{"source":"MITRE ATT&CK Enterprise (attack-stix-data)","tactics":[{"shortname":"reconnaissance","tactic_id":"TA0043","name":"Reconnaissance","ordinal":0},{"shortname":"resource-development","tactic_id":"TA0042","name":"Resource Development","ordinal":1},{"shortname":"initial-access","tactic_id":"TA0001","name":"Initial Access","ordinal":2},{"shortname":"execution","tactic_id":"TA0002","name":"Execution","ordinal":3},{"shortname":"persistence","tactic_id":"TA0003","name":"Persistence","ordinal":4},{"shortname":"privilege-escalation","tactic_id":"TA0004","name":"Privilege Escalation","ordinal":5},{"shortname":"stealth","tactic_id":"TA0005","name":"Stealth","ordinal":6},{"shortname":"defense-impairment","tactic_id":"TA0112","name":"Defense Impairment","ordinal":7},{"shortname":"credential-access","tactic_id":"TA0006","name":"Credential Access","ordinal":8},{"shortname":"discovery","tactic_id":"TA0007","name":"Discovery","ordinal":9},{"shortname":"lateral-movement","tactic_id":"TA0008","name":"Lateral Movement","ordinal":10},{"shortname":"collection","tactic_id":"TA0009","name":"Collection","ordinal":11},{"shortname":"command-and-control","tactic_id":"TA0011","name":"Command and Control","ordinal":12},{"shortname":"exfiltration","tactic_id":"TA0010","name":"Exfiltration","ordinal":13},{"shortname":"impact","tactic_id":"TA0040","name":"Impact","ordinal":14}],"techniques":[{"tid":"T1001","name":"Data Obfuscation","tactics":["command-and-control"],"groups_using":1,"our_events":0},{"tid":"T1003","name":"OS Credential Dumping","tactics":["credential-access"],"groups_using":13,"our_events":1},{"tid":"T1005","name":"Data from Local System","tactics":["collection"],"groups_using":45,"our_events":0},{"tid":"T1006","name":"Direct Volume Access","tactics":["stealth"],"groups_using":2,"our_events":0},{"tid":"T1007","name":"System Service Discovery","tactics":["discovery"],"groups_using":15,"our_events":0},{"tid":"T1008","name":"Fallback Channels","tactics":["command-and-control"],"groups_using":5,"our_events":0},{"tid":"T1010","name":"Application Window Discovery","tactics":["discovery"],"groups_using":3,"our_events":0},{"tid":"T1011","name":"Exfiltration Over Other Network Medium","tactics":["exfiltration"],"groups_using":0,"our_events":0},{"tid":"T1012","name":"Query Registry","tactics":["discovery"],"groups_using":19,"our_events":0},{"tid":"T1014","name":"Rootkit","tactics":["stealth"],"groups_using":6,"our_events":0},{"tid":"T1016","name":"System Network Configuration Discovery","tactics":["discovery"],"groups_using":43,"our_events":0},{"tid":"T1018","name":"Remote System Discovery","tactics":["discovery"],"groups_using":40,"our_events":0},{"tid":"T1020","name":"Automated Exfiltration","tactics":["exfiltration"],"groups_using":7,"our_events":0},{"tid":"T1021","name":"Remote Services","tactics":["lateral-movement"],"groups_using":3,"our_events":0},{"tid":"T1025","name":"Data from Removable Media","tactics":["collection"],"groups_using":4,"our_events":0},{"tid":"T1027","name":"Obfuscated Files or Information","tactics":["stealth"],"groups_using":18,"our_events":2},{"tid":"T1029","name":"Scheduled Transfer","tactics":["exfiltration"],"groups_using":1,"our_events":0},{"tid":"T1030","name":"Data Transfer Size Limits","tactics":["exfiltration"],"groups_using":5,"our_events":0},{"tid":"T1033","name":"System Owner/User Discovery","tactics":["discovery"],"groups_using":40,"our_events":0},{"tid":"T1036","name":"Masquerading","tactics":["stealth"],"groups_using":20,"our_events":0},{"tid":"T1037","name":"Boot or Logon Initialization Scripts","tactics":["persistence","privilege-escalation"],"groups_using":4,"our_events":0},{"tid":"T1039","name":"Data from