{"techniques": [{"technique": "T1001", "name": "Data Obfuscation", "in_vocabulary": false}, {"technique": "T1001.001", "name": "Junk Data", "in_vocabulary": false}, {"technique": "T1001.002", "name": "Steganography", "in_vocabulary": false}, {"technique": "T1001.003", "name": "Protocol or Service Impersonation", "in_vocabulary": false}, {"technique": "T1003", "name": "OS Credential Dumping", "in_vocabulary": true}, {"technique": "T1003.001", "name": "LSASS Memory", "in_vocabulary": false}, {"technique": "T1003.002", "name": "Security Account Manager", "in_vocabulary": false}, {"technique": "T1003.003", "name": "NTDS", "in_vocabulary": false}, {"technique": "T1003.004", "name": "LSA Secrets", "in_vocabulary": false}, {"technique": "T1003.005", "name": "Cached Domain Credentials", "in_vocabulary": false}, {"technique": "T1003.006", "name": "DCSync", "in_vocabulary": false}, {"technique": "T1003.007", "name": "Proc Filesystem", "in_vocabulary": false}, {"technique": "T1003.008", "name": "/etc/passwd and /etc/shadow", "in_vocabulary": false}, {"technique": "T1005", "name": "Data from Local System", "in_vocabulary": true}, {"technique": "T1006", "name": "Direct Volume Access", "in_vocabulary": false}, {"technique": "T1007", "name": "System Service Discovery", "in_vocabulary": false}, {"technique": "T1008", "name": "Fallback Channels", "in_vocabulary": false}, {"technique": "T1010", "name": "Application Window Discovery", "in_vocabulary": false}, {"technique": "T1011", "name": "Exfiltration Over Other Network Medium", "in_vocabulary": false}, {"technique": "T1011.001", "name": "Exfiltration Over Bluetooth", "in_vocabulary": false}, {"technique": "T1012", "name": "Query Registry", "in_vocabulary": false}, {"technique": "T1014", "name": "Rootkit", "in_vocabulary": false}, {"technique": "T1016", "name": "System Network Configuration Discovery", "in_vocabulary": false}, {"technique": "T1016.001", "name": "Internet Connection Discovery", "in_vocabulary": false}, {"technique": "T1016.002", "name": "Wi-Fi Discovery", "in_vocabulary": false}, {"technique": "T1018", "name": "Remote System Discovery", "in_vocabulary": false}, {"technique": "T1020", "name": "Automated Exfiltration", "in_vocabulary": false}, {"technique": "T1020.001", "name": "Traffic Duplication", "in_vocabulary": false}, {"technique": "T1021", "name": "Remote Services", "in_vocabulary": true}, {"technique": "T1021.001", "name": "Remote Desktop Protocol", "in_vocabulary": false}, {"technique": "T1021.002", "name": "SMB/Windows Admin Shares", "in_vocabulary": false}, {"technique": "T1021.003", "name": "Distributed Component Object Model", "in_vocabulary": false}, {"technique": "T1021.004", "name": "SSH", "in_vocabulary": false}, {"technique": "T1021.005", "name": "VNC", "in_vocabulary": false}, {"technique": "T1021.006", "name": "Windows Remote Management", "in_vocabulary": false}, {"technique": "T1021.007", "name": "Cloud Services", "in_vocabulary": false}, {"technique": "T1021.008", "name": "Direct Cloud VM Connections", "in_vocabulary": false}, {"technique": "T1025", "name": "Data from Removable Media", "in_vocabulary": false}, {"technique": "T1027", "name": "Obfuscated Files or Information", "in_vocabulary": false}, {"technique": "T1027.001", "name": "Binary Padding", "in_vocabulary": false}, {"technique": "T1027.002", "name": "Software Packing", "in_vocabulary": false}, {"technique": "T1027.003", "name": "Steganography", "in_vocabulary": false}, {"technique": "T1027.004", "name": "Compile After Delivery", "in_vocabulary": false}, {"technique": "T1027.005", "name": "Indicator Removal from Tools", "in_vocabulary": false}, {"technique": "T1027.006", "name": "HTML Smuggling", "in_vocabulary": false}, {"technique": "T1027.007", "name": "Dynamic API Resolution", "in_vocabulary": false}, {"technique": "T1027.008", "name": "Stripped Payloads", "in_vocabulary": false}, {"technique": "T1027.009", "name": "Embedded Payloads", "in_vocabulary": false}, {"technique": "T1027.010", "name": "Command Obfuscation", "in_vocabulary": false}, {"technique": "T1027.011", "name": "Fileless Storage", "in_vocabulary": false}, {"technique": "T1027.012", "name": "LNK Icon Smuggling", "in_vocabulary": false}, {"technique": "T1027.013", "name": "Encrypted/Encoded File", "in_vocabulary": false}, {"technique": "T1027.014", "name": "Polymorphic Code", "in_vocabulary": false}, {"technique": "T1027.015", "name": "Compression", "in_vocabulary": false}, {"technique": "T1027.016", "name": "Junk Code Insertion", "in_vocabulary": false}, {"technique": "T1027.017", "name": "SVG Smuggling", "in_vocabulary": false}, {"technique": "T1027.018", "name": "Invisible Unicode", "in_vocabulary": false}, {"technique": "T1029", "name": "Scheduled Transfer", "in_vocabulary": false}, {"technique": "T1030", "name": "Data Transfer Size Limits", "in_vocabulary": false}, {"technique": "T1033", "name": "System Owner/User Discovery", "in_vocabulary": false}, {"technique": "T1036", "name": "Masquerading", "in_vocabulary": true}, {"technique": "T1036.001", "name": "Invalid Code Signature", "in_vocabulary": false}, {"technique": "T1036.002", "name": "Right-to-Left Override", "in_vocabulary": false}, {"technique": "T1036.003", "name": "Rename Legitimate Utilities", "in_vocabulary": false}, {"technique": "T1036.004", "name": "Masquerade Task or Service", "in_vocabulary": false}, {"technique": "T1036.005", "name": "Match Legitimate Resource Name or Location", "in_vocabulary": false}, {"technique": "T1036.006", "name": "Space after Filename", "in_vocabulary": false}, {"technique": "T1036.007", "name": "Double File Extension", "in_vocabulary": false}, {"technique": "T1036.008", "name": "Masquerade File Type", "in_vocabulary": false}, {"technique": "T1036.009", "name": "Break Process Trees", "in_vocabulary": false}, {"technique": "T1036.010", "name": "Masquerade Account Name", "in_vocabulary": false}, {"technique": "T1036.011", "name": "Overwrite Process Arguments", "in_vocabulary": false}, {"technique": "T1036.012", "name": "Browser Fingerprint", "in_vocabulary": false}, {"technique": "T1037", "name": "Boot or Logon Initialization Scripts", "in_vocabulary": false}, {"technique": "T1037.001", "name": "Logon Script (Windows)", "in_vocabulary": false}, {"technique": "T1037.002", "name": "Login Hook", "in_vocabulary": false}, {"technique": "T1037.003", "name": "Network Logon Script", "in_vocabulary": false}, {"technique": "T1037.004", "name": "RC Scripts", "in_vocabulary": false}, {"technique": "T1037.005", "name": "Startup Items", "in_vocabulary": false}, {"technique": "T1039", "name": "Data from Network Shared Drive", "in_vocabulary": false}, {"technique": "T1040", "name": "Network Sniffing", "in_vocabulary": true}, {"technique": "T1041", "name": "Exfiltration Over C2 Channel", "in_vocabulary": true}, {"technique": "T1046", "name": "Network Service Discovery", "in_vocabulary": true}, {"technique": "T1047", "name": "Windows Management Instrumentation", "in_vocabulary": false}, {"technique": "T1048", "name": "Exfiltration Over Alternative Protocol", "in_vocabulary": false}, {"technique": "T1048.001", "name": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol", "in_vocabulary": false}, {"technique": "T1048.002", "name": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol", "in_vocabulary": false}, {"technique": "T1048.003", "name": "Exfiltration