{"_built":"2026-08-23 05:47 UTC","techniques":[{"id":"T1001","name":"Data Obfuscation","tactics":["command-and-control"],"ds":1,"an":3,"sigma":0,"kev":2},{"id":"T1001.001","name":"Junk Data","tactics":["command-and-control"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1001.002","name":"Steganography","tactics":["command-and-control"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1001.003","name":"Protocol or Service Impersonation","tactics":["command-and-control"],"ds":1,"an":4,"sigma":2,"kev":0},{"id":"T1003","name":"OS Credential Dumping","tactics":["credential-access"],"ds":1,"an":3,"sigma":37,"kev":18},{"id":"T1003.001","name":"LSASS Memory","tactics":["credential-access"],"ds":1,"an":1,"sigma":79,"kev":4},{"id":"T1003.002","name":"Security Account Manager","tactics":["credential-access"],"ds":1,"an":1,"sigma":28,"kev":0},{"id":"T1003.003","name":"NTDS","tactics":["credential-access"],"ds":1,"an":1,"sigma":24,"kev":3},{"id":"T1003.004","name":"LSA Secrets","tactics":["credential-access"],"ds":1,"an":1,"sigma":12,"kev":0},{"id":"T1003.005","name":"Cached Domain Credentials","tactics":["credential-access"],"ds":1,"an":2,"sigma":8,"kev":0},{"id":"T1003.006","name":"DCSync","tactics":["credential-access"],"ds":1,"an":1,"sigma":7,"kev":0},{"id":"T1003.007","name":"Proc Filesystem","tactics":["credential-access"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1003.008","name":"/etc/passwd and /etc/shadow","tactics":["credential-access"],"ds":1,"an":1,"sigma":0,"kev":1},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"ds":1,"an":5,"sigma":14,"kev":46},{"id":"T1006","name":"Direct Volume Access","tactics":["stealth"],"ds":1,"an":2,"sigma":1,"kev":0},{"id":"T1007","name":"System Service Discovery","tactics":["discovery"],"ds":1,"an":3,"sigma":11,"kev":1},{"id":"T1008","name":"Fallback Channels","tactics":["command-and-control"],"ds":1,"an":4,"sigma":4,"kev":0},{"id":"T1010","name":"Application Window Discovery","tactics":["discovery"],"ds":1,"an":3,"sigma":1,"kev":0},{"id":"T1011","name":"Exfiltration Over Other Network Medium","tactics":["exfiltration"],"ds":1,"an":3,"sigma":0,"kev":4},{"id":"T1011.001","name":"Exfiltration Over Bluetooth","tactics":["exfiltration"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1012","name":"Query Registry","tactics":["discovery"],"ds":1,"an":1,"sigma":14,"kev":0},{"id":"T1014","name":"Rootkit","tactics":["stealth"],"ds":1,"an":3,"sigma":1,"kev":0},{"id":"T1016","name":"System Network Configuration Discovery","tactics":["discovery"],"ds":1,"an":5,"sigma":12,"kev":1},{"id":"T1016.001","name":"Internet Connection Discovery","tactics":["discovery"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1016.002","name":"Wi-Fi Discovery","tactics":["discovery"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1018","name":"Remote System Discovery","tactics":["discovery"],"ds":1,"an":5,"sigma":17,"kev":2},{"id":"T1020","name":"Automated Exfiltration","tactics":["exfiltration"],"ds":1,"an":3,"sigma":10,"kev":0},{"id":"T1020.001","name":"Traffic Duplication","tactics":["exfiltration"],"ds":1,"an":2,"sigma":0,"kev":0},{"id":"T1021","name":"Remote Services","tactics":["lateral-movement"],"ds":1,"an":5,"sigma":11,"kev":4},{"id":"T1021.001","name":"Remote Desktop Protocol","tactics":["lateral-movement"],"ds":1,"an":1,"sigma":16,"kev":2},{"id":"T1021.002","name":"SMB/Windows Admin Shares","tactics":["lateral-movement"],"ds":1,"an":1,"sigma":38,"kev":0},{"id":"T1021.003","name":"Distributed Component Object Model","tactics":["lateral-movement"],"ds":1,"an":1,"sigma":13,"kev":0},{"id":"T1021.004","name":"SSH","tactics":["lateral-movement"],"ds":1,"an":3,"sigma":5,"kev":2},{"id":"T1021.005","name":"VNC","tactics":["lateral-movement"],"ds":1,"an":3,"sigma":1,"kev":0},{"id":"T1021.006","name":"Windows Remote Management","tactics":["lateral-movement"],"ds":1,"an":1,"sigma":11,"kev":0},{"id":"T1021.007","name":"Cloud Services","tactics":["lateral-movement"],"ds":1,"an":4,"sigma":1,"kev":0},{"id":"T1021.008","name":"Direct Cloud VM Connections","tactics":["lateral-movement"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1025","name":"Data from Removable Media","tactics":["collection"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1027","name":"Obfuscated Files or Information","tactics":["stealth"],"ds":1,"an":5,"sigma":94,"kev":5},{"id":"T1027.001","name":"Binary Padding","tactics":["stealth"],"ds":1,"an":3,"sigma":3,"kev":0},{"id":"T1027.002","name":"Software Packing","tactics":["stealth"],"ds":1,"an":3,"sigma":1,"kev":0},{"id":"T1027.003","name":"Steganography","tactics":["stealth"],"ds":1,"an":3,"sigma":5,"kev":0},{"id":"T1027.004","name":"Compile After Delivery","tactics":["stealth"],"ds":1,"an":3,"sigma":6,"kev":0},{"id":"T1027.005","name":"Indicator Removal from Tools","tactics":["stealth"],"ds":1,"an":3,"sigma":4,"kev":0},{"id":"T1027.006","name":"HTML Smuggling","tactics":["stealth"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1027.007","name":"Dynamic API Resolution","tactics":["stealth"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1027.008","name":"Stripped Payloads","tactics":["stealth"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1027.009","name":"Embedded Payloads","tactics":["stealth"],"ds":1,"an":3,"sigma":2,"kev":0},{"id":"T1027.010","name":"Command Obfuscation","tactics":["stealth"],"ds":1,"an":3,"sigma":10,"kev":0},{"id":"T1027.011","name":"Fileless Storage","tactics":["stealth"],"ds":1,"an":2,"sigma":1,"kev":0},{"id":"T1027.012","name":"LNK Icon Smuggling","tactics":["stealth"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1027.013","name":"Encrypted/Encoded File","tactics":["stealth"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1027.014","name":"Polymorphic Code","tactics":["stealth"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1027.015","name":"Compression","tactics":["stealth"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1027.016","name":"Junk Code Insertion","tactics":["stealth"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1027.017","name":"SVG Smuggling","tactics":["stealth"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1027.018","name":"Invisible Unicode","tactics":["stealth"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1029","name":"Scheduled Transfer","tactics":["exfiltration"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1030","name":"Data Transfer Size Limits","tactics":["exfiltration"],"ds":1,"an":3,"sigma":2,"kev":0},{"id":"T1033","name":"System Owner/User Discovery","tactics":["discovery"],"ds":1,"an":4,"sigma":30,"kev":2},{"id":"T1036","name":"Masquerading","tactics":["stealth"],"ds":1,"an":5,"sigma":40,"kev":2},{"id":"T1036.001","name":"Invalid Code Signature","tactics":["stealth"],"ds":1,"an":2,"sigma":0,"kev":0},{"id":"T1036.002","name":"Right-to-Left Override","tactics":["stealth"],"ds":1,"an":3,"sigma":3,"kev":0},{"id":"T1036.003","name":"Rename Legitimate Utilities","tactics":["stealth"],"ds":1,"an":3,"sigma":27,"kev":0},{"id":"T1036.004","name":"Masquerade Task or Service","tactics":["stealth"],"ds":1,"an":3,"sigma":3,"kev":0},{"id":"T1036.005","name":"Match Legitimate Resource Name or Location","tactics":["stealth"],"ds":1,"an":5,"sigma":21,"kev":1},{"id":"T1036.006","name":"Space after Filename","tactics":["stealth"],"ds":1,"an":2,"sigma":1,"kev":0},{"id":"T1036.007","name":"Double File Extension","tactics":["stealth"],"ds":1,"an":1,"sigma":3,"kev":0},{"id":"T1036.008","name":"Masquerade File Type","tactics":["stealth"],"ds":1,"an":3,"sigma":1,"kev":0},{"id":"T1036.009","name":"Break Process Trees","tactics":["stealth"],"ds":1,"an":2,"sigma":0,"kev":0},{"id":"T1036.010","name":"Masquerade Account Name","tactics":["stealth"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1036.011","name":"Overwrite Process Arguments","tactics":["stealth"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1036.012","name":"Browser Fingerprint","tactics":["stealth"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1037","name":"Boot or Logon Initialization Scripts","tactics":["persistence","privilege-escalation"],"ds":1,"an":5,"sigma":0,"kev":3},{"id":"T1037.001","name":"Logon Script (Windows)","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":3,"kev":0},{"id":"T1037.002","name":"Login Hook","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1037.003","name":"Network Logon Script","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1037.004","name":"RC Scripts","tactics":["persistence","privilege-escalation"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1037.005","name":"Startup Items","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1039","name":"Data from Network Shared Drive","tactics":["collection"],"ds":1,"an":3,"sigma":2,"kev":0},{"id":"T1040","name":"Network Sniffing","tactics":["credential-access","discovery"],"ds":1,"an":5,"sigma":9,"kev":2},{"id":"T1041","name":"Exfiltration Over C2 Channel","tactics":["exfiltration"],"ds":1,"an":4,"sigma":5,"kev":12},{"id":"T1046","name":"Network Service Discovery","tactics":["discovery"],"ds":1,"an":4,"sigma":20,"kev":7},{"id":"T1047","name":"Windows Management Instrumentation","tactics":["execution"],"ds":1,"an":1,"sigma":52,"kev":2},{"id":"T1048","name":"Exfiltration Over Alternative Protocol","tactics":["exfiltration"],"ds":1,"an":5,"sigma":12,"kev":4},{"id":"T1048.001","name":"Exfiltration Over Symmetric Encrypted Non-C2 Protocol","tactics":["exfiltration"],"ds":1,"an":4,"sigma":1,"kev":0},{"id":"T1048.002","name":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","tactics":["exfiltration"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1048.003","name":"Exfiltration