Network Shared Drive","tactics":["collection"],"groups_using":8,"our_events":0},{"tid":"T1040","name":"Network Sniffing","tactics":["credential-access","discovery"],"groups_using":8,"our_events":0},{"tid":"T1041","name":"Exfiltration Over C2 Channel","tactics":["exfiltration"],"groups_using":27,"our_events":0},{"tid":"T1046","name":"Network Service Discovery","tactics":["discovery"],"groups_using":31,"our_events":0},{"tid":"T1047","name":"Windows Management Instrumentation","tactics":["execution"],"groups_using":42,"our_events":0},{"tid":"T1048","name":"Exfiltration Over Alternative Protocol","tactics":["exfiltration"],"groups_using":2,"our_events":2},{"tid":"T1049","name":"System Network Connections Discovery","tactics":["discovery"],"groups_using":32,"our_events":0},{"tid":"T1052","name":"Exfiltration Over Physical Medium","tactics":["exfiltration"],"groups_using":0,"our_events":0},{"tid":"T1053","name":"Scheduled Task/Job","tactics":["execution","persistence","privilege-escalation"],"groups_using":0,"our_events":0},{"tid":"T1055","name":"Process Injection","tactics":["stealth","privilege-escalation"],"groups_using":15,"our_events":0},{"tid":"T1056","name":"Input Capture","tactics":["collection","credential-access"],"groups_using":3,"our_events":0},{"tid":"T1057","name":"Process Discovery","tactics":["discovery"],"groups_using":41,"our_events":0},{"tid":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"groups_using":17,"our_events":0},{"tid":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"groups_using":22,"our_events":1},{"tid":"T1069","name":"Permission Groups Discovery","tactics":["discovery"],"groups_using":6,"our_events":0},{"tid":"T1070","name":"Indicator Removal","tactics":["stealth"],"groups_using":4,"our_events":0},{"tid":"T1071","name":"Application Layer Protocol","tactics":["command-and-control"],"groups_using":5,"our_events":1},{"tid":"T1072","name":"Software Deployment Tools","tactics":["execution","lateral-movement"],"groups_using":7,"our_events":0},{"tid":"T1074","name":"Data Staged","tactics":["collection"],"groups_using":5,"our_events":1},{"tid":"T1078","name":"Valid Accounts","tactics":["stealth","persistence","privilege-escalation","initial-access"],"groups_using":45,"our_events":1},{"tid":"T1080","name":"Taint Shared Content","tactics":["lateral-movement"],"groups_using":5,"our_events":0},{"tid":"T1082","name":"System Information Discovery","tactics":["discovery"],"groups_using":57,"our_events":0},{"tid":"T1083","name":"File and Directory Discovery","tactics":["discovery"],"groups_using":51,"our_events":0},{"tid":"T1087","name":"Account Discovery","tactics":["discovery"],"groups_using":3,"our_events":1},{"tid":"T1090","name":"Proxy","tactics":["command-and-control"],"groups_using":19,"our_events":1},{"tid":"T1091","name":"Replication Through Removable Media","tactics":["lateral-movement","initial-access"],"groups_using":8,"our_events":0},{"tid":"T1092","name":"Communication Through Removable Media","tactics":["command-and-control"],"groups_using":1,"our_events":0},{"tid":"T1095","name":"Non-Application Layer Protocol","tactics":["command-and-control"],"groups_using":12,"our_events":0},{"tid":"T1098","name":"Account Manipulation","tactics":["persistence","privilege-escalation"],"groups_using":4,"our_events":1},{"tid":"T1102","name":"Web Service","tactics":["command-and-control"],"groups_using":15,"our_events":0},{"tid":"T1104","name":"Multi-Stage Channels","tactics":["command-and-control"],"groups_using":4,"our_events":0},{"tid":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"groups_using":86,"our_events":0},{"tid":"T1106","name":"Native API","tactics":["execution"],"groups_using":20,"our_events":0},{"tid":"T1110","name":"Brute