Over Unencrypted Non-C2 Protocol", "in_vocabulary": false}, {"technique": "T1049", "name": "System Network Connections Discovery", "in_vocabulary": false}, {"technique": "T1052", "name": "Exfiltration Over Physical Medium", "in_vocabulary": false}, {"technique": "T1052.001", "name": "Exfiltration over USB", "in_vocabulary": false}, {"technique": "T1053", "name": "Scheduled Task/Job", "in_vocabulary": false}, {"technique": "T1053.002", "name": "At", "in_vocabulary": false}, {"technique": "T1053.003", "name": "Cron", "in_vocabulary": false}, {"technique": "T1053.005", "name": "Scheduled Task", "in_vocabulary": false}, {"technique": "T1053.006", "name": "Systemd Timers", "in_vocabulary": false}, {"technique": "T1053.007", "name": "Container Orchestration Job", "in_vocabulary": false}, {"technique": "T1055", "name": "Process Injection", "in_vocabulary": true}, {"technique": "T1055.001", "name": "Dynamic-link Library Injection", "in_vocabulary": false}, {"technique": "T1055.002", "name": "Portable Executable Injection", "in_vocabulary": false}, {"technique": "T1055.003", "name": "Thread Execution Hijacking", "in_vocabulary": false}, {"technique": "T1055.004", "name": "Asynchronous Procedure Call", "in_vocabulary": false}, {"technique": "T1055.005", "name": "Thread Local Storage", "in_vocabulary": false}, {"technique": "T1055.008", "name": "Ptrace System Calls", "in_vocabulary": false}, {"technique": "T1055.009", "name": "Proc Memory", "in_vocabulary": false}, {"technique": "T1055.011", "name": "Extra Window Memory Injection", "in_vocabulary": false}, {"technique": "T1055.012", "name": "Process Hollowing", "in_vocabulary": false}, {"technique": "T1055.013", "name": "Process Doppelg\u00e4nging", "in_vocabulary": false}, {"technique": "T1055.014", "name": "VDSO Hijacking", "in_vocabulary": false}, {"technique": "T1055.015", "name": "ListPlanting", "in_vocabulary": false}, {"technique": "T1056", "name": "Input Capture", "in_vocabulary": false}, {"technique": "T1056.001", "name": "Keylogging", "in_vocabulary": false}, {"technique": "T1056.002", "name": "GUI Input Capture", "in_vocabulary": false}, {"technique": "T1056.003", "name": "Web Portal Capture", "in_vocabulary": false}, {"technique": "T1056.004", "name": "Credential API Hooking", "in_vocabulary": false}, {"technique": "T1057", "name": "Process Discovery", "in_vocabulary": false}, {"technique": "T1059", "name": "Command and Scripting Interpreter", "in_vocabulary": true}, {"technique": "T1059.001", "name": "PowerShell", "in_vocabulary": false}, {"technique": "T1059.002", "name": "AppleScript", "in_vocabulary": false}, {"technique": "T1059.003", "name": "Windows Command Shell", "in_vocabulary": false}, {"technique": "T1059.004", "name": "Unix Shell", "in_vocabulary": false}, {"technique": "T1059.005", "name": "Visual Basic", "in_vocabulary": false}, {"technique": "T1059.006", "name": "Python", "in_vocabulary": false}, {"technique": "T1059.007", "name": "JavaScript", "in_vocabulary": false}, {"technique": "T1059.008", "name": "Network Device CLI", "in_vocabulary": false}, {"technique": "T1059.009", "name": "Cloud API", "in_vocabulary": false}, {"technique": "T1059.010", "name": "AutoHotKey & AutoIT", "in_vocabulary": false}, {"technique": "T1059.011", "name": "Lua", "in_vocabulary": false}, {"technique": "T1059.012", "name": "Hypervisor CLI", "in_vocabulary": false}, {"technique": "T1059.013", "name": "Container CLI/API", "in_vocabulary": false}, {"technique": "T1068", "name": "Exploitation for Privilege Escalation", "in_vocabulary": true}, {"technique": "T1069", "name": "Permission Groups Discovery", "in_vocabulary": false}, {"technique": "T1069.001", "name": "Local Groups", "in_vocabulary": false}, {"technique": "T1069.002", "name": "Domain Groups", "in_vocabulary": false}, {"technique": "T1069.003", "name": "Cloud Groups", "in_vocabulary": false}, {"technique": "T1070", "name": "Indicator Removal", "in_vocabulary": true}, {"technique": "T1070.003", "name": "Clear Command History", "in_vocabulary": false}, {"technique": "T1070.004", "name": "File Deletion", "in_vocabulary": false}, {"technique": "T1070.005", "name": "Network Share Connection Removal", "in_vocabulary": false}, {"technique": "T1070.006", "name": "Timestomp", "in_vocabulary": false}, {"technique": "T1070.007", "name": "Clear Network Connection History and Configurations", "in_vocabulary": false}, {"technique": "T1070.008", "name": "Clear Mailbox Data", "in_vocabulary": false}, {"technique": "T1070.009", "name": "Clear Persistence", "in_vocabulary": false}, {"technique": "T1070.010", "name": "Relocate Malware", "in_vocabulary": false}, {"technique": "T1071", "name": "Application Layer Protocol", "in_vocabulary": true}, {"technique": "T1071.001", "name": "Web Protocols", "in_vocabulary": false}, {"technique": "T1071.002", "name": "File Transfer Protocols", "in_vocabulary": false}, {"technique": "T1071.003", "name": "Mail Protocols", "in_vocabulary": false}, {"technique": "T1071.004", "name": "DNS", "in_vocabulary": false}, {"technique": "T1071.005", "name": "Publish/Subscribe Protocols", "in_vocabulary": false}, {"technique": "T1072", "name": "Software Deployment Tools", "in_vocabulary": false}, {"technique": "T1074", "name": "Data Staged", "in_vocabulary": false}, {"technique": "T1074.001", "name": "Local Data Staging", "in_vocabulary": false}, {"technique": "T1074.002", "name": "Remote Data Staging", "in_vocabulary": false}, {"technique": "T1078", "name": "Valid Accounts", "in_vocabulary": true}, {"technique": "T1078.001", "name": "Default Accounts", "in_vocabulary": false}, {"technique": "T1078.002", "name": "Domain Accounts", "in_vocabulary": false}, {"technique": "T1078.003", "name": "Local Accounts", "in_vocabulary": false}, {"technique": "T1078.004", "name": "Cloud Accounts", "in_vocabulary": false}, {"technique": "T1080", "name": "Taint Shared Content", "in_vocabulary": false}, {"technique": "T1082", "name": "System Information Discovery", "in_vocabulary": true}, {"technique": "T1083", "name": "File and Directory Discovery", "in_vocabulary": true}, {"technique": "T1087", "name": "Account Discovery", "in_vocabulary": true}, {"technique": "T1087.001", "name": "Local Account", "in_vocabulary": false}, {"technique": "T1087.002", "name": "Domain Account", "in_vocabulary": false}, {"technique": "T1087.003", "name": "Email Account", "in_vocabulary": false}, {"technique": "T1087.004", "name": "Cloud Account", "in_vocabulary": false}, {"technique": "T1090", "name": "Proxy", "in_vocabulary": false}, {"technique": "T1090.001", "name": "Internal Proxy", "in_vocabulary": false}, {"technique": "T1090.002", "name": "External Proxy", "in_vocabulary": false}, {"technique": "T1090.003", "name": "Multi-hop Proxy", "in_vocabulary": false}, {"technique": "T1090.004", "name": "Domain Fronting", "in_vocabulary": false}, {"technique": "T1091", "name": "Replication Through Removable Media", "in_vocabulary": true}, {"technique": "T1092", "name": "Communication Through Removable Media", "in_vocabulary": false}, {"technique": "T1095", "name": "Non-Application Layer