data.json

{
    "T1531": {
        "Tactic": [
            "impact"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "root",
            "SYSTEM"
        ],
        "Data Sources": [
            "Windows event logs",
            "Process command-line parameters",
            "Process monitoring"
        ],
        "name": "Account Access Removal"
    },
    "T1506": {
        "Tactic": [
            "defense-evasion",
            "lateral-movement"
        ],
        "Platform": [
            "Office 365",
            "SaaS"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Authentication logs",
            "Office 365 account logs"
        ],
        "name": "Web Session Cookie"
    },
    "T1539": {
        "Tactic": [
            "credential-access"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows",
            "Office 365",
            "SaaS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "File monitoring",
            "API monitoring"
        ],
        "name": "Steal Web Session Cookie"
    },
    "T1529": {
        "Tactic": [
            "impact"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "root",
            "SYSTEM"
        ],
        "Data Sources": [
            "Windows event logs",
            "Process command-line parameters",
            "Process monitoring"
        ],
        "name": "System Shutdown/Reboot"
    },
    "T1519": {
        "Tactic": [
            "persistence",
            "privilege-escalation"
        ],
        "Platform": [
            "macOS"
        ],
        "Permissions Required": [
            "Administrator"
        ],
        "Data Sources": [
            "File monitoring",
            "API monitoring"
        ],
        "name": "Emond"
    },
    "T1518": {
        "Tactic": [
            "discovery"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "Process command-line parameters",
            "Process monitoring",
            "File monitoring"
        ],
        "name": "Software Discovery"
    },
    "T1534": {
        "Tactic": [
            "lateral-movement"
        ],
        "Platform": [
            "Windows",
            "macOS",
            "Linux",
            "Office 365",
            "SaaS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "SSL/TLS inspection",
            "DNS records",
            "Anti-virus",
            "Web proxy",
            "File monitoring",
            "Mail server",
            "Office 365 trace logs"
        ],
        "name": "Internal Spearphishing"
    },
    "T1528": {
        "Tactic": [
            "credential-access"
        ],
        "Platform": [
            "SaaS",
            "Office 365",
            "Azure AD"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Azure activity logs",
            "OAuth audit logs"
        ],
        "name": "Steal Application Access Token"
    },
    "T1522": {
        "Tactic": [
            "credential-access"
        ],
        "Platform": [
            "AWS",
            "GCP",
            "Azure"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Azure activity logs",
            "AWS CloudTrail logs",
            "Authentication logs"
        ],
        "name": "Cloud Instance Metadata API"
    },
    "T1536": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "AWS",
            "GCP",
            "Azure"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "Azure OS logs",
            "AWS CloudTrail logs",
            "Azure activity logs",
            "Stackdriver logs",
            "AWS OS logs"
        ],
        "name": "Revert Cloud Instance"
    },
    "T1535": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "AWS",
            "GCP",
            "Azure"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Stackdriver logs",
            "Azure activity logs",
            "AWS CloudTrail logs"
        ],
        "name": "Unused/Unsupported Cloud Regions"
    },
    "T1525": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "GCP",
            "Azure",
            "AWS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [],
        "name": "Implant Container Image"
    },
    "T1538": {
        "Tactic": [
            "discovery"
        ],
        "Platform": [
            "AWS",
            "GCP",
            "Azure",
            "Azure AD",
            "Office 365"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Office 365 audit logs",
            "Azure activity logs",
            "Stackdriver logs",
            "AWS CloudTrail logs"
        ],
        "name": "Cloud Service Dashboard"
    },
    "T1530": {
        "Tactic": [
            "collection"
        ],
        "Platform": [
            "AWS",
            "GCP",
            "Azure"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Stackdriver logs",
            "Azure activity logs",
            "AWS CloudTrail logs"
        ],
        "name": "Data from Cloud Storage Object"
    },
    "T1537": {
        "Tactic": [
            "exfiltration"
        ],
        "Platform": [
            "Azure",
            "AWS",
            "GCP"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Stackdriver logs",
            "Azure activity logs",
            "AWS CloudTrail logs"
        ],
        "name": "Transfer Data to Cloud Account"
    },
    "T1526": {
        "Tactic": [
            "discovery"
        ],
        "Platform": [
            "AWS",
            "GCP",
            "Azure",
            "Azure AD",
            "Office 365",
            "SaaS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Azure activity logs",
            "Stackdriver logs",
            "AWS CloudTrail logs"
        ],
        "name": "Cloud Service Discovery"
    },
    "T1527": {
        "Tactic": [
            "defense-evasion",
            "lateral-movement"
        ],
        "Platform": [
            "SaaS",
            "Office 365"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "OAuth audit logs",
            "Office 365 account logs"
        ],
        "name": "Application Access Token"
    },
    "T1514": {
        "Tactic": [
            "privilege-escalation"
        ],
        "Platform": [
            "macOS"
        ],
        "Permissions Required": [
            "Administrator",
            "User"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "API monitoring"
        ],
        "name": "Elevated Execution with Prompt"
    },
    "T1505": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "Windows",
            "Linux"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM",
            "root"
        ],
        "Data Sources": [
            "File monitoring",
            "Application logs"
        ],
        "name": "Server Software Component"
    },
    "T1503": {
        "Tactic": [
            "credential-access"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Process monitoring",
            "PowerShell logs",
            "File monitoring",
            "API monitoring"
        ],
        "name": "Credentials from Web Browsers"
    },
    "T1504": {
        "Tactic": [
            "persistence",
            "privilege-escalation"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "Process monitoring",
            "File monitoring",
            "PowerShell logs"
        ],
        "name": "PowerShell Profile"
    },
    "T1502": {
        "Tactic": [
            "defense-evasion",
            "privilege-escalation"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "Windows event logs",
            "Process monitoring",
            "API monitoring"
        ],
        "name": "Parent PID Spoofing"
    },
    "T1500": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Process command-line parameters",
            "Process monitoring",
            "File monitoring"
        ],
        "name": "Compile After Delivery"
    },
    "T1501": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "Linux"
        ],
        "Permissions Required": [
            "root",
            "User"
        ],
        "Data Sources": [
            "Process command-line parameters",
            "Process monitoring",
            "File monitoring"
        ],
        "name": "Systemd Service"
    },
    "T1499": {
        "Tactic": [
            "impact"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "SSL/TLS inspection",
            "Web logs",
            "Web application firewall logs",
            "Network intrusion detection system",
            "Network protocol analysis",
            "Network device logs",
            "Netflow/Enclave netflow"
        ],
        "name": "Endpoint Denial of Service"
    },
    "T1497": {
        "Tactic": [
            "defense-evasion",
            "discovery"
        ],
        "Platform": [
            "Windows",
            "macOS"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Virtualization/Sandbox Evasion"
    },
    "T1498": {
        "Tactic": [
            "impact"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Sensor health and status",
            "Network protocol analysis",
            "Netflow/Enclave netflow",
            "Network intrusion detection system",
            "Network device logs"
        ],
        "name": "Network Denial of Service"
    },
    "T1496": {
        "Tactic": [
            "impact"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows",
            "AWS",
            "GCP",
            "Azure"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "Azure activity logs",
            "Stackdriver logs",
            "AWS CloudTrail logs",
            "Process use of network",
            "Process monitoring",
            "Network protocol analysis",
            "Network device logs"
        ],
        "name": "Resource Hijacking"
    },
    "T1495": {
        "Tactic": [
            "impact"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "root",
            "SYSTEM"
        ],
        "Data Sources": [
            "BIOS",
            "Component firmware"
        ],
        "name": "Firmware Corruption"
    },
    "T1494": {
        "Tactic": [
            "impact"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "root",
            "SYSTEM"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring"
