ATT&CK Techniques against India

T1589 Gather Victim Identity Information1 T1590 Gather Victim Network Information1 T1591 Gather Victim Org Information1 T1595 Active Scanning1 T1598 Phishing for Information1

T1588 Obtain Capabilities11 T1583 Acquire Infrastructure10 T1587 Develop Capabilities6 T1585 Establish Accounts4 T1584 Compromise Infrastructure3 T1608 Stage Capabilities3 T1586 Compromise Accounts1

T1566 Phishing15 T1078 Valid Accounts9 T1190 Exploit Public-Facing Application6 T1133 External Remote Services4 T1189 Drive-by Compromise4 T1195 Supply Chain Compromise3 T1199 Trusted Relationship3

T1204 User Execution14 T1059 Command and Scripting Interpreter12 T1053 Scheduled Task/Job9 T1047 Windows Management Instrumentation7 T1203 Exploitation for Client Execution5 T1574 Hijack Execution Flow5 T1106 Native API4 T1569 System Services3 T1559 Inter-Process Communication2 T1197 BITS Jobs1 T1651 Cloud Administration Command1

T1053 Scheduled Task/Job9 T1078 Valid Accounts9 T1547 Boot or Logon Autostart Execution9 T1112 Modify Registry4 T1133 External Remote Services4 T1136 Create Account3 T1543 Create or Modify System Process3 T1137 Office Application Startup2 T1505 Server Software Component2 T1546 Event Triggered Execution2 T1037 Boot or Logon Initialization Scripts1 T1098 Account Manipulation1 T1197 BITS Jobs1 T1542 Pre-OS Boot1 T1556 Modify Authentication Process1

T1053 Scheduled Task/Job9 T1078 Valid Accounts9 T1547 Boot or Logon Autostart Execution9 T1055 Process Injection5 T1068 Exploitation for Privilege Escalation3 T1543 Create or Modify System Process3 T1548 Abuse Elevation Control Mechanism3 T1546 Event Triggered Execution2 T1037 Boot or Logon Initialization Scripts1 T1098 Account Manipulation1 T1134 Access Token Manipulation1

T1027 Obfuscated Files or Information12 T1036 Masquerading10 T1078 Valid Accounts9 T1140 Deobfuscate/Decode Files or Information7 T1218 System Binary Proxy Execution7 T1055 Process Injection5 T1574 Hijack Execution Flow5 T1070 Indicator Removal4 T1564 Hide Artifacts3 T1014 Rootkit1 T1134 Access Token Manipulation1 T1197 BITS Jobs1 T1221 Template Injection1 T1480 Execution Guardrails1 T1542 Pre-OS Boot1 T1684 Social Engineering1

T1553 Subvert Trust Controls7 T1685 Disable or Modify Tools6 T1112 Modify Registry4 T1222 File and Directory Permissions Modification1 T1556 Modify Authentication Process1 T1686 Disable or Modify System Firewall1

T1003 OS Credential Dumping10 T1555 Credentials from Password Stores6 T1056 Input Capture3 T1552 Unsecured Credentials3 T1110 Brute Force2 T1557 Adversary-in-the-Middle2 T1558 Steal or Forge Kerberos Tickets2 T1528 Steal Application Access Token1 T1556 Modify Authentication Process1 T1621 Multi-Factor Authentication Request Generation1 T1649 Steal or Forge Authentication Certificates1

T1016 System Network Configuration Discovery10 T1087 Account Discovery10 T1018 Remote System Discovery7 T1049 System Network Connections Discovery7 T1057 Process Discovery7 T1082 System Information Discovery7 T1083 File and Directory Discovery7 T1518 Software Discovery6 T1033 System Owner/User Discovery5 T1069 Permission Groups Discovery5 T1007 System Service Discovery3 T1012 Query Registry3 T1046 Network Service Discovery3 T1120 Peripheral Device Discovery2 T1135 Network Share Discovery2 T1124 System Time Discovery1 T1201 Password Policy Discovery1 T1217 Browser Information Discovery1

T1021 Remote Services8 T1210 Exploitation of Remote Services4 T1550 Use Alternate Authentication Material3 T1570 Lateral Tool Transfer2 T1534 Internal Spearphishing1

T1005 Data from Local System9 T1560 Archive Collected Data8 T1074 Data Staged5 T1119 Automated Collection4 T1056 Input Capture3 T1114 Email Collection3 T1213 Data from Information Repositories2 T1557 Adversary-in-the-Middle2 T1025 Data from Removable Media1 T1039 Data from Network Shared Drive1 T1113 Screen Capture1

T1105 Ingress Tool Transfer12 T1071 Application Layer Protocol9 T1090 Proxy5 T1102 Web Service3 T1568 Dynamic Resolution3 T1573 Encrypted Channel3 T1095 Non-Application Layer Protocol1 T1104 Multi-Stage Channels1 T1132 Data Encoding1 T1219 Remote Access Tools1 T1571 Non-Standard Port1 T1665 Hide Infrastructure1

T1567 Exfiltration Over Web Service5 T1041 Exfiltration Over C2 Channel3 T1020 Automated Exfiltration1 T1030 Data Transfer Size Limits1 T1048 Exfiltration Over Alternative Protocol1

T1486 Data Encrypted for Impact2 T1489 Service Stop1 T1490 Inhibit System Recovery1