Protocol", "in_vocabulary": false}, {"technique": "T1098", "name": "Account Manipulation", "in_vocabulary": true}, {"technique": "T1098.001", "name": "Additional Cloud Credentials", "in_vocabulary": false}, {"technique": "T1098.002", "name": "Additional Email Delegate Permissions", "in_vocabulary": false}, {"technique": "T1098.003", "name": "Additional Cloud Roles", "in_vocabulary": false}, {"technique": "T1098.004", "name": "SSH Authorized Keys", "in_vocabulary": false}, {"technique": "T1098.005", "name": "Device Registration", "in_vocabulary": false}, {"technique": "T1098.006", "name": "Additional Container Cluster Roles", "in_vocabulary": false}, {"technique": "T1098.007", "name": "Additional Local or Domain Groups", "in_vocabulary": false}, {"technique": "T1102", "name": "Web Service", "in_vocabulary": false}, {"technique": "T1102.001", "name": "Dead Drop Resolver", "in_vocabulary": false}, {"technique": "T1102.002", "name": "Bidirectional Communication", "in_vocabulary": false}, {"technique": "T1102.003", "name": "One-Way Communication", "in_vocabulary": false}, {"technique": "T1104", "name": "Multi-Stage Channels", "in_vocabulary": false}, {"technique": "T1105", "name": "Ingress Tool Transfer", "in_vocabulary": true}, {"technique": "T1106", "name": "Native API", "in_vocabulary": true}, {"technique": "T1110", "name": "Brute Force", "in_vocabulary": true}, {"technique": "T1110.001", "name": "Password Guessing", "in_vocabulary": false}, {"technique": "T1110.002", "name": "Password Cracking", "in_vocabulary": false}, {"technique": "T1110.003", "name": "Password Spraying", "in_vocabulary": false}, {"technique": "T1110.004", "name": "Credential Stuffing", "in_vocabulary": false}, {"technique": "T1111", "name": "Multi-Factor Authentication Interception", "in_vocabulary": false}, {"technique": "T1112", "name": "Modify Registry", "in_vocabulary": false}, {"technique": "T1113", "name": "Screen Capture", "in_vocabulary": false}, {"technique": "T1114", "name": "Email Collection", "in_vocabulary": false}, {"technique": "T1114.001", "name": "Local Email Collection", "in_vocabulary": false}, {"technique": "T1114.002", "name": "Remote Email Collection", "in_vocabulary": false}, {"technique": "T1114.003", "name": "Email Forwarding Rule", "in_vocabulary": false}, {"technique": "T1115", "name": "Clipboard Data", "in_vocabulary": false}, {"technique": "T1119", "name": "Automated Collection", "in_vocabulary": false}, {"technique": "T1120", "name": "Peripheral Device Discovery", "in_vocabulary": false}, {"technique": "T1123", "name": "Audio Capture", "in_vocabulary": false}, {"technique": "T1124", "name": "System Time Discovery", "in_vocabulary": false}, {"technique": "T1125", "name": "Video Capture", "in_vocabulary": false}, {"technique": "T1127", "name": "Trusted Developer Utilities Proxy Execution", "in_vocabulary": false}, {"technique": "T1127.001", "name": "MSBuild", "in_vocabulary": false}, {"technique": "T1127.002", "name": "ClickOnce", "in_vocabulary": false}, {"technique": "T1127.003", "name": "JamPlus", "in_vocabulary": false}, {"technique": "T1129", "name": "Shared Modules", "in_vocabulary": false}, {"technique": "T1132", "name": "Data Encoding", "in_vocabulary": false}, {"technique": "T1132.001", "name": "Standard Encoding", "in_vocabulary": false}, {"technique": "T1132.002", "name": "Non-Standard Encoding", "in_vocabulary": false}, {"technique": "T1133", "name": "External Remote Services", "in_vocabulary": true}, {"technique": "T1134", "name": "Access Token Manipulation", "in_vocabulary": false}, {"technique": "T1134.001", "name": "Token Impersonation/Theft", "in_vocabulary": false}, {"technique": "T1134.002", "name": "Create Process with Token", "in_vocabulary": false}, {"technique": "T1134.003", "name": "Make and Impersonate Token", "in_vocabulary": false}, {"technique": "T1134.004", "name": "Parent PID Spoofing", "in_vocabulary": false}, {"technique": "T1134.005", "name": "SID-History Injection", "in_vocabulary": false}, {"technique": "T1135", "name": "Network Share Discovery", "in_vocabulary": false}, {"technique": "T1136", "name": "Create Account", "in_vocabulary": true}, {"technique": "T1136.001", "name": "Local Account", "in_vocabulary": false}, {"technique": "T1136.002", "name": "Domain Account", "in_vocabulary": false}, {"technique": "T1136.003", "name": "Cloud Account", "in_vocabulary": false}, {"technique": "T1137", "name": "Office Application Startup", "in_vocabulary": false}, {"technique": "T1137.001", "name": "Office Template Macros", "in_vocabulary": false}, {"technique": "T1137.002", "name": "Office Test", "in_vocabulary": false}, {"technique": "T1137.003", "name": "Outlook Forms", "in_vocabulary": false}, {"technique": "T1137.004", "name": "Outlook Home Page", "in_vocabulary": false}, {"technique": "T1137.005", "name": "Outlook Rules", "in_vocabulary": false}, {"technique": "T1137.006", "name": "Add-ins", "in_vocabulary": false}, {"technique": "T1140", "name": "Deobfuscate/Decode Files or Information", "in_vocabulary": false}, {"technique": "T1176", "name": "Software Extensions", "in_vocabulary": false}, {"technique": "T1176.001", "name": "Browser Extensions", "in_vocabulary": false}, {"technique": "T1176.002", "name": "IDE Extensions", "in_vocabulary": false}, {"technique": "T1185", "name": "Browser Session Hijacking", "in_vocabulary": true}, {"technique": "T1187", "name": "Forced Authentication", "in_vocabulary": false}, {"technique": "T1189", "name": "Drive-by Compromise", "in_vocabulary": true}, {"technique": "T1190", "name": "Exploit Public-Facing Application", "in_vocabulary": true}, {"technique": "T1195", "name": "Supply Chain Compromise", "in_vocabulary": false}, {"technique": "T1195.001", "name": "Compromise Software Dependencies and Development Tools", "in_vocabulary": false}, {"technique": "T1195.002", "name": "Compromise Software Supply Chain", "in_vocabulary": false}, {"technique": "T1195.003", "name": "Compromise Hardware Supply Chain", "in_vocabulary": false}, {"technique": "T1197", "name": "BITS Jobs", "in_vocabulary": false}, {"technique": "T1199", "name": "Trusted Relationship", "in_vocabulary": false}, {"technique": "T1200", "name": "Hardware Additions", "in_vocabulary": false}, {"technique": "T1201", "name": "Password Policy Discovery", "in_vocabulary": false}, {"technique": "T1202", "name": "Indirect Command Execution", "in_vocabulary": true}, {"technique": "T1203", "name": "Exploitation for Client Execution", "in_vocabulary": true}, {"technique": "T1204", "name": "User Execution", "in_vocabulary": true}, {"technique": "T1204.001", "name": "Malicious Link", "in_vocabulary": false}, {"technique": "T1204.002", "name": "Malicious File", "in_vocabulary": false}, {"technique": "T1204.003", "name": "Malicious Image", "in_vocabulary": false}, {"technique": "T1204.004", "name": "Malicious Copy and Paste", "in_vocabulary": false}, {"technique": "T1204.005", "name": "Malicious Library", "in_vocabulary": false}, {"technique": "T1205", "name": "Traffic Signaling", "in_vocabulary": false}, {"technique": "T1205.001", "name": "Port Knocking", "in_vocabulary": false}, {"technique": "T1205.002", "name": "Socket Filters", "in_vocabulary": false}, {"technique": "T1207", "name": "Rogue