        ],
        "name": "Runtime Data Manipulation"
    },
    "T1493": {
        "Tactic": [
            "impact"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "root",
            "SYSTEM"
        ],
        "Data Sources": [
            "Packet capture",
            "Network protocol analysis"
        ],
        "name": "Transmitted Data Manipulation"
    },
    "T1492": {
        "Tactic": [
            "impact"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "root",
            "SYSTEM"
        ],
        "Data Sources": [
            "Application logs",
            "File monitoring"
        ],
        "name": "Stored Data Manipulation"
    },
    "T1491": {
        "Tactic": [
            "impact"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Packet capture",
            "Web application firewall logs",
            "Web logs",
            "Packet capture"
        ],
        "name": "Defacement"
    },
    "T1490": {
        "Tactic": [
            "impact"
        ],
        "Platform": [
            "Windows",
            "macOS",
            "Linux"
        ],
        "Permissions Required": [
            "Administrator",
            "root",
            "SYSTEM",
            "User"
        ],
        "Data Sources": [
            "Windows Registry",
            "Services",
            "Windows event logs",
            "Process command-line parameters",
            "Process monitoring"
        ],
        "name": "Inhibit System Recovery"
    },
    "T1489": {
        "Tactic": [
            "impact"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM",
            "User"
        ],
        "Data Sources": [
            "Process command-line parameters",
            "Process monitoring",
            "Windows Registry",
            "API monitoring"
        ],
        "name": "Service Stop"
    },
    "T1488": {
        "Tactic": [
            "impact"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "root",
            "SYSTEM"
        ],
        "Data Sources": [
            "Kernel drivers",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Disk Content Wipe"
    },
    "T1487": {
        "Tactic": [
            "impact"
        ],
        "Platform": [
            "Windows",
            "macOS",
            "Linux"
        ],
        "Permissions Required": [
            "Administrator",
            "root",
            "SYSTEM"
        ],
        "Data Sources": [
            "Kernel drivers",
            "MBR"
        ],
        "name": "Disk Structure Wipe"
    },
    "T1486": {
        "Tactic": [
            "impact"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "root",
            "SYSTEM"
        ],
        "Data Sources": [
            "Kernel drivers",
            "File monitoring",
            "Process command-line parameters",
            "Process monitoring"
        ],
        "name": "Data Encrypted for Impact"
    },
    "T1485": {
        "Tactic": [
            "impact"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "root",
            "SYSTEM"
        ],
        "Data Sources": [
            "File monitoring",
            "Process command-line parameters",
            "Process monitoring"
        ],
        "name": "Data Destruction"
    },
    "T1484": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "User"
        ],
        "Data Sources": [
            "Windows event logs"
        ],
        "name": "Group Policy Modification"
    },
    "T1483": {
        "Tactic": [
            "command-and-control"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Process use of network",
            "Packet capture",
            "Network device logs",
            "Netflow/Enclave netflow",
            "DNS records"
        ],
        "name": "Domain Generation Algorithms"
    },
    "T1482": {
        "Tactic": [
            "discovery"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "PowerShell logs",
            "API monitoring",
            "Process command-line parameters",
            "Process monitoring"
        ],
        "name": "Domain Trust Discovery"
    },
    "T1480": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Process monitoring"
        ],
        "name": "Execution Guardrails"
    },
    "T1222": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Linux",
            "Windows",
            "macOS"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "SYSTEM",
            "root"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters",
            "Windows event logs"
        ],
        "name": "File and Directory Permissions Modification"
    },
    "T1223": {
        "Tactic": [
            "defense-evasion",
            "execution"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Compiled HTML File"
    },
    "T1221": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Anti-virus",
            "Email gateway",
            "Network intrusion detection system",
            "Web logs"
        ],
        "name": "Template Injection"
    },
    "T1220": {
        "Tactic": [
            "defense-evasion",
            "execution"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Process monitoring",
            "Process command-line parameters",
            "Process use of network",
            "DLL monitoring"
        ],
        "name": "XSL Script Processing"
    },
    "T1217": {
        "Tactic": [
            "discovery"
        ],
        "Platform": [
            "Linux",
            "Windows",
            "macOS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "API monitoring",
            "File monitoring",
            "Process command-line parameters",
            "Process monitoring"
        ],
        "name": "Browser Bookmark Discovery"
    },
    "T1213": {
        "Tactic": [
            "collection"
        ],
        "Platform": [
            "Linux",
            "Windows",
            "macOS",
            "SaaS",
            "AWS",
            "GCP",
            "Azure"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Azure activity logs",
            "AWS CloudTrail logs",
            "Stackdriver logs",
            "OAuth audit logs",
            "Application logs",
            "Authentication logs",
            "Data loss prevention",
            "Third-party application logs"
        ],
        "name": "Data from Information Repositories"
    },
    "T1190": {
        "Tactic": [
            "initial-access"
        ],
        "Platform": [
            "Linux",
            "Windows",
            "macOS",
            "AWS",
            "GCP",
            "Azure"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Azure activity logs",
            "AWS CloudTrail logs",
            "Stackdriver logs",
            "Packet capture",
            "Web logs",
            "Web application firewall logs",
            "Application logs"
        ],
        "name": "Exploit Public-Facing Application"
    },
    "T1210": {
        "Tactic": [
            "lateral-movement"
        ],
        "Platform": [
            "Linux",
            "Windows",
            "macOS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Windows Error Reporting",
            "Process monitoring",
            "File monitoring"
        ],
        "name": "Exploitation of Remote Services"
    },
    "T1200": {
        "Tactic": [
            "initial-access"
        ],
        "Platform": [
            "Windows",
            "Linux",
            "macOS"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Asset management",
            "Data loss prevention"
        ],
        "name": "Hardware Additions"
    },
    "T1202": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters",
            "Windows event logs"
        ],
        "name": "Indirect Command Execution"
    },
    "T1194": {
        "Tactic": [
            "initial-access"
        ],
        "Platform": [
            "Windows",
            "macOS",
            "Linux"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "SSL/TLS inspection",
            "Anti-virus",
            "Web proxy"
        ],
        "name": "Spearphishing via Service"
    },
    "T1209": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "API monitoring",
            "Binary file metadata",
            "DLL monitoring",
            "File monitoring",
            "Loaded DLLs",
            "Process monitoring"
        ],
        "name": "Time Providers"
    },
    "T1199": {
        "Tactic": [
            "initial-access"
        ],
        "Platform": [
            "Linux",
            "Windows",
            "macOS",
            "AWS",
            "GCP",
            "Azure",
            "SaaS"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Azure activity logs",
            "Stackdriver logs",
            "AWS CloudTrail logs",
            "Application logs",
            "Authentication logs",
            "Third-party application logs"
        ],
        "name": "Trusted Relationship"
    },
    "T1191": {
        "Tactic": [
            "defense-evasion",
            "execution"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Process monitoring",
            "Process command-line parameters",
            "Process use of network",
            "Windows event logs"
        ],
        "name": "CMSTP"
    },
    "T1207": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator"
        ],
        "Data Sources": [
            "API monitoring",
            "Authentication logs",
            "Network protocol analysis",
            "Packet capture"
        ],
        "name": "DCShadow"
    },
    "T1189": {
        "Tactic": [
            "initial-access"
        ],
        "Platform": [
            "Windows",
            "Linux",
            "macOS",
            "SaaS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Packet capture",
            "Network device logs",
            "Process use of network",
            "Web proxy",
            "Network intrusion detection system",
            "SSL/TLS inspection"
        ],
        "name": "Drive-by Compromise"
    },
    "T1211": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Linux",
