MITRE ATT&CK Techniques

ATT&CK ID	Title	Associated Tactics
T1001	Data Obfuscation	Command and Control
T1001.001	Junk Data	Command and Control
T1001.002	Steganography	Command and Control
T1001.003	Protocol Impersonation	Command and Control
T1003	OS Credential Dumping	Credential Access
T1003.001	LSASS Memory	Credential Access
T1003.002	Security Account Manager	Credential Access
T1003.003	NTDS	Credential Access
T1003.004	LSA Secrets	Credential Access
T1003.005	Cached Domain Credentials	Credential Access
T1003.006	DCSync	Credential Access
T1003.007	Proc Filesystem	Credential Access
T1003.008	/etc/passwd and /etc/shadow	Credential Access
T1005	Data from Local System	Collection
T1006	Direct Volume Access	Defense Evasion
T1007	System Service Discovery	Discovery
T1008	Fallback Channels	Command and Control
T1010	Application Window Discovery	Discovery
T1011	Exfiltration Over Other Network Medium	Exfiltration
T1011.001	Exfiltration Over Bluetooth	Exfiltration
T1012	Query Registry	Discovery
T1014	Rootkit	Defense Evasion
T1016	System Network Configuration Discovery	Discovery
T1016.001	Internet Connection Discovery	Discovery
T1016.002	Wi-Fi Discovery	Discovery
T1018	Remote System Discovery	Discovery
T1020	Automated Exfiltration	Exfiltration
T1020.001	Traffic Duplication	Exfiltration
T1021	Remote Services	Lateral Movement
T1021.001	Remote Desktop Protocol	Lateral Movement
T1021.002	SMB/Windows Admin Shares	Lateral Movement
T1021.003	Distributed Component Object Model	Lateral Movement
T1021.004	SSH	Lateral Movement
T1021.005	VNC	Lateral Movement
T1021.006	Windows Remote Management	Lateral Movement
T1021.007	Cloud Services	Lateral Movement
T1021.008	Direct Cloud VM Connections	Lateral Movement
T1025	Data from Removable Media	Collection
T1027	Obfuscated Files or Information	Defense Evasion
T1027.001	Binary Padding	Defense Evasion
T1027.002	Software Packing	Defense Evasion
T1027.003	Steganography	Defense Evasion
T1027.004	Compile After Delivery	Defense Evasion
T1027.005	Indicator Removal from Tools	Defense Evasion
T1027.006	HTML Smuggling	Defense Evasion
T1027.007	Dynamic API Resolution	Defense Evasion
T1027.008	Stripped Payloads	Defense Evasion
T1027.009	Embedded Payloads	Defense Evasion
T1027.010	Command Obfuscation	Defense Evasion
T1027.011	Fileless Storage	Defense Evasion
T1027.012	LNK Icon Smuggling	Defense Evasion
T1029	Scheduled Transfer	Exfiltration
T1030	Data Transfer Size Limits	Exfiltration
T1033	System Owner/User Discovery	Discovery
T1036	Masquerading	Defense Evasion
T1036.001	Invalid Code Signature	Defense Evasion
T1036.002	Right-to-Left Override	Defense Evasion
T1036.003	Rename System Utilities	Defense Evasion
T1036.004	Masquerade Task or Service	Defense Evasion
T1036.005	Match Legitimate Name or Location	Defense Evasion
T1036.006	Space after Filename	Defense Evasion
T1036.007	Double File Extension	Defense Evasion
T1036.008	Masquerade File Type	Defense Evasion
T1036.009	Break Process Trees	Defense Evasion
T1037	Boot or Logon Initialization Scripts	Persistence, Privilege Escalation
T1037.001	Logon Script (Windows)	Persistence, Privilege Escalation
T1037.002	Login Hook	Persistence, Privilege Escalation
T1037.003	Network Logon Script	Persistence, Privilege Escalation
T1037.004	RC Scripts	Persistence, Privilege Escalation
T1037.005	Startup Items	Persistence, Privilege Escalation
T1039	Data from Network Shared Drive	Collection
T1040	Network Sniffing	Credential Access, Discovery
T1041	Exfiltration Over C2 Channel	Exfiltration
T1046	Network Service Discovery	Discovery
T1047	Windows Management Instrumentation	Execution
T1048	Exfiltration Over Alternative Protocol	Exfiltration
T1048.001	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Exfiltration
T1048.002	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Exfiltration
T1048.003	Exfiltration Over Unencrypted Non-C2 Protocol	Exfiltration
T1049	System Network Connections Discovery	Discovery
T1052	Exfiltration Over Physical Medium	Exfiltration