Over Unencrypted Non-C2 Protocol","tactics":["exfiltration"],"ds":1,"an":5,"sigma":9,"kev":1},{"id":"T1049","name":"System Network Connections Discovery","tactics":["discovery"],"ds":1,"an":6,"sigma":9,"kev":1},{"id":"T1052","name":"Exfiltration Over Physical Medium","tactics":["exfiltration"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1052.001","name":"Exfiltration over USB","tactics":["exfiltration"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1053","name":"Scheduled Task/Job","tactics":["execution","persistence","privilege-escalation"],"ds":1,"an":5,"sigma":12,"kev":2},{"id":"T1053.002","name":"At","tactics":["execution","persistence","privilege-escalation"],"ds":1,"an":3,"sigma":8,"kev":0},{"id":"T1053.003","name":"Cron","tactics":["execution","persistence","privilege-escalation"],"ds":1,"an":3,"sigma":6,"kev":0},{"id":"T1053.005","name":"Scheduled Task","tactics":["execution","persistence","privilege-escalation"],"ds":1,"an":1,"sigma":51,"kev":2},{"id":"T1053.006","name":"Systemd Timers","tactics":["execution","persistence","privilege-escalation"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1053.007","name":"Container Orchestration Job","tactics":["execution","persistence","privilege-escalation"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1055","name":"Process Injection","tactics":["stealth","privilege-escalation"],"ds":1,"an":3,"sigma":37,"kev":19},{"id":"T1055.001","name":"Dynamic-link Library Injection","tactics":["stealth","privilege-escalation"],"ds":1,"an":1,"sigma":8,"kev":1},{"id":"T1055.002","name":"Portable Executable Injection","tactics":["stealth","privilege-escalation"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1055.003","name":"Thread Execution Hijacking","tactics":["stealth","privilege-escalation"],"ds":1,"an":1,"sigma":2,"kev":0},{"id":"T1055.004","name":"Asynchronous Procedure Call","tactics":["stealth","privilege-escalation"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1055.005","name":"Thread Local Storage","tactics":["stealth","privilege-escalation"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1055.008","name":"Ptrace System Calls","tactics":["stealth","privilege-escalation"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1055.009","name":"Proc Memory","tactics":["stealth","privilege-escalation"],"ds":1,"an":1,"sigma":2,"kev":0},{"id":"T1055.011","name":"Extra Window Memory Injection","tactics":["stealth","privilege-escalation"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1055.012","name":"Process Hollowing","tactics":["stealth","privilege-escalation"],"ds":1,"an":1,"sigma":5,"kev":1},{"id":"T1055.013","name":"Process Doppelgänging","tactics":["stealth","privilege-escalation"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1055.014","name":"VDSO Hijacking","tactics":["stealth","privilege-escalation"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1055.015","name":"ListPlanting","tactics":["stealth","privilege-escalation"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1056","name":"Input Capture","tactics":["collection","credential-access"],"ds":1,"an":4,"sigma":2,"kev":3},{"id":"T1056.001","name":"Keylogging","tactics":["collection","credential-access"],"ds":1,"an":4,"sigma":3,"kev":1},{"id":"T1056.002","name":"GUI Input Capture","tactics":["collection","credential-access"],"ds":1,"an":3,"sigma":3,"kev":0},{"id":"T1056.003","name":"Web Portal Capture","tactics":["collection","credential-access"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1056.004","name":"Credential API Hooking","tactics":["collection","credential-access"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1057","name":"Process Discovery","tactics":["discovery"],"ds":1,"an":5,"sigma":8,"kev":0},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"ds":1,"an":5,"sigma":95,"kev":170},{"id":"T1059.001","name":"PowerShell","tactics":["execution"],"ds":1,"an":1,"sigma":220,"kev":1},{"id":"T1059.002","name":"AppleScript","tactics":["execution"],"ds":1,"an":1,"sigma":9,"kev":0},{"id":"T1059.003","name":"Windows Command Shell","tactics":["execution"],"ds":1,"an":1,"sigma":46,"kev":6},{"id":"T1059.004","name":"Unix Shell","tactics":["execution"],"ds":1,"an":4,"sigma":18,"kev":14},{"id":"T1059.005","name":"Visual Basic","tactics":["execution"],"ds":1,"an":3,"sigma":29,"kev":0},{"id":"T1059.006","name":"Python","tactics":["execution"],"ds":1,"an":4,"sigma":13,"kev":0},{"id":"T1059.007","name":"JavaScript","tactics":["execution"],"ds":1,"an":3,"sigma":29,"kev":14},{"id":"T1059.008","name":"Network Device CLI","tactics":["execution"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1059.009","name":"Cloud API","tactics":["execution"],"ds":1,"an":1,"sigma":3,"kev":0},{"id":"T1059.010","name":"AutoHotKey & AutoIT","tactics":["execution"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1059.011","name":"Lua","tactics":["execution"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1059.012","name":"Hypervisor CLI","tactics":["execution"],"ds":1,"an":1,"sigma":9,"kev":0},{"id":"T1059.013","name":"Container CLI/API","tactics":["execution"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"ds":1,"an":4,"sigma":31,"kev":69},{"id":"T1069","name":"Permission Groups Discovery","tactics":["discovery"],"ds":1,"an":3,"sigma":3,"kev":1},{"id":"T1069.001","name":"Local Groups","tactics":["discovery"],"ds":1,"an":3,"sigma":16,"kev":0},{"id":"T1069.002","name":"Domain Groups","tactics":["discovery"],"ds":1,"an":3,"sigma":15,"kev":0},{"id":"T1069.003","name":"Cloud Groups","tactics":["discovery"],"ds":1,"an":3,"sigma":1,"kev":0},{"id":"T1070","name":"Indicator Removal","tactics":["stealth"],"ds":1,"an":6,"sigma":20,"kev":3},{"id":"T1070.003","name":"Clear Command History","tactics":["stealth"],"ds":1,"an":5,"sigma":9,"kev":0},{"id":"T1070.004","name":"File Deletion","tactics":["stealth"],"ds":1,"an":4,"sigma":15,"kev":5},{"id":"T1070.005","name":"Network Share Connection Removal","tactics":["stealth"],"ds":1,"an":1,"sigma":4,"kev":0},{"id":"T1070.006","name":"Timestomp","tactics":["stealth"],"ds":1,"an":4,"sigma":6,"kev":0},{"id":"T1070.007","name":"Clear Network Connection History and Configurations","tactics":["stealth"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1070.008","name":"Clear Mailbox Data","tactics":["stealth"],"ds":1,"an":4,"sigma":2,"kev":0},{"id":"T1070.009","name":"Clear Persistence","tactics":["stealth"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1070.010","name":"Relocate Malware","tactics":["stealth"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1071","name":"Application Layer Protocol","tactics":["command-and-control"],"ds":1,"an":4,"sigma":7,"kev":1},{"id":"T1071.001","name":"Web Protocols","tactics":["command-and-control"],"ds":1,"an":5,"sigma":42,"kev":10},{"id":"T1071.002","name":"File Transfer Protocols","tactics":["command-and-control"],"ds":1,"an":5,"sigma":0,"kev":1},{"id":"T1071.003","name":"Mail Protocols","tactics":["command-and-control"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1071.004","name":"DNS","tactics":["command-and-control"],"ds":1,"an":5,"sigma":17,"kev":0},{"id":"T1071.005","name":"Publish/Subscribe Protocols","tactics":["command-and-control"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1072","name":"Software Deployment Tools","tactics":["execution","lateral-movement"],"ds":1,"an":5,"sigma":4,"kev":0},{"id":"T1074","name":"Data Staged","tactics":["collection"],"ds":1,"an":5,"sigma":2,"kev":0},{"id":"T1074.001","name":"Local Data Staging","tactics":["collection"],"ds":1,"an":4,"sigma":4,"kev":0},{"id":"T1074.002","name":"Remote Data Staging","tactics":["collection"],"ds":1,"an":5,"sigma":0,"kev":0},{"id":"T1078","name":"Valid Accounts","tactics":["stealth","persistence","privilege-escalation","initial-access"],"ds":1,"an":5,"sigma":56,"kev":46},{"id":"T1078.001","name":"Default Accounts","tactics":["stealth","persistence","privilege-escalation","initial-access"],"ds":1,"an":5,"sigma":4,"kev":0},{"id":"T1078.002","name":"Domain Accounts","tactics":["stealth","persistence","privilege-escalation","initial-access"],"ds":1,"an":4,"sigma":7,"kev":0},{"id":"T1078.003","name":"Local Accounts","tactics":["stealth","persistence","privilege-escalation","initial-access"],"ds":1,"an":3,"sigma":5,"kev":1},{"id":"T1078.004","name":"Cloud Accounts","tactics":["stealth","persistence","privilege-escalation","initial-access"],"ds":1,"an":4,"sigma":41,"kev":1},{"id":"T1080","name":"Taint Shared Content","tactics":["lateral-movement"],"ds":1,"an":5,"sigma":0,"kev":0},{"id":"T1082","name":"System Information Discovery","tactics":["discovery"],"ds":1,"an":6,"sigma":33,"kev":7},{"id":"T1083","name":"File and Directory Discovery","tactics":["discovery"],"ds":1,"an":5,"sigma":24,"kev":5},{"id":"T1087","name":"Account Discovery","tactics":["discovery"],"ds":1,"an":8,"sigma":16,"kev":6},{"id":"T1087.001","name":"Local Account","tactics":["discovery"],"ds":1,"an":4,"sigma":13,"kev":1},{"id":"T1087.002","name":"Domain Account","tactics":["discovery"],"ds":1,"an":3,"sigma":21,"kev":5},{"id":"T1087.003","name":"Email Account","tactics":["discovery"],"ds":1,"an":2,"sigma":0,"kev":0},{"id":"T1087.004","name":"Cloud Account","tactics":["discovery"],"ds":1,"an":4,"sigma":3,"kev":0},{"id":"T1090","name":"Proxy","tactics":["command-and-control"],"ds":1,"an":5,"sigma":22,"kev":3},{"id":"T1090.001","name":"Internal Proxy","tactics":["command-and-control"],"ds":1,"an":5,"sigma":6,"kev":1},{"id":"T1090.002","name":"External Proxy","tactics":["command-and-control"],"ds":1,"an":5,"sigma":2,"kev":0},{"id":"T1090.003","name":"Multi-hop