mitre_id,technique,tactics,groups
T1205.001,Port Knocking,Defense Evasion|Persistence|Command And Control,no
T1564.006,Run Virtual Instance,Defense Evasion,no
T1564.005,Hidden File System,Defense Evasion,Strider|Equation
T1556.003,Pluggable Authentication Modules,Credential Access|Defense Evasion,no
T1574.012,COR_PROFILER,Persistence|Privilege Escalation|Defense Evasion,Blue Mockingbird
T1562.007,Disable or Modify Cloud Firewall,Defense Evasion,no
T1098.004,SSH Authorized Keys,Persistence,no
T1480.001,Environmental Keying,Defense Evasion,APT41|Equation
T1059.007,JavaScript/JScript,Execution,APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer
T1578.004,Revert Cloud Instance,Defense Evasion,no
T1578.003,Delete Cloud Instance,Defense Evasion,no
T1578.001,Create Snapshot,Defense Evasion,no
T1578.002,Create Cloud Instance,Defense Evasion,no
T1127.001,MSBuild,Defense Evasion,Frankenstein
T1027.005,Indicator Removal from Tools,Defense Evasion,Soft Cell|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda
T1562.006,Indicator Blocking,Defense Evasion,no
T1573.002,Asymmetric Cryptography,Command And Control,Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6
T1573.001,Symmetric Cryptography,Command And Control,Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group
T1573,Encrypted Channel,Command And Control,Tropic Trooper
T1027.004,Compile After Delivery,Defense Evasion,Gamaredon Group|Rocke|MuddyWater
T1574.004,Dylib Hijacking,Persistence|Privilege Escalation|Defense Evasion,no
T1546.015,Component Object Model Hijacking,Privilege Escalation|Persistence,APT28
T1071.004,DNS,Command And Control,APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7
T1071.003,Mail Protocols,Command And Control,APT32|SilverTerrier|APT28
T1071.002,File Transfer Protocols,Command And Control,APT41|SilverTerrier|Machete|Honeybee
T1071.001,Web Protocols,Command And Control,Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|Machete|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Cobalt Group|APT19|Threat Group-3390|Rancor|Orangeworm|APT37|Ke3chang|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|APT32|OilRig|Magic Hound|Gamaredon Group|Stealth Falcon
T1572,Protocol Tunneling,Command And Control,OilRig|Cobalt Group|FIN6
T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group
T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,no
T1048.001,Exfiltration Over Symmetric Encrypted Non-C2 Protocol,Exfiltration,no
T1001.003,Protocol Impersonation,Command And Control,Lazarus Group
T1001.002,Steganography,Command And Control,Axiom
T1001.001,Junk Data,Command And Control,APT28
T1132.002,Non-Standard Encoding,Command And Control,no
T1132.001,Standard Encoding,Command And Control,Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork
T1090.004,Domain Fronting,Command And Control,APT29
T1090.003,Multi-hop Proxy,Command And Control,Inception|FIN4|APT29
T1090.002,External Proxy,Command And Control,APT39|Silence|Soft Cell|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28
T1090.001,Internal Proxy,Command And Control,APT39|Strider
T1102.003,One-Way Communication,Command And Control,Leviathan
T1102.002,Bidirectional Communication,Command And Control,Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak
T1102.001,Dead Drop Resolver,Command And Control,Rocke|APT41|BRONZE BUTLER|RTM|Patchwork
T1571,Non-Standard Port,Command And Control,Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7
T1074.002,Remote Data Staging,Collection,Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8
T1074.001,Local Data Staging,Collection,Machete|Soft Cell|TEMP.Veles|Patchwork|Dragonfly 2.0|Honeybee|Leviathan|APT3|FIN5|menuPass|FIN6|Lazarus Group|Threat Group-3390|APT28
T1078.004,Cloud Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT33
T1564.004,NTFS File Attributes,Defense Evasion,APT32
T1564.003,Hidden Window,Defense Evasion,Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound
T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Tropic Trooper|FIN10|Stolen Pencil|APT32
T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,TA505|APT3|Threat Group-1314
T1078.001,Default Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,no
T1564.002,Hidden Users,Defense Evasion,no
T1574.006,LD_PRELOAD,Persistence|Privilege Escalation|Defense Evasion,Rocke
T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,BRONZE BUTLER|Naikon|APT41|Soft Cell|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390