T1052.001	Exfiltration over USB	Exfiltration
T1053	Scheduled Task/Job	Execution, Persistence, Privilege Escalation
T1053.002	At	Execution, Persistence, Privilege Escalation
T1053.003	Cron	Execution, Persistence, Privilege Escalation
T1053.005	Scheduled Task	Execution, Persistence, Privilege Escalation
T1053.006	Systemd Timers	Execution, Persistence, Privilege Escalation
T1053.007	Container Orchestration Job	Execution, Persistence, Privilege Escalation
T1055	Process Injection	Defense Evasion, Privilege Escalation
T1055.001	Dynamic-link Library Injection	Defense Evasion, Privilege Escalation
T1055.002	Portable Executable Injection	Defense Evasion, Privilege Escalation
T1055.003	Thread Execution Hijacking	Defense Evasion, Privilege Escalation
T1055.004	Asynchronous Procedure Call	Defense Evasion, Privilege Escalation
T1055.005	Thread Local Storage	Defense Evasion, Privilege Escalation
T1055.008	Ptrace System Calls	Defense Evasion, Privilege Escalation
T1055.009	Proc Memory	Defense Evasion, Privilege Escalation
T1055.011	Extra Window Memory Injection	Defense Evasion, Privilege Escalation
T1055.012	Process Hollowing	Defense Evasion, Privilege Escalation
T1055.013	Process Doppelgänging	Defense Evasion, Privilege Escalation
T1055.014	VDSO Hijacking	Defense Evasion, Privilege Escalation
T1055.015	ListPlanting	Defense Evasion, Privilege Escalation
T1056	Input Capture	Collection, Credential Access
T1056.001	Keylogging	Collection, Credential Access
T1056.002	GUI Input Capture	Collection, Credential Access
T1056.003	Web Portal Capture	Collection, Credential Access
T1056.004	Credential API Hooking	Collection, Credential Access
T1057	Process Discovery	Discovery
T1059	Command and Scripting Interpreter	Execution
T1059.001	PowerShell	Execution
T1059.002	AppleScript	Execution
T1059.003	Windows Command Shell	Execution
T1059.004	Unix Shell	Execution
T1059.005	Visual Basic	Execution
T1059.006	Python	Execution
T1059.007	JavaScript	Execution
T1059.008	Network Device CLI	Execution
T1059.009	Cloud API	Execution
T1068	Exploitation for Privilege Escalation	Privilege Escalation
T1069	Permission Groups Discovery	Discovery
T1069.001	Local Groups	Discovery
T1069.002	Domain Groups	Discovery
T1069.003	Cloud Groups	Discovery
T1070	Indicator Removal	Defense Evasion
T1070.001	Clear Windows Event Logs	Defense Evasion
T1070.002	Clear Linux or Mac System Logs	Defense Evasion
T1070.003	Clear Command History	Defense Evasion
T1070.004	File Deletion	Defense Evasion
T1070.005	Network Share Connection Removal	Defense Evasion
T1070.006	Timestomp	Defense Evasion
T1070.007	Clear Network Connection History and Configurations	Defense Evasion
T1070.008	Clear Mailbox Data	Defense Evasion
T1070.009	Clear Persistence	Defense Evasion
T1071	Application Layer Protocol	Command and Control
T1071.001	Web Protocols	Command and Control
T1071.002	File Transfer Protocols	Command and Control
T1071.003	Mail Protocols	Command and Control
T1071.004	DNS	Command and Control
T1072	Software Deployment Tools	Execution, Lateral Movement
T1074	Data Staged	Collection
T1074.001	Local Data Staging	Collection
T1074.002	Remote Data Staging	Collection
T1078	Valid Accounts	Defense Evasion, Initial Access, Persistence, Privilege Escalation
T1078.001	Default Accounts	Defense Evasion, Initial Access, Persistence, Privilege Escalation
T1078.002	Domain Accounts	Defense Evasion, Initial Access, Persistence, Privilege Escalation
T1078.003	Local Accounts	Defense Evasion, Initial Access, Persistence, Privilege Escalation
T1078.004	Cloud Accounts	Defense Evasion, Initial Access, Persistence, Privilege Escalation
T1080	Taint Shared Content	Lateral Movement
T1082	System Information Discovery	Discovery
T1083	File and Directory Discovery	Discovery
T1087	Account Discovery	Discovery
T1087.001	Local Account	Discovery
T1087.002	Domain Account	Discovery
T1087.003	Email Account	Discovery
T1087.004	Cloud Account	Discovery
T1090	Proxy	Command and Control