Domain Controller", "in_vocabulary": false}, {"technique": "T1210", "name": "Exploitation of Remote Services", "in_vocabulary": true}, {"technique": "T1211", "name": "Exploitation for Stealth", "in_vocabulary": true}, {"technique": "T1212", "name": "Exploitation for Credential Access", "in_vocabulary": true}, {"technique": "T1213", "name": "Data from Information Repositories", "in_vocabulary": false}, {"technique": "T1213.001", "name": "Confluence", "in_vocabulary": false}, {"technique": "T1213.002", "name": "Sharepoint", "in_vocabulary": false}, {"technique": "T1213.003", "name": "Code Repositories", "in_vocabulary": false}, {"technique": "T1213.004", "name": "Customer Relationship Management Software", "in_vocabulary": false}, {"technique": "T1213.005", "name": "Messaging Applications", "in_vocabulary": false}, {"technique": "T1213.006", "name": "Databases", "in_vocabulary": false}, {"technique": "T1216", "name": "System Script Proxy Execution", "in_vocabulary": false}, {"technique": "T1216.001", "name": "PubPrn", "in_vocabulary": false}, {"technique": "T1216.002", "name": "SyncAppvPublishingServer", "in_vocabulary": false}, {"technique": "T1217", "name": "Browser Information Discovery", "in_vocabulary": false}, {"technique": "T1218", "name": "System Binary Proxy Execution", "in_vocabulary": false}, {"technique": "T1218.001", "name": "Compiled HTML File", "in_vocabulary": false}, {"technique": "T1218.002", "name": "Control Panel", "in_vocabulary": false}, {"technique": "T1218.003", "name": "CMSTP", "in_vocabulary": false}, {"technique": "T1218.004", "name": "InstallUtil", "in_vocabulary": false}, {"technique": "T1218.005", "name": "Mshta", "in_vocabulary": false}, {"technique": "T1218.007", "name": "Msiexec", "in_vocabulary": false}, {"technique": "T1218.008", "name": "Odbcconf", "in_vocabulary": false}, {"technique": "T1218.009", "name": "Regsvcs/Regasm", "in_vocabulary": false}, {"technique": "T1218.010", "name": "Regsvr32", "in_vocabulary": false}, {"technique": "T1218.011", "name": "Rundll32", "in_vocabulary": false}, {"technique": "T1218.012", "name": "Verclsid", "in_vocabulary": false}, {"technique": "T1218.013", "name": "Mavinject", "in_vocabulary": false}, {"technique": "T1218.014", "name": "MMC", "in_vocabulary": false}, {"technique": "T1218.015", "name": "Electron Applications", "in_vocabulary": false}, {"technique": "T1219", "name": "Remote Access Tools", "in_vocabulary": false}, {"technique": "T1219.001", "name": "IDE Tunneling", "in_vocabulary": false}, {"technique": "T1219.002", "name": "Remote Desktop Software", "in_vocabulary": false}, {"technique": "T1219.003", "name": "Remote Access Hardware", "in_vocabulary": false}, {"technique": "T1220", "name": "XSL Script Processing", "in_vocabulary": false}, {"technique": "T1221", "name": "Template Injection", "in_vocabulary": false}, {"technique": "T1222", "name": "File and Directory Permissions Modification", "in_vocabulary": false}, {"technique": "T1222.001", "name": "Windows Permissions", "in_vocabulary": false}, {"technique": "T1222.002", "name": "Linux and Mac Permissions", "in_vocabulary": false}, {"technique": "T1480", "name": "Execution Guardrails", "in_vocabulary": false}, {"technique": "T1480.001", "name": "Environmental Keying", "in_vocabulary": false}, {"technique": "T1480.002", "name": "Mutual Exclusion", "in_vocabulary": false}, {"technique": "T1482", "name": "Domain Trust Discovery", "in_vocabulary": false}, {"technique": "T1484", "name": "Domain or Tenant Policy Modification", "in_vocabulary": false}, {"technique": "T1484.001", "name": "Group Policy Modification", "in_vocabulary": false}, {"technique": "T1484.002", "name": "Trust Modification", "in_vocabulary": false}, {"technique": "T1485", "name": "Data Destruction", "in_vocabulary": true}, {"technique": "T1485.001", "name": "Lifecycle-Triggered Deletion", "in_vocabulary": false}, {"technique": "T1486", "name": "Data Encrypted for Impact", "in_vocabulary": true}, {"technique": "T1489", "name": "Service Stop", "in_vocabulary": false}, {"technique": "T1490", "name": "Inhibit System Recovery", "in_vocabulary": false}, {"technique": "T1491", "name": "Defacement", "in_vocabulary": false}, {"technique": "T1491.001", "name": "Internal Defacement", "in_vocabulary": false}, {"technique": "T1491.002", "name": "External Defacement", "in_vocabulary": false}, {"technique": "T1495", "name": "Firmware Corruption", "in_vocabulary": false}, {"technique": "T1496", "name": "Resource Hijacking", "in_vocabulary": true}, {"technique": "T1496.001", "name": "Compute Hijacking", "in_vocabulary": false}, {"technique": "T1496.002", "name": "Bandwidth Hijacking", "in_vocabulary": false}, {"technique": "T1496.003", "name": "SMS Pumping", "in_vocabulary": false}, {"technique": "T1496.004", "name": "Cloud Service Hijacking", "in_vocabulary": false}, {"technique": "T1497", "name": "Virtualization/Sandbox Evasion", "in_vocabulary": true}, {"technique": "T1497.001", "name": "System Checks", "in_vocabulary": false}, {"technique": "T1497.002", "name": "User Activity Based Checks", "in_vocabulary": false}, {"technique": "T1497.003", "name": "Time Based Checks", "in_vocabulary": false}, {"technique": "T1498", "name": "Network Denial of Service", "in_vocabulary": true}, {"technique": "T1498.001", "name": "Direct Network Flood", "in_vocabulary": false}, {"technique": "T1498.002", "name": "Reflection Amplification", "in_vocabulary": false}, {"technique": "T1499", "name": "Endpoint Denial of Service", "in_vocabulary": true}, {"technique": "T1499.001", "name": "OS Exhaustion Flood", "in_vocabulary": false}, {"technique": "T1499.002", "name": "Service Exhaustion Flood", "in_vocabulary": false}, {"technique": "T1499.003", "name": "Application Exhaustion Flood", "in_vocabulary": false}, {"technique": "T1499.004", "name": "Application or System Exploitation", "in_vocabulary": false}, {"technique": "T1505", "name": "Server Software Component", "in_vocabulary": true}, {"technique": "T1505.001", "name": "SQL Stored Procedures", "in_vocabulary": false}, {"technique": "T1505.002", "name": "Transport Agent", "in_vocabulary": false}, {"technique": "T1505.003", "name": "Web Shell", "in_vocabulary": false}, {"technique": "T1505.004", "name": "IIS Components", "in_vocabulary": false}, {"technique": "T1505.005", "name": "Terminal Services DLL", "in_vocabulary": false}, {"technique": "T1505.006", "name": "vSphere Installation Bundles", "in_vocabulary": false}, {"technique": "T1518", "name": "Software Discovery", "in_vocabulary": false}, {"technique": "T1518.001", "name": "Security Software Discovery", "in_vocabulary": false}, {"technique": "T1518.002", "name": "Backup Software Discovery", "in_vocabulary": false}, {"technique": "T1525", "name": "Implant Internal Image", "in_vocabulary": false}, {"technique": "T1526", "name": "Cloud Service Discovery", "in_vocabulary": false}, {"technique": "T1528", "name": "Steal Application Access Token", "in_vocabulary": true}, {"technique": "T1529", "name": "System Shutdown/Reboot", "in_vocabulary": false}, {"technique": "T1530", "name": "Data from Cloud Storage", "in_vocabulary": false}, {"technique": "T1531", "name": "Account Access Removal", "in_vocabulary": false}, {"technique": "T1534", "name": "Internal