T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Whitefly|RTM|Threat Group-3390|menuPass
T1574.008,Path Interception by Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,no
T1574.007,Path Interception by PATH Environment Variable,Persistence|Privilege Escalation|Defense Evasion,no
T1574.009,Path Interception by Unquoted Path,Persistence|Privilege Escalation|Defense Evasion,no
T1574.011,Services Registry Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no
T1574.005,Executable Installer File Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no
T1574.010,Services File Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no
T1574,Hijack Execution Flow,Persistence|Privilege Escalation|Defense Evasion,no
T1069.001,Local Groups,Discovery,Turla|OilRig|admin@338
T1570,Lateral Tool Transfer,Lateral Movement,APT32|Wizard Spider|Turla|FIN10
T1568.003,DNS Calculation,Command And Control,APT12
T1204.002,Malicious File,Execution,Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|APT19|Dragonfly 2.0|BRONZE BUTLER|Cobalt Group|DarkHydrus|Gorgon Group|Patchwork|OilRig|Dark Caracal|MuddyWater|Lazarus Group|FIN7|APT32|Rancor|APT37|FIN8|APT28|Elderwood|TA459|APT29|Leviathan|menuPass|PLATINUM
T1204.001,Malicious Link,Execution,Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla
T1195.003,Compromise Hardware Supply Chain,Initial Access,no
T1195.002,Compromise Software Supply Chain,Initial Access,Sandworm Team|APT41
T1195.001,Compromise Software Dependencies and Development Tools,Initial Access,no
T1568.001,Fast Flux DNS,Command And Control,TA505
T1052.001,Exfiltration over USB,Exfiltration,Tropic Trooper
T1569.002,Service Execution,Execution,Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang
T1569.001,Launchctl,Execution,no
T1569,System Services,Execution,no
T1568.002,Domain Generation Algorithms,Command And Control,APT41
T1568,Dynamic Resolution,Command And Control,no
T1011.001,Exfiltration Over Bluetooth,Exfiltration,no
T1567.002,Exfiltration to Cloud Storage,Exfiltration,Leviathan|Turla
T1567.001,Exfiltration to Code Repository,Exfiltration,no
T1059.006,Python,Execution,Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete
T1059.005,Visual Basic,Execution,APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound
T1059.004,Unix Shell,Execution,Rocke|APT41
T1059.003,Windows Command Shell,Execution,TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|Soft Cell|Turla|Silence|APT32|APT39|Darkhotel|MuddyWater|APT18|APT38|Dark Caracal|Gorgon Group|Dragonfly 2.0|Rancor|Ke3chang|APT37|Leviathan|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|Threat Group-3390|menuPass|Gamaredon Group|Suckfly|Patchwork|Threat Group-1314|APT3|admin@338|APT1
T1059.002,AppleScript,Execution,no
T1059.001,PowerShell,Execution,Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|Soft Cell|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|DarkHydrus|APT28|Thrip|Gorgon Group|Cobalt Group|Dragonfly 2.0|Leviathan|TA459|FIN8|MuddyWater|Magic Hound|OilRig|BRONZE BUTLER|CopyKittens|APT32|FIN7|FIN10|Threat Group-3390|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda
T1567,Exfiltration Over Web Service,Exfiltration,no
T1497.003,Time Based Evasion,Defense Evasion|Discovery,no
T1497.002,User Activity Based Checks,Defense Evasion|Discovery,FIN7
T1497.001,System Checks,Defense Evasion|Discovery,Frankenstein
T1498.002,Reflection Amplification,Impact,no
T1498.001,Direct Network Flood,Impact,no
T1566.003,Spearphishing via Service,Initial Access,Magic Hound|Windshift|FIN6|OilRig|Dark Caracal
T1566.002,Spearphishing Link,Initial Access,Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Turla|APT28|Cobalt Group|Dragonfly 2.0|OilRig|APT33|Elderwood|Leviathan|Magic Hound|Patchwork|APT29|FIN8
T1566.001,Spearphishing Attachment,Initial Access,Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Turla|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|OilRig|Lazarus Group|APT19|Dragonfly 2.0|BRONZE BUTLER|APT32|FIN8|MuddyWater|APT28|TA459|Leviathan|Patchwork|PLATINUM|Elderwood|APT29|APT37|menuPass
T1566,Phishing,Initial Access,no
T1565.003,Runtime Data Manipulation,Impact,APT38
T1565.002,Transmitted Data Manipulation,Impact,APT38
T1565.001,Stored Data Manipulation,Impact,FIN4|APT38
T1565,Data Manipulation,Impact,no
T1564.001,Hidden Files and Directories,Defense Evasion,Rocke|APT32|Tropic Trooper|APT28|Lazarus Group
