| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name |
|---|---|---|---|---|
| action.malware.vector.Email link | Email via embedded link. Child of 'Email' | related-to | T1003.005 | OS Credential Dumping: Cached Domain Credentials |
| action.malware.vector.Email link | Email via embedded link. Child of 'Email' | related-to | T1204.001 | User Execution: Malicious Link |
| action.malware.vector.Email link | Email via embedded link. Child of 'Email' | related-to | T1556.002 | Phishing: Spearphishing Link |
| action.malware.vector.Email link | Email via embedded link. Child of 'Email' | related-to | T1598.003 | Phishing for Information: Spearphishing Link |