UNC3886

T1003 - OS Credential Dumping T1003.001 - LSASS Memory T1005 - Data from Local System T1008 T1014 - Rootkit T1016 T1018 - Remote System Discovery T1021 - Remote Services T1021.004 - SSH T1027 - Obfuscated Files or Information T1027.001 - Binary Padding T1027.005 T1027.013 T1036 - Masquerading T1036.004 - Masquerade Task or Service T1036.005 T1037 T1037.004 T1040 - Network Sniffing T1041 - Exfiltration Over C2 Channel T1049 - System Network Connections Discovery T1053 - Scheduled Task/Job T1055 - Process Injection T1056 - Input Capture T1057 T1059 - Command and Scripting Interpreter T1059.001 - PowerShell T1059.003 T1059.004 - Unix Shell T1059.006 T1059.008 T1059.012 T1068 T1070 - Indicator Removal on Host T1070.002 - Clear Linux or Mac System Logs T1070.004 - File Deletion T1070.006 T1070.007 T1071 - Application Layer Protocol T1071.001 - Web Protocols T1074 - Data Staged T1074.001 T1078 - Valid Accounts T1078.001 T1082 - System Information Discovery T1083 - File and Directory Discovery T1087 - Account Discovery T1090 - Proxy T1090.003 T1095 - Non-Application Layer Protocol T1102 - Web Service T1104 T1105 - Ingress Tool Transfer T1110 - Brute Force T1124 T1133 - External Remote Services T1134 - Access Token Manipulation T1136 - Create Account T1140 - Deobfuscate/Decode Files or Information T1190 - Exploit Public-Facing Application T1203 - Exploitation for Client Execution T1204 - User Execution T1205 - Traffic Signaling T1205.001 T1212 T1218 T1218.011 T1219 - Remote Access Software T1486 - Data Encrypted for Impact T1490 - Inhibit System Recovery T1496 - Resource Hijacking T1497 - Virtualization/Sandbox Evasion T1498 - Network Denial of Service T1505 T1505.003 - Web Shell T1505.006 T1529 - System Shutdown/Reboot T1543 - Create or Modify System Process T1547 - Boot or Logon Autostart Execution T1548 T1552.004 - Private Keys T1553 - Subvert Trust Controls T1553.006 - Code Signing Policy Modification T1554 T1555 - Credentials from Password Stores T1555.005 T1556 - Modify Authentication Process T1560 - Archive Collected Data T1560.001 T1560.003 T1562 - Impair Defenses T1562.001 - Disable or Modify Tools T1562.003 T1562.004 T1563 - Remote Service Session Hijacking T1564 T1564.011 T1570 T1571 - Non-Standard Port T1573 - Encrypted Channel T1573.001 T1587 T1587.001 T1587.004 T1588 T1588.001 T1588.004 T1601 - Modify System Image T1673 T1675 T1681 T1685 T1686 T1690