T1564,Hide Artifacts,Defense Evasion,no
T1563.002,RDP Hijacking,Lateral Movement,no
T1563.001,SSH Hijacking,Lateral Movement,no
T1563,Remote Service Session Hijacking,Lateral Movement,no
T1518.001,Security Software Discovery,Discovery,Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon
T1069.003,Cloud Groups,Discovery,no
T1069.002,Domain Groups,Discovery,Turla|Wizard Spider|Inception|OilRig|FIN6|Dragonfly 2.0|Ke3chang
T1087.004,Cloud Account,Discovery,no
T1087.003,Email Account,Discovery,Sandworm Team|TA505
T1087.002,Domain Account,Discovery,Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang
T1087.001,Local Account,Discovery,Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338
T1553.004,Install Root Certificate,Defense Evasion,no
T1562.004,Disable or Modify System Firewall,Defense Evasion,Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak
T1562.003,HISTCONTROL,Defense Evasion,no
T1562.002,Disable Windows Event Logging,Defense Evasion,Threat Group-3390
T1562.001,Disable or Modify Tools,Defense Evasion,Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda
T1562,Impair Defenses,Defense Evasion,no
T1003.004,LSA Secrets,Credential Access,OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390
T1003.005,Cached Domain Credentials,Credential Access,OilRig|MuddyWater|Leafminer|APT33
T1561.002,Disk Structure Wipe,Impact,Sandworm Team|Lazarus Group|APT38|APT37
T1561.001,Disk Content Wipe,Impact,Lazarus Group
T1561,Disk Wipe,Impact,no
T1560.003,Archive via Custom Method,Collection,Lazarus Group|Kimsuky|CopyKittens|FIN6
T1560.002,Archive via Library,Collection,Lazarus Group|Threat Group-3390
T1560.001,Archive via Utility,Collection,APT41|Soft Cell|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|APT3|Sowbug|menuPass|APT1|Ke3chang
T1560,Archive Collected Data,Collection,menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang
T1499.004,Application or System Exploitation,Impact,no
T1499.003,Application Exhaustion Flood,Impact,no
T1499.002,Service Exhaustion Flood,Impact,no
T1499.001,OS Exhaustion Flood,Impact,no
T1491.002,External Defacement,Impact,no
T1491.001,Internal Defacement,Impact,Lazarus Group
T1114.003,Email Forwarding Rule,Collection,no
T1114.002,Remote Email Collection,Collection,APT1|FIN4|APT28|Dragonfly 2.0|Ke3chang|Leafminer
T1114.001,Local Email Collection,Collection,Magic Hound|APT1
T1134.005,SID-History Injection,Defense Evasion|Privilege Escalation,no
T1134.004,Parent PID Spoofing,Defense Evasion|Privilege Escalation,no
T1134.003,Make and Impersonate Token,Defense Evasion|Privilege Escalation,no
T1134.002,Create Process with Token,Defense Evasion|Privilege Escalation,Turla|Lazarus Group
T1134.001,Token Impersonation/Theft,Defense Evasion|Privilege Escalation,APT28
T1213.002,Sharepoint,Collection,Ke3chang|APT28
T1213.001,Confluence,Collection,no
T1555.003,Credentials from Web Browsers,Credential Access,Magic Hound|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats
T1555.002,Securityd Memory,Credential Access,no
T1555.001,Keychain,Credential Access,no
T1559.002,Dynamic Data Exchange,Execution,Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7
T1559.001,Component Object Model,Execution,Gamaredon Group|MuddyWater
T1559,Inter-Process Communication,Execution,no
T1558.002,Silver Ticket,Credential Access,no
T1558.001,Golden Ticket,Credential Access,Ke3chang
T1558,Steal or Forge Kerberos Tickets,Credential Access,no
T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,no
T1557,Man-in-the-Middle,Credential Access|Collection,no
T1556.002,Password Filter DLL,Credential Access|Defense Evasion,Strider
T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion,no
T1556,Modify Authentication Process,Credential Access|Defense Evasion,no
T1056.004,Credential API Hooking,Collection|Credential Access,PLATINUM
T1056.003,Web Portal Capture,Collection|Credential Access,no
T1056.002,GUI Input Capture,Collection|Credential Access,FIN4
T1056.001,Keylogging,Collection|Credential Access,APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|Ke3chang|OilRig|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28
T1555,Credentials from Password Stores,Credential Access,APT39|OilRig|MuddyWater|Leafminer|APT33|Turla|Stealth Falcon
T1552.005,Cloud Instance Metadata API,Credential Access,no
T1003.008,/etc/passwd and /etc/shadow,Credential Access,no
T1003.007,Proc Filesystem,Credential Access,no
