UNC5291

T1003 T1003.001 T1003.003 T1005 T1006 T1007 T1010 T1012 T1016 T1016.001 T1018 T1021 T1021.001 T1027 T1027.002 T1033 T1036 - Masquerading T1036.004 T1036.005 T1036.008 T1046 T1047 T1049 T1053 - Scheduled Task/Job T1055 - Process Injection T1055.009 T1056 - Input Capture T1056.001 T1057 T1059 T1059.001 T1059.003 T1059.004 T1068 T1069 T1069.001 T1069.002 T1070 T1070.001 T1070.004 T1070.007 T1071 T1071.001 T1074 T1074.001 T1078 T1078.002 T1082 T1083 T1087 T1087.001 T1087.002 T1090 T1090.001 T1090.003 T1095 T1105 T1112 T1113 T1120 T1124 - System Time Discovery T1133 T1140 - Deobfuscate/Decode Files or Information T1190 T1217 T1218 T1222 T1222.002 T1497 T1497.001 T1505 T1505.003 T1518 T1518.001 T1543 - Create or Modify System Process T1546 - Event Triggered Execution T1550 - Use Alternate Authentication Material T1552 T1552.004 T1555 T1555.003 T1560 T1560.001 T1562 - Impair Defenses T1562.001 T1564 T1564.013 T1566 T1570 T1571 T1573 T1573.001 T1573.002 T1583 T1583.003 T1584 T1584.003 T1584.004 T1584.005 T1584.008 T1587 T1587.001 T1587.004 T1588 T1588.002 T1588.006 T1589 T1589.002 T1590 T1590.004 T1590.006 T1591 T1591.004 T1592 T1593 T1594 T1596 T1596.005 T1614 T1654 T1680