadata": []}, {"techniqueID": "T1018", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Scan network", "metadata": []}, {"techniqueID": "T1046", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Scan network", "metadata": []}, {"techniqueID": "T1049", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Scan network", "metadata": []}, {"techniqueID": "T1135", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Scan network", "metadata": []}, {"techniqueID": "T1482", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Scan network", "metadata": []}, {"techniqueID": "T1595", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.malware.variety.Scan network", "metadata": []}, {"techniqueID": "T1595.001", "score": 2, "comment": " Related to: \n \u2022value_chain.targeting.variety.Organizational Information\n\u2022action.malware.variety.Scan network", "metadata": []}, {"techniqueID": "T1204.003", "score": 4, "comment": " Related to: \n \u2022action.social.variety.Phishing\n\u2022action.social.variety.Pretexting\n\u2022action.malware.variety.Trojan\n\u2022action.malware.variety.Unknown", "metadata": []}, {"techniqueID": "T1080", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.Worm\n\u2022action.malware.variety.Unknown", "metadata": []}, {"techniqueID": "T1091", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.Worm\n\u2022action.malware.vector.Removable media", "metadata": []}, {"techniqueID": "T1001.002", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Unknown", "metadata": []}, {"techniqueID": "T1001.003", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Unknown", "metadata": []}, {"techniqueID": "T1140", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Unknown", "metadata": []}, {"techniqueID": "T1204", "score": 2, "comment": " Related to: \n \u2022action.social.variety.Phishing\n\u2022action.malware.variety.Unknown", "metadata": []}, {"techniqueID": "T1204.001", "score": 3, "comment": " Related to: \n \u2022action.social.variety.Phishing\n\u2022action.malware.vector.Email link\n\u2022action.malware.variety.Unknown", "metadata": []}, {"techniqueID": "T1204.002", "score": 3, "comment": " Related to: \n \u2022action.social.variety.Phishing\n\u2022action.malware.variety.Unknown\n\u2022action.malware.vector.Email attachment", "metadata": []}, {"techniqueID": "T1608", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.Unknown\n\u2022value_chain.distribution.variety.Unknown", "metadata": []}, {"techniqueID": "T1608.001", "score": 2, "comment": " Related to: \n \u2022value_chain.distribution.variety.Website\n\u2022action.malware.variety.Unknown", "metadata": []}, {"techniqueID": "T1608.002", "score": 2, "comment": " Related to: \n \u2022value_chain.distribution.variety.Website\n\u2022action.malware.variety.Unknown", "metadata": []}, {"techniqueID": "T1608.003", "score": 2, "comment": " Related to: \n \u2022action.malware.variety.Unknown\n\u2022value_chain.distribution.variety.Other", "metadata": []}, {"techniqueID": "T1608.004", "score": 2, "comment": " Related to: \n \u2022value_chain.distribution.variety.Website\n\u2022action.malware.variety.Unknown", "metadata": []}, {"techniqueID": "T1608.005", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Unknown", "metadata": []}, {"techniqueID": "T1610", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Unknown", "metadata": []}, {"techniqueID": "T1612", "score": 1, "comment": " Related to: \n \u2022action.malware.variety.Unknown", "metadata": []}, {"techniqueID": "T1566.001", "score": 3, "comment": " Related to: \n \u2022action.social.variety.Phishing\n\u2022action.malware.vector.Email attachment\n\u2022action.social.vector.Email", "metadata": []}, {"techniqueID": "T1598.002", "score": 4, "comment": " Related to: \n \u2022action.social.variety.Phishing\n\u2022value_chain.targeting.variety.Organizational Information\n\u2022action.malware.vector.Email attachment\n\u2022action.social.variety.Pretexting", "metadata": []}, {"techniqueID": "T1556.002", "score": 3, "comment": " Related to: \n \u2022action.malware.vector.Email link\n\u2022attribute.integrity.variety.Modify privileges\n\u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1598.003", "score": 4, "comment": " Related to: \n \u2022action.social.variety.Phishing\n\u2022action.malware.vector.Email link\n\u2022value_chain.targeting.variety.Organizational Information\n\u2022action.social.variety.Pretexting", "metadata": []}, {"techniqueID": "T1566", "score": 2, "comment": " Related to: \n \u2022action.social.variety.Phishing\n\u2022action.malware.vector.Instant messaging", "metadata": []}, {"techniqueID": "T1570", "score": 1, "comment": " Related to: \n \u2022action.malware.vector.Network propagation", "metadata": []}, {"techniqueID": "T1092", "score": 1, "comment": " Related to: \n \u2022action.malware.vector.Removable media", "metadata": []}, {"techniqueID": "T1189", "score": 1, "comment": " Related to: \n \u2022action.malware.vector.Web application - drive-by", "metadata": []}, {"techniqueID": "T1566.002", "score": 2, "comment": " Related to: \n \u2022action.social.variety.Phishing\n\u2022action.social.vector.Email", "metadata": []}, {"techniqueID": "T1566.003", "score": 2, "comment": " Related to: \n \u2022action.social.variety.Phishing\n\u2022action.social.vector.Email", "metadata": []}, {"techniqueID": "T1598", "score": 3, "comment": " Related to: \n \u2022action.social.variety.Phishing\n\u2022value_chain.targeting.variety.Organizational Information\n\u2022action.social.variety.Pretexting", "metadata": []}, {"techniqueID": "T1598.001", "score": 3, "comment": " Related to: \n \u2022action.social.variety.Phishing\n\u2022value_chain.targeting.variety.Organizational Information\n\u2022action.social.variety.Pretexting", "metadata": []}, {"techniqueID": "T1534", "score": 2, "comment": " Related to: \n \u2022action.social.variety.Pretexting\n\u2022attribute.integrity.variety.Misrepresentation", "metadata": []}, {"techniqueID": "T1585", "score": 2, "comment": " Related to: \n \u2022action.social.variety.Pretexting\n\u2022value_chain.development.variety.Persona", "metadata": []}, {"techniqueID": "T1585.001", "score": 2, "comment": " Related to: \n \u2022action.social.variety.Pretexting\n\u2022value_chain.development.variety.Persona", "metadata": []}, {"techniqueID": "T1585.002", "score": 2, "comment": " Related to: \n \u2022action.social.variety.Pretexting\n\u2022value_chain.development.variety.Persona", "metadata": []}, {"techniqueID": "T1546.001", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Alter behavior", "metadata": []}, {"techniqueID": "T1546.002", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Alter behavior", "metadata": []}, {"techniqueID": "T1546.003", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Alter behavior", "metadata": []}, {"techniqueID": "T1546.004", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Alter behavior", "metadata": []}, {"techniqueID": "T1546.005", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Alter behavior", "metadata": []}, {"techniqueID": "T1546.006", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Alter behavior", "metadata": []}, {"techniqueID": "T1546.007", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Alter behavior", "metadata": []}, {"techniqueID": "T1546.008", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Alter behavior", "metadata": []}, {"techniqueID": "T1546.009", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Alter behavior", "metadata": []}, {"techniqueID": "T1546.010", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Alter behavior", "metadata": []}, {"techniqueID": "T1546.011", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Alter behavior", "metadata": []}, {"techniqueID": "T1546.012", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Alter behavior", "metadata": []}, {"techniqueID": "T1546.013", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Alter behavior", "metadata": []}, {"techniqueID": "T1546.014", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Alter behavior", "metadata": []}, {"techniqueID": "T1546.015", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Alter behavior", "metadata": []}, {"techniqueID": "T1136.001", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Created account", "metadata": []}, {"techniqueID": "T1136.002", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Created account", "metadata": []}, {"techniqueID": "T1136.003", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Created account", "metadata": []}, {"techniqueID": "T1491", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Defacement", "metadata": []}, {"techniqueID": "T1491.001", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Defacement", "metadata": []}, {"techniqueID": "T1491.002", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Defacement", "metadata": []}, {"techniqueID": "T1037.001", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1037.002", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1037.003", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1037.004", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1037.005", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1484", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1484.001", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1484.002", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1547.001", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1547.002", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1547.003", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1547.004", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1547.005", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1547.006", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1547.007", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1547.008", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1547.009", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1547.010", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1547.011", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1547.012", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1547.013", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1556", "score": 2, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify privileges\n\u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1556.001", "score": 2, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify privileges\n\u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1556.003", "score": 2, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify privileges\n\u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1556.004", "score": 2, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify privileges\n\u2022attribute.integrity.variety.Modify configuration", "metadata": []}, {"techniqueID": "T1565", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify data", "metadata": []}, {"techniqueID": "T1565.001", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify data", "metadata": []}, {"techniqueID": "T1565.002", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify data", "metadata": []}, {"techniqueID": "T1565.003", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify data", "metadata": []}, {"techniqueID": "T1098.001", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify privileges", "metadata": []}, {"techniqueID": "T1098.002", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify privileges", "metadata": []}, {"techniqueID": "T1098.003", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify privileges", "metadata": []}, {"techniqueID": "T1098.004", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify privileges", "metadata": []}, {"techniqueID": "T1547.014", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Modify privileges", "metadata": []}, {"techniqueID": "T1535", "score": 1, "comment": " Related to: \n \u2022attribute.integrity.variety.Repurpose", "metadata": []}, {"techniqueID": null, "score": 156, "comment": " Related to: \n \u2022action.social.variety.Scam\n\u2022attribute.integrity.variety.Fraudulent transaction\n\u2022action.hacking.variety.RFI\n\u2022attribute.integrity.variety.Hardware tampering\n\u2022value_chain.targeting.variety.Partner\n\u2022action.misuse.result.Unknown\n\u2022value_chain.targeting.variety.Unknown\n\u2022action.misuse.result.Lateral movement\n\u2022value_chain.non-distribution services.variety.Hashcracking\n\u2022action.hacking.variety.XQuery injection\n\u2022action.misuse.variety.Unapproved hardware\n\u2022action.social.vector.IM\n\u2022action.social.result.Unknown\n\u2022action.social.vector.Website\n\u2022action.social.vector.Removable media\n\u2022action.social.target.Executive\n\u2022action.malware.result.Unknown\n\u2022value_chain.distribution.variety.Email\n\u2022action.hacking.result.Other\n\u2022action.misuse.result.NA\n\u2022value_chain.targeting.variety.Misconfigurations\n\u2022action.hacking.variety.Null byte injection\n\u2022action.social.variety.Unknown\n\u2022value_chain.targeting.variety.Weaknesses\n\u2022action.misuse.result.Other\n\u2022action.hacking.variety.SSI injection\n\u2022action.social.target.Customer\n\u2022action.hacking.variety.Session prediction\n\u2022action.social.target.System admin\n\u2022action.malware.result.NA\n\u2022value_chain.non-distribution services.variety.Proxy\n\u2022action.social.result.Other\n\u2022action.hacking.variety.Session replay\n\u2022action.misuse.variety.Illicit content\n\u2022action.social.variety.Influence\n\u2022action.malware.variety.Other\n\u2022action.misuse.result.Infiltrate\n\u2022action.social.vector.Unknown\n\u2022action.hacking.result.Unknown\n\u2022action.misuse.result.Exfiltrate\n\u2022action.malware.vector.Email autoexecute\n\u2022action.malware.vector.Email unknown\n\u2022action.misuse.variety.Email misuse\n\u2022action.hacking.variety.Cache poisoning\n\u2022action.social.variety.Baiting\n\u2022action.hacking.variety.URL redirector abuse\n\u2022attribute.integrity.variety.Software