            "Windows",
            "macOS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Windows Error Reporting",
            "Process monitoring",
            "File monitoring"
        ],
        "name": "Exploitation for Defense Evasion"
    },
    "T1218": {
        "Tactic": [
            "defense-evasion",
            "execution"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Signed Binary Proxy Execution"
    },
    "T1193": {
        "Tactic": [
            "initial-access"
        ],
        "Platform": [
            "Windows",
            "macOS",
            "Linux"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "File monitoring",
            "Packet capture",
            "Network intrusion detection system",
            "Detonation chamber",
            "Email gateway",
            "Mail server"
        ],
        "name": "Spearphishing Attachment"
    },
    "T1195": {
        "Tactic": [
            "initial-access"
        ],
        "Platform": [
            "Linux",
            "Windows",
            "macOS"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Web proxy",
            "File monitoring"
        ],
        "name": "Supply Chain Compromise"
    },
    "T1204": {
        "Tactic": [
            "execution"
        ],
        "Platform": [
            "Linux",
            "Windows",
            "macOS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Anti-virus",
            "Process command-line parameters",
            "Process monitoring"
        ],
        "name": "User Execution"
    },
    "T1196": {
        "Tactic": [
            "defense-evasion",
            "execution"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "API monitoring",
            "Binary file metadata",
            "DLL monitoring",
            "Windows Registry",
            "Windows event logs",
            "Process command-line parameters",
            "Process monitoring"
        ],
        "name": "Control Panel Items"
    },
    "T1212": {
        "Tactic": [
            "credential-access"
        ],
        "Platform": [
            "Linux",
            "Windows",
            "macOS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Authentication logs",
            "Windows Error Reporting",
            "Process monitoring"
        ],
        "name": "Exploitation for Credential Access"
    },
    "T1215": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "Linux",
            "macOS"
        ],
        "Permissions Required": [
            "root"
        ],
        "Data Sources": [
            "System calls",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Kernel Modules and Extensions"
    },
    "T1197": {
        "Tactic": [
            "defense-evasion",
            "persistence"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "API monitoring",
            "Packet capture",
            "Windows event logs"
        ],
        "name": "BITS Jobs"
    },
    "T1214": {
        "Tactic": [
            "credential-access"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "Windows Registry",
            "Process command-line parameters",
            "Process monitoring"
        ],
        "name": "Credentials in Registry"
    },
    "T1216": {
        "Tactic": [
            "defense-evasion",
            "execution"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Signed Script Proxy Execution"
    },
    "T1192": {
        "Tactic": [
            "initial-access"
        ],
        "Platform": [
            "Windows",
            "macOS",
            "Linux",
            "Office 365",
            "SaaS"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Packet capture",
            "Web proxy",
            "Email gateway",
            "Detonation chamber",
            "SSL/TLS inspection",
            "DNS records",
            "Mail server"
        ],
        "name": "Spearphishing Link"
    },
    "T1198": {
        "Tactic": [
            "defense-evasion",
            "persistence"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "API monitoring",
            "Application logs",
            "DLL monitoring",
            "Loaded DLLs",
            "Process monitoring",
            "Windows Registry",
            "Windows event logs"
        ],
        "name": "SIP and Trust Provider Hijacking"
    },
    "T1206": {
        "Tactic": [
            "privilege-escalation"
        ],
        "Platform": [
            "Linux",
            "macOS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "File monitoring",
            "Process command-line parameters"
        ],
        "name": "Sudo Caching"
    },
    "T1203": {
        "Tactic": [
            "execution"
        ],
        "Platform": [
            "Linux",
            "Windows",
            "macOS"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Anti-virus",
            "System calls",
            "Process monitoring"
        ],
        "name": "Exploitation for Client Execution"
    },
    "T1208": {
        "Tactic": [
            "credential-access"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Windows event logs"
        ],
        "name": "Kerberoasting"
    },
    "T1201": {
        "Tactic": [
            "discovery"
        ],
        "Platform": [
            "Windows",
            "Linux",
            "macOS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Process command-line parameters",
            "Process monitoring"
        ],
        "name": "Password Policy Discovery"
    },
    "T1205": {
        "Tactic": [
            "defense-evasion",
            "persistence",
            "command-and-control"
        ],
        "Platform": [
            "Linux",
            "macOS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Packet capture",
            "Netflow/Enclave netflow"
        ],
        "name": "Port Knocking"
    },
    "T1219": {
        "Tactic": [
            "command-and-control"
        ],
        "Platform": [
            "Linux",
            "Windows",
            "macOS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Network intrusion detection system",
            "Network protocol analysis",
            "Process use of network",
            "Process monitoring"
        ],
        "name": "Remote Access Tools"
    },
    "T1172": {
        "Tactic": [
            "command-and-control"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "SSL/TLS inspection",
            "Packet capture"
        ],
        "name": "Domain Fronting"
    },
    "T1173": {
        "Tactic": [
            "execution"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "API monitoring",
            "DLL monitoring",
            "Process monitoring",
            "Windows Registry",
            "Windows event logs"
        ],
        "name": "Dynamic Data Exchange"
    },
    "T1187": {
        "Tactic": [
            "credential-access"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "File monitoring",
            "Network protocol analysis",
            "Network device logs",
            "Process use of network"
        ],
        "name": "Forced Authentication"
    },
    "T1188": {
        "Tactic": [
            "command-and-control"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Network protocol analysis",
            "Netflow/Enclave netflow"
        ],
        "name": "Multi-hop Proxy"
    },
    "T1174": {
        "Tactic": [
            "credential-access"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "DLL monitoring",
            "Process monitoring",
            "Windows Registry"
        ],
        "name": "Password Filter DLL"
    },
    "T1175": {
        "Tactic": [
            "lateral-movement",
            "execution"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM",
            "User"
        ],
        "Data Sources": [
            "PowerShell logs",
            "API monitoring",
            "Authentication logs",
            "DLL monitoring",
            "Packet capture",
            "Process monitoring",
            "Windows Registry",
            "Windows event logs"
        ],
        "name": "Component Object Model and Distributed COM"
    },
    "T1170": {
        "Tactic": [
            "defense-evasion",
            "execution"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Mshta"
    },
    "T1179": {
        "Tactic": [
            "persistence",
            "privilege-escalation",
            "credential-access"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "API monitoring",
            "Binary file metadata",
            "DLL monitoring",
            "Loaded DLLs",
            "Process monitoring",
            "Windows event logs"
        ],
        "name": "Hooking"
    },
    "T1184": {
        "Tactic": [
            "lateral-movement"
        ],
        "Platform": [
            "Linux",
            "macOS"
        ],
        "Permissions Required": [
            "User",
            "root"
        ],
        "Data Sources": [
            "Authentication logs"
        ],
        "name": "SSH Hijacking"
    },
    "T1181": {
        "Tactic": [
            "defense-evasion",
            "privilege-escalation"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "API monitoring",
            "Process monitoring"
        ],
        "name": "Extra Window Memory Injection"
    },
    "T1177": {
        "Tactic": [
            "execution",
            "persistence"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "API monitoring",
            "DLL monitoring",
            "File monitoring",
            "Kernel drivers",
            "Loaded DLLs",
            "Process monitoring"
        ],
        "name": "LSASS Driver"
    },
    "T1182": {
        "Tactic": [
            "persistence",
            "privilege-escalation"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "Loaded DLLs",
            "Process monitoring",
            "Windows Registry"
        ],
        "name": "AppCert DLLs"
    },
    "T1176": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Network protocol analysis",
            "Packet capture",
            "System calls",
            "Process use of network",
            "Process monitoring",