Proxy","tactics":["command-and-control"],"ds":1,"an":5,"sigma":3,"kev":0},{"id":"T1090.004","name":"Domain Fronting","tactics":["command-and-control"],"ds":1,"an":4,"sigma":1,"kev":0},{"id":"T1091","name":"Replication Through Removable Media","tactics":["lateral-movement","initial-access"],"ds":1,"an":1,"sigma":1,"kev":6},{"id":"T1092","name":"Communication Through Removable Media","tactics":["command-and-control"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1095","name":"Non-Application Layer Protocol","tactics":["command-and-control"],"ds":1,"an":5,"sigma":3,"kev":0},{"id":"T1098","name":"Account Manipulation","tactics":["persistence","privilege-escalation"],"ds":1,"an":6,"sigma":34,"kev":2},{"id":"T1098.001","name":"Additional Cloud Credentials","tactics":["persistence","privilege-escalation"],"ds":1,"an":3,"sigma":3,"kev":0},{"id":"T1098.002","name":"Additional Email Delegate Permissions","tactics":["persistence","privilege-escalation"],"ds":1,"an":2,"sigma":0,"kev":0},{"id":"T1098.003","name":"Additional Cloud Roles","tactics":["persistence","privilege-escalation"],"ds":1,"an":3,"sigma":7,"kev":0},{"id":"T1098.004","name":"SSH Authorized Keys","tactics":["persistence","privilege-escalation"],"ds":1,"an":5,"sigma":0,"kev":1},{"id":"T1098.005","name":"Device Registration","tactics":["persistence","privilege-escalation"],"ds":1,"an":2,"sigma":1,"kev":0},{"id":"T1098.006","name":"Additional Container Cluster Roles","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1098.007","name":"Additional Local or Domain Groups","tactics":["persistence","privilege-escalation"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1102","name":"Web Service","tactics":["command-and-control"],"ds":1,"an":4,"sigma":13,"kev":0},{"id":"T1102.001","name":"Dead Drop Resolver","tactics":["command-and-control"],"ds":1,"an":4,"sigma":4,"kev":0},{"id":"T1102.002","name":"Bidirectional Communication","tactics":["command-and-control"],"ds":1,"an":3,"sigma":4,"kev":0},{"id":"T1102.003","name":"One-Way Communication","tactics":["command-and-control"],"ds":1,"an":4,"sigma":2,"kev":0},{"id":"T1104","name":"Multi-Stage Channels","tactics":["command-and-control"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"ds":1,"an":5,"sigma":87,"kev":35},{"id":"T1106","name":"Native API","tactics":["execution"],"ds":1,"an":3,"sigma":14,"kev":7},{"id":"T1110","name":"Brute Force","tactics":["credential-access"],"ds":1,"an":5,"sigma":25,"kev":2},{"id":"T1110.001","name":"Password Guessing","tactics":["credential-access"],"ds":1,"an":6,"sigma":3,"kev":0},{"id":"T1110.002","name":"Password Cracking","tactics":["credential-access"],"ds":1,"an":5,"sigma":1,"kev":0},{"id":"T1110.003","name":"Password Spraying","tactics":["credential-access"],"ds":1,"an":8,"sigma":0,"kev":0},{"id":"T1110.004","name":"Credential Stuffing","tactics":["credential-access"],"ds":1,"an":9,"sigma":0,"kev":0},{"id":"T1111","name":"Multi-Factor Authentication Interception","tactics":["credential-access"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1112","name":"Modify Registry","tactics":["defense-impairment","persistence"],"ds":1,"an":1,"sigma":96,"kev":4},{"id":"T1113","name":"Screen Capture","tactics":["collection"],"ds":1,"an":3,"sigma":10,"kev":0},{"id":"T1114","name":"Email Collection","tactics":["collection"],"ds":1,"an":4,"sigma":4,"kev":3},{"id":"T1114.001","name":"Local Email Collection","tactics":["collection"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1114.002","name":"Remote Email Collection","tactics":["collection"],"ds":1,"an":2,"sigma":0,"kev":1},{"id":"T1114.003","name":"Email Forwarding Rule","tactics":["collection"],"ds":1,"an":4,"sigma":6,"kev":0},{"id":"T1115","name":"Clipboard Data","tactics":["collection"],"ds":1,"an":3,"sigma":8,"kev":0},{"id":"T1119","name":"Automated Collection","tactics":["collection"],"ds":1,"an":4,"sigma":5,"kev":1},{"id":"T1120","name":"Peripheral Device Discovery","tactics":["discovery"],"ds":1,"an":3,"sigma":2,"kev":0},{"id":"T1123","name":"Audio Capture","tactics":["collection"],"ds":1,"an":3,"sigma":6,"kev":0},{"id":"T1124","name":"System Time Discovery","tactics":["discovery"],"ds":1,"an":5,"sigma":3,"kev":0},{"id":"T1125","name":"Video Capture","tactics":["collection"],"ds":1,"an":3,"sigma":1,"kev":0},{"id":"T1127","name":"Trusted Developer Utilities Proxy Execution","tactics":["stealth","execution"],"ds":1,"an":1,"sigma":20,"kev":0},{"id":"T1127.001","name":"MSBuild","tactics":["stealth","execution"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1127.002","name":"ClickOnce","tactics":["stealth","execution"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1127.003","name":"JamPlus","tactics":["stealth","execution"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1129","name":"Shared Modules","tactics":["execution"],"ds":1,"an":3,"sigma":2,"kev":0},{"id":"T1132","name":"Data Encoding","tactics":["command-and-control"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1132.001","name":"Standard Encoding","tactics":["command-and-control"],"ds":1,"an":4,"sigma":4,"kev":0},{"id":"T1132.002","name":"Non-Standard Encoding","tactics":["command-and-control"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1133","name":"External Remote Services","tactics":["persistence","initial-access"],"ds":1,"an":4,"sigma":20,"kev":25},{"id":"T1134","name":"Access Token Manipulation","tactics":["stealth","privilege-escalation"],"ds":1,"an":1,"sigma":4,"kev":0},{"id":"T1134.001","name":"Token Impersonation/Theft","tactics":["stealth","privilege-escalation"],"ds":1,"an":1,"sigma":9,"kev":1},{"id":"T1134.002","name":"Create Process with Token","tactics":["stealth","privilege-escalation"],"ds":1,"an":1,"sigma":7,"kev":0},{"id":"T1134.003","name":"Make and Impersonate Token","tactics":["stealth","privilege-escalation"],"ds":1,"an":1,"sigma":4,"kev":0},{"id":"T1134.004","name":"Parent PID Spoofing","tactics":["stealth","privilege-escalation"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1134.005","name":"SID-History Injection","tactics":["stealth","privilege-escalation"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1135","name":"Network Share Discovery","tactics":["discovery"],"ds":1,"an":3,"sigma":7,"kev":0},{"id":"T1136","name":"Create Account","tactics":["persistence"],"ds":1,"an":5,"sigma":3,"kev":10},{"id":"T1136.001","name":"Local Account","tactics":["persistence"],"ds":1,"an":6,"sigma":18,"kev":2},{"id":"T1136.002","name":"Domain Account","tactics":["persistence"],"ds":1,"an":3,"sigma":6,"kev":0},{"id":"T1136.003","name":"Cloud Account","tactics":["persistence"],"ds":1,"an":4,"sigma":3,"kev":0},{"id":"T1137","name":"Office Application Startup","tactics":["persistence"],"ds":1,"an":2,"sigma":9,"kev":0},{"id":"T1137.001","name":"Office Template Macros","tactics":["persistence"],"ds":1,"an":2,"sigma":0,"kev":0},{"id":"T1137.002","name":"Office Test","tactics":["persistence"],"ds":1,"an":2,"sigma":2,"kev":0},{"id":"T1137.003","name":"Outlook Forms","tactics":["persistence"],"ds":1,"an":2,"sigma":1,"kev":0},{"id":"T1137.004","name":"Outlook Home Page","tactics":["persistence"],"ds":1,"an":2,"sigma":0,"kev":0},{"id":"T1137.005","name":"Outlook Rules","tactics":["persistence"],"ds":1,"an":2,"sigma":0,"kev":0},{"id":"T1137.006","name":"Add-ins","tactics":["persistence"],"ds":1,"an":2,"sigma":4,"kev":0},{"id":"T1140","name":"Deobfuscate/Decode Files or Information","tactics":["stealth"],"ds":1,"an":3,"sigma":18,"kev":2},{"id":"T1176","name":"Software Extensions","tactics":["persistence"],"ds":1,"an":3,"sigma":1,"kev":0},{"id":"T1176.001","name":"Browser Extensions","tactics":["persistence"],"ds":1,"an":3,"sigma":2,"kev":0},{"id":"T1176.002","name":"IDE Extensions","tactics":["persistence"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1185","name":"Browser Session Hijacking","tactics":["collection"],"ds":1,"an":1,"sigma":2,"kev":3},{"id":"T1187","name":"Forced Authentication","tactics":["credential-access"],"ds":1,"an":1,"sigma":9,"kev":0},{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"ds":1,"an":4,"sigma":3,"kev":21},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"ds":1,"an":7,"sigma":149,"kev":157},{"id":"T1195","name":"Supply Chain Compromise","tactics":["initial-access"],"ds":1,"an":3,"sigma":1,"kev":1},{"id":"T1195.001","name":"Compromise Software Dependencies and Development Tools","tactics":["initial-access"],"ds":1,"an":3,"sigma":2,"kev":0},{"id":"T1195.002","name":"Compromise Software Supply Chain","tactics":["initial-access"],"ds":1,"an":3,"sigma":17,"kev":2},{"id":"T1195.003","name":"Compromise Hardware Supply Chain","tactics":["initial-access"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1197","name":"BITS Jobs","tactics":["stealth","persistence","execution"],"ds":1,"an":1,"sigma":16,"kev":0},{"id":"T1199","name":"Trusted Relationship","tactics":["initial-access"],"ds":1,"an":7,"sigma":2,"kev":1},{"id":"T1200","name":"Hardware Additions","tactics":["initial-access"],"ds":1,"an":3,"sigma":3,"kev":0},{"id":"T1201","name":"Password Policy Discovery","tactics":["discovery"],"ds":1,"an":7,"sigma":6,"kev":0},{"id":"T1202","name":"Indirect Command Execution","tactics":["stealth"],"ds":1,"an":1,"sigma":40,"kev":9},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"ds":1,"an":3,"sigma":35,"kev":43},{"id":"T1204","name":"User Execution","tactics":["execution"],"ds":1,"an":5,"sigma":10,"kev":2},{"id":"T1204.001","name":"Malicious Link","tactics":["execution"],"ds":1,"an":3,"sigma":4,"kev":11},{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"ds":1,"an":3,"sigma":39,"kev":33},{"id":"T1204.003","name":"Malicious