TA0001 5
Initial Access
T1078Valid Accounts
T1078.003Valid Accounts: Local Accounts
T1190Exploit Public-Facing Application
T1566.001Phishing: Spearphishing Attachment
T1566.004Phishing: Spearphishing Voice
TA0002 6
Execution
T1047Windows Management Instrumentation
T1059Command and Scripting Interpreter
T1059.001Command and Scripting Interpreter: PowerShell
T1059.003Command and Scripting Interpreter: Windows Command Shell
T1059.006Command and Scripting Interpreter: Python
T1203Exploitation for Client Execution
TA0003 8
Persistence
T1098Account Manipulation
T1133External Remote Services
T1136Create Account
T1136.001Create Account: Local Account
T1136.002Create Account: Domain Account
T1547Boot or Logon Autostart Execution
T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
T1547.004Boot or Logon Autostart Execution: Winlogon Helper DLL
TA0004 2
Privilege Escalation
T1068Exploitation for Privilege Escalation
T1548.002Abuse Elevation Control Mechanism: Bypass UAC
TA0005 18
Defense Evasion
T1027Obfuscated Files or Information
T1027.009Obfuscated Files or Information: Embedded Payloads
T1027.013Obfuscated Files or Information: Encrypted/Encoded File
T1036Masquerading
T1055.012Process Injection: Process Hollowing
T1070Indicator Removal
T1070.001Indicator Removal: Clear Windows Event Logs
T1112Modify Registry
T1134Access Token Manipulation
T1134.001Access Token Manipulation: Token Impersonation/Theft
T1222.001File and Directory Permissions Modification: Windows Permissions
T1480Execution Guardrails
T1484.001Domain or Tenant Policy Modification: Group Policy Modification
T1562Impair Defenses: Disable or Modify Tools
T1562.001Impair Defenses: Disable or Modify Tools
T1564Hidden Artifacts
T1564.003Hidden Artifacts: Hidden Window
T1620Reflective DLL Injection
TA0006 7
Credential Access
T1003OS Credential Dumping
T1003.001OS Credential Dumping: LSASS Memory
T1003.003OS Credential Dumping: NTDS
T1003.008OS Credential Dumping: /etc/passwd and /etc/shadow
T1110Brute Force
T1110.003Brute Force: Password Spraying
T1555.005Credentials from Password Stores: Password Managers
TA0007 14
Discovery
T1007System Service Discovery
T1016.001Internet Connection Discovery
T1018Remote System Discovery
T1033System Owner/User Discovery
T1046Network Service Discovery
T1057Process Discovery
T1082System Information Discovery
T1083File and Directory Discovery
T1087Account Discovery
T1087.001Account Discovery: Local Account
T1087.002Account Discovery: Domain Account
T1120Peripheral Device Discovery
T1135Network Share Discovery
T1482Domain Trust Discovery
TA0008 6
Lateral Movement
T1021Remote Services
T1021.001Remote Services: Remote Desktop Protocol
T1021.002Remote Services: SMB/Windows Admin Shares
T1021.004Remote Services: SSH
T1210Exploitation of Remote Services
T1570Lateral Tool Transfer
TA0009 1
Collection
T1005Data from Local System
TA0010 6
Exfiltration
T1048Exfiltration Over Alternative Protocol
T1048.002Exfiltration Over Alternative Protocol: Asymmetric Encrypted Non-C2 Protocol
T1048.003Exfiltration Over Alternative Protocol: Unencrypted Non-C2 Protocol
T1537Transfer Data to Cloud Account
T1567Exfiltration Over Web Service
T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage
TA0011 3
Command & Control
T1071.001Application Layer Protocol: Web Protocols
T1102.002Web Service: Bidirectional Communication
T1219Remote Access Tools
TA0040 6
Impact
T1486Data Encrypted for Impact
T1489Service Stop
T1490Inhibit System Recovery
T1529System Shutdown/Reboot
T1531Account Access Removal
T1561.001Disk Wipe: Disk Content Wipe