            "Browser extensions"
        ],
        "name": "Browser Extensions"
    },
    "T1185": {
        "Tactic": [
            "collection"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "Authentication logs",
            "Packet capture",
            "Process monitoring",
            "API monitoring"
        ],
        "name": "Man in the Browser"
    },
    "T1180": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Process monitoring",
            "Process command-line parameters",
            "Windows Registry",
            "File monitoring"
        ],
        "name": "Screensaver"
    },
    "T1183": {
        "Tactic": [
            "privilege-escalation",
            "persistence",
            "defense-evasion"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "Process monitoring",
            "Windows Registry",
            "Windows event logs"
        ],
        "name": "Image File Execution Options Injection"
    },
    "T1171": {
        "Tactic": [
            "credential-access"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Windows event logs",
            "Windows Registry",
            "Packet capture",
            "Netflow/Enclave netflow"
        ],
        "name": "LLMNR/NBT-NS Poisoning and Relay"
    },
    "T1186": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM",
            "User"
        ],
        "Data Sources": [
            "API monitoring",
            "Process monitoring"
        ],
        "name": "Process Doppelg\u00e4nging"
    },
    "T1178": {
        "Tactic": [
            "privilege-escalation"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "API monitoring",
            "Authentication logs",
            "Windows event logs"
        ],
        "name": "SID-History Injection"
    },
    "T1138": {
        "Tactic": [
            "persistence",
            "privilege-escalation"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator"
        ],
        "Data Sources": [
            "Loaded DLLs",
            "System calls",
            "Windows Registry",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Application Shimming"
    },
    "T1140": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Deobfuscate/Decode Files or Information"
    },
    "T1149": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "macOS"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "Binary file metadata",
            "Malware reverse engineering",
            "Process monitoring"
        ],
        "name": "LC_MAIN Hijacking"
    },
    "T1152": {
        "Tactic": [
            "defense-evasion",
            "execution",
            "persistence"
        ],
        "Platform": [
            "macOS"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Launchctl"
    },
    "T1150": {
        "Tactic": [
            "defense-evasion",
            "persistence",
            "privilege-escalation"
        ],
        "Platform": [
            "macOS"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Plist Modification"
    },
    "T1163": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "macOS"
        ],
        "Permissions Required": [
            "root"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring"
        ],
        "name": "Rc.common"
    },
    "T1166": {
        "Tactic": [
            "privilege-escalation",
            "persistence"
        ],
        "Platform": [
            "Linux",
            "macOS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Setuid and Setgid"
    },
    "T1157": {
        "Tactic": [
            "persistence",
            "privilege-escalation"
        ],
        "Platform": [
            "macOS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "File monitoring"
        ],
        "name": "Dylib Hijacking"
    },
    "T1155": {
        "Tactic": [
            "execution",
            "lateral-movement"
        ],
        "Platform": [
            "macOS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "API monitoring",
            "System calls",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "AppleScript"
    },
    "T1136": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows",
            "AWS",
            "GCP",
            "Azure AD",
            "Azure",
            "Office 365"
        ],
        "Permissions Required": [
            "Administrator"
        ],
        "Data Sources": [
            "Office 365 account logs",
            "Azure activity logs",
            "AWS CloudTrail logs",
            "Process monitoring",
            "Process command-line parameters",
            "Authentication logs",
            "Windows event logs"
        ],
        "name": "Create Account"
    },
    "T1143": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Windows event logs",
            "PowerShell logs",
            "Process command-line parameters",
            "Process monitoring",
            "File monitoring"
        ],
        "name": "Hidden Window"
    },
    "T1141": {
        "Tactic": [
            "credential-access"
        ],
        "Platform": [
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Process monitoring",
            "Process command-line parameters",
            "User interface",
            "PowerShell logs"
        ],
        "name": "Input Prompt"
    },
    "T1142": {
        "Tactic": [
            "credential-access"
        ],
        "Platform": [
            "macOS"
        ],
        "Permissions Required": [
            "Administrator"
        ],
        "Data Sources": [
            "System calls",
            "Process monitoring"
        ],
        "name": "Keychain"
    },
    "T1159": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "macOS"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring"
        ],
        "name": "Launch Agent"
    },
    "T1135": {
        "Tactic": [
            "discovery"
        ],
        "Platform": [
            "macOS",
            "Windows",
            "AWS",
            "GCP",
            "Azure"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Process monitoring",
            "Process command-line parameters",
            "Network protocol analysis",
            "Process use of network"
        ],
        "name": "Network Share Discovery"
    },
    "T1148": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Linux",
            "macOS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Process monitoring",
            "Authentication logs",
            "File monitoring",
            "Environment variable"
        ],
        "name": "HISTCONTROL"
    },
    "T1161": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "macOS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Binary file metadata",
            "Process monitoring",
            "Process command-line parameters",
            "File monitoring"
        ],
        "name": "LC_LOAD_DYLIB Addition"
    },
    "T1154": {
        "Tactic": [
            "execution",
            "persistence"
        ],
        "Platform": [
            "Linux",
            "macOS"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Trap"
    },
    "T1134": {
        "Tactic": [
            "defense-evasion",
            "privilege-escalation"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "API monitoring",
            "Access tokens",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Access Token Manipulation"
    },
    "T1139": {
        "Tactic": [
            "credential-access"
        ],
        "Platform": [
            "Linux",
            "macOS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Bash History"
    },
    "T1147": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "macOS"
        ],
        "Permissions Required": [
            "Administrator",
            "root"
        ],
        "Data Sources": [
            "Authentication logs",
            "File monitoring"
        ],
        "name": "Hidden Users"
    },
    "T1156": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "Linux",
            "macOS"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters",
            "Process use of network"
        ],
        "name": ".bash_profile and .bashrc"
    },
    "T1146": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Linux",
            "macOS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Authentication logs",
            "File monitoring"
        ],
        "name": "Clear Command History"
    },
    "T1160": {
        "Tactic": [
            "persistence",
            "privilege-escalation"
        ],
        "Platform": [
            "macOS"
        ],
        "Permissions Required": [
            "Administrator"
        ],
        "Data Sources": [
            "Process monitoring",
            "File monitoring"
        ],
        "name": "Launch Daemon"
    },
    "T1145": {
        "Tactic": [
            "credential-access"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "File monitoring"
        ],
        "name": "Private Keys"
    },
    "T1165": {
        "Tactic": [
            "persistence",
            "privilege-escalation"
        ],
        "Platform": [
            "macOS"
        ],
        "Permissions Required": [
            "Administrator"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring"
        ],
        "name": "Startup Items"
    },
    "T1162": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "macOS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "File monitoring",
            "API monitoring"
        ],
        "name": "Login Item"
    },
    "T1137": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "Windows",
            "Office 365"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "Process monitoring",
            "Process command-line parameters",
            "Windows Registry",
            "File monitoring"
        ],
        "name": "Office Application Startup"
    },
    "T1151": {
        "Tactic": [
            "defense-evasion",
            "execution"
        ],
        "Platform": [
            "Linux",
            "macOS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring"
        ],
        "name": "Space after Filename"
