| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name |
|---|---|---|---|---|
| action.malware.vector.Direct install | Directly installed or inserted by threat agent (after system access) | related-to | T1047 | Windows Management Instrumentation |
| action.malware.vector.Direct install | Directly installed or inserted by threat agent (after system access) | related-to | T1569.002 | System Services: Service Execution |