T1090.001	Internal Proxy	Command and Control
T1090.002	External Proxy	Command and Control
T1090.003	Multi-hop Proxy	Command and Control
T1090.004	Domain Fronting	Command and Control
T1091	Replication Through Removable Media	Initial Access, Lateral Movement
T1092	Communication Through Removable Media	Command and Control
T1095	Non-Application Layer Protocol	Command and Control
T1098	Account Manipulation	Persistence, Privilege Escalation
T1098.001	Additional Cloud Credentials	Persistence, Privilege Escalation
T1098.002	Additional Email Delegate Permissions	Persistence, Privilege Escalation
T1098.003	Additional Cloud Roles	Persistence, Privilege Escalation
T1098.004	SSH Authorized Keys	Persistence, Privilege Escalation
T1098.005	Device Registration	Persistence, Privilege Escalation
T1098.006	Additional Container Cluster Roles	Persistence, Privilege Escalation
T1102	Web Service	Command and Control
T1102.001	Dead Drop Resolver	Command and Control
T1102.002	Bidirectional Communication	Command and Control
T1102.003	One-Way Communication	Command and Control
T1104	Multi-Stage Channels	Command and Control
T1105	Ingress Tool Transfer	Command and Control
T1106	Native API	Execution
T1110	Brute Force	Credential Access
T1110.001	Password Guessing	Credential Access
T1110.002	Password Cracking	Credential Access
T1110.003	Password Spraying	Credential Access
T1110.004	Credential Stuffing	Credential Access
T1111	Multi-Factor Authentication Interception	Credential Access
T1112	Modify Registry	Defense Evasion
T1113	Screen Capture	Collection
T1114	Email Collection	Collection
T1114.001	Local Email Collection	Collection
T1114.002	Remote Email Collection	Collection
T1114.003	Email Forwarding Rule	Collection
T1115	Clipboard Data	Collection
T1119	Automated Collection	Collection
T1120	Peripheral Device Discovery	Discovery
T1123	Audio Capture	Collection
T1124	System Time Discovery	Discovery
T1125	Video Capture	Collection
T1127	Trusted Developer Utilities Proxy Execution	Defense Evasion
T1127.001	MSBuild	Defense Evasion
T1129	Shared Modules	Execution
T1132	Data Encoding	Command and Control
T1132.001	Standard Encoding	Command and Control
T1132.002	Non-Standard Encoding	Command and Control
T1133	External Remote Services	Initial Access, Persistence
T1134	Access Token Manipulation	Defense Evasion, Privilege Escalation
T1134.001	Token Impersonation/Theft	Defense Evasion, Privilege Escalation
T1134.002	Create Process with Token	Defense Evasion, Privilege Escalation
T1134.003	Make and Impersonate Token	Defense Evasion, Privilege Escalation
T1134.004	Parent PID Spoofing	Defense Evasion, Privilege Escalation
T1134.005	SID-History Injection	Defense Evasion, Privilege Escalation
T1135	Network Share Discovery	Discovery
T1136	Create Account	Persistence
T1136.001	Local Account	Persistence
T1136.002	Domain Account	Persistence
T1136.003	Cloud Account	Persistence
T1137	Office Application Startup	Persistence
T1137.001	Office Template Macros	Persistence
T1137.002	Office Test	Persistence
T1137.003	Outlook Forms	Persistence
T1137.004	Outlook Home Page	Persistence
T1137.005	Outlook Rules	Persistence
T1137.006	Add-ins	Persistence
T1140	Deobfuscate/Decode Files or Information	Defense Evasion
T1176	Browser Extensions	Persistence
T1185	Browser Session Hijacking	Collection
T1187	Forced Authentication	Credential Access
T1189	Drive-by Compromise	Initial Access
T1190	Exploit Public-Facing Application	Initial Access
T1195	Supply Chain Compromise	Initial Access
T1195.001	Compromise Software Dependencies and Development Tools	Initial Access
T1195.002	Compromise Software Supply Chain	Initial Access
T1195.003	Compromise Hardware Supply Chain	Initial Access
T1197	BITS Jobs	Defense Evasion, Persistence
T1199	Trusted Relationship	Initial Access
T1200	Hardware Additions	Initial Access
T1201	Password Policy Discovery	Discovery
T1202	Indirect Command Execution	Defense Evasion
T1203	Exploitation for Client Execution	Execution
T1204	User Execution	Execution