T1003.006,DCSync,Credential Access,no
T1558.003,Kerberoasting,Credential Access,no
T1552.006,Group Policy Preferences,Credential Access,APT33
T1003.003,NTDS,Credential Access,FIN6|Dragonfly 2.0
T1003.002,Security Account Manager,Credential Access,Threat Group-3390|Ke3chang|Soft Cell|Night Dragon|Dragonfly 2.0|menuPass
T1003.001,LSASS Memory,Credential Access,Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|Soft Cell|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Lazarus Group|Leafminer|Magic Hound|MuddyWater|PLATINUM|FIN8|BRONZE BUTLER|OilRig|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver
T1110.004,Credential Stuffing,Credential Access,no
T1110.003,Password Spraying,Credential Access,APT33|Leafminer|Lazarus Group
T1110.002,Password Cracking,Credential Access,APT41|Dragonfly 2.0|APT3
T1110.001,Password Guessing,Credential Access,no
T1021.006,Windows Remote Management,Lateral Movement,Threat Group-3390
T1021.005,VNC,Lateral Movement,GCMAN
T1021.004,SSH,Lateral Movement,Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN
T1021.003,Distributed Component Object Model,Lateral Movement,no
T1021.002,SMB/Windows Admin Shares,Lateral Movement,Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang
T1021.001,Remote Desktop Protocol,Lateral Movement,Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|menuPass|FIN10|Patchwork|FIN6|Lazarus Group|APT1|Axiom
T1554,Compromise Client Software Binary,Persistence,no
T1036.006,Space after Filename,Defense Evasion,no
T1036.005,Match Legitimate Name or Location,Defense Evasion,Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1
T1036.004,Masquerade Task or Service,Defense Evasion,Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7
T1036.003,Rename System Utilities,Defense Evasion,menuPass|APT32|Soft Cell|PLATINUM
T1036.002,Right-to-Left Override,Defense Evasion,BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic
T1036.001,Invalid Code Signature,Defense Evasion,Windshift
T1553.003,SIP and Trust Provider Hijacking,Defense Evasion,no
T1553.002,Code Signing,Defense Evasion,Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|APT37|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel
T1553.001,Gatekeeper Bypass,Defense Evasion,no
T1553,Subvert Trust Controls,Defense Evasion,no
T1027.003,Steganography,Defense Evasion,BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37
T1027.002,Software Packing,Defense Evasion,TA505|Rocke|Soft Cell|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon
T1027.001,Binary Padding,Defense Evasion,Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee
T1222.002,Linux and Mac File and Directory Permissions Modification,Defense Evasion,Rocke|APT32
T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,no
T1552.004,Private Keys,Credential Access,Rocke
T1552.003,Bash History,Credential Access,no
T1552.002,Credentials in Registry,Credential Access,APT32
T1552.001,Credentials In Files,Credential Access,Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3
T1552,Unsecured Credentials,Credential Access,no
T1216.001,PubPrn,Defense Evasion,APT32
T1070.006,Timestomp,Defense Evasion,Rocke|TEMP.Veles|APT32|Lazarus Group|APT28
T1070.005,Network Share Connection Removal,Defense Evasion,Threat Group-3390
T1070.004,File Deletion,Defense Evasion,Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|FIN10|APT28|Threat Group-3390|Group5|Lazarus Group|APT18|APT29
T1070.003,Clear Command History,Defense Evasion,APT41
T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,no
T1550.001,Application Access Token,Defense Evasion|Lateral Movement,APT28
T1550.003,Pass the Ticket,Defense Evasion|Lateral Movement,APT32|BRONZE BUTLER|APT29
T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Soft Cell|APT32|Night Dragon|APT28|APT1
T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,no
T1548.004,Elevated Execution with Prompt,Privilege Escalation|Defense Evasion,no
T1548.003,Sudo and Sudo Caching,Privilege Escalation|Defense Evasion,no
T1548.002,Bypass User Access Control,Privilege Escalation|Defense Evasion,APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29
T1548.001,Setuid and Setgid,Privilege Escalation|Defense Evasion,no
T1548,Abuse Elevation Control Mechanism,Privilege Escalation|Defense Evasion,no
T1136.003,Cloud Account,Persistence,no
T1070.002,Clear Linux or Mac System Logs,Defense Evasion,Rocke
