ATT&CK Techniques against Japan

T1595 Active Scanning4 T1591 Gather Victim Org Information3 T1598 Phishing for Information3 T1589 Gather Victim Identity Information2 T1596 Search Open Technical Databases1

T1583 Acquire Infrastructure11 T1588 Obtain Capabilities11 T1584 Compromise Infrastructure6 T1608 Stage Capabilities5 T1585 Establish Accounts3 T1586 Compromise Accounts2 T1587 Develop Capabilities2

T1566 Phishing17 T1078 Valid Accounts8 T1189 Drive-by Compromise8 T1190 Exploit Public-Facing Application7 T1133 External Remote Services5 T1199 Trusted Relationship4 T1195 Supply Chain Compromise3 T1091 Replication Through Removable Media2 T1669 Wi-Fi Networks1

T1204 User Execution15 T1059 Command and Scripting Interpreter14 T1203 Exploitation for Client Execution11 T1053 Scheduled Task/Job10 T1047 Windows Management Instrumentation6 T1574 Hijack Execution Flow6 T1106 Native API4 T1559 Inter-Process Communication3 T1569 System Services2 T1197 BITS Jobs1 T1651 Cloud Administration Command1

T1547 Boot or Logon Autostart Execution11 T1053 Scheduled Task/Job10 T1078 Valid Accounts8 T1112 Modify Registry6 T1133 External Remote Services5 T1505 Server Software Component5 T1098 Account Manipulation4 T1543 Create or Modify System Process4 T1136 Create Account3 T1546 Event Triggered Execution3 T1037 Boot or Logon Initialization Scripts2 T1137 Office Application Startup1 T1197 BITS Jobs1 T1542 Pre-OS Boot1 T1556 Modify Authentication Process1

T1547 Boot or Logon Autostart Execution11 T1053 Scheduled Task/Job10 T1078 Valid Accounts8 T1055 Process Injection5 T1548 Abuse Elevation Control Mechanism5 T1068 Exploitation for Privilege Escalation4 T1098 Account Manipulation4 T1543 Create or Modify System Process4 T1546 Event Triggered Execution3 T1037 Boot or Logon Initialization Scripts2 T1134 Access Token Manipulation2

T1027 Obfuscated Files or Information12 T1036 Masquerading11 T1140 Deobfuscate/Decode Files or Information9 T1078 Valid Accounts8 T1070 Indicator Removal7 T1218 System Binary Proxy Execution6 T1574 Hijack Execution Flow6 T1055 Process Injection5 T1564 Hide Artifacts3 T1014 Rootkit2 T1134 Access Token Manipulation2 T1221 Template Injection2 T1197 BITS Jobs1 T1211 Exploitation for Stealth1 T1220 XSL Script Processing1 T1497 Virtualization/Sandbox Evasion1 T1542 Pre-OS Boot1 T1684 Social Engineering1

T1553 Subvert Trust Controls7 T1685 Disable or Modify Tools7 T1112 Modify Registry6 T1222 File and Directory Permissions Modification1 T1556 Modify Authentication Process1 T1686 Disable or Modify System Firewall1

T1003 OS Credential Dumping12 T1056 Input Capture5 T1555 Credentials from Password Stores4 T1110 Brute Force3 T1528 Steal Application Access Token2 T1552 Unsecured Credentials2 T1557 Adversary-in-the-Middle2 T1040 Network Sniffing1 T1187 Forced Authentication1 T1539 Steal Web Session Cookie1 T1556 Modify Authentication Process1 T1558 Steal or Forge Kerberos Tickets1 T1621 Multi-Factor Authentication Request Generation1 T1649 Steal or Forge Authentication Certificates1

T1016 System Network Configuration Discovery11 T1087 Account Discovery9 T1018 Remote System Discovery7 T1057 Process Discovery7 T1083 File and Directory Discovery7 T1033 System Owner/User Discovery6 T1049 System Network Connections Discovery5 T1082 System Information Discovery5 T1135 Network Share Discovery4 T1007 System Service Discovery3 T1012 Query Registry3 T1046 Network Service Discovery3 T1069 Permission Groups Discovery3 T1124 System Time Discovery3 T1518 Software Discovery3 T1120 Peripheral Device Discovery2 T1482 Domain Trust Discovery2 T1040 Network Sniffing1

T1021 Remote Services8 T1210 Exploitation of Remote Services7 T1550 Use Alternate Authentication Material5 T1080 Taint Shared Content2 T1091 Replication Through Removable Media2 T1563 Remote Service Session Hijacking1 T1570 Lateral Tool Transfer1

T1005 Data from Local System10 T1560 Archive Collected Data10 T1074 Data Staged6 T1056 Input Capture5 T1114 Email Collection4 T1119 Automated Collection4 T1039 Data from Network Shared Drive3 T1113 Screen Capture3 T1557 Adversary-in-the-Middle2 T1025 Data from Removable Media1 T1123 Audio Capture1 T1213 Data from Information Repositories1

T1105 Ingress Tool Transfer13 T1071 Application Layer Protocol9 T1090 Proxy7 T1573 Encrypted Channel5 T1102 Web Service4 T1568 Dynamic Resolution4 T1001 Data Obfuscation3 T1092 Communication Through Removable Media1 T1132 Data Encoding1 T1665 Hide Infrastructure1

T1567 Exfiltration Over Web Service4 T1030 Data Transfer Size Limits2 T1041 Exfiltration Over C2 Channel2 T1048 Exfiltration Over Alternative Protocol2 T1029 Scheduled Transfer1

T1486 Data Encrypted for Impact2 T1489 Service Stop1 T1490 Inhibit System Recovery1 T1498 Network Denial of Service1 T1529 System Shutdown/Reboot1 T1561 Disk Wipe1