T1204.001	Malicious Link	Execution
T1204.002	Malicious File	Execution
T1204.003	Malicious Image	Execution
T1205	Traffic Signaling	Command and Control, Defense Evasion, Persistence
T1205.001	Port Knocking	Command and Control, Defense Evasion, Persistence
T1205.002	Socket Filters	Command and Control, Defense Evasion, Persistence
T1207	Rogue Domain Controller	Defense Evasion
T1210	Exploitation of Remote Services	Lateral Movement
T1211	Exploitation for Defense Evasion	Defense Evasion
T1212	Exploitation for Credential Access	Credential Access
T1213	Data from Information Repositories	Collection
T1213.001	Confluence	Collection
T1213.002	Sharepoint	Collection
T1213.003	Code Repositories	Collection
T1216	System Script Proxy Execution	Defense Evasion
T1216.001	PubPrn	Defense Evasion
T1217	Browser Information Discovery	Discovery
T1218	System Binary Proxy Execution	Defense Evasion
T1218.001	Compiled HTML File	Defense Evasion
T1218.002	Control Panel	Defense Evasion
T1218.003	CMSTP	Defense Evasion
T1218.004	InstallUtil	Defense Evasion
T1218.005	Mshta	Defense Evasion
T1218.007	Msiexec	Defense Evasion
T1218.008	Odbcconf	Defense Evasion
T1218.009	Regsvcs/Regasm	Defense Evasion
T1218.010	Regsvr32	Defense Evasion
T1218.011	Rundll32	Defense Evasion
T1218.012	Verclsid	Defense Evasion
T1218.013	Mavinject	Defense Evasion
T1218.014	MMC	Defense Evasion
T1219	Remote Access Software	Command and Control
T1220	XSL Script Processing	Defense Evasion
T1221	Template Injection	Defense Evasion
T1222	File and Directory Permissions Modification	Defense Evasion
T1222.001	Windows File and Directory Permissions Modification	Defense Evasion
T1222.002	Linux and Mac File and Directory Permissions Modification	Defense Evasion
T1480	Execution Guardrails	Defense Evasion
T1480.001	Environmental Keying	Defense Evasion
T1482	Domain Trust Discovery	Discovery
T1484	Domain Policy Modification	Defense Evasion, Privilege Escalation
T1484.001	Group Policy Modification	Defense Evasion, Privilege Escalation
T1484.002	Domain Trust Modification	Defense Evasion, Privilege Escalation
T1485	Data Destruction	Impact
T1486	Data Encrypted for Impact	Impact
T1489	Service Stop	Impact
T1490	Inhibit System Recovery	Impact
T1491	Defacement	Impact
T1491.001	Internal Defacement	Impact
T1491.002	External Defacement	Impact
T1495	Firmware Corruption	Impact
T1496	Resource Hijacking	Impact
T1497	Virtualization/Sandbox Evasion	Defense Evasion, Discovery
T1497.001	System Checks	Defense Evasion, Discovery
T1497.002	User Activity Based Checks	Defense Evasion, Discovery
T1497.003	Time Based Evasion	Defense Evasion, Discovery
T1498	Network Denial of Service	Impact
T1498.001	Direct Network Flood	Impact
T1498.002	Reflection Amplification	Impact
T1499	Endpoint Denial of Service	Impact
T1499.001	OS Exhaustion Flood	Impact
T1499.002	Service Exhaustion Flood	Impact
T1499.003	Application Exhaustion Flood	Impact
T1499.004	Application or System Exploitation	Impact
T1505	Server Software Component	Persistence
T1505.001	SQL Stored Procedures	Persistence
T1505.002	Transport Agent	Persistence
T1505.003	Web Shell	Persistence
T1505.004	IIS Components	Persistence
T1505.005	Terminal Services DLL	Persistence
T1518	Software Discovery	Discovery
T1518.001	Security Software Discovery	Discovery
T1525	Implant Internal Image	Persistence
T1526	Cloud Service Discovery	Discovery
T1528	Steal Application Access Token	Credential Access
T1529	System Shutdown/Reboot	Impact
T1530	Data from Cloud Storage	Collection
T1531	Account Access Removal	Impact
T1534	Internal Spearphishing	Lateral Movement
T1535	Unused/Unsupported Cloud Regions	Defense Evasion
T1537	Transfer Data to Cloud Account	Exfiltration
T1538	Cloud Service Dashboard	Discovery
T1539	Steal Web Session Cookie	Credential Access
T1542	Pre-OS Boot	Defense Evasion, Persistence
T1542.001	System Firmware	Defense Evasion, Persistence
T1542.002	Component Firmware	Defense Evasion, Persistence
T1542.003	Bootkit	Defense Evasion, Persistence