Force","tactics":["credential-access"],"groups_using":15,"our_events":0},{"tid":"T1111","name":"Multi-Factor Authentication Interception","tactics":["credential-access"],"groups_using":4,"our_events":0},{"tid":"T1112","name":"Modify Registry","tactics":["defense-impairment","persistence"],"groups_using":29,"our_events":0},{"tid":"T1113","name":"Screen Capture","tactics":["collection"],"groups_using":19,"our_events":0},{"tid":"T1114","name":"Email Collection","tactics":["collection"],"groups_using":4,"our_events":1},{"tid":"T1115","name":"Clipboard Data","tactics":["collection"],"groups_using":4,"our_events":0},{"tid":"T1119","name":"Automated Collection","tactics":["collection"],"groups_using":21,"our_events":1},{"tid":"T1120","name":"Peripheral Device Discovery","tactics":["discovery"],"groups_using":9,"our_events":0},{"tid":"T1123","name":"Audio Capture","tactics":["collection"],"groups_using":2,"our_events":0},{"tid":"T1124","name":"System Time Discovery","tactics":["discovery"],"groups_using":14,"our_events":0},{"tid":"T1125","name":"Video Capture","tactics":["collection"],"groups_using":4,"our_events":0},{"tid":"T1127","name":"Trusted Developer Utilities Proxy Execution","tactics":["stealth","execution"],"groups_using":0,"our_events":0},{"tid":"T1129","name":"Shared Modules","tactics":["execution"],"groups_using":1,"our_events":0},{"tid":"T1132","name":"Data Encoding","tactics":["command-and-control"],"groups_using":1,"our_events":0},{"tid":"T1133","name":"External Remote Services","tactics":["persistence","initial-access"],"groups_using":28,"our_events":0},{"tid":"T1134","name":"Access Token Manipulation","tactics":["stealth","privilege-escalation"],"groups_using":3,"our_events":0},{"tid":"T1135","name":"Network Share Discovery","tactics":["discovery"],"groups_using":16,"our_events":0},{"tid":"T1136","name":"Create Account","tactics":["persistence"],"groups_using":3,"our_events":0},{"tid":"T1137","name":"Office Application Startup","tactics":["persistence"],"groups_using":2,"our_events":0},{"tid":"T1140","name":"Deobfuscate/Decode Files or Information","tactics":["stealth"],"groups_using":38,"our_events":0},{"tid":"T1176","name":"Software Extensions","tactics":["persistence"],"groups_using":0,"our_events":0},{"tid":"T1185","name":"Browser Session Hijacking","tactics":["collection"],"groups_using":1,"our_events":1},{"tid":"T1187","name":"Forced Authentication","tactics":["credential-access"],"groups_using":2,"our_events":0},{"tid":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"groups_using":31,"our_events":0},{"tid":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"groups_using":44,"our_events":1},{"tid":"T1195","name":"Supply Chain Compromise","tactics":["initial-access"],"groups_using":3,"our_events":0},{"tid":"T1197","name":"BITS Jobs","tactics":["stealth","persistence","execution"],"groups_using":5,"our_events":0},{"tid":"T1199","name":"Trusted Relationship","tactics":["initial-access"],"groups_using":12,"our_events":1},{"tid":"T1200","name":"Hardware Additions","tactics":["initial-access"],"groups_using":1,"our_events":0},{"tid":"T1201","name":"Password Policy Discovery","tactics":["discovery"],"groups_using":3,"our_events":0},{"tid":"T1202","name":"Indirect Command Execution","tactics":["stealth"],"groups_using":2,"our_events":0},{"tid":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"groups_using":41,"our_events":1},{"tid":"T1204","name":"User Execution","tactics":["execution"],"groups_using":2,"our_events":0},{"tid":"T1205","name":"Traffic Signaling","tactics":["stealth","persistence","command-and-control"],"groups_using":3,"our_events":0},{"tid":"T1207","name":"Rogue Domain