Spearphishing", "in_vocabulary": false}, {"technique": "T1535", "name": "Unused/Unsupported Cloud Regions", "in_vocabulary": false}, {"technique": "T1537", "name": "Transfer Data to Cloud Account", "in_vocabulary": false}, {"technique": "T1538", "name": "Cloud Service Dashboard", "in_vocabulary": false}, {"technique": "T1539", "name": "Steal Web Session Cookie", "in_vocabulary": false}, {"technique": "T1542", "name": "Pre-OS Boot", "in_vocabulary": true}, {"technique": "T1542.001", "name": "System Firmware", "in_vocabulary": false}, {"technique": "T1542.002", "name": "Component Firmware", "in_vocabulary": false}, {"technique": "T1542.003", "name": "Bootkit", "in_vocabulary": false}, {"technique": "T1542.004", "name": "ROMMONkit", "in_vocabulary": false}, {"technique": "T1542.005", "name": "TFTP Boot", "in_vocabulary": false}, {"technique": "T1543", "name": "Create or Modify System Process", "in_vocabulary": true}, {"technique": "T1543.001", "name": "Launch Agent", "in_vocabulary": false}, {"technique": "T1543.002", "name": "Systemd Service", "in_vocabulary": false}, {"technique": "T1543.003", "name": "Windows Service", "in_vocabulary": false}, {"technique": "T1543.004", "name": "Launch Daemon", "in_vocabulary": false}, {"technique": "T1543.005", "name": "Container Service", "in_vocabulary": false}, {"technique": "T1546", "name": "Event Triggered Execution", "in_vocabulary": false}, {"technique": "T1546.001", "name": "Change Default File Association", "in_vocabulary": false}, {"technique": "T1546.002", "name": "Screensaver", "in_vocabulary": false}, {"technique": "T1546.003", "name": "Windows Management Instrumentation Event Subscription", "in_vocabulary": false}, {"technique": "T1546.004", "name": "Unix Shell Configuration Modification", "in_vocabulary": false}, {"technique": "T1546.005", "name": "Trap", "in_vocabulary": false}, {"technique": "T1546.006", "name": "LC_LOAD_DYLIB Addition", "in_vocabulary": false}, {"technique": "T1546.007", "name": "Netsh Helper DLL", "in_vocabulary": false}, {"technique": "T1546.008", "name": "Accessibility Features", "in_vocabulary": false}, {"technique": "T1546.009", "name": "AppCert DLLs", "in_vocabulary": false}, {"technique": "T1546.010", "name": "AppInit DLLs", "in_vocabulary": false}, {"technique": "T1546.011", "name": "Application Shimming", "in_vocabulary": false}, {"technique": "T1546.012", "name": "Image File Execution Options Injection", "in_vocabulary": false}, {"technique": "T1546.013", "name": "PowerShell Profile", "in_vocabulary": false}, {"technique": "T1546.014", "name": "Emond", "in_vocabulary": false}, {"technique": "T1546.015", "name": "Component Object Model Hijacking", "in_vocabulary": false}, {"technique": "T1546.016", "name": "Installer Packages", "in_vocabulary": false}, {"technique": "T1546.017", "name": "Udev Rules", "in_vocabulary": false}, {"technique": "T1546.018", "name": "Python Startup Hooks", "in_vocabulary": false}, {"technique": "T1547", "name": "Boot or Logon Autostart Execution", "in_vocabulary": false}, {"technique": "T1547.001", "name": "Registry Run Keys / Startup Folder", "in_vocabulary": false}, {"technique": "T1547.002", "name": "Authentication Package", "in_vocabulary": false}, {"technique": "T1547.003", "name": "Time Providers", "in_vocabulary": false}, {"technique": "T1547.004", "name": "Winlogon Helper DLL", "in_vocabulary": false}, {"technique": "T1547.005", "name": "Security Support Provider", "in_vocabulary": false}, {"technique": "T1547.006", "name": "Kernel Modules and Extensions", "in_vocabulary": false}, {"technique": "T1547.007", "name": "Re-opened Applications", "in_vocabulary": false}, {"technique": "T1547.008", "name": "LSASS Driver", "in_vocabulary": false}, {"technique": "T1547.009", "name": "Shortcut Modification", "in_vocabulary": false}, {"technique": "T1547.010", "name": "Port Monitors", "in_vocabulary": false}, {"technique": "T1547.012", "name": "Print Processors", "in_vocabulary": false}, {"technique": "T1547.013", "name": "XDG Autostart Entries", "in_vocabulary": false}, {"technique": "T1547.014", "name": "Active Setup", "in_vocabulary": false}, {"technique": "T1547.015", "name": "Login Items", "in_vocabulary": false}, {"technique": "T1548", "name": "Abuse Elevation Control Mechanism", "in_vocabulary": true}, {"technique": "T1548.001", "name": "Setuid and Setgid", "in_vocabulary": false}, {"technique": "T1548.002", "name": "Bypass User Account Control", "in_vocabulary": false}, {"technique": "T1548.003", "name": "Sudo and Sudo Caching", "in_vocabulary": false}, {"technique": "T1548.004", "name": "Elevated Execution with Prompt", "in_vocabulary": false}, {"technique": "T1548.005", "name": "Temporary Elevated Cloud Access", "in_vocabulary": false}, {"technique": "T1548.006", "name": "TCC Manipulation", "in_vocabulary": false}, {"technique": "T1550", "name": "Use Alternate Authentication Material", "in_vocabulary": true}, {"technique": "T1550.001", "name": "Application Access Token", "in_vocabulary": false}, {"technique": "T1550.002", "name": "Pass the Hash", "in_vocabulary": false}, {"technique": "T1550.003", "name": "Pass the Ticket", "in_vocabulary": false}, {"technique": "T1550.004", "name": "Web Session Cookie", "in_vocabulary": false}, {"technique": "T1552", "name": "Unsecured Credentials", "in_vocabulary": true}, {"technique": "T1552.001", "name": "Credentials In Files", "in_vocabulary": false}, {"technique": "T1552.002", "name": "Credentials in Registry", "in_vocabulary": false}, {"technique": "T1552.003", "name": "Shell History", "in_vocabulary": false}, {"technique": "T1552.004", "name": "Private Keys", "in_vocabulary": false}, {"technique": "T1552.005", "name": "Cloud Instance Metadata API", "in_vocabulary": false}, {"technique": "T1552.006", "name": "Group Policy Preferences", "in_vocabulary": false}, {"technique": "T1552.007", "name": "Container API", "in_vocabulary": false}, {"technique": "T1552.008", "name": "Chat Messages", "in_vocabulary": false}, {"technique": "T1553", "name": "Subvert Trust Controls", "in_vocabulary": false}, {"technique": "T1553.001", "name": "Gatekeeper Bypass", "in_vocabulary": false}, {"technique": "T1553.002", "name": "Code Signing", "in_vocabulary": false}, {"technique": "T1553.003", "name": "SIP and Trust Provider Hijacking", "in_vocabulary": false}, {"technique": "T1553.004", "name": "Install Root Certificate", "in_vocabulary": false}, {"technique": "T1553.005", "name": "Mark-of-the-Web Bypass", "in_vocabulary": false}, {"technique": "T1553.006", "name": "Code Signing Policy Modification", "in_vocabulary": false}, {"technique": "T1554", "name": "Compromise Host Software Binary", "in_vocabulary": false}, {"technique": "T1555", "name": "Credentials from Password Stores", "in_vocabulary": true}, {"technique": "T1555.001", "name": "Keychain", "in_vocabulary": false}, {"technique": "T1555.002", "name": "Securityd Memory", "in_vocabulary": false}, {"technique": "T1555.003", "name": "Credentials from Web Browsers", "in_vocabulary": false}, {"technique": "T1555.004", "name": "Windows Credential Manager", "in_vocabulary": false}, {"technique": "T1555.005", "name": "Password Managers", "in_vocabulary": false}, {"technique": "T1555.006", "name": "Cloud