T1542.004	ROMMONkit	Defense Evasion, Persistence
T1542.005	TFTP Boot	Defense Evasion, Persistence
T1543	Create or Modify System Process	Persistence, Privilege Escalation
T1543.001	Launch Agent	Persistence, Privilege Escalation
T1543.002	Systemd Service	Persistence, Privilege Escalation
T1543.003	Windows Service	Persistence, Privilege Escalation
T1543.004	Launch Daemon	Persistence, Privilege Escalation
T1546	Event Triggered Execution	Persistence, Privilege Escalation
T1546.001	Change Default File Association	Persistence, Privilege Escalation
T1546.002	Screensaver	Persistence, Privilege Escalation
T1546.003	Windows Management Instrumentation Event Subscription	Persistence, Privilege Escalation
T1546.004	Unix Shell Configuration Modification	Persistence, Privilege Escalation
T1546.005	Trap	Persistence, Privilege Escalation
T1546.006	LC_LOAD_DYLIB Addition	Persistence, Privilege Escalation
T1546.007	Netsh Helper DLL	Persistence, Privilege Escalation
T1546.008	Accessibility Features	Persistence, Privilege Escalation
T1546.009	AppCert DLLs	Persistence, Privilege Escalation
T1546.010	AppInit DLLs	Persistence, Privilege Escalation
T1546.011	Application Shimming	Persistence, Privilege Escalation
T1546.012	Image File Execution Options Injection	Persistence, Privilege Escalation
T1546.013	PowerShell Profile	Persistence, Privilege Escalation
T1546.014	Emond	Persistence, Privilege Escalation
T1546.015	Component Object Model Hijacking	Persistence, Privilege Escalation
T1546.016	Installer Packages	Persistence, Privilege Escalation
T1547	Boot or Logon Autostart Execution	Persistence, Privilege Escalation
T1547.001	Registry Run Keys / Startup Folder	Persistence, Privilege Escalation
T1547.002	Authentication Package	Persistence, Privilege Escalation
T1547.003	Time Providers	Persistence, Privilege Escalation
T1547.004	Winlogon Helper DLL	Persistence, Privilege Escalation
T1547.005	Security Support Provider	Persistence, Privilege Escalation
T1547.006	Kernel Modules and Extensions	Persistence, Privilege Escalation
T1547.007	Re-opened Applications	Persistence, Privilege Escalation
T1547.008	LSASS Driver	Persistence, Privilege Escalation
T1547.009	Shortcut Modification	Persistence, Privilege Escalation
T1547.010	Port Monitors	Persistence, Privilege Escalation
T1547.012	Print Processors	Persistence, Privilege Escalation
T1547.013	XDG Autostart Entries	Persistence, Privilege Escalation
T1547.014	Active Setup	Persistence, Privilege Escalation
T1547.015	Login Items	Persistence, Privilege Escalation
T1548	Abuse Elevation Control Mechanism	Defense Evasion, Privilege Escalation
T1548.001	Setuid and Setgid	Defense Evasion, Privilege Escalation
T1548.002	Bypass User Account Control	Defense Evasion, Privilege Escalation
T1548.003	Sudo and Sudo Caching	Defense Evasion, Privilege Escalation
T1548.004	Elevated Execution with Prompt	Defense Evasion, Privilege Escalation
T1548.005	Temporary Elevated Cloud Access	Defense Evasion, Privilege Escalation
T1550	Use Alternate Authentication Material	Defense Evasion, Lateral Movement
T1550.001	Application Access Token	Defense Evasion, Lateral Movement
T1550.002	Pass the Hash	Defense Evasion, Lateral Movement
T1550.003	Pass the Ticket	Defense Evasion, Lateral Movement
T1550.004	Web Session Cookie	Defense Evasion, Lateral Movement
T1552	Unsecured Credentials	Credential Access
T1552.001	Credentials In Files	Credential Access
T1552.002	Credentials in Registry	Credential Access
T1552.003	Bash History	Credential Access
T1552.004	Private Keys	Credential Access
T1552.005	Cloud Instance Metadata API	Credential Access
T1552.006	Group Policy Preferences	Credential Access
T1552.007	Container API	Credential Access
T1552.008	Chat Messages	Credential Access
T1553	Subvert Trust Controls	Defense Evasion
T1553.001	Gatekeeper Bypass	Defense Evasion
T1553.002	Code Signing	Defense Evasion
T1553.003	SIP and Trust Provider Hijacking	Defense Evasion
T1553.004	Install Root Certificate	Defense Evasion