T1070.001,Clear Windows Event Logs,Defense Evasion,APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28
T1136.002,Domain Account,Persistence,Soft Cell
T1136.001,Local Account,Persistence,APT39|APT41|Dragonfly 2.0|Leafminer|APT3
T1547.011,Plist Modification,Persistence|Privilege Escalation,no
T1547.010,Port Monitors,Persistence|Privilege Escalation,no
T1547.009,Shortcut Modification,Persistence|Privilege Escalation,APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Leviathan|Lazarus Group
T1547.008,LSASS Driver,Persistence|Privilege Escalation,no
T1547.007,Re-opened Applications,Persistence|Privilege Escalation,no
T1547.006,Kernel Modules and Extensions,Persistence|Privilege Escalation,no
T1547.005,Security Support Provider,Persistence|Privilege Escalation,no
T1547.004,Winlogon Helper DLL,Persistence|Privilege Escalation,Tropic Trooper|Turla
T1547.003,Time Providers,Persistence|Privilege Escalation,no
T1546.014,Emond,Privilege Escalation|Persistence,no
T1546.013,PowerShell Profile,Privilege Escalation|Persistence,Turla
T1546.012,Image File Execution Options Injection,Privilege Escalation|Persistence,TEMP.Veles
T1218.008,Odbcconf,Defense Evasion,Cobalt Group
T1546.011,Application Shimming,Privilege Escalation|Persistence,FIN7
T1547.002,Authentication Package,Persistence|Privilege Escalation,no
T1546.010,AppInit DLLs,Privilege Escalation|Persistence,no
T1546.009,AppCert DLLs,Privilege Escalation|Persistence,Honeybee
T1218.007,Msiexec,Defense Evasion,TA505|Rancor
T1546.008,Accessibility Features,Privilege Escalation|Persistence,APT41|APT3|APT29|Deep Panda|Axiom
T1546.007,Netsh Helper DLL,Privilege Escalation|Persistence,no
T1546.006,LC_LOAD_DYLIB Addition,Privilege Escalation|Persistence,no
T1546.005,Trap,Privilege Escalation|Persistence,no
T1546.004,.bash_profile and .bashrc,Privilege Escalation|Persistence,no
T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,APT33|Blue Mockingbird|Turla|Leviathan|APT29
T1546.002,Screensaver,Privilege Escalation|Persistence,no
T1546.001,Change Default File Association,Privilege Escalation|Persistence,Kimsuky
T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Machete|Kimsuky|APT33|APT39|APT32|APT18|Turla|Dark Caracal|Cobalt Group|Honeybee|Threat Group-3390|Dragonfly 2.0|Gorgon Group|Ke3chang|APT19|Leviathan|MuddyWater|APT37|BRONZE BUTLER|Magic Hound|APT3|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel
T1218.002,Control Panel,Defense Evasion,no
T1218.010,Regsvr32,Defense Evasion,Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda
T1218.009,Regsvcs/Regasm,Defense Evasion,no
T1218.005,Mshta,Defense Evasion,Inception|Kimsuky|APT32|MuddyWater|FIN7
T1218.004,InstallUtil,Defense Evasion,no
T1218.001,Compiled HTML File,Defense Evasion,APT41|Silence|Lazarus Group|Dark Caracal|OilRig
T1218.003,CMSTP,Defense Evasion,Cobalt Group|MuddyWater
T1218.011,Rundll32,Defense Evasion,APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28
T1547,Boot or Logon Autostart Execution,Persistence|Privilege Escalation,no
T1546,Event Triggered Execution,Privilege Escalation|Persistence,no
T1098.003,Add Office 365 Global Administrator Role,Persistence,no
T1098.002,Exchange Email Delegate Permissions,Persistence,Magic Hound
T1098.001,Additional Azure Service Principal Credentials,Persistence,no
T1543.004,Launch Daemon,Persistence|Privilege Escalation,no
T1543.003,Windows Service,Persistence|Privilege Escalation,Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|Honeybee|FIN7|Threat Group-3390|APT19|APT3|Lazarus Group|Carbanak
T1543.002,Systemd Service,Persistence|Privilege Escalation,Rocke
T1543.001,Launch Agent,Persistence|Privilege Escalation,no
T1037.005,Startup Items,Persistence|Privilege Escalation,no
T1037.004,Rc.common,Persistence|Privilege Escalation,no
T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Threat Group-3390|menuPass|Gorgon Group|Patchwork
T1055.013,Process Doppelgänging,Defense Evasion|Privilege Escalation,Leafminer
T1055.011,Extra Window Memory Injection,Defense Evasion|Privilege Escalation,no
T1055.014,VDSO Hijacking,Defense Evasion|Privilege Escalation,no
T1055.009,Proc Memory,Defense Evasion|Privilege Escalation,no
T1055.008,Ptrace System Calls,Defense Evasion|Privilege Escalation,no
T1055.005,Thread Local Storage,Defense Evasion|Privilege Escalation,no
T1055.004,Asynchronous Procedure Call,Defense Evasion|Privilege Escalation,no
T1055.003,Thread Execution Hijacking,Defense Evasion|Privilege Escalation,no