Controller","tactics":["defense-impairment"],"groups_using":0,"our_events":0},{"tid":"T1210","name":"Exploitation of Remote Services","tactics":["lateral-movement"],"groups_using":11,"our_events":0},{"tid":"T1211","name":"Exploitation for Stealth","tactics":["stealth"],"groups_using":2,"our_events":0},{"tid":"T1212","name":"Exploitation for Credential Access","tactics":["credential-access"],"groups_using":1,"our_events":0},{"tid":"T1213","name":"Data from Information Repositories","tactics":["collection"],"groups_using":1,"our_events":0},{"tid":"T1216","name":"System Script Proxy Execution","tactics":["stealth"],"groups_using":0,"our_events":0},{"tid":"T1217","name":"Browser Information Discovery","tactics":["discovery"],"groups_using":7,"our_events":0},{"tid":"T1218","name":"System Binary Proxy Execution","tactics":["stealth"],"groups_using":2,"our_events":0},{"tid":"T1219","name":"Remote Access Tools","tactics":["command-and-control"],"groups_using":12,"our_events":0},{"tid":"T1220","name":"XSL Script Processing","tactics":["stealth"],"groups_using":2,"our_events":0},{"tid":"T1221","name":"Template Injection","tactics":["stealth"],"groups_using":8,"our_events":0},{"tid":"T1222","name":"File and Directory Permissions Modification","tactics":["defense-impairment"],"groups_using":0,"our_events":0},{"tid":"T1480","name":"Execution Guardrails","tactics":["stealth"],"groups_using":4,"our_events":0},{"tid":"T1482","name":"Domain Trust Discovery","tactics":["discovery"],"groups_using":10,"our_events":0},{"tid":"T1484","name":"Domain or Tenant Policy Modification","tactics":["defense-impairment","privilege-escalation"],"groups_using":0,"our_events":0},{"tid":"T1485","name":"Data Destruction","tactics":["impact"],"groups_using":6,"our_events":0},{"tid":"T1486","name":"Data Encrypted for Impact","tactics":["impact"],"groups_using":18,"our_events":0},{"tid":"T1489","name":"Service Stop","tactics":["impact"],"groups_using":7,"our_events":0},{"tid":"T1490","name":"Inhibit System Recovery","tactics":["impact"],"groups_using":7,"our_events":0},{"tid":"T1491","name":"Defacement","tactics":["impact"],"groups_using":0,"our_events":0},{"tid":"T1495","name":"Firmware Corruption","tactics":["impact"],"groups_using":0,"our_events":0},{"tid":"T1496","name":"Resource Hijacking","tactics":["impact"],"groups_using":0,"our_events":0},{"tid":"T1497","name":"Virtualization/Sandbox Evasion","tactics":["stealth","discovery"],"groups_using":3,"our_events":0},{"tid":"T1498","name":"Network Denial of Service","tactics":["impact"],"groups_using":1,"our_events":0},{"tid":"T1499","name":"Endpoint Denial of Service","tactics":["impact"],"groups_using":1,"our_events":0},{"tid":"T1505","name":"Server Software Component","tactics":["persistence"],"groups_using":0,"our_events":0},{"tid":"T1518","name":"Software Discovery","tactics":["discovery"],"groups_using":11,"our_events":0},{"tid":"T1525","name":"Implant Internal Image","tactics":["persistence"],"groups_using":0,"our_events":0},{"tid":"T1526","name":"Cloud Service Discovery","tactics":["discovery"],"groups_using":1,"our_events":0},{"tid":"T1528","name":"Steal Application Access Token","tactics":["credential-access"],"groups_using":2,"our_events":0},{"tid":"T1529","name":"System Shutdown/Reboot","tactics":["impact"],"groups_using":4,"our_events":0},{"tid":"T1530","name":"Data from Cloud Storage","tactics":["collection"],"groups_using":5,"our_events":0},{"tid":"T1531","name":"Account Access Removal","tactics":["impact"],"groups_using":2,"our_events":0},{"tid":"T1534","name":"Internal Spearphishing","tactics":["lateral-movement"],"groups_using":6,"our_events":0},{"tid":"T1535","name":"Unused/Unsupported Cloud