T1553.005	Mark-of-the-Web Bypass	Defense Evasion
T1553.006	Code Signing Policy Modification	Defense Evasion
T1554	Compromise Client Software Binary	Persistence
T1555	Credentials from Password Stores	Credential Access
T1555.001	Keychain	Credential Access
T1555.002	Securityd Memory	Credential Access
T1555.003	Credentials from Web Browsers	Credential Access
T1555.004	Windows Credential Manager	Credential Access
T1555.005	Password Managers	Credential Access
T1555.006	Cloud Secrets Management Stores	Credential Access
T1556	Modify Authentication Process	Credential Access, Defense Evasion, Persistence
T1556.001	Domain Controller Authentication	Credential Access, Defense Evasion, Persistence
T1556.002	Password Filter DLL	Credential Access, Defense Evasion, Persistence
T1556.003	Pluggable Authentication Modules	Credential Access, Defense Evasion, Persistence
T1556.004	Network Device Authentication	Credential Access, Defense Evasion, Persistence
T1556.005	Reversible Encryption	Credential Access, Defense Evasion, Persistence
T1556.006	Multi-Factor Authentication	Credential Access, Defense Evasion, Persistence
T1556.007	Hybrid Identity	Credential Access, Defense Evasion, Persistence
T1556.008	Network Provider DLL	Credential Access, Defense Evasion, Persistence
T1557	Adversary-in-the-Middle	Collection, Credential Access
T1557.001	LLMNR/NBT-NS Poisoning and SMB Relay	Collection, Credential Access
T1557.002	ARP Cache Poisoning	Collection, Credential Access
T1557.003	DHCP Spoofing	Collection, Credential Access
T1558	Steal or Forge Kerberos Tickets	Credential Access
T1558.001	Golden Ticket	Credential Access
T1558.002	Silver Ticket	Credential Access
T1558.003	Kerberoasting	Credential Access
T1558.004	AS-REP Roasting	Credential Access
T1559	Inter-Process Communication	Execution
T1559.001	Component Object Model	Execution
T1559.002	Dynamic Data Exchange	Execution
T1559.003	XPC Services	Execution
T1560	Archive Collected Data	Collection
T1560.001	Archive via Utility	Collection
T1560.002	Archive via Library	Collection
T1560.003	Archive via Custom Method	Collection
T1561	Disk Wipe	Impact
T1561.001	Disk Content Wipe	Impact
T1561.002	Disk Structure Wipe	Impact
T1562	Impair Defenses	Defense Evasion
T1562.001	Disable or Modify Tools	Defense Evasion
T1562.002	Disable Windows Event Logging	Defense Evasion
T1562.003	Impair Command History Logging	Defense Evasion
T1562.004	Disable or Modify System Firewall	Defense Evasion
T1562.006	Indicator Blocking	Defense Evasion
T1562.007	Disable or Modify Cloud Firewall	Defense Evasion
T1562.008	Disable or Modify Cloud Logs	Defense Evasion
T1562.009	Safe Mode Boot	Defense Evasion
T1562.010	Downgrade Attack	Defense Evasion
T1562.011	Spoof Security Alerting	Defense Evasion
T1562.012	Disable or Modify Linux Audit System	Defense Evasion
T1563	Remote Service Session Hijacking	Lateral Movement
T1563.001	SSH Hijacking	Lateral Movement
T1563.002	RDP Hijacking	Lateral Movement
T1564	Hide Artifacts	Defense Evasion
T1564.001	Hidden Files and Directories	Defense Evasion
T1564.002	Hidden Users	Defense Evasion
T1564.003	Hidden Window	Defense Evasion
T1564.004	NTFS File Attributes	Defense Evasion
T1564.005	Hidden File System	Defense Evasion
T1564.006	Run Virtual Instance	Defense Evasion
T1564.007	VBA Stomping	Defense Evasion
T1564.008	Email Hiding Rules	Defense Evasion
T1564.009	Resource Forking	Defense Evasion
T1564.010	Process Argument Spoofing	Defense Evasion
T1564.011	Ignore Process Interrupts	Defense Evasion
T1565	Data Manipulation	Impact
T1565.001	Stored Data Manipulation	Impact
T1565.002	Transmitted Data Manipulation	Impact
T1565.003	Runtime Data Manipulation	Impact
T1566	Phishing	Initial Access
T1566.001	Spearphishing Attachment	Initial Access
T1566.002	Spearphishing Link	Initial Access
T1566.003	Spearphishing via Service	Initial Access
T1566.004	Spearphishing Voice	Initial Access
T1567	Exfiltration Over Web Service	Exfiltration
T1567.001	Exfiltration to Code Repository	Exfiltration