    },
    "T1144": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "macOS"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "File monitoring",
            "Process command-line parameters"
        ],
        "name": "Gatekeeper Bypass"
    },
    "T1158": {
        "Tactic": [
            "defense-evasion",
            "persistence"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Hidden Files and Directories"
    },
    "T1168": {
        "Tactic": [
            "persistence",
            "execution"
        ],
        "Platform": [
            "Linux",
            "macOS"
        ],
        "Permissions Required": [
            "Administrator",
            "User",
            "root"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring"
        ],
        "name": "Local Job Scheduling"
    },
    "T1164": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "macOS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "File monitoring"
        ],
        "name": "Re-opened Applications"
    },
    "T1167": {
        "Tactic": [
            "credential-access"
        ],
        "Platform": [
            "macOS"
        ],
        "Permissions Required": [
            "root"
        ],
        "Data Sources": [
            "Process monitoring"
        ],
        "name": "Securityd Memory"
    },
    "T1153": {
        "Tactic": [
            "execution"
        ],
        "Platform": [
            "Linux",
            "macOS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Process monitoring",
            "File monitoring",
            "Process command-line parameters"
        ],
        "name": "Source"
    },
    "T1169": {
        "Tactic": [
            "privilege-escalation"
        ],
        "Platform": [
            "Linux",
            "macOS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "File monitoring"
        ],
        "name": "Sudo"
    },
    "T1133": {
        "Tactic": [
            "persistence",
            "initial-access"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Authentication logs"
        ],
        "name": "External Remote Services"
    },
    "T1132": {
        "Tactic": [
            "command-and-control"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Packet capture",
            "Process use of network",
            "Process monitoring",
            "Network protocol analysis"
        ],
        "name": "Data Encoding"
    },
    "T1131": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator"
        ],
        "Data Sources": [
            "DLL monitoring",
            "Windows Registry",
            "Loaded DLLs"
        ],
        "name": "Authentication Package"
    },
    "T1130": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Linux",
            "Windows",
            "macOS"
        ],
        "Permissions Required": [
            "Administrator",
            "User"
        ],
        "Data Sources": [
            "SSL/TLS inspection",
            "Digital certificate logs"
        ],
        "name": "Install Root Certificate"
    },
    "T1129": {
        "Tactic": [
            "execution"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "API monitoring",
            "DLL monitoring",
            "File monitoring",
            "Process monitoring"
        ],
        "name": "Execution through Module Load"
    },
    "T1128": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "DLL monitoring",
            "Windows Registry",
            "Process monitoring"
        ],
        "name": "Netsh Helper DLL"
    },
    "T1127": {
        "Tactic": [
            "defense-evasion",
            "execution"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Process monitoring"
        ],
        "name": "Trusted Developer Utilities"
    },
    "T1126": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "User"
        ],
        "Data Sources": [
            "Process monitoring",
            "Process command-line parameters",
            "Packet capture",
            "Authentication logs"
        ],
        "name": "Network Share Connection Removal"
    },
    "T1125": {
        "Tactic": [
            "collection"
        ],
        "Platform": [
            "Windows",
            "macOS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Process monitoring",
            "File monitoring",
            "API monitoring"
        ],
        "name": "Video Capture"
    },
    "T1124": {
        "Tactic": [
            "discovery"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Process monitoring",
            "Process command-line parameters",
            "API monitoring"
        ],
        "name": "System Time Discovery"
    },
    "T1123": {
        "Tactic": [
            "collection"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "API monitoring",
            "Process monitoring",
            "File monitoring"
        ],
        "name": "Audio Capture"
    },
    "T1122": {
        "Tactic": [
            "defense-evasion",
            "persistence"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Windows Registry",
            "DLL monitoring",
            "Loaded DLLs"
        ],
        "name": "Component Object Model Hijacking"
    },
    "T1121": {
        "Tactic": [
            "defense-evasion",
            "execution"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Regsvcs/Regasm"
    },
    "T1120": {
        "Tactic": [
            "discovery"
        ],
        "Platform": [
            "Windows",
            "macOS"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "PowerShell logs",
            "API monitoring",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Peripheral Device Discovery"
    },
    "T1119": {
        "Tactic": [
            "collection"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "File monitoring",
            "Data loss prevention",
            "Process command-line parameters"
        ],
        "name": "Automated Collection"
    },
    "T1118": {
        "Tactic": [
            "defense-evasion",
            "execution"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "InstallUtil"
    },
    "T1117": {
        "Tactic": [
            "defense-evasion",
            "execution"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "Loaded DLLs",
            "Process monitoring",
            "Windows Registry",
            "Process command-line parameters"
        ],
        "name": "Regsvr32"
    },
    "T1116": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Binary file metadata"
        ],
        "name": "Code Signing"
    },
    "T1115": {
        "Tactic": [
            "collection"
        ],
        "Platform": [
            "Linux",
            "Windows",
            "macOS"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "API monitoring"
        ],
        "name": "Clipboard Data"
    },
    "T1114": {
        "Tactic": [
            "collection"
        ],
        "Platform": [
            "Windows",
            "Office 365"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Office 365 trace logs",
            "Mail server",
            "Email gateway",
            "Authentication logs",
            "File monitoring",
            "Process monitoring",
            "Process use of network"
        ],
        "name": "Email Collection"
    },
    "T1113": {
        "Tactic": [
            "collection"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "API monitoring",
            "Process monitoring",
            "File monitoring"
        ],
        "name": "Screen Capture"
    },
    "T1112": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "Windows Registry",
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters",
            "Windows event logs"
        ],
        "name": "Modify Registry"
    },
    "T1111": {
        "Tactic": [
            "credential-access"
        ],
        "Platform": [
            "Linux",
            "Windows",
            "macOS"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "API monitoring",
            "Process monitoring",
            "Kernel drivers"
        ],
        "name": "Two-Factor Authentication Interception"
    },
    "T1110": {
        "Tactic": [
            "credential-access"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows",
            "Office 365",
            "Azure AD",
            "SaaS"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Office 365 account logs",
            "Authentication logs"
        ],
        "name": "Brute Force"
    },
    "T1109": {
        "Tactic": [
            "defense-evasion",
            "persistence"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "SYSTEM"
        ],
        "Data Sources": [
            "Disk forensics",
            "API monitoring",
            "Process monitoring",
            "Component firmware"
        ],
        "name": "Component Firmware"
    },
    "T1108": {
        "Tactic": [
            "defense-evasion",
            "persistence"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows",
            "AWS",
            "GCP",
            "Azure",
            "Office 365",
            "SaaS",
            "Azure AD"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "Office 365 account logs",
            "Azure activity logs",
            "AWS CloudTrail logs",
            "Stackdriver logs",
            "Process monitoring",
            "Process use of network",
            "Packet capture",
            "Network protocol analysis",
            "File monitoring",
            "Authentication logs",
            "Binary file metadata"
        ],
        "name": "Redundant Access"
    },
    "T1107": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "File monitoring",
            "Process command-line parameters",
            "Binary file metadata"
        ],
        "name": "File Deletion"
    },
    "T1106": {
        "Tactic": [
            "execution"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "API monitoring",
            "Process monitoring"
        ],
        "name": "Execution through API"
    },
    "T1105": {
        "Tactic": [
            "command-and-control",