Image","tactics":["execution"],"ds":1,"an":2,"sigma":0,"kev":0},{"id":"T1204.004","name":"Malicious Copy and Paste","tactics":["execution"],"ds":1,"an":3,"sigma":6,"kev":0},{"id":"T1204.005","name":"Malicious Library","tactics":["execution"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1205","name":"Traffic Signaling","tactics":["stealth","persistence","command-and-control"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1205.001","name":"Port Knocking","tactics":["stealth","persistence","command-and-control"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1205.002","name":"Socket Filters","tactics":["stealth","persistence","command-and-control"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1207","name":"Rogue Domain Controller","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":2,"kev":0},{"id":"T1210","name":"Exploitation of Remote Services","tactics":["lateral-movement"],"ds":1,"an":4,"sigma":15,"kev":4},{"id":"T1211","name":"Exploitation for Stealth","tactics":["stealth"],"ds":1,"an":5,"sigma":4,"kev":1},{"id":"T1212","name":"Exploitation for Credential Access","tactics":["credential-access"],"ds":1,"an":4,"sigma":5,"kev":4},{"id":"T1213","name":"Data from Information Repositories","tactics":["collection"],"ds":1,"an":4,"sigma":7,"kev":2},{"id":"T1213.001","name":"Confluence","tactics":["collection"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1213.002","name":"Sharepoint","tactics":["collection"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1213.003","name":"Code Repositories","tactics":["collection"],"ds":1,"an":1,"sigma":5,"kev":0},{"id":"T1213.004","name":"Customer Relationship Management Software","tactics":["collection"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1213.005","name":"Messaging Applications","tactics":["collection"],"ds":1,"an":2,"sigma":0,"kev":0},{"id":"T1213.006","name":"Databases","tactics":["collection"],"ds":1,"an":5,"sigma":0,"kev":0},{"id":"T1216","name":"System Script Proxy Execution","tactics":["stealth"],"ds":1,"an":1,"sigma":13,"kev":0},{"id":"T1216.001","name":"PubPrn","tactics":["stealth"],"ds":1,"an":1,"sigma":2,"kev":0},{"id":"T1216.002","name":"SyncAppvPublishingServer","tactics":["stealth"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1217","name":"Browser Information Discovery","tactics":["discovery"],"ds":1,"an":3,"sigma":4,"kev":1},{"id":"T1218","name":"System Binary Proxy Execution","tactics":["stealth"],"ds":1,"an":3,"sigma":153,"kev":2},{"id":"T1218.001","name":"Compiled HTML File","tactics":["stealth"],"ds":1,"an":1,"sigma":6,"kev":0},{"id":"T1218.002","name":"Control Panel","tactics":["stealth"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1218.003","name":"CMSTP","tactics":["stealth"],"ds":1,"an":1,"sigma":7,"kev":0},{"id":"T1218.004","name":"InstallUtil","tactics":["stealth"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1218.005","name":"Mshta","tactics":["stealth"],"ds":1,"an":1,"sigma":8,"kev":0},{"id":"T1218.007","name":"Msiexec","tactics":["stealth"],"ds":1,"an":1,"sigma":10,"kev":0},{"id":"T1218.008","name":"Odbcconf","tactics":["stealth"],"ds":1,"an":1,"sigma":8,"kev":0},{"id":"T1218.009","name":"Regsvcs/Regasm","tactics":["stealth"],"ds":1,"an":1,"sigma":4,"kev":0},{"id":"T1218.010","name":"Regsvr32","tactics":["stealth"],"ds":1,"an":1,"sigma":19,"kev":0},{"id":"T1218.011","name":"Rundll32","tactics":["stealth"],"ds":1,"an":1,"sigma":43,"kev":0},{"id":"T1218.012","name":"Verclsid","tactics":["stealth"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1218.013","name":"Mavinject","tactics":["stealth"],"ds":1,"an":1,"sigma":2,"kev":0},{"id":"T1218.014","name":"MMC","tactics":["stealth"],"ds":1,"an":1,"sigma":2,"kev":0},{"id":"T1218.015","name":"Electron Applications","tactics":["stealth"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1219","name":"Remote Access Tools","tactics":["command-and-control"],"ds":1,"an":3,"sigma":6,"kev":1},{"id":"T1219.001","name":"IDE Tunneling","tactics":["command-and-control"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1219.002","name":"Remote Desktop Software","tactics":["command-and-control"],"ds":1,"an":3,"sigma":46,"kev":0},{"id":"T1219.003","name":"Remote Access Hardware","tactics":["command-and-control"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1220","name":"XSL Script Processing","tactics":["stealth"],"ds":1,"an":1,"sigma":5,"kev":0},{"id":"T1221","name":"Template Injection","tactics":["stealth"],"ds":1,"an":1,"sigma":2,"kev":3},{"id":"T1222","name":"File and Directory Permissions Modification","tactics":["defense-impairment"],"ds":1,"an":4,"sigma":2,"kev":1},{"id":"T1222.001","name":"Windows Permissions","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":5,"kev":0},{"id":"T1222.002","name":"Linux and Mac Permissions","tactics":["defense-impairment"],"ds":1,"an":2,"sigma":4,"kev":0},{"id":"T1480","name":"Execution Guardrails","tactics":["stealth"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1480.001","name":"Environmental Keying","tactics":["stealth"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1480.002","name":"Mutual Exclusion","tactics":["stealth"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1482","name":"Domain Trust Discovery","tactics":["discovery"],"ds":1,"an":1,"sigma":17,"kev":2},{"id":"T1484","name":"Domain or Tenant Policy Modification","tactics":["defense-impairment","privilege-escalation"],"ds":1,"an":2,"sigma":1,"kev":0},{"id":"T1484.001","name":"Group Policy Modification","tactics":["defense-impairment","privilege-escalation"],"ds":1,"an":1,"sigma":6,"kev":1},{"id":"T1484.002","name":"Trust Modification","tactics":["defense-impairment","privilege-escalation"],"ds":1,"an":2,"sigma":2,"kev":0},{"id":"T1485","name":"Data Destruction","tactics":["impact"],"ds":1,"an":6,"sigma":20,"kev":6},{"id":"T1485.001","name":"Lifecycle-Triggered Deletion","tactics":["impact"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1486","name":"Data Encrypted for Impact","tactics":["impact"],"ds":1,"an":5,"sigma":16,"kev":15},{"id":"T1489","name":"Service Stop","tactics":["impact"],"ds":1,"an":4,"sigma":20,"kev":1},{"id":"T1490","name":"Inhibit System Recovery","tactics":["impact"],"ds":1,"an":5,"sigma":27,"kev":2},{"id":"T1491","name":"Defacement","tactics":["impact"],"ds":1,"an":5,"sigma":0,"kev":0},{"id":"T1491.001","name":"Internal Defacement","tactics":["impact"],"ds":1,"an":4,"sigma":4,"kev":0},{"id":"T1491.002","name":"External Defacement","tactics":["impact"],"ds":1,"an":4,"sigma":0,"kev":1},{"id":"T1495","name":"Firmware Corruption","tactics":["impact"],"ds":1,"an":4,"sigma":1,"kev":2},{"id":"T1496","name":"Resource Hijacking","tactics":["impact"],"ds":1,"an":6,"sigma":13,"kev":19},{"id":"T1496.001","name":"Compute Hijacking","tactics":["impact"],"ds":1,"an":5,"sigma":0,"kev":0},{"id":"T1496.002","name":"Bandwidth Hijacking","tactics":["impact"],"ds":1,"an":5,"sigma":0,"kev":0},{"id":"T1496.003","name":"SMS Pumping","tactics":["impact"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1496.004","name":"Cloud Service Hijacking","tactics":["impact"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1497","name":"Virtualization/Sandbox Evasion","tactics":["stealth","discovery"],"ds":1,"an":3,"sigma":0,"kev":4},{"id":"T1497.001","name":"System Checks","tactics":["stealth","discovery"],"ds":1,"an":3,"sigma":3,"kev":0},{"id":"T1497.002","name":"User Activity Based Checks","tactics":["stealth","discovery"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1497.003","name":"Time Based Checks","tactics":["stealth","discovery"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1498","name":"Network Denial of Service","tactics":["impact"],"ds":1,"an":2,"sigma":3,"kev":8},{"id":"T1498.001","name":"Direct Network Flood","tactics":["impact"],"ds":1,"an":4,"sigma":0,"kev":1},{"id":"T1498.002","name":"Reflection Amplification","tactics":["impact"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1499","name":"Endpoint Denial of Service","tactics":["impact"],"ds":1,"an":5,"sigma":3,"kev":7},{"id":"T1499.001","name":"OS Exhaustion Flood","tactics":["impact"],"ds":1,"an":3,"sigma":1,"kev":0},{"id":"T1499.002","name":"Service Exhaustion Flood","tactics":["impact"],"ds":1,"an":4,"sigma":0,"kev":2},{"id":"T1499.003","name":"Application Exhaustion Flood","tactics":["impact"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1499.004","name":"Application or System Exploitation","tactics":["impact"],"ds":1,"an":4,"sigma":3,"kev":2},{"id":"T1505","name":"Server Software Component","tactics":["persistence"],"ds":1,"an":4,"sigma":1,"kev":2},{"id":"T1505.001","name":"SQL Stored Procedures","tactics":["persistence"],"ds":1,"an":2,"sigma":2,"kev":0},{"id":"T1505.002","name":"Transport Agent","tactics":["persistence"],"ds":1,"an":2,"sigma":3,"kev":0},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"ds":1,"an":3,"sigma":35,"kev":26},{"id":"T1505.004","name":"IIS Components","tactics":["persistence"],"ds":1,"an":1,"sigma":5,"kev":0},{"id":"T1505.005","name":"Terminal Services DLL","tactics":["persistence"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1505.006","name":"vSphere Installation Bundles","tactics":["persistence"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1518","name":"Software Discovery","tactics":["discovery"],"ds":1,"an":5,"sigma":4,"kev":0},{"id":"T1518.001","name":"Security Software Discovery","tactics":["discovery"],"ds":1,"an":3,"sigma":9,"kev":0},{"id":"T1518.002","name":"Backup Software Discovery","tactics":["discovery"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1525","name":"Implant Internal Image","tactics":["persistence"],"ds":1,"an":2,"sigma":1,"kev":0},{"id":"T1526","name":"Cloud