T1567.002	Exfiltration to Cloud Storage	Exfiltration
T1567.003	Exfiltration to Text Storage Sites	Exfiltration
T1567.004	Exfiltration Over Webhook	Exfiltration
T1568	Dynamic Resolution	Command and Control
T1568.001	Fast Flux DNS	Command and Control
T1568.002	Domain Generation Algorithms	Command and Control
T1568.003	DNS Calculation	Command and Control
T1569	System Services	Execution
T1569.001	Launchctl	Execution
T1569.002	Service Execution	Execution
T1570	Lateral Tool Transfer	Lateral Movement
T1571	Non-Standard Port	Command and Control
T1572	Protocol Tunneling	Command and Control
T1573	Encrypted Channel	Command and Control
T1573.001	Symmetric Cryptography	Command and Control
T1573.002	Asymmetric Cryptography	Command and Control
T1574	Hijack Execution Flow	Defense Evasion, Persistence, Privilege Escalation
T1574.001	DLL Search Order Hijacking	Defense Evasion, Persistence, Privilege Escalation
T1574.002	DLL Side-Loading	Defense Evasion, Persistence, Privilege Escalation
T1574.004	Dylib Hijacking	Defense Evasion, Persistence, Privilege Escalation
T1574.005	Executable Installer File Permissions Weakness	Defense Evasion, Persistence, Privilege Escalation
T1574.006	Dynamic Linker Hijacking	Defense Evasion, Persistence, Privilege Escalation
T1574.007	Path Interception by PATH Environment Variable	Defense Evasion, Persistence, Privilege Escalation
T1574.008	Path Interception by Search Order Hijacking	Defense Evasion, Persistence, Privilege Escalation
T1574.009	Path Interception by Unquoted Path	Defense Evasion, Persistence, Privilege Escalation
T1574.010	Services File Permissions Weakness	Defense Evasion, Persistence, Privilege Escalation
T1574.011	Services Registry Permissions Weakness	Defense Evasion, Persistence, Privilege Escalation
T1574.012	COR_PROFILER	Defense Evasion, Persistence, Privilege Escalation
T1574.013	KernelCallbackTable	Defense Evasion, Persistence, Privilege Escalation
T1578	Modify Cloud Compute Infrastructure	Defense Evasion
T1578.001	Create Snapshot	Defense Evasion
T1578.002	Create Cloud Instance	Defense Evasion
T1578.003	Delete Cloud Instance	Defense Evasion
T1578.004	Revert Cloud Instance	Defense Evasion
T1578.005	Modify Cloud Compute Configurations	Defense Evasion
T1580	Cloud Infrastructure Discovery	Discovery
T1583	Acquire Infrastructure	Resource Development
T1583.001	Domains	Resource Development
T1583.002	DNS Server	Resource Development
T1583.003	Virtual Private Server	Resource Development
T1583.004	Server	Resource Development
T1583.005	Botnet	Resource Development
T1583.006	Web Services	Resource Development
T1583.007	Serverless	Resource Development
T1583.008	Malvertising	Resource Development
T1584	Compromise Infrastructure	Resource Development
T1584.001	Domains	Resource Development
T1584.002	DNS Server	Resource Development
T1584.003	Virtual Private Server	Resource Development
T1584.004	Server	Resource Development
T1584.005	Botnet	Resource Development
T1584.006	Web Services	Resource Development
T1584.007	Serverless	Resource Development
T1585	Establish Accounts	Resource Development
T1585.001	Social Media Accounts	Resource Development
T1585.002	Email Accounts	Resource Development
T1585.003	Cloud Accounts	Resource Development
T1586	Compromise Accounts	Resource Development
T1586.001	Social Media Accounts	Resource Development
T1586.002	Email Accounts	Resource Development
T1586.003	Cloud Accounts	Resource Development
T1587	Develop Capabilities	Resource Development
T1587.001	Malware	Resource Development
T1587.002	Code Signing Certificates	Resource Development
T1587.003	Digital Certificates	Resource Development
T1587.004	Exploits	Resource Development
T1588	Obtain Capabilities	Resource Development
T1588.001	Malware	Resource Development
T1588.002	Tool	Resource Development
T1588.003	Code Signing Certificates	Resource Development
T1588.004	Digital Certificates	Resource Development
T1588.005	Exploits	Resource Development
T1588.006	Vulnerabilities	Resource Development
