TA0001 3
Initial Access
T1078Valid accounts
T1190Exploit public-facing application
T1566.001Phishing: Spear-phishing attachment
TA0002 3
Execution
T1059Command and scripting interpreter
T1106Native API
T1204User execution
TA0003 2
Persistence
T1543.003Create or modify system process: Windows service
T1547Boot or logon autostart execution
TA0004 3
Privilege Escalation
T1068Exploitation for privilege escalation
T1484.001Domain Policy modification: Group Policy modification
T1574Hijack execution flow
TA0005 7
Defense Evasion
T1036.001Masquerading: invalid code signature
T1055.001Process injection: DLL injection
T1070.001Indicator removal on host: clear Windows event logs
T1070.004Indicator removal on host: file deletion
T1140Deobfuscate/Decode files or information
T1202Indirect command execution
T1562.001Impair defenses: disable or modify tools
TA0006 0
Credential Access
TA0007 6
Discovery
T1012Query registry
T1018Remote system discovery
T1057Process discovery
T1063Security software discovery
T1082System information discovery
T1083File and directory discovery
TA0008 2
Lateral Movement
T1021.002Remote services: SMB/Windows admin shares
T1570Lateral tool transfer
TA0009 1
Collection
T1005Data from local system
TA0010 1
Exfiltration
T1567Exfiltration over web service
TA0011 1
Command & Control
T1071Application Layer Protocol
TA0040 2
Impact
T1486Data encrypted for impact
T1490Inhibit system recovery