Service Discovery","tactics":["discovery"],"ds":1,"an":4,"sigma":3,"kev":0},{"id":"T1528","name":"Steal Application Access Token","tactics":["credential-access"],"ds":1,"an":5,"sigma":14,"kev":1},{"id":"T1529","name":"System Shutdown/Reboot","tactics":["impact"],"ds":1,"an":5,"sigma":8,"kev":0},{"id":"T1530","name":"Data from Cloud Storage","tactics":["collection"],"ds":1,"an":3,"sigma":0,"kev":2},{"id":"T1531","name":"Account Access Removal","tactics":["impact"],"ds":1,"an":6,"sigma":9,"kev":1},{"id":"T1534","name":"Internal Spearphishing","tactics":["lateral-movement"],"ds":1,"an":5,"sigma":0,"kev":0},{"id":"T1535","name":"Unused/Unsupported Cloud Regions","tactics":["stealth"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1537","name":"Transfer Data to Cloud Account","tactics":["exfiltration"],"ds":1,"an":3,"sigma":6,"kev":0},{"id":"T1538","name":"Cloud Service Dashboard","tactics":["discovery"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1539","name":"Steal Web Session Cookie","tactics":["credential-access"],"ds":1,"an":5,"sigma":2,"kev":0},{"id":"T1542","name":"Pre-OS Boot","tactics":["stealth","persistence"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1542.001","name":"System Firmware","tactics":["stealth","persistence"],"ds":1,"an":2,"sigma":2,"kev":0},{"id":"T1542.002","name":"Component Firmware","tactics":["stealth","persistence"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1542.003","name":"Bootkit","tactics":["stealth","persistence"],"ds":1,"an":2,"sigma":1,"kev":0},{"id":"T1542.004","name":"ROMMONkit","tactics":["stealth","persistence"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1542.005","name":"TFTP Boot","tactics":["stealth","persistence"],"ds":1,"an":1,"sigma":0,"kev":1},{"id":"T1543","name":"Create or Modify System Process","tactics":["persistence","privilege-escalation"],"ds":1,"an":4,"sigma":9,"kev":9},{"id":"T1543.001","name":"Launch Agent","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":2,"kev":0},{"id":"T1543.002","name":"Systemd Service","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":4,"kev":0},{"id":"T1543.003","name":"Windows Service","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":47,"kev":0},{"id":"T1543.004","name":"Launch Daemon","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":3,"kev":0},{"id":"T1543.005","name":"Container Service","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1546","name":"Event Triggered Execution","tactics":["privilege-escalation","persistence"],"ds":1,"an":6,"sigma":10,"kev":0},{"id":"T1546.001","name":"Change Default File Association","tactics":["privilege-escalation","persistence"],"ds":1,"an":1,"sigma":5,"kev":0},{"id":"T1546.002","name":"Screensaver","tactics":["privilege-escalation","persistence"],"ds":1,"an":1,"sigma":4,"kev":0},{"id":"T1546.003","name":"Windows Management Instrumentation Event Subscription","tactics":["privilege-escalation","persistence"],"ds":1,"an":1,"sigma":12,"kev":0},{"id":"T1546.004","name":"Unix Shell Configuration Modification","tactics":["privilege-escalation","persistence"],"ds":1,"an":2,"sigma":1,"kev":0},{"id":"T1546.005","name":"Trap","tactics":["privilege-escalation","persistence"],"ds":1,"an":2,"sigma":0,"kev":0},{"id":"T1546.006","name":"LC_LOAD_DYLIB Addition","tactics":["privilege-escalation","persistence"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1546.007","name":"Netsh Helper DLL","tactics":["privilege-escalation","persistence"],"ds":1,"an":1,"sigma":4,"kev":0},{"id":"T1546.008","name":"Accessibility Features","tactics":["privilege-escalation","persistence"],"ds":1,"an":1,"sigma":6,"kev":0},{"id":"T1546.009","name":"AppCert DLLs","tactics":["privilege-escalation","persistence"],"ds":1,"an":1,"sigma":2,"kev":0},{"id":"T1546.010","name":"AppInit DLLs","tactics":["privilege-escalation","persistence"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1546.011","name":"Application Shimming","tactics":["privilege-escalation","persistence"],"ds":1,"an":1,"sigma":6,"kev":0},{"id":"T1546.012","name":"Image File Execution Options Injection","tactics":["privilege-escalation","persistence"],"ds":1,"an":1,"sigma":2,"kev":0},{"id":"T1546.013","name":"PowerShell Profile","tactics":["privilege-escalation","persistence"],"ds":1,"an":1,"sigma":3,"kev":0},{"id":"T1546.014","name":"Emond","tactics":["privilege-escalation","persistence"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1546.015","name":"Component Object Model Hijacking","tactics":["privilege-escalation","persistence"],"ds":1,"an":1,"sigma":9,"kev":0},{"id":"T1546.016","name":"Installer Packages","tactics":["privilege-escalation","persistence"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1546.017","name":"Udev Rules","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1546.018","name":"Python Startup Hooks","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1547","name":"Boot or Logon Autostart Execution","tactics":["persistence","privilege-escalation"],"ds":1,"an":3,"sigma":7,"kev":1},{"id":"T1547.001","name":"Registry Run Keys / Startup Folder","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":39,"kev":1},{"id":"T1547.002","name":"Authentication Package","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1547.003","name":"Time Providers","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1547.004","name":"Winlogon Helper DLL","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":4,"kev":0},{"id":"T1547.005","name":"Security Support Provider","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1547.006","name":"Kernel Modules and Extensions","tactics":["persistence","privilege-escalation"],"ds":1,"an":2,"sigma":2,"kev":0},{"id":"T1547.007","name":"Re-opened Applications","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1547.008","name":"LSASS Driver","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1547.009","name":"Shortcut Modification","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":4,"kev":1},{"id":"T1547.010","name":"Port Monitors","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":4,"kev":0},{"id":"T1547.012","name":"Print Processors","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1547.013","name":"XDG Autostart Entries","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1547.014","name":"Active Setup","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1547.015","name":"Login Items","tactics":["persistence","privilege-escalation"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1548","name":"Abuse Elevation Control Mechanism","tactics":["privilege-escalation"],"ds":1,"an":5,"sigma":24,"kev":4},{"id":"T1548.001","name":"Setuid and Setgid","tactics":["privilege-escalation"],"ds":1,"an":2,"sigma":2,"kev":1},{"id":"T1548.002","name":"Bypass User Account Control","tactics":["privilege-escalation"],"ds":1,"an":1,"sigma":56,"kev":1},{"id":"T1548.003","name":"Sudo and Sudo Caching","tactics":["privilege-escalation"],"ds":1,"an":2,"sigma":3,"kev":0},{"id":"T1548.004","name":"Elevated Execution with Prompt","tactics":["privilege-escalation"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1548.005","name":"Temporary Elevated Cloud Access","tactics":["privilege-escalation"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1548.006","name":"TCC Manipulation","tactics":["privilege-escalation"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1550","name":"Use Alternate Authentication Material","tactics":["lateral-movement"],"ds":1,"an":7,"sigma":5,"kev":0},{"id":"T1550.001","name":"Application Access Token","tactics":["lateral-movement"],"ds":1,"an":5,"sigma":4,"kev":0},{"id":"T1550.002","name":"Pass the Hash","tactics":["lateral-movement"],"ds":1,"an":1,"sigma":6,"kev":4},{"id":"T1550.003","name":"Pass the Ticket","tactics":["lateral-movement"],"ds":1,"an":1,"sigma":7,"kev":0},{"id":"T1550.004","name":"Web Session Cookie","tactics":["lateral-movement"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1552","name":"Unsecured Credentials","tactics":["credential-access"],"ds":1,"an":7,"sigma":13,"kev":4},{"id":"T1552.001","name":"Credentials In Files","tactics":["credential-access"],"ds":1,"an":5,"sigma":24,"kev":3},{"id":"T1552.002","name":"Credentials in Registry","tactics":["credential-access"],"ds":1,"an":1,"sigma":5,"kev":0},{"id":"T1552.003","name":"Shell History","tactics":["credential-access"],"ds":1,"an":2,"sigma":3,"kev":0},{"id":"T1552.004","name":"Private Keys","tactics":["credential-access"],"ds":1,"an":4,"sigma":7,"kev":1},{"id":"T1552.005","name":"Cloud Instance Metadata API","tactics":["credential-access"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1552.006","name":"Group Policy Preferences","tactics":["credential-access"],"ds":1,"an":1,"sigma":6,"kev":0},{"id":"T1552.007","name":"Container API","tactics":["credential-access"],"ds":1,"an":1,"sigma":4,"kev":0},{"id":"T1552.008","name":"Chat Messages","tactics":["credential-access"],"ds":1,"an":2,"sigma":0,"kev":0},{"id":"T1553","name":"Subvert Trust Controls","tactics":["defense-impairment"],"ds":1,"an":3,"sigma":4,"kev":0},{"id":"T1553.001","name":"Gatekeeper Bypass","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1553.002","name":"Code Signing","tactics":["defense-impairment"],"ds":1,"an":2,"sigma":1,"kev":0},{"id":"T1553.003","name":"SIP and Trust Provider Hijacking","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":2,"kev":0},{"id":"T1553.004","name":"Install Root Certificate","tactics":["defense-impairment"],"ds":1,"an":3,"sigma":10,"kev":0},{"id":"T1553.005","name":"Mark-of-the-Web Bypass","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":6,"kev":2},{"id":"T1553.006","name":"Code