TA0001 3
Initial Access
T1078Valid Accounts
T1190Exploit Public-Facing Application
T1566Phishing
TA0002 3
Execution
T1047Windows Management Instrumentation
T1053.005Scheduled Task/Job: Scheduled Task
T1059.001Command and Scripting Interpreter: PowerShell
TA0003 1
Persistence
T1547.001Boot or Logon Autostart Execution: Registry Run Keys
TA0004 0
Privilege Escalation
TA0005 3
Defense Evasion
T1027Obfuscated Files or Information
T1070.001Indicator Removal: Clear Windows Event Logs
T1562.001Disable or Modify Tools
TA0006 2
Credential Access
T1003.001OS Credential Dumping: LSASS Memory
T1110Brute Force
TA0007 2
Discovery
T1046Network Service Discovery
T1482Domain Trust Discovery
TA0008 3
Lateral Movement
T1021.001Remote Services: Remote Desktop Protocol
T1021.002Remote Services: SMB/Windows Admin Shares
T1210Exploitation of Remote Services
TA0009 1
Collection
T1560.001Archive Collected Data: Archive via Utility
TA0010 2
Exfiltration
T1048Exfiltration Over Alternative Protocol
T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage
TA0011 2
Command & Control
T1090.003Proxy: Multi-hop Proxy
T1219Remote Access Software
TA0040 3
Impact
T1486Data Encrypted for Impact
T1489Service Stop
T1490Inhibit System Recovery