            "lateral-movement"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "File monitoring",
            "Packet capture",
            "Process use of network",
            "Netflow/Enclave netflow",
            "Network protocol analysis",
            "Process monitoring"
        ],
        "name": "Remote File Copy"
    },
    "T1104": {
        "Tactic": [
            "command-and-control"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Netflow/Enclave netflow",
            "Network device logs",
            "Network protocol analysis",
            "Packet capture",
            "Process use of network"
        ],
        "name": "Multi-Stage Channels"
    },
    "T1103": {
        "Tactic": [
            "persistence",
            "privilege-escalation"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator"
        ],
        "Data Sources": [
            "Loaded DLLs",
            "Process monitoring",
            "Windows Registry"
        ],
        "name": "AppInit DLLs"
    },
    "T1102": {
        "Tactic": [
            "command-and-control",
            "defense-evasion"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Host network interface",
            "Netflow/Enclave netflow",
            "Network protocol analysis",
            "Packet capture",
            "SSL/TLS inspection"
        ],
        "name": "Web Service"
    },
    "T1101": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator"
        ],
        "Data Sources": [
            "DLL monitoring",
            "Windows Registry",
            "Loaded DLLs"
        ],
        "name": "Security Support Provider"
    },
    "T1100": {
        "Tactic": [
            "persistence",
            "privilege-escalation"
        ],
        "Platform": [
            "Linux",
            "Windows",
            "macOS"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Anti-virus",
            "Authentication logs",
            "File monitoring",
            "Netflow/Enclave netflow",
            "Process monitoring"
        ],
        "name": "Web Shell"
    },
    "T1099": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Linux",
            "Windows",
            "macOS"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Timestomp"
    },
    "T1098": {
        "Tactic": [
            "credential-access",
            "persistence"
        ],
        "Platform": [
            "Windows",
            "Office 365",
            "Azure",
            "GCP",
            "Azure AD",
            "AWS"
        ],
        "Permissions Required": [
            "Administrator"
        ],
        "Data Sources": [
            "Authentication logs",
            "API monitoring",
            "Windows event logs",
            "Packet capture"
        ],
        "name": "Account Manipulation"
    },
    "T1097": {
        "Tactic": [
            "lateral-movement"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Authentication logs"
        ],
        "name": "Pass the Ticket"
    },
    "T1096": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "File monitoring",
            "Kernel drivers",
            "API monitoring",
            "Process command-line parameters"
        ],
        "name": "NTFS File Attributes"
    },
    "T1095": {
        "Tactic": [
            "command-and-control"
        ],
        "Platform": [
            "Windows",
            "Linux",
            "macOS"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Host network interface",
            "Netflow/Enclave netflow",
            "Network intrusion detection system",
            "Network protocol analysis",
            "Packet capture",
            "Process use of network"
        ],
        "name": "Standard Non-Application Layer Protocol"
    },
    "T1094": {
        "Tactic": [
            "command-and-control"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Packet capture",
            "Netflow/Enclave netflow",
            "Process use of network",
            "Process monitoring",
            "Host network interface",
            "Network intrusion detection system",
            "Network protocol analysis"
        ],
        "name": "Custom Command and Control Protocol"
    },
    "T1093": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Process monitoring",
            "API monitoring"
        ],
        "name": "Process Hollowing"
    },
    "T1092": {
        "Tactic": [
            "command-and-control"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "File monitoring",
            "Data loss prevention"
        ],
        "name": "Communication Through Removable Media"
    },
    "T1091": {
        "Tactic": [
            "lateral-movement",
            "initial-access"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "File monitoring",
            "Data loss prevention"
        ],
        "name": "Replication Through Removable Media"
    },
    "T1090": {
        "Tactic": [
            "command-and-control",
            "defense-evasion"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Process use of network",
            "Process monitoring",
            "Netflow/Enclave netflow",
            "Packet capture"
        ],
        "name": "Connection Proxy"
    },
    "T1089": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "API monitoring",
            "File monitoring",
            "Services",
            "Windows Registry",
            "Process command-line parameters",
            "Anti-virus"
        ],
        "name": "Disabling Security Tools"
    },
    "T1088": {
        "Tactic": [
            "defense-evasion",
            "privilege-escalation"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "System calls",
            "Process monitoring",
            "Authentication logs",
            "Process command-line parameters"
        ],
        "name": "Bypass User Account Control"
    },
    "T1087": {
        "Tactic": [
            "discovery"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows",
            "Office 365",
            "Azure AD"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Azure activity logs",
            "Office 365 account logs",
            "API monitoring",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Account Discovery"
    },
    "T1086": {
        "Tactic": [
            "execution"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "PowerShell logs",
            "Loaded DLLs",
            "DLL monitoring",
            "Windows Registry",
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "PowerShell"
    },
    "T1085": {
        "Tactic": [
            "defense-evasion",
            "execution"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters",
            "Binary file metadata"
        ],
        "name": "Rundll32"
    },
    "T1084": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "WMI Objects"
        ],
        "name": "Windows Management Instrumentation Event Subscription"
    },
    "T1083": {
        "Tactic": [
            "discovery"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "File and Directory Discovery"
    },
    "T1082": {
        "Tactic": [
            "discovery"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows",
            "AWS",
            "GCP",
            "Azure"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Azure activity logs",
            "Stackdriver logs",
            "AWS CloudTrail logs",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "System Information Discovery"
    },
    "T1081": {
        "Tactic": [
            "credential-access"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows",
            "AWS",
            "GCP",
            "Azure"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "File monitoring",
            "Process command-line parameters"
        ],
        "name": "Credentials in Files"
    },
    "T1080": {
        "Tactic": [
            "lateral-movement"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring"
        ],
        "name": "Taint Shared Content"
    },
    "T1079": {
        "Tactic": [
            "command-and-control"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Packet capture",
            "Process use of network",
            "Malware reverse engineering",
            "Process monitoring"
        ],
        "name": "Multilayer Encryption"
    },
    "T1078": {
        "Tactic": [
            "defense-evasion",
            "persistence",
            "privilege-escalation",
            "initial-access"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows",
            "AWS",
            "GCP",
            "Azure",
            "SaaS",
            "Office 365"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "AWS CloudTrail logs",
            "Stackdriver logs",
            "Authentication logs",
            "Process monitoring"
        ],
        "name": "Valid Accounts"
    },
    "T1077": {
        "Tactic": [
            "lateral-movement"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator"
        ],
        "Data Sources": [
            "Process use of network",
            "Authentication logs",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Windows Admin Shares"
    },
    "T1076": {
        "Tactic": [
            "lateral-movement"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Remote Desktop Users",
            "User"
        ],
        "Data Sources": [
            "Authentication logs",
            "Netflow/Enclave netflow",
            "Process monitoring"
        ],
        "name": "Remote Desktop Protocol"
    },
    "T1075": {
        "Tactic": [
            "lateral-movement"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Authentication logs"
        ],
        "name": "Pass the Hash"
    },
    "T1074": {
        "Tactic": [
            "collection"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows",
            "AWS",
            "GCP",
            "Azure"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Data Staged"
    },
    "T1073": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Process use of network",
            "Process monitoring",
            "Loaded DLLs"
        ],