T1589	Gather Victim Identity Information	Reconnaissance
T1589.001	Credentials	Reconnaissance
T1589.002	Email Addresses	Reconnaissance
T1589.003	Employee Names	Reconnaissance
T1590	Gather Victim Network Information	Reconnaissance
T1590.001	Domain Properties	Reconnaissance
T1590.002	DNS	Reconnaissance
T1590.003	Network Trust Dependencies	Reconnaissance
T1590.004	Network Topology	Reconnaissance
T1590.005	IP Addresses	Reconnaissance
T1590.006	Network Security Appliances	Reconnaissance
T1591	Gather Victim Org Information	Reconnaissance
T1591.001	Determine Physical Locations	Reconnaissance
T1591.002	Business Relationships	Reconnaissance
T1591.003	Identify Business Tempo	Reconnaissance
T1591.004	Identify Roles	Reconnaissance
T1592	Gather Victim Host Information	Reconnaissance
T1592.001	Hardware	Reconnaissance
T1592.002	Software	Reconnaissance
T1592.003	Firmware	Reconnaissance
T1592.004	Client Configurations	Reconnaissance
T1593	Search Open Websites/Domains	Reconnaissance
T1593.001	Social Media	Reconnaissance
T1593.002	Search Engines	Reconnaissance
T1593.003	Code Repositories	Reconnaissance
T1594	Search Victim-Owned Websites	Reconnaissance
T1595	Active Scanning	Reconnaissance
T1595.001	Scanning IP Blocks	Reconnaissance
T1595.002	Vulnerability Scanning	Reconnaissance
T1595.003	Wordlist Scanning	Reconnaissance
T1596	Search Open Technical Databases	Reconnaissance
T1596.001	DNS/Passive DNS	Reconnaissance
T1596.002	WHOIS	Reconnaissance
T1596.003	Digital Certificates	Reconnaissance
T1596.004	CDNs	Reconnaissance
T1596.005	Scan Databases	Reconnaissance
T1597	Search Closed Sources	Reconnaissance
T1597.001	Threat Intel Vendors	Reconnaissance
T1597.002	Purchase Technical Data	Reconnaissance
T1598	Phishing for Information	Reconnaissance
T1598.001	Spearphishing Service	Reconnaissance
T1598.002	Spearphishing Attachment	Reconnaissance
T1598.003	Spearphishing Link	Reconnaissance
T1598.004	Spearphishing Voice	Reconnaissance
T1599	Network Boundary Bridging	Defense Evasion
T1599.001	Network Address Translation Traversal	Defense Evasion
T1600	Weaken Encryption	Defense Evasion
T1600.001	Reduce Key Space	Defense Evasion
T1600.002	Disable Crypto Hardware	Defense Evasion
T1601	Modify System Image	Defense Evasion
T1601.001	Patch System Image	Defense Evasion
T1601.002	Downgrade System Image	Defense Evasion
T1602	Data from Configuration Repository	Collection
T1602.001	SNMP (MIB Dump)	Collection
T1602.002	Network Device Configuration Dump	Collection
T1606	Forge Web Credentials	Credential Access
T1606.001	Web Cookies	Credential Access
T1606.002	SAML Tokens	Credential Access
T1608	Stage Capabilities	Resource Development
T1608.001	Upload Malware	Resource Development
T1608.002	Upload Tool	Resource Development
T1608.003	Install Digital Certificate	Resource Development
T1608.004	Drive-by Target	Resource Development
T1608.005	Link Target	Resource Development
T1608.006	SEO Poisoning	Resource Development
T1609	Container Administration Command	Execution
T1610	Deploy Container	Defense Evasion, Execution
T1611	Escape to Host	Privilege Escalation
T1612	Build Image on Host	Defense Evasion
T1613	Container and Resource Discovery	Discovery
T1614	System Location Discovery	Discovery
T1614.001	System Language Discovery	Discovery
T1615	Group Policy Discovery	Discovery
T1619	Cloud Storage Object Discovery	Discovery
T1620	Reflective Code Loading	Defense Evasion
T1621	Multi-Factor Authentication Request Generation	Credential Access
T1622	Debugger Evasion	Defense Evasion, Discovery
T1647	Plist File Modification	Defense Evasion
T1648	Serverless Execution	Execution
T1649	Steal or Forge Authentication Certificates	Credential Access
T1650	Acquire Access	Resource Development
T1651	Cloud Administration Command	Execution
T1652	Device Driver Discovery	Discovery
T1653	Power Settings	Persistence
T1654	Log Enumeration	Discovery
T1656	Impersonation	Defense Evasion
T1657	Financial Theft	Impact
T1659	Content Injection	Command and Control, Initial Access