Secrets Management Stores", "in_vocabulary": false}, {"technique": "T1556", "name": "Modify Authentication Process", "in_vocabulary": false}, {"technique": "T1556.001", "name": "Domain Controller Authentication", "in_vocabulary": false}, {"technique": "T1556.002", "name": "Password Filter DLL", "in_vocabulary": false}, {"technique": "T1556.003", "name": "Pluggable Authentication Modules", "in_vocabulary": false}, {"technique": "T1556.004", "name": "Network Device Authentication", "in_vocabulary": false}, {"technique": "T1556.005", "name": "Reversible Encryption", "in_vocabulary": false}, {"technique": "T1556.006", "name": "Multi-Factor Authentication", "in_vocabulary": false}, {"technique": "T1556.007", "name": "Hybrid Identity", "in_vocabulary": false}, {"technique": "T1556.008", "name": "Network Provider DLL", "in_vocabulary": false}, {"technique": "T1556.009", "name": "Conditional Access Policies", "in_vocabulary": false}, {"technique": "T1557", "name": "Adversary-in-the-Middle", "in_vocabulary": true}, {"technique": "T1557.001", "name": "Name Resolution Poisoning and SMB Relay", "in_vocabulary": false}, {"technique": "T1557.002", "name": "ARP Cache Poisoning", "in_vocabulary": false}, {"technique": "T1557.003", "name": "DHCP Spoofing", "in_vocabulary": false}, {"technique": "T1557.004", "name": "Evil Twin", "in_vocabulary": false}, {"technique": "T1558", "name": "Steal or Forge Kerberos Tickets", "in_vocabulary": false}, {"technique": "T1558.001", "name": "Golden Ticket", "in_vocabulary": false}, {"technique": "T1558.002", "name": "Silver Ticket", "in_vocabulary": false}, {"technique": "T1558.003", "name": "Kerberoasting", "in_vocabulary": false}, {"technique": "T1558.004", "name": "AS-REP Roasting", "in_vocabulary": false}, {"technique": "T1558.005", "name": "Ccache Files", "in_vocabulary": false}, {"technique": "T1559", "name": "Inter-Process Communication", "in_vocabulary": false}, {"technique": "T1559.001", "name": "Component Object Model", "in_vocabulary": false}, {"technique": "T1559.002", "name": "Dynamic Data Exchange", "in_vocabulary": false}, {"technique": "T1559.003", "name": "XPC Services", "in_vocabulary": false}, {"technique": "T1560", "name": "Archive Collected Data", "in_vocabulary": false}, {"technique": "T1560.001", "name": "Archive via Utility", "in_vocabulary": false}, {"technique": "T1560.002", "name": "Archive via Library", "in_vocabulary": false}, {"technique": "T1560.003", "name": "Archive via Custom Method", "in_vocabulary": false}, {"technique": "T1561", "name": "Disk Wipe", "in_vocabulary": false}, {"technique": "T1561.001", "name": "Disk Content Wipe", "in_vocabulary": false}, {"technique": "T1561.002", "name": "Disk Structure Wipe", "in_vocabulary": false}, {"technique": "T1563", "name": "Remote Service Session Hijacking", "in_vocabulary": true}, {"technique": "T1563.001", "name": "SSH Hijacking", "in_vocabulary": false}, {"technique": "T1563.002", "name": "RDP Hijacking", "in_vocabulary": false}, {"technique": "T1564", "name": "Hide Artifacts", "in_vocabulary": false}, {"technique": "T1564.001", "name": "Hidden Files and Directories", "in_vocabulary": false}, {"technique": "T1564.002", "name": "Hidden Users", "in_vocabulary": false}, {"technique": "T1564.003", "name": "Hidden Window", "in_vocabulary": false}, {"technique": "T1564.004", "name": "NTFS File Attributes", "in_vocabulary": false}, {"technique": "T1564.005", "name": "Hidden File System", "in_vocabulary": false}, {"technique": "T1564.006", "name": "Run Virtual Instance", "in_vocabulary": false}, {"technique": "T1564.007", "name": "VBA Stomping", "in_vocabulary": false}, {"technique": "T1564.008", "name": "Email Hiding Rules", "in_vocabulary": false}, {"technique": "T1564.009", "name": "Resource Forking", "in_vocabulary": false}, {"technique": "T1564.010", "name": "Process Argument Spoofing", "in_vocabulary": false}, {"technique": "T1564.011", "name": "Ignore Process Interrupts", "in_vocabulary": false}, {"technique": "T1564.012", "name": "File/Path Exclusions", "in_vocabulary": false}, {"technique": "T1564.013", "name": "Bind Mounts", "in_vocabulary": false}, {"technique": "T1564.014", "name": "Extended Attributes", "in_vocabulary": false}, {"technique": "T1565", "name": "Data Manipulation", "in_vocabulary": true}, {"technique": "T1565.001", "name": "Stored Data Manipulation", "in_vocabulary": false}, {"technique": "T1565.002", "name": "Transmitted Data Manipulation", "in_vocabulary": false}, {"technique": "T1565.003", "name": "Runtime Data Manipulation", "in_vocabulary": false}, {"technique": "T1566", "name": "Phishing", "in_vocabulary": true}, {"technique": "T1566.001", "name": "Spearphishing Attachment", "in_vocabulary": false}, {"technique": "T1566.002", "name": "Spearphishing Link", "in_vocabulary": false}, {"technique": "T1566.003", "name": "Spearphishing via Service", "in_vocabulary": false}, {"technique": "T1566.004", "name": "Spearphishing Voice", "in_vocabulary": false}, {"technique": "T1567", "name": "Exfiltration Over Web Service", "in_vocabulary": false}, {"technique": "T1567.001", "name": "Exfiltration to Code Repository", "in_vocabulary": false}, {"technique": "T1567.002", "name": "Exfiltration to Cloud Storage", "in_vocabulary": false}, {"technique": "T1567.003", "name": "Exfiltration to Text Storage Sites", "in_vocabulary": false}, {"technique": "T1567.004", "name": "Exfiltration Over Webhook", "in_vocabulary": false}, {"technique": "T1568", "name": "Dynamic Resolution", "in_vocabulary": false}, {"technique": "T1568.001", "name": "Fast Flux DNS", "in_vocabulary": false}, {"technique": "T1568.002", "name": "Domain Generation Algorithms", "in_vocabulary": false}, {"technique": "T1568.003", "name": "DNS Calculation", "in_vocabulary": false}, {"technique": "T1569", "name": "System Services", "in_vocabulary": false}, {"technique": "T1569.001", "name": "Launchctl", "in_vocabulary": false}, {"technique": "T1569.002", "name": "Service Execution", "in_vocabulary": false}, {"technique": "T1569.003", "name": "Systemctl", "in_vocabulary": false}, {"technique": "T1570", "name": "Lateral Tool Transfer", "in_vocabulary": false}, {"technique": "T1571", "name": "Non-Standard Port", "in_vocabulary": false}, {"technique": "T1572", "name": "Protocol Tunneling", "in_vocabulary": false}, {"technique": "T1573", "name": "Encrypted Channel", "in_vocabulary": false}, {"technique": "T1573.001", "name": "Symmetric Cryptography", "in_vocabulary": false}, {"technique": "T1573.002", "name": "Asymmetric Cryptography", "in_vocabulary": false}, {"technique": "T1574", "name": "Hijack Execution Flow", "in_vocabulary": true}, {"technique": "T1574.001", "name": "DLL", "in_vocabulary": false}, {"technique": "T1574.004", "name": "Dylib Hijacking", "in_vocabulary": false}, {"technique": "T1574.005", "name": "Executable Installer File Permissions Weakness", "in_vocabulary": false}, {"technique": "T1574.006", "name": "Dynamic Linker Hijacking", "in_vocabulary": false}, {"technique": "T1574.007", "name": "Path Interception by PATH Environment Variable", "in_vocabulary": false}, {"technique": "T1574.008", "name": "Path Interception by Search Order Hijacking", "in_vocabulary": false}, {"technique": "T1574.009", "name": "Path