T1055.002,Portable Executable Injection,Defense Evasion|Privilege Escalation,Rocke|Gorgon Group
T1055.001,Dynamic-link Library Injection,Defense Evasion|Privilege Escalation,TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda
T1037.003,Network Logon Script,Persistence|Privilege Escalation,no
T1543,Create or Modify System Process,Persistence|Privilege Escalation,no
T1037.002,Logon Script (Mac),Persistence|Privilege Escalation,no
T1037.001,Logon Script (Windows),Persistence|Privilege Escalation,Cobalt Group|APT28
T1542.003,Bootkit,Persistence|Defense Evasion,APT41|Lazarus Group|APT28
T1542.002,Component Firmware,Persistence|Defense Evasion,Equation
T1542.001,System Firmware,Persistence|Defense Evasion,no
T1505.003,Web Shell,Persistence,Tropic Trooper|Soft Cell|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda
T1505.002,Transport Agent,Persistence,no
T1505.001,SQL Stored Procedures,Persistence,no
T1053.003,Cron,Execution|Persistence|Privilege Escalation,Rocke
T1053.004,Launchd,Execution|Persistence|Privilege Escalation,no
T1053.001,At (Linux),Execution|Persistence|Privilege Escalation,no
T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|Machete|Soft Cell|Silence|TEMP.Veles|APT33|APT39|Dragonfly 2.0|Patchwork|OilRig|Rancor|Cobalt Group|FIN8|menuPass|FIN10|APT32|FIN7|Stealth Falcon|FIN6|APT3|APT29
T1053.002,At (Windows),Execution|Persistence|Privilege Escalation,BRONZE BUTLER|Threat Group-3390|APT18
T1542,Pre-OS Boot,Defense Evasion|Persistence,no
T1137.001,Office Template Macros,Persistence,MuddyWater
T1137.004,Outlook Home Page,Persistence,OilRig
T1137.003,Outlook Forms,Persistence,no
T1137.005,Outlook Rules,Persistence,no
T1137.006,Add-ins,Persistence,Naikon
T1137.002,Office Test,Persistence,APT28
T1531,Account Access Removal,Impact,no
T1539,Steal Web Session Cookie,Credential Access,no
T1529,System Shutdown/Reboot,Impact,Lazarus Group|APT38|APT37
T1518,Software Discovery,Discovery,BRONZE BUTLER|Tropic Trooper|Inception
T1534,Internal Spearphishing,Lateral Movement,Gamaredon Group
T1528,Steal Application Access Token,Credential Access,APT28
T1535,Unused/Unsupported Cloud Regions,Defense Evasion,no
T1525,Implant Container Image,Persistence,no
T1538,Cloud Service Dashboard,Discovery,no
T1530,Data from Cloud Storage Object,Collection,no
T1578,Modify Cloud Compute Infrastructure,Defense Evasion,no
T1537,Transfer Data to Cloud Account,Exfiltration,no
T1526,Cloud Service Discovery,Discovery,no
T1505,Server Software Component,Persistence,no
T1499,Endpoint Denial of Service,Impact,no
T1497,Virtualization/Sandbox Evasion,Defense Evasion|Discovery,no
T1498,Network Denial of Service,Impact,no
T1496,Resource Hijacking,Impact,Blue Mockingbird|Rocke|APT41|Lazarus Group
T1495,Firmware Corruption,Impact,no
T1491,Defacement,Impact,no
T1490,Inhibit System Recovery,Impact,no
T1489,Service Stop,Impact,Lazarus Group
T1486,Data Encrypted for Impact,Impact,APT41|TA505|APT38
T1485,Data Destruction,Impact,Sandworm Team|Lazarus Group|APT38
T1484,Group Policy Modification,Defense Evasion|Privilege Escalation,no
T1482,Domain Trust Discovery,Discovery,Wizard Spider
T1480,Execution Guardrails,Defense Evasion,no
T1222,File and Directory Permissions Modification,Defense Evasion,no
T1221,Template Injection,Defense Evasion,Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus
T1220,XSL Script Processing,Defense Evasion,Cobalt Group
T1197,BITS Jobs,Defense Evasion|Persistence,Patchwork|APT41|Leviathan
T1217,Browser Bookmark Discovery,Discovery,no
T1213,Data from Information Repositories,Collection,Turla
T1189,Drive-by Compromise,Initial Access,Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|BRONZE BUTLER|Leafminer|Dark Caracal|APT19|APT32|Lazarus Group|Threat Group-3390|Elderwood|APT37|Patchwork|PLATINUM
T1203,Exploitation for Client Execution,Execution,Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|Lazarus Group|BRONZE BUTLER|Cobalt Group|APT37|Patchwork|Leviathan|Elderwood|TA459|APT29
T1212,Exploitation for Credential Access,Credential Access,no
T1211,Exploitation for Defense Evasion,Defense Evasion,APT28
T1190,Exploit Public-Facing Application,Initial Access,Blue Mockingbird|Rocke|APT39|BlackTech|APT41|Soft Cell|Night Dragon|Axiom
T1210,Exploitation of Remote Services,Lateral Movement,Threat Group-3390|APT28
T1202,Indirect Command Execution,Defense Evasion,no
T1200,Hardware Additions,Initial Access,DarkVishnya
