ATT&CK Techniques

T1595 Active Scanning5 T1598 Phishing for Information5 T1589 Gather Victim Identity Information4 T1591 Gather Victim Org Information3 T1590 Gather Victim Network Information1 T1596 Search Open Technical Databases1 T1682 Query Public AI Services1

T1588 Obtain Capabilities20 T1583 Acquire Infrastructure17 T1584 Compromise Infrastructure9 T1587 Develop Capabilities8 T1585 Establish Accounts7 T1608 Stage Capabilities7 T1586 Compromise Accounts3

T1566 Phishing34 T1078 Valid Accounts16 T1189 Drive-by Compromise14 T1190 Exploit Public-Facing Application11 T1133 External Remote Services7 T1195 Supply Chain Compromise4 T1199 Trusted Relationship4 T1091 Replication Through Removable Media3 T1669 Wi-Fi Networks1

T1204 User Execution32 T1059 Command and Scripting Interpreter30 T1203 Exploitation for Client Execution21 T1053 Scheduled Task/Job20 T1047 Windows Management Instrumentation12 T1574 Hijack Execution Flow12 T1106 Native API6 T1559 Inter-Process Communication6 T1569 System Services4 T1197 BITS Jobs2 T1072 Software Deployment Tools1 T1651 Cloud Administration Command1

T1547 Boot or Logon Autostart Execution22 T1053 Scheduled Task/Job20 T1078 Valid Accounts16 T1112 Modify Registry9 T1546 Event Triggered Execution8 T1133 External Remote Services7 T1505 Server Software Component7 T1543 Create or Modify System Process7 T1098 Account Manipulation5 T1136 Create Account5 T1137 Office Application Startup4 T1037 Boot or Logon Initialization Scripts2 T1197 BITS Jobs2 T1542 Pre-OS Boot2 T1556 Modify Authentication Process2

T1547 Boot or Logon Autostart Execution22 T1053 Scheduled Task/Job20 T1078 Valid Accounts16 T1055 Process Injection8 T1546 Event Triggered Execution8 T1068 Exploitation for Privilege Escalation7 T1543 Create or Modify System Process7 T1548 Abuse Elevation Control Mechanism6 T1098 Account Manipulation5 T1134 Access Token Manipulation3 T1037 Boot or Logon Initialization Scripts2

T1036 Masquerading25 T1027 Obfuscated Files or Information24 T1078 Valid Accounts16 T1218 System Binary Proxy Execution15 T1140 Deobfuscate/Decode Files or Information13 T1574 Hijack Execution Flow12 T1070 Indicator Removal10 T1564 Hide Artifacts9 T1055 Process Injection8 T1134 Access Token Manipulation3 T1221 Template Injection3 T1684 Social Engineering3 T1014 Rootkit2 T1197 BITS Jobs2 T1542 Pre-OS Boot2 T1211 Exploitation for Stealth1 T1216 System Script Proxy Execution1 T1220 XSL Script Processing1

T1553 Subvert Trust Controls10 T1685 Disable or Modify Tools10 T1112 Modify Registry9 T1222 File and Directory Permissions Modification2 T1556 Modify Authentication Process2 T1686 Disable or Modify System Firewall2

T1003 OS Credential Dumping21 T1056 Input Capture10 T1555 Credentials from Password Stores10 T1110 Brute Force6 T1552 Unsecured Credentials6 T1557 Adversary-in-the-Middle3 T1040 Network Sniffing2 T1528 Steal Application Access Token2 T1539 Steal Web Session Cookie2 T1556 Modify Authentication Process2 T1558 Steal or Forge Kerberos Tickets2 T1111 Multi-Factor Authentication Interception1 T1187 Forced Authentication1 T1621 Multi-Factor Authentication Request Generation1 T1649 Steal or Forge Authentication Certificates1 T1697 Steal Application Specific Passwords1

T1016 System Network Configuration Discovery20 T1083 File and Directory Discovery18 T1087 Account Discovery17 T1082 System Information Discovery16 T1057 Process Discovery14 T1018 Remote System Discovery13 T1049 System Network Connections Discovery12 T1033 System Owner/User Discovery11 T1518 Software Discovery10 T1069 Permission Groups Discovery9 T1007 System Service Discovery6 T1012 Query Registry6 T1135 Network Share Discovery6 T1046 Network Service Discovery5 T1124 System Time Discovery5 T1120 Peripheral Device Discovery4 T1040 Network Sniffing2 T1482 Domain Trust Discovery2

T1021 Remote Services14 T1210 Exploitation of Remote Services8 T1550 Use Alternate Authentication Material6 T1570 Lateral Tool Transfer4 T1091 Replication Through Removable Media3 T1080 Taint Shared Content2 T1534 Internal Spearphishing2 T1072 Software Deployment Tools1 T1563 Remote Service Session Hijacking1

T1560 Archive Collected Data19 T1005 Data from Local System15 T1074 Data Staged11 T1056 Input Capture10 T1119 Automated Collection6 T1113 Screen Capture5 T1114 Email Collection5 T1039 Data from Network Shared Drive4 T1213 Data from Information Repositories3 T1557 Adversary-in-the-Middle3 T1025 Data from Removable Media2 T1123 Audio Capture1 T1530 Data from Cloud Storage1

T1105 Ingress Tool Transfer24 T1071 Application Layer Protocol19 T1090 Proxy13 T1102 Web Service10 T1573 Encrypted Channel9 T1132 Data Encoding4 T1568 Dynamic Resolution4 T1001 Data Obfuscation3 T1571 Non-Standard Port3 T1095 Non-Application Layer Protocol2 T1104 Multi-Stage Channels2 T1092 Communication Through Removable Media1 T1219 Remote Access Tools1 T1572 Protocol Tunneling1 T1665 Hide Infrastructure1

T1567 Exfiltration Over Web Service8 T1041 Exfiltration Over C2 Channel7 T1048 Exfiltration Over Alternative Protocol4 T1020 Automated Exfiltration2 T1030 Data Transfer Size Limits2 T1029 Scheduled Transfer1

T1486 Data Encrypted for Impact2 T1489 Service Stop1 T1490 Inhibit System Recovery1 T1498 Network Denial of Service1 T1529 System Shutdown/Reboot1 T1561 Disk Wipe1