        "name": "DLL Side-Loading"
    },
    "T1072": {
        "Tactic": [
            "execution",
            "lateral-movement"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "File monitoring",
            "Third-party application logs",
            "Windows Registry",
            "Process monitoring",
            "Process use of network",
            "Binary file metadata"
        ],
        "name": "Third-party Software"
    },
    "T1071": {
        "Tactic": [
            "command-and-control"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Packet capture",
            "Netflow/Enclave netflow",
            "Process use of network",
            "Malware reverse engineering",
            "Process monitoring"
        ],
        "name": "Standard Application Layer Protocol"
    },
    "T1070": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters",
            "API monitoring",
            "Windows event logs"
        ],
        "name": "Indicator Removal on Host"
    },
    "T1069": {
        "Tactic": [
            "discovery"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows",
            "Office 365",
            "Azure AD"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Azure activity logs",
            "Office 365 account logs",
            "API monitoring",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Permission Groups Discovery"
    },
    "T1068": {
        "Tactic": [
            "privilege-escalation"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Windows Error Reporting",
            "Process monitoring",
            "Application logs"
        ],
        "name": "Exploitation for Privilege Escalation"
    },
    "T1067": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "Linux",
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "API monitoring",
            "MBR",
            "VBR"
        ],
        "name": "Bootkit"
    },
    "T1066": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Process use of network",
            "Process monitoring",
            "Process command-line parameters",
            "Anti-virus",
            "Binary file metadata"
        ],
        "name": "Indicator Removal from Tools"
    },
    "T1065": {
        "Tactic": [
            "command-and-control"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Netflow/Enclave netflow",
            "Process use of network",
            "Process monitoring"
        ],
        "name": "Uncommonly Used Port"
    },
    "T1064": {
        "Tactic": [
            "defense-evasion",
            "execution"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Process monitoring",
            "File monitoring",
            "Process command-line parameters"
        ],
        "name": "Scripting"
    },
    "T1063": {
        "Tactic": [
            "discovery"
        ],
        "Platform": [
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Security Software Discovery"
    },
    "T1062": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "System calls"
        ],
        "name": "Hypervisor"
    },
    "T1061": {
        "Tactic": [
            "execution"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters",
            "Binary file metadata"
        ],
        "name": "Graphical User Interface"
    },
    "T1060": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "Windows Registry",
            "File monitoring"
        ],
        "name": "Registry Run Keys / Startup Folder"
    },
    "T1059": {
        "Tactic": [
            "execution"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Command-Line Interface"
    },
    "T1058": {
        "Tactic": [
            "persistence",
            "privilege-escalation"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "Process command-line parameters",
            "Services",
            "Windows Registry"
        ],
        "name": "Service Registry Permissions Weakness"
    },
    "T1057": {
        "Tactic": [
            "discovery"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Process Discovery"
    },
    "T1056": {
        "Tactic": [
            "collection",
            "credential-access"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "Windows Registry",
            "Kernel drivers",
            "Process monitoring",
            "API monitoring"
        ],
        "name": "Input Capture"
    },
    "T1055": {
        "Tactic": [
            "defense-evasion",
            "privilege-escalation"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "SYSTEM",
            "root"
        ],
        "Data Sources": [
            "API monitoring",
            "Windows Registry",
            "File monitoring",
            "DLL monitoring",
            "Process monitoring",
            "Named Pipes"
        ],
        "name": "Process Injection"
    },
    "T1054": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Sensor health and status",
            "Process command-line parameters",
            "Process monitoring"
        ],
        "name": "Indicator Blocking"
    },
    "T1053": {
        "Tactic": [
            "execution",
            "persistence",
            "privilege-escalation"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM",
            "User"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters",
            "Windows event logs"
        ],
        "name": "Scheduled Task"
    },
    "T1052": {
        "Tactic": [
            "exfiltration"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Data loss prevention",
            "File monitoring"
        ],
        "name": "Exfiltration Over Physical Medium"
    },
    "T1051": {
        "Tactic": [
            "lateral-movement"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "File monitoring",
            "Process monitoring"
        ],
        "name": "Shared Webroot"
    },
    "T1050": {
        "Tactic": [
            "persistence",
            "privilege-escalation"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "Windows Registry",
            "Process monitoring",
            "Process command-line parameters",
            "Windows event logs"
        ],
        "name": "New Service"
    },
    "T1049": {
        "Tactic": [
            "discovery"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows",
            "AWS",
            "GCP",
            "Azure"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "System Network Connections Discovery"
    },
    "T1048": {
        "Tactic": [
            "exfiltration"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "User interface",
            "Process monitoring",
            "Process use of network",
            "Packet capture",
            "Netflow/Enclave netflow",
            "Network protocol analysis"
        ],
        "name": "Exfiltration Over Alternative Protocol"
    },
    "T1047": {
        "Tactic": [
            "execution"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "Authentication logs",
            "Netflow/Enclave netflow",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Windows Management Instrumentation"
    },
    "T1046": {
        "Tactic": [
            "discovery"
        ],
        "Platform": [
            "Linux",
            "Windows",
            "macOS",
            "AWS",
            "GCP",
            "Azure"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM",
            "User"
        ],
        "Data Sources": [
            "Netflow/Enclave netflow",
            "Network protocol analysis",
            "Packet capture",
            "Process command-line parameters",
            "Process use of network"
        ],
        "name": "Network Service Scanning"
    },
    "T1045": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Windows",
            "macOS"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Binary file metadata"
        ],
        "name": "Software Packing"
    },
    "T1044": {
        "Tactic": [
            "persistence",
            "privilege-escalation"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "User"
        ],
        "Data Sources": [
            "File monitoring",
            "Services",
            "Process command-line parameters"
        ],
        "name": "File System Permissions Weakness"
    },
    "T1043": {
        "Tactic": [
            "command-and-control"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Packet capture",
            "Netflow/Enclave netflow",
            "Process use of network",
            "Process monitoring"
        ],
        "name": "Commonly Used Port"
    },
    "T1042": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "Windows Registry",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Change Default File Association"
    },
    "T1041": {
        "Tactic": [
            "exfiltration"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "User interface",
            "Process monitoring"
        ],
        "name": "Exfiltration Over Command and Control Channel"
    },
    "T1040": {
        "Tactic": [
            "credential-access",
            "discovery"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "Network device logs",
            "Host network interface",
            "Netflow/Enclave netflow",
            "Process monitoring"
        ],
        "name": "Network Sniffing"
    },
    "T1039": {
        "Tactic": [
            "collection"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Data from Network Shared Drive"
    },
    "T1038": {
        "Tactic": [
            "persistence",
            "privilege-escalation",
            "defense-evasion"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "File monitoring",
            "DLL monitoring",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "DLL Search Order Hijacking"
    },
    "T1037": {
        "Tactic": [
            "lateral-movement",
            "persistence"
        ],
        "Platform": [
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "File monitoring",
            "Process monitoring"
        ],
        "name": "Logon Scripts"
    },
    "T1036": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Binary file metadata"
        ],
        "name": "Masquerading"