Regions","tactics":["stealth"],"groups_using":0,"our_events":0},{"tid":"T1537","name":"Transfer Data to Cloud Account","tactics":["exfiltration"],"groups_using":3,"our_events":0},{"tid":"T1538","name":"Cloud Service Dashboard","tactics":["discovery"],"groups_using":1,"our_events":0},{"tid":"T1539","name":"Steal Web Session Cookie","tactics":["credential-access"],"groups_using":8,"our_events":0},{"tid":"T1542","name":"Pre-OS Boot","tactics":["stealth","persistence"],"groups_using":0,"our_events":0},{"tid":"T1543","name":"Create or Modify System Process","tactics":["persistence","privilege-escalation"],"groups_using":0,"our_events":0},{"tid":"T1546","name":"Event Triggered Execution","tactics":["privilege-escalation","persistence"],"groups_using":0,"our_events":0},{"tid":"T1547","name":"Boot or Logon Autostart Execution","tactics":["persistence","privilege-escalation"],"groups_using":1,"our_events":0},{"tid":"T1548","name":"Abuse Elevation Control Mechanism","tactics":["privilege-escalation"],"groups_using":1,"our_events":0},{"tid":"T1550","name":"Use Alternate Authentication Material","tactics":["lateral-movement"],"groups_using":0,"our_events":1},{"tid":"T1552","name":"Unsecured Credentials","tactics":["credential-access"],"groups_using":1,"our_events":0},{"tid":"T1553","name":"Subvert Trust Controls","tactics":["defense-impairment"],"groups_using":1,"our_events":0},{"tid":"T1554","name":"Compromise Host Software Binary","tactics":["persistence"],"groups_using":2,"our_events":0},{"tid":"T1555","name":"Credentials from Password Stores","tactics":["credential-access"],"groups_using":12,"our_events":0},{"tid":"T1556","name":"Modify Authentication Process","tactics":["defense-impairment","persistence","credential-access"],"groups_using":1,"our_events":1},{"tid":"T1557","name":"Adversary-in-the-Middle","tactics":["credential-access","collection"],"groups_using":3,"our_events":1},{"tid":"T1558","name":"Steal or Forge Kerberos Tickets","tactics":["credential-access"],"groups_using":1,"our_events":0},{"tid":"T1559","name":"Inter-Process Communication","tactics":["execution"],"groups_using":0,"our_events":0},{"tid":"T1560","name":"Archive Collected Data","tactics":["collection"],"groups_using":13,"our_events":1},{"tid":"T1561","name":"Disk Wipe","tactics":["impact"],"groups_using":0,"our_events":0},{"tid":"T1563","name":"Remote Service Session Hijacking","tactics":["lateral-movement"],"groups_using":0,"our_events":0},{"tid":"T1564","name":"Hide Artifacts","tactics":["stealth"],"groups_using":0,"our_events":0},{"tid":"T1565","name":"Data Manipulation","tactics":["impact"],"groups_using":1,"our_events":0},{"tid":"T1566","name":"Phishing","tactics":["initial-access"],"groups_using":8,"our_events":1},{"tid":"T1567","name":"Exfiltration Over Web Service","tactics":["exfiltration"],"groups_using":4,"our_events":0},{"tid":"T1568","name":"Dynamic Resolution","tactics":["command-and-control"],"groups_using":8,"our_events":0},{"tid":"T1569","name":"System Services","tactics":["execution"],"groups_using":0,"our_events":1},{"tid":"T1570","name":"Lateral Tool Transfer","tactics":["lateral-movement"],"groups_using":19,"our_events":0},{"tid":"T1571","name":"Non-Standard Port","tactics":["command-and-control"],"groups_using":17,"our_events":0},{"tid":"T1572","name":"Protocol Tunneling","tactics":["command-and-control"],"groups_using":15,"our_events":0},{"tid":"T1573","name":"Encrypted Channel","tactics":["command-and-control"],"groups_using":4,"our_events":0},{"tid":"T1574","name":"Hijack Execution Flow","tactics":["stealth","execution"],"groups_using":0,"our_events":0},{"tid":"T1578","name":"Modify Cloud Compute Infrastructure","tactics":["defense-impairment"],"groups_using":0,"our_events":0},{"tid":"T1580","name":"Cloud