Signing Policy Modification","tactics":["defense-impairment"],"ds":1,"an":2,"sigma":0,"kev":0},{"id":"T1554","name":"Compromise Host Software Binary","tactics":["persistence"],"ds":1,"an":4,"sigma":6,"kev":0},{"id":"T1555","name":"Credentials from Password Stores","tactics":["credential-access"],"ds":1,"an":4,"sigma":8,"kev":9},{"id":"T1555.001","name":"Keychain","tactics":["credential-access"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1555.002","name":"Securityd Memory","tactics":["credential-access"],"ds":1,"an":2,"sigma":0,"kev":0},{"id":"T1555.003","name":"Credentials from Web Browsers","tactics":["credential-access"],"ds":1,"an":3,"sigma":8,"kev":0},{"id":"T1555.004","name":"Windows Credential Manager","tactics":["credential-access"],"ds":1,"an":1,"sigma":4,"kev":0},{"id":"T1555.005","name":"Password Managers","tactics":["credential-access"],"ds":1,"an":3,"sigma":1,"kev":0},{"id":"T1555.006","name":"Cloud Secrets Management Stores","tactics":["credential-access"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1556","name":"Modify Authentication Process","tactics":["defense-impairment","persistence","credential-access"],"ds":1,"an":5,"sigma":12,"kev":2},{"id":"T1556.001","name":"Domain Controller Authentication","tactics":["defense-impairment","persistence","credential-access"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1556.002","name":"Password Filter DLL","tactics":["defense-impairment","persistence","credential-access"],"ds":1,"an":1,"sigma":3,"kev":0},{"id":"T1556.003","name":"Pluggable Authentication Modules","tactics":["defense-impairment","persistence","credential-access"],"ds":1,"an":2,"sigma":0,"kev":0},{"id":"T1556.004","name":"Network Device Authentication","tactics":["defense-impairment","persistence","credential-access"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1556.005","name":"Reversible Encryption","tactics":["defense-impairment","persistence","credential-access"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1556.006","name":"Multi-Factor Authentication","tactics":["defense-impairment","persistence","credential-access"],"ds":1,"an":7,"sigma":3,"kev":0},{"id":"T1556.007","name":"Hybrid Identity","tactics":["defense-impairment","persistence","credential-access"],"ds":1,"an":5,"sigma":0,"kev":0},{"id":"T1556.008","name":"Network Provider DLL","tactics":["defense-impairment","persistence","credential-access"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1556.009","name":"Conditional Access Policies","tactics":["defense-impairment","persistence","credential-access"],"ds":1,"an":2,"sigma":0,"kev":0},{"id":"T1557","name":"Adversary-in-the-Middle","tactics":["credential-access","collection"],"ds":1,"an":4,"sigma":10,"kev":4},{"id":"T1557.001","name":"Name Resolution Poisoning and SMB Relay","tactics":["credential-access","collection"],"ds":1,"an":1,"sigma":10,"kev":1},{"id":"T1557.002","name":"ARP Cache Poisoning","tactics":["credential-access","collection"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1557.003","name":"DHCP Spoofing","tactics":["credential-access","collection"],"ds":1,"an":3,"sigma":1,"kev":0},{"id":"T1557.004","name":"Evil Twin","tactics":["credential-access","collection"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1558","name":"Steal or Forge Kerberos Tickets","tactics":["credential-access"],"ds":1,"an":3,"sigma":6,"kev":3},{"id":"T1558.001","name":"Golden Ticket","tactics":["credential-access"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1558.002","name":"Silver Ticket","tactics":["credential-access"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1558.003","name":"Kerberoasting","tactics":["credential-access"],"ds":1,"an":1,"sigma":18,"kev":0},{"id":"T1558.004","name":"AS-REP Roasting","tactics":["credential-access"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1558.005","name":"Ccache Files","tactics":["credential-access"],"ds":1,"an":2,"sigma":0,"kev":0},{"id":"T1559","name":"Inter-Process Communication","tactics":["execution"],"ds":1,"an":3,"sigma":1,"kev":0},{"id":"T1559.001","name":"Component Object Model","tactics":["execution"],"ds":1,"an":1,"sigma":4,"kev":0},{"id":"T1559.002","name":"Dynamic Data Exchange","tactics":["execution"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1559.003","name":"XPC Services","tactics":["execution"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1560","name":"Archive Collected Data","tactics":["collection"],"ds":1,"an":3,"sigma":4,"kev":0},{"id":"T1560.001","name":"Archive via Utility","tactics":["collection"],"ds":1,"an":3,"sigma":17,"kev":2},{"id":"T1560.002","name":"Archive via Library","tactics":["collection"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1560.003","name":"Archive via Custom Method","tactics":["collection"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1561","name":"Disk Wipe","tactics":["impact"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1561.001","name":"Disk Content Wipe","tactics":["impact"],"ds":1,"an":4,"sigma":1,"kev":0},{"id":"T1561.002","name":"Disk Structure Wipe","tactics":["impact"],"ds":1,"an":4,"sigma":1,"kev":0},{"id":"T1563","name":"Remote Service Session Hijacking","tactics":["lateral-movement"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1563.001","name":"SSH Hijacking","tactics":["lateral-movement"],"ds":1,"an":2,"sigma":0,"kev":0},{"id":"T1563.002","name":"RDP Hijacking","tactics":["lateral-movement"],"ds":1,"an":1,"sigma":2,"kev":0},{"id":"T1564","name":"Hide Artifacts","tactics":["stealth"],"ds":1,"an":5,"sigma":10,"kev":0},{"id":"T1564.001","name":"Hidden Files and Directories","tactics":["stealth"],"ds":1,"an":3,"sigma":9,"kev":0},{"id":"T1564.002","name":"Hidden Users","tactics":["stealth"],"ds":1,"an":3,"sigma":4,"kev":0},{"id":"T1564.003","name":"Hidden Window","tactics":["stealth"],"ds":1,"an":3,"sigma":8,"kev":0},{"id":"T1564.004","name":"NTFS File Attributes","tactics":["stealth"],"ds":1,"an":1,"sigma":23,"kev":0},{"id":"T1564.005","name":"Hidden File System","tactics":["stealth"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1564.006","name":"Run Virtual Instance","tactics":["stealth"],"ds":1,"an":4,"sigma":2,"kev":0},{"id":"T1564.007","name":"VBA Stomping","tactics":["stealth"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1564.008","name":"Email Hiding Rules","tactics":["stealth"],"ds":1,"an":4,"sigma":4,"kev":0},{"id":"T1564.009","name":"Resource Forking","tactics":["stealth"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1564.010","name":"Process Argument Spoofing","tactics":["stealth"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1564.011","name":"Ignore Process Interrupts","tactics":["stealth"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1564.012","name":"File/Path Exclusions","tactics":["stealth"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1564.013","name":"Bind Mounts","tactics":["stealth"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1564.014","name":"Extended Attributes","tactics":["stealth"],"ds":1,"an":2,"sigma":0,"kev":0},{"id":"T1565","name":"Data Manipulation","tactics":["impact"],"ds":1,"an":3,"sigma":3,"kev":2},{"id":"T1565.001","name":"Stored Data Manipulation","tactics":["impact"],"ds":1,"an":3,"sigma":6,"kev":2},{"id":"T1565.002","name":"Transmitted Data Manipulation","tactics":["impact"],"ds":1,"an":3,"sigma":2,"kev":0},{"id":"T1565.003","name":"Runtime Data Manipulation","tactics":["impact"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1566","name":"Phishing","tactics":["initial-access"],"ds":1,"an":6,"sigma":14,"kev":6},{"id":"T1566.001","name":"Spearphishing Attachment","tactics":["initial-access"],"ds":1,"an":3,"sigma":24,"kev":7},{"id":"T1566.002","name":"Spearphishing Link","tactics":["initial-access"],"ds":1,"an":4,"sigma":4,"kev":5},{"id":"T1566.003","name":"Spearphishing via Service","tactics":["initial-access"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1566.004","name":"Spearphishing Voice","tactics":["initial-access"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1567","name":"Exfiltration Over Web Service","tactics":["exfiltration"],"ds":1,"an":5,"sigma":12,"kev":3},{"id":"T1567.001","name":"Exfiltration to Code Repository","tactics":["exfiltration"],"ds":1,"an":4,"sigma":2,"kev":0},{"id":"T1567.002","name":"Exfiltration to Cloud Storage","tactics":["exfiltration"],"ds":1,"an":4,"sigma":14,"kev":0},{"id":"T1567.003","name":"Exfiltration to Text Storage Sites","tactics":["exfiltration"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1567.004","name":"Exfiltration Over Webhook","tactics":["exfiltration"],"ds":1,"an":5,"sigma":0,"kev":0},{"id":"T1568","name":"Dynamic Resolution","tactics":["command-and-control"],"ds":1,"an":4,"sigma":2,"kev":0},{"id":"T1568.001","name":"Fast Flux DNS","tactics":["command-and-control"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1568.002","name":"Domain Generation Algorithms","tactics":["command-and-control"],"ds":1,"an":4,"sigma":2,"kev":0},{"id":"T1568.003","name":"DNS Calculation","tactics":["command-and-control"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1569","name":"System Services","tactics":["execution"],"ds":1,"an":3,"sigma":4,"kev":0},{"id":"T1569.001","name":"Launchctl","tactics":["execution"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1569.002","name":"Service Execution","tactics":["execution"],"ds":1,"an":1,"sigma":43,"kev":1},{"id":"T1569.003","name":"Systemctl","tactics":["execution"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1570","name":"Lateral Tool Transfer","tactics":["lateral-movement"],"ds":1,"an":4,"sigma":6,"kev":1},{"id":"T1571","name":"Non-Standard