    },
    "T1035": {
        "Tactic": [
            "execution"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "Windows Registry",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Service Execution"
    },
    "T1034": {
        "Tactic": [
            "persistence",
            "privilege-escalation"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring"
        ],
        "name": "Path Interception"
    },
    "T1033": {
        "Tactic": [
            "discovery"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "System Owner/User Discovery"
    },
    "T1032": {
        "Tactic": [
            "command-and-control"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Packet capture",
            "Netflow/Enclave netflow",
            "Malware reverse engineering",
            "Process use of network",
            "Process monitoring",
            "SSL/TLS inspection"
        ],
        "name": "Standard Cryptographic Protocol"
    },
    "T1031": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "Windows Registry",
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Modify Existing Service"
    },
    "T1030": {
        "Tactic": [
            "exfiltration"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Packet capture",
            "Netflow/Enclave netflow",
            "Process use of network",
            "Process monitoring"
        ],
        "name": "Data Transfer Size Limits"
    },
    "T1029": {
        "Tactic": [
            "exfiltration"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Netflow/Enclave netflow",
            "Process use of network",
            "Process monitoring"
        ],
        "name": "Scheduled Transfer"
    },
    "T1028": {
        "Tactic": [
            "execution",
            "lateral-movement"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "File monitoring",
            "Authentication logs",
            "Netflow/Enclave netflow",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Windows Remote Management"
    },
    "T1027": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Network protocol analysis",
            "Process use of network",
            "File monitoring",
            "Malware reverse engineering",
            "Binary file metadata",
            "Process command-line parameters",
            "Environment variable",
            "Process monitoring",
            "Windows event logs",
            "Network intrusion detection system",
            "Email gateway",
            "SSL/TLS inspection"
        ],
        "name": "Obfuscated Files or Information"
    },
    "T1026": {
        "Tactic": [
            "command-and-control"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Packet capture",
            "Netflow/Enclave netflow",
            "Process use of network",
            "Malware reverse engineering",
            "Process monitoring"
        ],
        "name": "Multiband Communication"
    },
    "T1025": {
        "Tactic": [
            "collection"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Data from Removable Media"
    },
    "T1024": {
        "Tactic": [
            "command-and-control"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Packet capture",
            "Netflow/Enclave netflow",
            "Process use of network",
            "Malware reverse engineering",
            "Process monitoring"
        ],
        "name": "Custom Cryptographic Protocol"
    },
    "T1023": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator"
        ],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Shortcut Modification"
    },
    "T1022": {
        "Tactic": [
            "exfiltration"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters",
            "Binary file metadata"
        ],
        "name": "Data Encrypted"
    },
    "T1021": {
        "Tactic": [
            "lateral-movement"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Authentication logs"
        ],
        "name": "Remote Services"
    },
    "T1020": {
        "Tactic": [
            "exfiltration"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process use of network"
        ],
        "name": "Automated Exfiltration"
    },
    "T1019": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "API monitoring",
            "BIOS",
            "EFI"
        ],
        "name": "System Firmware"
    },
    "T1018": {
        "Tactic": [
            "discovery"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows",
            "GCP",
            "Azure",
            "AWS"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "Network protocol analysis",
            "Process monitoring",
            "Process use of network",
            "Process command-line parameters"
        ],
        "name": "Remote System Discovery"
    },
    "T1017": {
        "Tactic": [
            "lateral-movement"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "File monitoring",
            "Process use of network",
            "Process monitoring"
        ],
        "name": "Application Deployment Software"
    },
    "T1016": {
        "Tactic": [
            "discovery"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "System Network Configuration Discovery"
    },
    "T1015": {
        "Tactic": [
            "persistence",
            "privilege-escalation"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator"
        ],
        "Data Sources": [
            "Windows Registry",
            "File monitoring",
            "Process monitoring"
        ],
        "name": "Accessibility Features"
    },
    "T1014": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM",
            "root"
        ],
        "Data Sources": [
            "BIOS",
            "MBR",
            "System calls"
        ],
        "name": "Rootkit"
    },
    "T1013": {
        "Tactic": [
            "persistence",
            "privilege-escalation"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "File monitoring",
            "API monitoring",
            "DLL monitoring",
            "Windows Registry",
            "Process monitoring"
        ],
        "name": "Port Monitors"
    },
    "T1012": {
        "Tactic": [
            "discovery"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "Windows Registry",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Query Registry"
    },
    "T1011": {
        "Tactic": [
            "exfiltration"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "User interface",
            "Process monitoring"
        ],
        "name": "Exfiltration Over Other Network Medium"
    },
    "T1010": {
        "Tactic": [
            "discovery"
        ],
        "Platform": [
            "macOS",
            "Windows"
        ],
        "Permissions Required": [
            "User"
        ],
        "Data Sources": [
            "API monitoring",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Application Window Discovery"
    },
    "T1009": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Binary file metadata",
            "File monitoring",
            "Malware reverse engineering"
        ],
        "name": "Binary Padding"
    },
    "T1008": {
        "Tactic": [
            "command-and-control"
        ],
        "Platform": [
            "Linux",
            "Windows",
            "macOS"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Malware reverse engineering",
            "Netflow/Enclave netflow",
            "Packet capture",
            "Process monitoring",
            "Process use of network"
        ],
        "name": "Fallback Channels"
    },
    "T1007": {
        "Tactic": [
            "discovery"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "User",
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "System Service Discovery"
    },
    "T1006": {
        "Tactic": [
            "defense-evasion"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator"
        ],
        "Data Sources": [
            "API monitoring"
        ],
        "name": "File System Logical Offsets"
    },
    "T1005": {
        "Tactic": [
            "collection"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows",
            "GCP",
            "AWS",
            "Azure"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "File monitoring",
            "Process monitoring",
            "Process command-line parameters"
        ],
        "name": "Data from Local System"
    },
    "T1004": {
        "Tactic": [
            "persistence"
        ],
        "Platform": [
            "Windows"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM"
        ],
        "Data Sources": [
            "Windows Registry",
            "File monitoring",
            "Process monitoring"
        ],
        "name": "Winlogon Helper DLL"
    },
    "T1003": {
        "Tactic": [
            "credential-access"
        ],
        "Platform": [
            "Windows",
            "Linux",
            "macOS"
        ],
        "Permissions Required": [
            "Administrator",
            "SYSTEM",
            "root"
        ],
        "Data Sources": [
            "API monitoring",
            "Process monitoring",
            "PowerShell logs",
            "Process command-line parameters"
        ],
        "name": "Credential Dumping"
    },
    "T1002": {
        "Tactic": [
            "exfiltration"
        ],
        "Platform": [
            "Linux",
            "Windows",
            "macOS"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Binary file metadata",
            "File monitoring",
            "Process command-line parameters",
            "Process monitoring"
        ],
        "name": "Data Compressed"
    },
    "T1001": {
        "Tactic": [
            "command-and-control"
        ],
        "Platform": [
            "Linux",
            "macOS",
            "Windows"
        ],
        "Permissions Required": [],
        "Data Sources": [
            "Packet capture",
            "Process use of network",
            "Process monitoring",
            "Network protocol analysis"
        ],
        "name": "Data Obfuscation"
    }
}