Infrastructure Discovery","tactics":["discovery"],"groups_using":2,"our_events":0},{"tid":"T1583","name":"Acquire Infrastructure","tactics":["resource-development"],"groups_using":8,"our_events":2},{"tid":"T1584","name":"Compromise Infrastructure","tactics":["resource-development"],"groups_using":0,"our_events":1},{"tid":"T1585","name":"Establish Accounts","tactics":["resource-development"],"groups_using":5,"our_events":0},{"tid":"T1586","name":"Compromise Accounts","tactics":["resource-development"],"groups_using":0,"our_events":0},{"tid":"T1587","name":"Develop Capabilities","tactics":["resource-development"],"groups_using":3,"our_events":1},{"tid":"T1588","name":"Obtain Capabilities","tactics":["resource-development"],"groups_using":0,"our_events":2},{"tid":"T1589","name":"Gather Victim Identity Information","tactics":["reconnaissance"],"groups_using":10,"our_events":1},{"tid":"T1590","name":"Gather Victim Network Information","tactics":["reconnaissance"],"groups_using":3,"our_events":0},{"tid":"T1591","name":"Gather Victim Org Information","tactics":["reconnaissance"],"groups_using":7,"our_events":0},{"tid":"T1592","name":"Gather Victim Host Information","tactics":["reconnaissance"],"groups_using":1,"our_events":0},{"tid":"T1593","name":"Search Open Websites/Domains","tactics":["reconnaissance"],"groups_using":6,"our_events":1},{"tid":"T1594","name":"Search Victim-Owned Websites","tactics":["reconnaissance"],"groups_using":6,"our_events":0},{"tid":"T1595","name":"Active Scanning","tactics":["reconnaissance"],"groups_using":0,"our_events":2},{"tid":"T1596","name":"Search Open Technical Databases","tactics":["reconnaissance"],"groups_using":2,"our_events":1},{"tid":"T1597","name":"Search Closed Sources","tactics":["reconnaissance"],"groups_using":1,"our_events":1},{"tid":"T1598","name":"Phishing for Information","tactics":["reconnaissance"],"groups_using":5,"our_events":0},{"tid":"T1599","name":"Network Boundary Bridging","tactics":["defense-impairment"],"groups_using":1,"our_events":0},{"tid":"T1600","name":"Weaken Encryption","tactics":["defense-impairment"],"groups_using":0,"our_events":0},{"tid":"T1601","name":"Modify System Image","tactics":["defense-impairment"],"groups_using":0,"our_events":0},{"tid":"T1602","name":"Data from Configuration Repository","tactics":["collection"],"groups_using":0,"our_events":1},{"tid":"T1606","name":"Forge Web Credentials","tactics":["credential-access"],"groups_using":0,"our_events":0},{"tid":"T1608","name":"Stage Capabilities","tactics":["resource-development"],"groups_using":1,"our_events":1},{"tid":"T1609","name":"Container Administration Command","tactics":["execution"],"groups_using":1,"our_events":0},{"tid":"T1610","name":"Deploy Container","tactics":["execution"],"groups_using":1,"our_events":0},{"tid":"T1611","name":"Escape to Host","tactics":["privilege-escalation"],"groups_using":1,"our_events":0},{"tid":"T1612","name":"Build Image on Host","tactics":["stealth"],"groups_using":0,"our_events":0},{"tid":"T1613","name":"Container and Resource Discovery","tactics":["discovery"],"groups_using":1,"our_events":0},{"tid":"T1614","name":"System Location Discovery","tactics":["discovery"],"groups_using":2,"our_events":0},{"tid":"T1615","name":"Group Policy Discovery","tactics":["discovery"],"groups_using":1,"our_events":0},{"tid":"T1619","name":"Cloud Storage Object Discovery","tactics":["discovery"],"groups_using":0,"our_events":0},{"tid":"T1620","name":"Reflective Code Loading","tactics":["stealth"],"groups_using":4,"our_events":0},{"tid":"T1621","name":"Multi-Factor Authentication Request Generation","tactics":["credential-access"],"groups_using":3,"our_events":0},{"tid":"T1622","name":"Debugger