SCATTERED SPIDER

T1001 T1001.003 T1003 - OS Credential Dumping T1003.001 - LSASS Memory T1003.002 T1003.003 T1003.006 - DCSync T1005 - Data from Local System T1006 T1008 T1011 T1012 - Query Registry T1014 T1016 - System Network Configuration Discovery T1018 - Remote System Discovery T1021 - Remote Services T1021.001 - Remote Desktop Protocol T1021.002 T1021.004 T1021.007 T1027 - Obfuscated Files or Information T1027.002 T1027.013 T1029 - Scheduled Transfer T1030 T1033 T1036 - Masquerading T1036.004 T1036.005 T1037 T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1048 - Exfiltration Over Alternative Protocol T1048.003 T1049 - System Network Connections Discovery T1053 - Scheduled Task/Job T1053.005 - Scheduled Task T1055 - Process Injection T1056 - Input Capture T1056.001 T1057 - Process Discovery T1059 - Command and Scripting Interpreter T1059.001 - PowerShell T1059.003 - Windows Command Shell T1059.004 T1059.006 - Python T1059.007 T1068 - Exploitation for Privilege Escalation T1069 T1069.002 T1069.003 T1070 - Indicator Removal on Host T1070.001 - Clear Windows Event Logs T1070.003 T1070.004 T1070.008 T1071 - Application Layer Protocol T1071.001 - Web Protocols T1071.002 T1071.004 T1074 - Data Staged T1074.001 T1078 - Valid Accounts T1078.001 - Default Accounts T1078.002 - Domain Accounts T1078.003 - Local Accounts T1078.004 - Cloud Accounts T1082 - System Information Discovery T1083 - File and Directory Discovery T1087 - Account Discovery T1087.001 T1087.002 T1087.003 T1087.004 T1089 T1090 - Proxy T1098 T1098.001 - Additional Cloud Credentials T1098.003 T1098.005 T1098.007 T1102 - Web Service T1102.001 T1104 - Multi-Stage Channels T1105 - Ingress Tool Transfer T1106 - Native API T1110 - Brute Force T1110.001 - Password Guessing T1110.002 - Password Cracking T1110.003 - Password Spraying T1110.004 - Credential Stuffing T1111 - Two-Factor Authentication Interception T1112 T1113 - Screen Capture T1114 T1114.003 T1115 - Clipboard Data T1119 - Automated Collection T1127 - Trusted Developer Utilities Proxy Execution T1127.001 - MSBuild T1132 - Data Encoding T1132.001 - Standard Encoding T1133 - External Remote Services T1134 - Access Token Manipulation T1135 - Network Share Discovery T1136 - Create Account T1136.001 - Local Account T1136.003 - Cloud Account T1140 - Deobfuscate/Decode Files or Information T1176 T1190 - Exploit Public-Facing Application T1195 - Supply Chain Compromise T1195.002 T1197 T1199 - Trusted Relationship T1203 T1204 - User Execution T1204.002 - Malicious File T1210 - Exploitation of Remote Services T1212 - Exploitation for Credential Access T1213 - Data from Information Repositories T1213.002 T1213.003 T1213.005 T1213.006 T1217 T1218 T1218.001 T1218.011 T1219 - Remote Access Software T1219.002 T1222.001 - Windows File and Directory Permissions Modification T1480 T1480.001 T1484 T1484.001 T1484.002 T1486 - Data Encrypted for Impact T1490 - Inhibit System Recovery T1496 - Resource Hijacking T1496.001 T1498 - Network Denial of Service T1505 - Server Software Component T1505.003 T1518 - Software Discovery T1526 - Cloud Service Discovery T1528 - Steal Application Access Token T1529 - System Shutdown/Reboot T1530 - Data from Cloud Storage Object T1531 T1538 T1539 - Steal Web Session Cookie T1542 T1542.003 T1543 - Create or Modify System Process T1543.002 T1543.003 T1546 T1546.008 T1547 - Boot or Logon Autostart Execution T1547.001 - Registry Run Keys / Startup Folder T1548 - Abuse Elevation Control Mechanism T1550 T1550.002 T1552 - Unsecured Credentials T1552.001 T1552.004 T1553 - Subvert Trust Controls T1553.002 T1553.005 - Mark-of-the-Web Bypass T1555 - Credentials from Password Stores T1555.003 T1555.005 T1556 T1556.006 T1556.009 T1557 - Man-in-the-Middle T1560 - Archive Collected Data T1560.001 T1560.003 T1562 - Impair Defenses T1562.001 - Disable or Modify Tools T1562.002 - Disable Windows Event Logging T1562.004 - Disable or Modify System Firewall T1562.006 T1564 T1564.008 T1565 - Data Manipulation T1566 - Phishing T1566.001 - Spearphishing Attachment T1566.002 - Spearphishing Link T1566.003 - Spearphishing via Service T1566.004 T1567 - Exfiltration Over Web Service T1567.002 T1568 T1568.002 T1569 T1569.002 T1570 - Lateral Tool Transfer T1571 - Non-Standard Port T1572 - Protocol Tunneling T1573 - Encrypted Channel T1573.002 T1574 - Hijack Execution Flow T1574.001 T1574.002 - DLL Side-Loading T1574.006 T1578 - Modify Cloud Compute Infrastructure T1578.002 T1580 T1583 - Acquire Infrastructure T1583.001 - Domains T1583.006 - Web Services T1583.007 T1584 - Compromise Infrastructure T1584.001 - Domains T1584.006 - Web Services T1585 - Establish Accounts T1585.001 T1586 - Compromise Accounts T1586.002 - Email Accounts T1586.003 T1588 - Obtain Capabilities T1588.001 T1588.002 T1588.003 T1588.005 - Exploits T1588.006 - Vulnerabilities T1589 - Gather Victim Identity Information T1589.001 T1589.002 - Email Addresses T1591 - Gather Victim Org Information T1591.002 - Business Relationships T1592.002 - Software T1593 T1593.002 T1594 T1595 T1595.002 T1595.003 T1596 T1596.005 T1598 T1598.001 T1598.003 T1598.004 T1599 T1606 - Forge Web Credentials T1608 - Stage Capabilities T1621 T1656 T1657 T1680 T1684 T1684.001 T1685