Interception by Unquoted Path", "in_vocabulary": false}, {"technique": "T1574.010", "name": "Services File Permissions Weakness", "in_vocabulary": false}, {"technique": "T1574.011", "name": "Services Registry Permissions Weakness", "in_vocabulary": false}, {"technique": "T1574.012", "name": "COR_PROFILER", "in_vocabulary": false}, {"technique": "T1574.013", "name": "KernelCallbackTable", "in_vocabulary": false}, {"technique": "T1574.014", "name": "AppDomainManager", "in_vocabulary": false}, {"technique": "T1578", "name": "Modify Cloud Compute Infrastructure", "in_vocabulary": false}, {"technique": "T1578.001", "name": "Create Snapshot", "in_vocabulary": false}, {"technique": "T1578.002", "name": "Create Cloud Instance", "in_vocabulary": false}, {"technique": "T1578.003", "name": "Delete Cloud Instance", "in_vocabulary": false}, {"technique": "T1578.004", "name": "Revert Cloud Instance", "in_vocabulary": false}, {"technique": "T1578.005", "name": "Modify Cloud Compute Configurations", "in_vocabulary": false}, {"technique": "T1580", "name": "Cloud Infrastructure Discovery", "in_vocabulary": false}, {"technique": "T1583", "name": "Acquire Infrastructure", "in_vocabulary": false}, {"technique": "T1583.001", "name": "Domains", "in_vocabulary": false}, {"technique": "T1583.002", "name": "DNS Server", "in_vocabulary": false}, {"technique": "T1583.003", "name": "Virtual Private Server", "in_vocabulary": false}, {"technique": "T1583.004", "name": "Server", "in_vocabulary": false}, {"technique": "T1583.005", "name": "Botnet", "in_vocabulary": false}, {"technique": "T1583.006", "name": "Web Services", "in_vocabulary": false}, {"technique": "T1583.007", "name": "Serverless", "in_vocabulary": false}, {"technique": "T1583.008", "name": "Malvertising", "in_vocabulary": false}, {"technique": "T1584", "name": "Compromise Infrastructure", "in_vocabulary": false}, {"technique": "T1584.001", "name": "Domains", "in_vocabulary": false}, {"technique": "T1584.002", "name": "DNS Server", "in_vocabulary": false}, {"technique": "T1584.003", "name": "Virtual Private Server", "in_vocabulary": false}, {"technique": "T1584.004", "name": "Server", "in_vocabulary": false}, {"technique": "T1584.005", "name": "Botnet", "in_vocabulary": false}, {"technique": "T1584.006", "name": "Web Services", "in_vocabulary": false}, {"technique": "T1584.007", "name": "Serverless", "in_vocabulary": false}, {"technique": "T1584.008", "name": "Network Devices", "in_vocabulary": false}, {"technique": "T1585", "name": "Establish Accounts", "in_vocabulary": false}, {"technique": "T1585.001", "name": "Social Media Accounts", "in_vocabulary": false}, {"technique": "T1585.002", "name": "Email Accounts", "in_vocabulary": false}, {"technique": "T1585.003", "name": "Cloud Accounts", "in_vocabulary": false}, {"technique": "T1586", "name": "Compromise Accounts", "in_vocabulary": false}, {"technique": "T1586.001", "name": "Social Media Accounts", "in_vocabulary": false}, {"technique": "T1586.002", "name": "Email Accounts", "in_vocabulary": false}, {"technique": "T1586.003", "name": "Cloud Accounts", "in_vocabulary": false}, {"technique": "T1587", "name": "Develop Capabilities", "in_vocabulary": false}, {"technique": "T1587.001", "name": "Malware", "in_vocabulary": false}, {"technique": "T1587.002", "name": "Code Signing Certificates", "in_vocabulary": false}, {"technique": "T1587.003", "name": "Digital Certificates", "in_vocabulary": false}, {"technique": "T1587.004", "name": "Exploits", "in_vocabulary": false}, {"technique": "T1588", "name": "Obtain Capabilities", "in_vocabulary": false}, {"technique": "T1588.001", "name": "Malware", "in_vocabulary": false}, {"technique": "T1588.002", "name": "Tool", "in_vocabulary": false}, {"technique": "T1588.003", "name": "Code Signing Certificates", "in_vocabulary": false}, {"technique": "T1588.004", "name": "Digital Certificates", "in_vocabulary": false}, {"technique": "T1588.005", "name": "Exploits", "in_vocabulary": false}, {"technique": "T1588.006", "name": "Vulnerabilities", "in_vocabulary": false}, {"technique": "T1588.007", "name": "Artificial Intelligence", "in_vocabulary": false}, {"technique": "T1589", "name": "Gather Victim Identity Information", "in_vocabulary": false}, {"technique": "T1589.001", "name": "Credentials", "in_vocabulary": false}, {"technique": "T1589.002", "name": "Email Addresses", "in_vocabulary": false}, {"technique": "T1589.003", "name": "Employee Names", "in_vocabulary": false}, {"technique": "T1590", "name": "Gather Victim Network Information", "in_vocabulary": false}, {"technique": "T1590.001", "name": "Domain Properties", "in_vocabulary": false}, {"technique": "T1590.002", "name": "DNS", "in_vocabulary": false}, {"technique": "T1590.003", "name": "Network Trust Dependencies", "in_vocabulary": false}, {"technique": "T1590.004", "name": "Network Topology", "in_vocabulary": false}, {"technique": "T1590.005", "name": "IP Addresses", "in_vocabulary": false}, {"technique": "T1590.006", "name": "Network Security Appliances", "in_vocabulary": false}, {"technique": "T1591", "name": "Gather Victim Org Information", "in_vocabulary": false}, {"technique": "T1591.001", "name": "Determine Physical Locations", "in_vocabulary": false}, {"technique": "T1591.002", "name": "Business Relationships", "in_vocabulary": false}, {"technique": "T1591.003", "name": "Identify Business Tempo", "in_vocabulary": false}, {"technique": "T1591.004", "name": "Identify Roles", "in_vocabulary": false}, {"technique": "T1592", "name": "Gather Victim Host Information", "in_vocabulary": false}, {"technique": "T1592.001", "name": "Hardware", "in_vocabulary": false}, {"technique": "T1592.002", "name": "Software", "in_vocabulary": false}, {"technique": "T1592.003", "name": "Firmware", "in_vocabulary": false}, {"technique": "T1592.004", "name": "Client Configurations", "in_vocabulary": false}, {"technique": "T1593", "name": "Search Open Websites/Domains", "in_vocabulary": false}, {"technique": "T1593.001", "name": "Social Media", "in_vocabulary": false}, {"technique": "T1593.002", "name": "Search Engines", "in_vocabulary": false}, {"technique": "T1593.003", "name": "Code Repositories", "in_vocabulary": false}, {"technique": "T1594", "name": "Search Victim-Owned Websites", "in_vocabulary": false}, {"technique": "T1595", "name": "Active Scanning", "in_vocabulary": false}, {"technique": "T1595.001", "name": "Scanning IP Blocks", "in_vocabulary": false}, {"technique": "T1595.002", "name": "Vulnerability Scanning", "in_vocabulary": false}, {"technique": "T1595.003", "name": "Wordlist Scanning", "in_vocabulary": false}, {"technique": "T1596", "name": "Search Open Technical Databases", "in_vocabulary": false}, {"technique": "T1596.001", "name": "DNS/Passive DNS", "in_vocabulary": false}, {"technique": "T1596.002", "name": "WHOIS", "in_vocabulary": false}, {"technique": "T1596.003", "name": "Digital Certificates", "in_vocabulary": false}, {"technique": "T1596.004", "name": "CDNs", "in_vocabulary": false}, {"technique": "T1596.005", "name": "Scan Databases", "in_vocabulary": false}, {"technique": "T1597", "name": "Search Closed Sources", "in_vocabulary": false}, {"technique": "T1597.001", "name": "Threat Intel