Evasion","tactics":["stealth","discovery"],"groups_using":1,"our_events":0},{"tid":"T1647","name":"Plist File Modification","tactics":["defense-impairment"],"groups_using":0,"our_events":0},{"tid":"T1648","name":"Serverless Execution","tactics":["execution"],"groups_using":0,"our_events":0},{"tid":"T1649","name":"Steal or Forge Authentication Certificates","tactics":["credential-access"],"groups_using":1,"our_events":0},{"tid":"T1650","name":"Acquire Access","tactics":["resource-development"],"groups_using":1,"our_events":0},{"tid":"T1651","name":"Cloud Administration Command","tactics":["execution"],"groups_using":2,"our_events":0},{"tid":"T1652","name":"Device Driver Discovery","tactics":["discovery"],"groups_using":1,"our_events":0},{"tid":"T1653","name":"Power Settings","tactics":["persistence"],"groups_using":0,"our_events":0},{"tid":"T1654","name":"Log Enumeration","tactics":["discovery"],"groups_using":5,"our_events":0},{"tid":"T1657","name":"Financial Theft","tactics":["impact"],"groups_using":15,"our_events":0},{"tid":"T1659","name":"Content Injection","tactics":["initial-access","command-and-control"],"groups_using":1,"our_events":0},{"tid":"T1665","name":"Hide Infrastructure","tactics":["command-and-control"],"groups_using":2,"our_events":0},{"tid":"T1666","name":"Modify Cloud Resource Hierarchy","tactics":["defense-impairment"],"groups_using":0,"our_events":0},{"tid":"T1667","name":"Email Bombing","tactics":["impact"],"groups_using":1,"our_events":0},{"tid":"T1668","name":"Exclusive Control","tactics":["persistence"],"groups_using":0,"our_events":0},{"tid":"T1669","name":"Wi-Fi Networks","tactics":["initial-access"],"groups_using":1,"our_events":0},{"tid":"T1671","name":"Cloud Application Integration","tactics":["persistence"],"groups_using":0,"our_events":0},{"tid":"T1673","name":"Virtual Machine Discovery","tactics":["discovery"],"groups_using":1,"our_events":0},{"tid":"T1674","name":"Input Injection","tactics":["execution"],"groups_using":1,"our_events":0},{"tid":"T1675","name":"ESXi Administration Command","tactics":["execution"],"groups_using":1,"our_events":0},{"tid":"T1677","name":"Poisoned Pipeline Execution","tactics":["execution"],"groups_using":0,"our_events":0},{"tid":"T1678","name":"Delay Execution","tactics":["stealth"],"groups_using":2,"our_events":0},{"tid":"T1679","name":"Selective Exclusion","tactics":["stealth"],"groups_using":1,"our_events":0},{"tid":"T1680","name":"Local Storage Discovery","tactics":["discovery"],"groups_using":10,"our_events":0},{"tid":"T1681","name":"Search Threat Vendor Data","tactics":["reconnaissance"],"groups_using":2,"our_events":0},{"tid":"T1682","name":"Query Public AI Services","tactics":["reconnaissance"],"groups_using":2,"our_events":0},{"tid":"T1683","name":"Generate Content","tactics":["resource-development"],"groups_using":0,"our_events":0},{"tid":"T1684","name":"Social Engineering","tactics":["stealth"],"groups_using":0,"our_events":0},{"tid":"T1685","name":"Disable or Modify Tools","tactics":["defense-impairment"],"groups_using":32,"our_events":0},{"tid":"T1686","name":"Disable or Modify System Firewall","tactics":["defense-impairment"],"groups_using":13,"our_events":0},{"tid":"T1687","name":"Exploitation for Defense Impairment","tactics":["defense-impairment"],"groups_using":0,"our_events":0},{"tid":"T1688","name":"Safe Mode Boot","tactics":["defense-impairment"],"groups_using":0,"our_events":0},{"tid":"T1689","name":"Downgrade Attack","tactics":["defense-impairment"],"groups_using":0,"our_events":0},{"tid":"T1690","name":"Prevent Command History Logging","tactics":["defense-impairment"],"groups_using":4,"our_events":0}]}