T1201,Password Policy Discovery,Discovery,Turla|OilRig
T1219,Remote Access Software,Command And Control,Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak
T1207,Rogue Domain Controller,Defense Evasion,no
T1199,Trusted Relationship,Initial Access,APT28|menuPass
T1218,Signed Binary Proxy Execution,Defense Evasion,no
T1204,User Execution,Execution,no
T1216,Signed Script Proxy Execution,Defense Evasion,no
T1195,Supply Chain Compromise,Initial Access,Elderwood
T1205,Traffic Signaling,Defense Evasion|Persistence|Command And Control,no
T1176,Browser Extensions,Persistence,Kimsuky|Stolen Pencil
T1175,Component Object Model and Distributed COM,Lateral Movement|Execution,no
T1187,Forced Authentication,Credential Access,DarkHydrus|Dragonfly 2.0
T1185,Man in the Browser,Collection,no
T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,Blue Mockingbird
T1136,Create Account,Persistence,no
T1140,Deobfuscate/Decode Files or Information,Defense Evasion,Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|menuPass|Honeybee|Threat Group-3390|APT19|Gorgon Group|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER
T1149,LC_MAIN Hijacking,Defense Evasion,no
T1135,Network Share Discovery,Discovery,APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug
T1137,Office Application Startup,Persistence,Gamaredon Group|APT32
T1153,Source,Execution,no
T1133,External Remote Services,Persistence|Initial Access,Sandworm Team|APT41|Soft Cell|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18
T1132,Data Encoding,Command And Control,no
T1129,Shared Modules,Execution,no
T1127,Trusted Developer Utilities Proxy Execution,Defense Evasion,no
T1125,Video Capture,Collection,Silence|FIN7
T1124,System Time Discovery,Discovery,The White Company|Lazarus Group|BRONZE BUTLER|Turla
T1123,Audio Capture,Collection,APT37
T1120,Peripheral Device Discovery,Discovery,Turla|APT37|Gamaredon Group|Equation|APT28
T1119,Automated Collection,Collection,Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6
T1115,Clipboard Data,Collection,APT39|APT38
T1114,Email Collection,Collection,no
T1113,Screen Capture,Collection,Gamaredon Group|APT39|Silence|MuddyWater|Dragonfly 2.0|OilRig|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28
T1112,Modify Registry,Defense Evasion,Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Honeybee|Patchwork|Gorgon Group|FIN8
T1111,Two-Factor Authentication Interception,Credential Access,no
T1110,Brute Force,Credential Access,DarkVishnya|APT39|OilRig|FIN5|Turla
T1108,Redundant Access,Defense Evasion|Persistence,no
T1106,Native API,Execution,Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|Gorgon Group|APT37
T1105,Ingress Tool Transfer,Command And Control,Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|Soft Cell|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Turla|Gorgon Group|OilRig|Dragonfly 2.0|APT37|FIN8|PLATINUM|Leviathan|Elderwood|Magic Hound|APT3|APT32|BRONZE BUTLER|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28
T1104,Multi-Stage Channels,Command And Control,APT41|MuddyWater|APT3
T1102,Web Service,Command And Control,Gamaredon Group|Rocke|Inception|FIN6
T1098,Account Manipulation,Persistence,APT3|Dragonfly 2.0|Lazarus Group
T1095,Non-Application Layer Protocol,Command And Control,APT29|PLATINUM|APT3
T1092,Communication Through Removable Media,Command And Control,APT28
T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Tropic Trooper|Darkhotel|APT28
T1090,Proxy,Command And Control,Sandworm Team|Blue Mockingbird|Wizard Spider|APT41|Turla
T1087,Account Discovery,Discovery,no
T1083,File and Directory Discovery,Discovery,Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|Magic Hound|Sowbug|BRONZE BUTLER|APT3|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang
T1082,System Information Discovery,Discovery,Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|Honeybee|APT19|APT37|APT32|Magic Hound|OilRig|APT3|Sowbug|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang
T1080,Taint Shared Content,Lateral Movement,BRONZE BUTLER|Darkhotel
T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Sandworm Team|Wizard Spider|Silence|APT41|Soft Cell|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|Leviathan|APT33|OilRig|FIN5|menuPass|APT28|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak
T1074,Data Staged,Collection,Wizard Spider
T1072,Software Deployment Tools,Execution|Lateral Movement,Silence|APT32|Threat Group-1314