Port","tactics":["command-and-control"],"ds":1,"an":4,"sigma":5,"kev":1},{"id":"T1572","name":"Protocol Tunneling","tactics":["command-and-control"],"ds":1,"an":4,"sigma":24,"kev":0},{"id":"T1573","name":"Encrypted Channel","tactics":["command-and-control"],"ds":1,"an":5,"sigma":6,"kev":0},{"id":"T1573.001","name":"Symmetric Cryptography","tactics":["command-and-control"],"ds":1,"an":5,"sigma":0,"kev":3},{"id":"T1573.002","name":"Asymmetric Cryptography","tactics":["command-and-control"],"ds":1,"an":5,"sigma":0,"kev":0},{"id":"T1574","name":"Hijack Execution Flow","tactics":["stealth","execution"],"ds":1,"an":3,"sigma":8,"kev":16},{"id":"T1574.001","name":"DLL","tactics":["stealth","execution"],"ds":1,"an":1,"sigma":93,"kev":0},{"id":"T1574.004","name":"Dylib Hijacking","tactics":["stealth","execution"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1574.005","name":"Executable Installer File Permissions Weakness","tactics":["stealth","execution"],"ds":1,"an":1,"sigma":2,"kev":0},{"id":"T1574.006","name":"Dynamic Linker Hijacking","tactics":["stealth","execution"],"ds":1,"an":2,"sigma":2,"kev":0},{"id":"T1574.007","name":"Path Interception by PATH Environment Variable","tactics":["stealth","execution"],"ds":1,"an":3,"sigma":2,"kev":0},{"id":"T1574.008","name":"Path Interception by Search Order Hijacking","tactics":["stealth","execution"],"ds":1,"an":1,"sigma":2,"kev":0},{"id":"T1574.009","name":"Path Interception by Unquoted Path","tactics":["stealth","execution"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1574.010","name":"Services File Permissions Weakness","tactics":["stealth","execution"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1574.011","name":"Services Registry Permissions Weakness","tactics":["stealth","execution"],"ds":1,"an":1,"sigma":11,"kev":0},{"id":"T1574.012","name":"COR_PROFILER","tactics":["stealth","execution"],"ds":1,"an":1,"sigma":2,"kev":0},{"id":"T1574.013","name":"KernelCallbackTable","tactics":["stealth","execution"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1574.014","name":"AppDomainManager","tactics":["stealth","execution"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1578","name":"Modify Cloud Compute Infrastructure","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1578.001","name":"Create Snapshot","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1578.002","name":"Create Cloud Instance","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1578.003","name":"Delete Cloud Instance","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1578.004","name":"Revert Cloud Instance","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1578.005","name":"Modify Cloud Compute Configurations","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1580","name":"Cloud Infrastructure Discovery","tactics":["discovery"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1583","name":"Acquire Infrastructure","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1583.001","name":"Domains","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1583.002","name":"DNS Server","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1583.003","name":"Virtual Private Server","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1583.004","name":"Server","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1583.005","name":"Botnet","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1583.006","name":"Web Services","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1583.007","name":"Serverless","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1583.008","name":"Malvertising","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1584","name":"Compromise Infrastructure","tactics":["resource-development"],"ds":1,"an":1,"sigma":4,"kev":0},{"id":"T1584.001","name":"Domains","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1584.002","name":"DNS Server","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1584.003","name":"Virtual Private Server","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1584.004","name":"Server","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1584.005","name":"Botnet","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":2},{"id":"T1584.006","name":"Web Services","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1584.007","name":"Serverless","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1584.008","name":"Network Devices","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1585","name":"Establish Accounts","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1585.001","name":"Social Media Accounts","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1585.002","name":"Email Accounts","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1585.003","name":"Cloud Accounts","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1586","name":"Compromise Accounts","tactics":["resource-development"],"ds":1,"an":1,"sigma":2,"kev":0},{"id":"T1586.001","name":"Social Media Accounts","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1586.002","name":"Email Accounts","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1586.003","name":"Cloud Accounts","tactics":["resource-development"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1587","name":"Develop Capabilities","tactics":["resource-development"],"ds":1,"an":1,"sigma":6,"kev":0},{"id":"T1587.001","name":"Malware","tactics":["resource-development"],"ds":1,"an":1,"sigma":11,"kev":0},{"id":"T1587.002","name":"Code Signing Certificates","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1587.003","name":"Digital Certificates","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1587.004","name":"Exploits","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1588","name":"Obtain Capabilities","tactics":["resource-development"],"ds":1,"an":1,"sigma":2,"kev":1},{"id":"T1588.001","name":"Malware","tactics":["resource-development"],"ds":1,"an":1,"sigma":1,"kev":2},{"id":"T1588.002","name":"Tool","tactics":["resource-development"],"ds":1,"an":1,"sigma":9,"kev":0},{"id":"T1588.003","name":"Code Signing Certificates","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1588.004","name":"Digital Certificates","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1588.005","name":"Exploits","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1588.006","name":"Vulnerabilities","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":1},{"id":"T1588.007","name":"Artificial Intelligence","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1589","name":"Gather Victim Identity Information","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":2,"kev":0},{"id":"T1589.001","name":"Credentials","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1589.002","name":"Email Addresses","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1589.003","name":"Employee Names","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1590","name":"Gather Victim Network Information","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":2,"kev":0},{"id":"T1590.001","name":"Domain Properties","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1590.002","name":"DNS","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1590.003","name":"Network Trust Dependencies","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1590.004","name":"Network Topology","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1590.005","name":"IP Addresses","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1590.006","name":"Network Security Appliances","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1591","name":"Gather Victim Org Information","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1591.001","name":"Determine Physical Locations","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1591.002","name":"Business Relationships","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1591.003","name":"Identify Business Tempo","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1591.004","name":"Identify Roles","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":2,"kev":0},{"id":"T1592","name":"Gather Victim Host Information","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":2},{"id":"T1592.001","name":"Hardware","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1592.002","name":"Software","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1592.003","name":"Firmware","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1592.004","name":"Client Configurations","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":3,"kev":0},{"id":"T1593","name":"Search Open Websites/Domains","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1593.001","name":"Social Media","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1593.002","name":"Search Engines","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1593.003","name":"Code Repositories","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":2,"kev":0},{"id":"T1594","name":"Search Victim-Owned Websites","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1595","name":"Active Scanning","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":3,"kev":1},{"id":"T1595.001","name":"Scanning IP Blocks","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1595.002","name":"Vulnerability Scanning","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1595.003","name":"Wordlist Scanning","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1596","name":"Search Open Technical Databases","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1596.001","name":"DNS/Passive DNS","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1596.002","name":"WHOIS","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1596.003","name":"Digital