Vendors", "in_vocabulary": false}, {"technique": "T1597.002", "name": "Purchase Technical Data", "in_vocabulary": false}, {"technique": "T1598", "name": "Phishing for Information", "in_vocabulary": false}, {"technique": "T1598.001", "name": "Spearphishing Service", "in_vocabulary": false}, {"technique": "T1598.002", "name": "Spearphishing Attachment", "in_vocabulary": false}, {"technique": "T1598.003", "name": "Spearphishing Link", "in_vocabulary": false}, {"technique": "T1598.004", "name": "Spearphishing Voice", "in_vocabulary": false}, {"technique": "T1599", "name": "Network Boundary Bridging", "in_vocabulary": false}, {"technique": "T1599.001", "name": "Network Address Translation Traversal", "in_vocabulary": false}, {"technique": "T1600", "name": "Weaken Encryption", "in_vocabulary": false}, {"technique": "T1600.001", "name": "Reduce Key Space", "in_vocabulary": false}, {"technique": "T1600.002", "name": "Disable Crypto Hardware", "in_vocabulary": false}, {"technique": "T1601", "name": "Modify System Image", "in_vocabulary": false}, {"technique": "T1601.001", "name": "Patch System Image", "in_vocabulary": false}, {"technique": "T1601.002", "name": "Downgrade System Image", "in_vocabulary": false}, {"technique": "T1602", "name": "Data from Configuration Repository", "in_vocabulary": false}, {"technique": "T1602.001", "name": "SNMP (MIB Dump)", "in_vocabulary": false}, {"technique": "T1602.002", "name": "Network Device Configuration Dump", "in_vocabulary": false}, {"technique": "T1606", "name": "Forge Web Credentials", "in_vocabulary": false}, {"technique": "T1606.001", "name": "Web Cookies", "in_vocabulary": false}, {"technique": "T1606.002", "name": "SAML Tokens", "in_vocabulary": false}, {"technique": "T1608", "name": "Stage Capabilities", "in_vocabulary": true}, {"technique": "T1608.001", "name": "Upload Malware", "in_vocabulary": false}, {"technique": "T1608.002", "name": "Upload Tool", "in_vocabulary": false}, {"technique": "T1608.003", "name": "Install Digital Certificate", "in_vocabulary": false}, {"technique": "T1608.004", "name": "Drive-by Target", "in_vocabulary": false}, {"technique": "T1608.005", "name": "Link Target", "in_vocabulary": false}, {"technique": "T1608.006", "name": "SEO Poisoning", "in_vocabulary": false}, {"technique": "T1609", "name": "Container Administration Command", "in_vocabulary": false}, {"technique": "T1610", "name": "Deploy Container", "in_vocabulary": false}, {"technique": "T1611", "name": "Escape to Host", "in_vocabulary": false}, {"technique": "T1612", "name": "Build Image on Host", "in_vocabulary": false}, {"technique": "T1613", "name": "Container and Resource Discovery", "in_vocabulary": false}, {"technique": "T1614", "name": "System Location Discovery", "in_vocabulary": false}, {"technique": "T1614.001", "name": "System Language Discovery", "in_vocabulary": false}, {"technique": "T1615", "name": "Group Policy Discovery", "in_vocabulary": false}, {"technique": "T1619", "name": "Cloud Storage Object Discovery", "in_vocabulary": false}, {"technique": "T1620", "name": "Reflective Code Loading", "in_vocabulary": false}, {"technique": "T1621", "name": "Multi-Factor Authentication Request Generation", "in_vocabulary": false}, {"technique": "T1622", "name": "Debugger Evasion", "in_vocabulary": false}, {"technique": "T1647", "name": "Plist File Modification", "in_vocabulary": false}, {"technique": "T1648", "name": "Serverless Execution", "in_vocabulary": false}, {"technique": "T1649", "name": "Steal or Forge Authentication Certificates", "in_vocabulary": false}, {"technique": "T1650", "name": "Acquire Access", "in_vocabulary": false}, {"technique": "T1651", "name": "Cloud Administration Command", "in_vocabulary": false}, {"technique": "T1652", "name": "Device Driver Discovery", "in_vocabulary": false}, {"technique": "T1653", "name": "Power Settings", "in_vocabulary": false}, {"technique": "T1654", "name": "Log Enumeration", "in_vocabulary": false}, {"technique": "T1657", "name": "Financial Theft", "in_vocabulary": false}, {"technique": "T1659", "name": "Content Injection", "in_vocabulary": false}, {"technique": "T1665", "name": "Hide Infrastructure", "in_vocabulary": false}, {"technique": "T1666", "name": "Modify Cloud Resource Hierarchy", "in_vocabulary": false}, {"technique": "T1667", "name": "Email Bombing", "in_vocabulary": false}, {"technique": "T1668", "name": "Exclusive Control", "in_vocabulary": false}, {"technique": "T1669", "name": "Wi-Fi Networks", "in_vocabulary": false}, {"technique": "T1671", "name": "Cloud Application Integration", "in_vocabulary": false}, {"technique": "T1673", "name": "Virtual Machine Discovery", "in_vocabulary": false}, {"technique": "T1674", "name": "Input Injection", "in_vocabulary": false}, {"technique": "T1675", "name": "ESXi Administration Command", "in_vocabulary": false}, {"technique": "T1677", "name": "Poisoned Pipeline Execution", "in_vocabulary": false}, {"technique": "T1678", "name": "Delay Execution", "in_vocabulary": false}, {"technique": "T1679", "name": "Selective Exclusion", "in_vocabulary": false}, {"technique": "T1680", "name": "Local Storage Discovery", "in_vocabulary": false}, {"technique": "T1681", "name": "Search Threat Vendor Data", "in_vocabulary": false}, {"technique": "T1682", "name": "Query Public AI Services", "in_vocabulary": false}, {"technique": "T1683", "name": "Generate Content", "in_vocabulary": false}, {"technique": "T1683.001", "name": "Written Content", "in_vocabulary": false}, {"technique": "T1683.002", "name": "Audio-Visual Content", "in_vocabulary": false}, {"technique": "T1684", "name": "Social Engineering", "in_vocabulary": false}, {"technique": "T1684.001", "name": "Impersonation", "in_vocabulary": false}, {"technique": "T1684.002", "name": "Email Spoofing", "in_vocabulary": false}, {"technique": "T1685", "name": "Disable or Modify Tools", "in_vocabulary": true}, {"technique": "T1685.001", "name": "Disable or Modify Windows Event Log", "in_vocabulary": false}, {"technique": "T1685.002", "name": "Disable or Modify Cloud Log", "in_vocabulary": false}, {"technique": "T1685.003", "name": "Modify or Spoof Tool UI", "in_vocabulary": false}, {"technique": "T1685.004", "name": "Disable or Modify Linux Audit System Log", "in_vocabulary": false}, {"technique": "T1685.005", "name": "Clear Windows Event Logs", "in_vocabulary": false}, {"technique": "T1685.006", "name": "Clear Linux or Mac System Logs", "in_vocabulary": false}, {"technique": "T1686", "name": "Disable or Modify System Firewall", "in_vocabulary": false}, {"technique": "T1686.001", "name": "Cloud Firewall", "in_vocabulary": false}, {"technique": "T1686.002", "name": "Network Device Firewall", "in_vocabulary": false}, {"technique": "T1686.003", "name": "Windows Host Firewall", "in_vocabulary": false}, {"technique": "T1687", "name": "Exploitation for Defense Impairment", "in_vocabulary": false}, {"technique": "T1688", "name": "Safe Mode Boot", "in_vocabulary": false}, {"technique": "T1689", "name": "Downgrade Attack", "in_vocabulary": false}, {"technique": "T1690", "name": "Prevent Command History Logging", "in_vocabulary": false}], "model": "CIRCL/vulnerability-attack-technique-biencoder", "model_revision": "fb2219fa308ef9b967374267363f9b834a775b17", "error": null}