ATT&CK Techniques against South Korea

T1589 Gather Victim Identity Information1 T1591 Gather Victim Org Information1 T1595 Active Scanning1 T1598 Phishing for Information1

T1588 Obtain Capabilities7 T1583 Acquire Infrastructure6 T1587 Develop Capabilities3 T1608 Stage Capabilities3 T1585 Establish Accounts2 T1586 Compromise Accounts1

T1566 Phishing13 T1078 Valid Accounts6 T1189 Drive-by Compromise4 T1190 Exploit Public-Facing Application3 T1199 Trusted Relationship3 T1133 External Remote Services2 T1195 Supply Chain Compromise2 T1091 Replication Through Removable Media1

T1204 User Execution13 T1059 Command and Scripting Interpreter9 T1053 Scheduled Task/Job8 T1203 Exploitation for Client Execution7 T1574 Hijack Execution Flow5 T1047 Windows Management Instrumentation4 T1106 Native API3 T1559 Inter-Process Communication2 T1569 System Services1 T1651 Cloud Administration Command1

T1053 Scheduled Task/Job8 T1547 Boot or Logon Autostart Execution8 T1078 Valid Accounts6 T1505 Server Software Component3 T1112 Modify Registry2 T1133 External Remote Services2 T1546 Event Triggered Execution2 T1037 Boot or Logon Initialization Scripts1 T1098 Account Manipulation1 T1136 Create Account1 T1137 Office Application Startup1 T1543 Create or Modify System Process1 T1556 Modify Authentication Process1

T1053 Scheduled Task/Job8 T1547 Boot or Logon Autostart Execution8 T1078 Valid Accounts6 T1055 Process Injection4 T1068 Exploitation for Privilege Escalation4 T1548 Abuse Elevation Control Mechanism4 T1546 Event Triggered Execution2 T1037 Boot or Logon Initialization Scripts1 T1098 Account Manipulation1 T1543 Create or Modify System Process1

T1027 Obfuscated Files or Information10 T1036 Masquerading6 T1078 Valid Accounts6 T1140 Deobfuscate/Decode Files or Information6 T1574 Hijack Execution Flow5 T1055 Process Injection4 T1070 Indicator Removal4 T1218 System Binary Proxy Execution3 T1014 Rootkit1 T1497 Virtualization/Sandbox Evasion1

T1553 Subvert Trust Controls5 T1685 Disable or Modify Tools4 T1112 Modify Registry2 T1556 Modify Authentication Process1

T1003 OS Credential Dumping8 T1056 Input Capture4 T1555 Credentials from Password Stores4 T1110 Brute Force2 T1552 Unsecured Credentials2 T1040 Network Sniffing1 T1528 Steal Application Access Token1 T1556 Modify Authentication Process1 T1557 Adversary-in-the-Middle1 T1621 Multi-Factor Authentication Request Generation1 T1649 Steal or Forge Authentication Certificates1

T1016 System Network Configuration Discovery6 T1087 Account Discovery5 T1018 Remote System Discovery4 T1083 File and Directory Discovery4 T1033 System Owner/User Discovery3 T1046 Network Service Discovery3 T1057 Process Discovery3 T1082 System Information Discovery3 T1518 Software Discovery3 T1049 System Network Connections Discovery2 T1069 Permission Groups Discovery2 T1124 System Time Discovery2 T1007 System Service Discovery1 T1012 Query Registry1 T1040 Network Sniffing1 T1120 Peripheral Device Discovery1 T1135 Network Share Discovery1 T1217 Browser Information Discovery1

T1021 Remote Services3 T1210 Exploitation of Remote Services3 T1080 Taint Shared Content2 T1550 Use Alternate Authentication Material2 T1091 Replication Through Removable Media1

T1005 Data from Local System5 T1056 Input Capture4 T1560 Archive Collected Data4 T1039 Data from Network Shared Drive2 T1074 Data Staged2 T1119 Automated Collection2 T1113 Screen Capture1 T1114 Email Collection1 T1123 Audio Capture1 T1557 Adversary-in-the-Middle1

T1105 Ingress Tool Transfer11 T1071 Application Layer Protocol6 T1573 Encrypted Channel4 T1090 Proxy3 T1568 Dynamic Resolution3 T1102 Web Service2 T1132 Data Encoding2 T1571 Non-Standard Port1 T1665 Hide Infrastructure1

T1030 Data Transfer Size Limits1 T1048 Exfiltration Over Alternative Protocol1 T1567 Exfiltration Over Web Service1

T1486 Data Encrypted for Impact2 T1529 System Shutdown/Reboot1 T1561 Disk Wipe1