Certificates","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1596.004","name":"CDNs","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1596.005","name":"Scan Databases","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1597","name":"Search Closed Sources","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1597.001","name":"Threat Intel Vendors","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1597.002","name":"Purchase Technical Data","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1598","name":"Phishing for Information","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1598.001","name":"Spearphishing Service","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1598.002","name":"Spearphishing Attachment","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":1,"kev":1},{"id":"T1598.003","name":"Spearphishing Link","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1598.004","name":"Spearphishing Voice","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1599","name":"Network Boundary Bridging","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1599.001","name":"Network Address Translation Traversal","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1600","name":"Weaken Encryption","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1600.001","name":"Reduce Key Space","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1600.002","name":"Disable Crypto Hardware","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1601","name":"Modify System Image","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":0,"kev":1},{"id":"T1601.001","name":"Patch System Image","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1601.002","name":"Downgrade System Image","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1602","name":"Data from Configuration Repository","tactics":["collection"],"ds":1,"an":1,"sigma":0,"kev":1},{"id":"T1602.001","name":"SNMP (MIB Dump)","tactics":["collection"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1602.002","name":"Network Device Configuration Dump","tactics":["collection"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1606","name":"Forge Web Credentials","tactics":["credential-access"],"ds":1,"an":7,"sigma":1,"kev":0},{"id":"T1606.001","name":"Web Cookies","tactics":["credential-access"],"ds":1,"an":5,"sigma":0,"kev":0},{"id":"T1606.002","name":"SAML Tokens","tactics":["credential-access"],"ds":1,"an":5,"sigma":0,"kev":0},{"id":"T1608","name":"Stage Capabilities","tactics":["resource-development"],"ds":1,"an":1,"sigma":2,"kev":0},{"id":"T1608.001","name":"Upload Malware","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":11},{"id":"T1608.002","name":"Upload Tool","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1608.003","name":"Install Digital Certificate","tactics":["resource-development"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1608.004","name":"Drive-by Target","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1608.005","name":"Link Target","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1608.006","name":"SEO Poisoning","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1609","name":"Container Administration Command","tactics":["execution"],"ds":1,"an":1,"sigma":3,"kev":0},{"id":"T1610","name":"Deploy Container","tactics":["execution"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1611","name":"Escape to Host","tactics":["privilege-escalation"],"ds":1,"an":4,"sigma":2,"kev":3},{"id":"T1612","name":"Build Image on Host","tactics":["stealth"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1613","name":"Container and Resource Discovery","tactics":["discovery"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1614","name":"System Location Discovery","tactics":["discovery"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1614.001","name":"System Language Discovery","tactics":["discovery"],"ds":1,"an":3,"sigma":2,"kev":0},{"id":"T1615","name":"Group Policy Discovery","tactics":["discovery"],"ds":1,"an":1,"sigma":5,"kev":0},{"id":"T1619","name":"Cloud Storage Object Discovery","tactics":["discovery"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1620","name":"Reflective Code Loading","tactics":["stealth"],"ds":1,"an":3,"sigma":3,"kev":0},{"id":"T1621","name":"Multi-Factor Authentication Request Generation","tactics":["credential-access"],"ds":1,"an":6,"sigma":2,"kev":0},{"id":"T1622","name":"Debugger Evasion","tactics":["stealth","discovery"],"ds":1,"an":3,"sigma":1,"kev":2},{"id":"T1647","name":"Plist File Modification","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1648","name":"Serverless Execution","tactics":["execution"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1649","name":"Steal or Forge Authentication Certificates","tactics":["credential-access"],"ds":1,"an":4,"sigma":11,"kev":0},{"id":"T1650","name":"Acquire Access","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1651","name":"Cloud Administration Command","tactics":["execution"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1652","name":"Device Driver Discovery","tactics":["discovery"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1653","name":"Power Settings","tactics":["persistence"],"ds":1,"an":3,"sigma":1,"kev":1},{"id":"T1654","name":"Log Enumeration","tactics":["discovery"],"ds":1,"an":5,"sigma":0,"kev":0},{"id":"T1657","name":"Financial Theft","tactics":["impact"],"ds":1,"an":5,"sigma":0,"kev":0},{"id":"T1659","name":"Content Injection","tactics":["initial-access","command-and-control"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1665","name":"Hide Infrastructure","tactics":["command-and-control"],"ds":1,"an":5,"sigma":0,"kev":0},{"id":"T1666","name":"Modify Cloud Resource Hierarchy","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1667","name":"Email Bombing","tactics":["impact"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1668","name":"Exclusive Control","tactics":["persistence"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1669","name":"Wi-Fi Networks","tactics":["initial-access"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1671","name":"Cloud Application Integration","tactics":["persistence"],"ds":1,"an":2,"sigma":0,"kev":0},{"id":"T1673","name":"Virtual Machine Discovery","tactics":["discovery"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1674","name":"Input Injection","tactics":["execution"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1675","name":"ESXi Administration Command","tactics":["execution"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1677","name":"Poisoned Pipeline Execution","tactics":["execution"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1678","name":"Delay Execution","tactics":["stealth"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1679","name":"Selective Exclusion","tactics":["stealth"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1680","name":"Local Storage Discovery","tactics":["discovery"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1681","name":"Search Threat Vendor Data","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1682","name":"Query Public AI Services","tactics":["reconnaissance"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1683","name":"Generate Content","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1683.001","name":"Written Content","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1683.002","name":"Audio-Visual Content","tactics":["resource-development"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1684","name":"Social Engineering","tactics":["stealth"],"ds":1,"an":5,"sigma":0,"kev":0},{"id":"T1684.001","name":"Impersonation","tactics":["stealth"],"ds":1,"an":5,"sigma":0,"kev":0},{"id":"T1684.002","name":"Email Spoofing","tactics":["stealth"],"ds":1,"an":4,"sigma":0,"kev":0},{"id":"T1685","name":"Disable or Modify Tools","tactics":["defense-impairment"],"ds":1,"an":7,"sigma":164,"kev":0},{"id":"T1685.001","name":"Disable or Modify Windows Event Log","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":28,"kev":0},{"id":"T1685.002","name":"Disable or Modify Cloud Log","tactics":["defense-impairment"],"ds":1,"an":4,"sigma":3,"kev":0},{"id":"T1685.003","name":"Modify or Spoof Tool UI","tactics":["defense-impairment"],"ds":1,"an":3,"sigma":0,"kev":0},{"id":"T1685.004","name":"Disable or Modify Linux Audit System Log","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":1,"kev":0},{"id":"T1685.005","name":"Clear Windows Event Logs","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":8,"kev":0},{"id":"T1685.006","name":"Clear Linux or Mac System Logs","tactics":["defense-impairment"],"ds":1,"an":2,"sigma":4,"kev":0},{"id":"T1686","name":"Disable or Modify System Firewall","tactics":["defense-impairment"],"ds":1,"an":5,"sigma":7,"kev":0},{"id":"T1686.001","name":"Cloud Firewall","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":5,"kev":0},{"id":"T1686.002","name":"Network Device Firewall","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":2,"kev":0},{"id":"T1686.003","name":"Windows Host Firewall","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":20,"kev":0},{"id":"T1687","name":"Exploitation for Defense Impairment","tactics":["defense-impairment"],"ds":1,"an":5,"sigma":0,"kev":0},{"id":"T1688","name":"Safe Mode Boot","tactics":["defense-impairment"],"ds":1,"an":1,"sigma":0,"kev":0},{"id":"T1689","name":"Downgrade Attack","tactics":["defense-impairment"],"ds":1,"an":3,"sigma":1,"kev":0},{"id":"T1690","name":"Prevent Command History Logging","tactics":["defense-impairment"],"ds":1,"an":5,"sigma":1,"kev":0}]}