T1071,Application Layer Protocol,Command And Control,Rocke|Magic Hound|Dragonfly 2.0
T1070,Indicator Removal on Host,Defense Evasion,no
T1069,Permission Groups Discovery,Discovery,TA505|APT3
T1068,Exploitation for Privilege Escalation,Privilege Escalation,Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28
T1064,Scripting,Defense Evasion|Execution,no
T1062,Hypervisor,Persistence,no
T1061,Graphical User Interface,Execution,no
T1059,Command and Scripting Interpreter,Execution,APT32|Molerats|Whitefly|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang
T1057,Process Discovery,Discovery,Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang
T1056,Input Capture,Collection|Credential Access,no
T1055,Process Injection,Defense Evasion|Privilege Escalation,APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM
T1053,Scheduled Task/Job,Execution|Persistence|Privilege Escalation,no
T1052,Exfiltration Over Physical Medium,Exfiltration,no
T1051,Shared Webroot,Lateral Movement,no
T1049,System Network Connections Discovery,Discovery,Tropic Trooper|APT41|APT38|Soft Cell|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang
T1048,Exfiltration Over Alternative Protocol,Exfiltration,no
T1047,Windows Management Instrumentation,Execution,Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|Soft Cell|APT32|MuddyWater|OilRig|Threat Group-3390|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda
T1046,Network Service Scanning,Discovery,Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|Leafminer|OilRig|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390
T1043,Commonly Used Port,Command And Control,Machete|OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|Dragonfly 2.0|FIN7|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390
T1041,Exfiltration Over C2 Channel,Exfiltration,Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|Soft Cell|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang
T1040,Network Sniffing,Credential Access|Discovery,Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28
T1039,Data from Network Shared Drive,Collection,Sowbug|BRONZE BUTLER|menuPass
T1037,Boot or Logon Initialization Scripts,Persistence|Privilege Escalation,Rocke
T1036,Masquerading,Defense Evasion,Windshift|APT32|BRONZE BUTLER|menuPass|Dragonfly 2.0
T1034,Path Interception,Persistence|Privilege Escalation,no
T1033,System Owner/User Discovery,Discovery,Frankenstein|APT41|Soft Cell|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3
T1030,Data Transfer Size Limits,Exfiltration,Threat Group-3390
T1029,Scheduled Transfer,Exfiltration,no
T1027,Obfuscated Files or Information,Defense Evasion,Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|Machete|Soft Cell|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Cobalt Group|Patchwork|Leafminer|APT37|Threat Group-3390|Honeybee|Dark Caracal|menuPass|APT19|BlackOasis|FIN8|Leviathan|Elderwood|MuddyWater|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28
T1026,Multiband Communication,Command And Control,Lazarus Group
T1025,Data from Removable Media,Collection,Machete|Turla|Gamaredon Group|APT28
T1021,Remote Services,Lateral Movement,no
T1020,Automated Exfiltration,Exfiltration,Tropic Trooper|Frankenstein|Honeybee
T1018,Remote System Discovery,Discovery,Sandworm Team|Rocke|Wizard Spider|Silence|Soft Cell|APT39|APT32|Deep Panda|Threat Group-3390|Dragonfly 2.0|Leafminer|Ke3chang|FIN8|APT3|FIN5|BRONZE BUTLER|menuPass|FIN6|Turla
T1016,System Network Configuration Discovery,Discovery,Sandworm Team|Tropic Trooper|Frankenstein|APT41|Soft Cell|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang
T1014,Rootkit,Defense Evasion,Rocke|APT41|APT28|Winnti Group
T1012,Query Registry,Discovery,APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla
T1011,Exfiltration Over Other Network Medium,Exfiltration,no
T1010,Application Window Discovery,Discovery,Lazarus Group
T1008,Fallback Channels,Command And Control,APT41|OilRig|Lazarus Group
T1007,System Service Discovery,Discovery,BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang
T1006,Direct Volume Access,Defense Evasion,no
T1005,Data from Local System,Collection,Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|Soft Cell|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang
T1003,OS Credential Dumping,Credential Access,APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom
T1001,Data Obfuscation,Command And Control,Axiom