installation\n\u2022action.hacking.result.Lateral movement\n\u2022action.social.result.Exfiltrate\n\u2022action.hacking.variety.CSRF\n\u2022value_chain.targeting.variety.NA\n\u2022action.malware.result.Exfiltrate\n\u2022action.social.target.Cashier\n\u2022action.malware.result.Elevate\n\u2022action.misuse.vector.LAN access\n\u2022action.social.vector.Phone\n\u2022action.hacking.variety.Other\n\u2022action.hacking.result.Deploy payload\n\u2022action.malware.result.Infiltrate\n\u2022action.malware.variety.Downloader\n\u2022action.misuse.result.Deploy payload\n\u2022action.misuse.variety.Unapproved workaround\n\u2022value_chain.non-distribution services.variety.Escrow\n\u2022action.misuse.variety.Privilege abuse\n\u2022action.misuse.variety.Snap picture\n\u2022action.social.target.Call center\n\u2022action.social.result.Deploy payload\n\u2022value_chain.non-distribution services.variety.VPN\n\u2022action.hacking.variety.Path traversal\n\u2022action.hacking.vector.Other\n\u2022value_chain.distribution.variety.Phone\n\u2022action.misuse.vector.Unknown\n\u2022action.malware.vector.Email other\n\u2022action.social.target.Guard\n\u2022action.hacking.variety.Reverse engineering\n\u2022action.hacking.variety.OS commanding\n\u2022action.social.variety.Other\n\u2022action.hacking.vector.VPN\n\u2022action.misuse.variety.Knowledge abuse\n\u2022action.social.variety.Extortion\n\u2022value_chain.non-distribution services.variety.Unknown\n\u2022action.hacking.variety.Mail command injection\n\u2022action.social.target.Finance\n\u2022action.malware.variety.SQL injection\n\u2022action.social.result.Lateral movement\n\u2022value_chain.non-distribution services.variety.DNS\n\u2022action.hacking.result.Exfiltrate\n\u2022action.social.vector.In-person\n\u2022value_chain.targeting.variety.Vulnerabilities\n\u2022value_chain.distribution.variety.Partner\n\u2022action.social.result.Elevate\n\u2022value_chain.development.variety.NA\n\u2022action.social.vector.Social media\n\u2022action.hacking.variety.User breakout\n\u2022value_chain.distribution.variety.Direct\n\u2022action.malware.result.Lateral movement\n\u2022action.misuse.variety.Data mishandling\n\u2022action.hacking.result.Elevate\n\u2022action.social.target.Partner\n\u2022action.social.vector.Other\n\u2022value_chain.non-distribution services.variety.C2\n\u2022action.social.result.Infiltrate\n\u2022value_chain.non-distribution services.variety.Marketplace\n\u2022action.misuse.variety.Net misuse\n\u2022action.hacking.result.Infiltrate\n\u2022action.malware.result.Other\n\u2022value_chain.targeting.variety.Default credentials\n\u2022action.misuse.variety.Possession abuse\n\u2022action.social.target.Unknown\n\u2022action.hacking.variety.SQLi\n\u2022action.malware.variety.Spam\n\u2022action.social.vector.Documents\n\u2022action.hacking.variety.Special element injection\n\u2022attribute.integrity.variety.Other\n\u2022action.social.target.Auditor\n\u2022action.misuse.vector.Remote access\n\u2022action.social.target.Manager\n\u2022action.misuse.variety.Unapproved software\n\u2022action.misuse.vector.Physical access\n\u2022action.malware.result.Deploy payload\n\u2022action.social.target.Former employee\n\u2022action.social.variety.Spam\n\u2022action.social.variety.Propaganda\n\u2022action.hacking.vector.Web application\n\u2022action.social.target.End-user\n\u2022action.social.target.Human resources\n\u2022action.social.target.Developer\n\u2022action.social.target.End-user or employee\n\u2022action.hacking.vector.Unknown\n\u2022attribute.confidentiality.data_disclosure\n\u2022action.social.vector.SMS\n\u2022action.social.target.Other employee\n\u2022action.misuse.variety.Other\n\u2022value_chain.distribution.variety.Loader\n\u2022action.misuse.result.Elevate\n\u2022action.hacking.result.NA\n\u2022action.hacking.vector.Desktop sharing\n\u2022action.social.target.Maintenance\n\u2022action.social.target.Other\n\u2022action.social.result.NA\n\u2022value_chain.non-distribution services.variety.NA\n\u2022action.social.variety.Elicitation\n\u2022action.misuse.vector.Web application\n\u2022action.malware.vector.Email\n\u2022action.hacking.variety.XSS\n\u2022action.social.target.Helpdesk\n\u2022action.misuse.vector.Other\n\u2022value_chain.non-distribution services.variety.Counter AV\n\u2022value_chain.distribution.variety.NA\n\u2022action.malware.vector.Other\n\u2022action.misuse.vector.Non-corporate\n\u2022action.social.vector.Software\n\u2022action.social.variety.Bribery\n\u2022action.malware.vector.Unknown\n\u2022value_chain.targeting.variety.Other\n\u2022action.misuse.variety.Unknown", "metadata": []}], "gradient": {"colors": ["#ffe766", "#ffaf66"], "minValue": 1, "maxValue": 156}}