Kimsuky

T1001 - Data Obfuscation T1002 T1003 - OS Credential Dumping T1003.001 T1005 - Data from Local System T1007 T1008 - Fallback Channels T1010 - Application Window Discovery T1011 - Exfiltration Over Other Network Medium T1012 - Query Registry T1014 - Rootkit T1016 - System Network Configuration Discovery T1018 - Remote System Discovery T1020 - Automated Exfiltration T1021 - Remote Services T1021.001 - Remote Desktop Protocol T1022 T1025 - Data from Removable Media T1027 - Obfuscated Files or Information T1027.001 T1027.002 - Software Packing T1027.007 T1027.010 T1027.012 T1027.013 T1027.015 T1027.016 T1030 - Data Transfer Size Limits T1031 T1033 - System Owner/User Discovery T1036 - Masquerading T1036.002 - Right-to-Left Override T1036.003 - Rename System Utilities T1036.004 T1036.005 - Match Legitimate Name or Location T1036.007 T1037 T1040 T1041 - Exfiltration Over C2 Channel T1045 T1046 T1047 T1049 - System Network Connections Discovery T1053 - Scheduled Task/Job T1053.005 - Scheduled Task T1055 - Process Injection T1055.001 - Dynamic-link Library Injection T1055.012 - Process Hollowing T1056 - Input Capture T1056.001 - Keylogging T1056.003 - Web Portal Capture T1057 - Process Discovery T1059 - Command and Scripting Interpreter T1059.001 - PowerShell T1059.003 - Windows Command Shell T1059.005 - Visual Basic T1059.006 - Python T1059.007 - JavaScript T1060 T1063 T1064 T1068 - Exploitation for Privilege Escalation T1069 - Permission Groups Discovery T1070 - Indicator Removal on Host T1070.004 - File Deletion T1070.006 T1071 - Application Layer Protocol T1071.001 - Web Protocols T1071.002 T1071.003 T1071.004 - DNS T1072 - Software Deployment Tools T1074 - Data Staged T1074.001 - Local Data Staging T1078 - Valid Accounts T1078.003 - Local Accounts T1082 - System Information Discovery T1083 - File and Directory Discovery T1087 - Account Discovery T1087.001 T1090 - Proxy T1090.003 - Multi-hop Proxy T1094 T1095 - Non-Application Layer Protocol T1098 T1098.007 T1102 - Web Service T1102.001 - Dead Drop Resolver T1102.002 T1104 - Multi-Stage Channels T1105 - Ingress Tool Transfer T1106 - Native API T1107 T1110 T1111 T1112 - Modify Registry T1113 - Screen Capture T1114 - Email Collection T1114.002 T1114.003 T1115 - Clipboard Data T1119 T1123 - Audio Capture T1124 - System Time Discovery T1125 - Video Capture T1127 T1129 - Shared Modules T1132 - Data Encoding T1132.001 - Standard Encoding T1132.002 T1133 - External Remote Services T1134 - Access Token Manipulation T1135 - Network Share Discovery T1136 T1136.001 T1137 T1137.001 T1140 - Deobfuscate/Decode Files or Information T1176 - Browser Extensions T1176.001 T1185 T1189 - Drive-by Compromise T1190 - Exploit Public-Facing Application T1192 - Spearphishing Link T1193 T1194 - Spearphishing via Service T1195 - Supply Chain Compromise T1199 - Trusted Relationship T1203 - Exploitation for Client Execution T1204 - User Execution T1204.001 T1204.002 - Malicious File T1204.004 T1205 T1213 T1217 - Browser Bookmark Discovery T1218 - Signed Binary Proxy Execution T1218.005 T1218.010 T1218.011 - Rundll32 T1219 - Remote Access Software T1219.002 T1221 T1404 - Exploit OS Vulnerability T1412 - Capture SMS Messages T1414 T1418 T1420 T1429 - Capture Audio T1432 - Access Contact List T1437 T1442 - Fake Developer Accounts T1449 T1454 T1480 T1480.002 T1486 - Data Encrypted for Impact T1489 - Service Stop T1490 - Inhibit System Recovery T1495 T1496 - Resource Hijacking T1497 - Virtualization/Sandbox Evasion T1497.001 - System Checks T1503 - Credentials from Web Browsers T1505 - Server Software Component T1505.003 T1512 - Capture Camera T1514 - Elevated Execution with Prompt T1518 - Software Discovery T1518.001 - Security Software Discovery T1529 T1530 - Data from Cloud Storage Object T1531 - Account Access Removal T1534 T1539 - Steal Web Session Cookie T1541 T1543 - Create or Modify System Process T1543.003 - Windows Service T1543.004 T1546 - Event Triggered Execution T1546.001 T1547 - Boot or Logon Autostart Execution T1547.001 - Registry Run Keys / Startup Folder T1548 T1550 T1550.002 - Pass the Hash T1552 - Unsecured Credentials T1552.001 T1552.004 T1553 - Subvert Trust Controls T1553.002 T1555 - Credentials from Password Stores T1555.003 - Credentials from Web Browsers T1556 T1557 - Man-in-the-Middle T1559 - Inter-Process Communication T1559.001 T1560 - Archive Collected Data T1560.001 T1560.003 T1562 - Impair Defenses T1562.001 - Disable or Modify Tools T1562.004 T1563 T1564 - Hide Artifacts T1564.002 T1564.003 T1564.011 T1566 - Phishing T1566.001 - Spearphishing Attachment T1566.002 - Spearphishing Link T1567 - Exfiltration Over Web Service T1567.001 - Exfiltration to Code Repository T1567.002 - Exfiltration to Cloud Storage T1568 - Dynamic Resolution T1569 - System Services T1570 - Lateral Tool Transfer T1571 - Non-Standard Port T1573 - Encrypted Channel T1573.001 - Symmetric Cryptography T1574 - Hijack Execution Flow T1574.001 T1574.002 T1582 T1583 - Acquire Infrastructure T1583.001 - Domains T1583.003 - Virtual Private Server T1583.004 - Server T1583.005 T1583.006 T1584 - Compromise Infrastructure T1584.001 T1584.004 - Server T1585 - Establish Accounts T1585.001 - Social Media Accounts T1585.002 T1586 - Compromise Accounts T1586.002 T1587 T1587.001 T1587.003 - Digital Certificates T1588 - Obtain Capabilities T1588.002 - Tool T1588.003 - Code Signing Certificates T1588.004 - Digital Certificates T1588.005 T1589 - Gather Victim Identity Information T1589.001 - Credentials T1589.002 T1589.003 - Employee Names T1590 - Gather Victim Network Information T1590.004 T1591 T1592 - Gather Victim Host Information T1593 T1593.001 T1593.002 T1594 T1596 T1598 - Phishing for Information T1598.003 - Spearphishing Link T1602 - Data from Configuration Repository T1606 - Forge Web Credentials T1608 - Stage Capabilities T1608.001 T1614 T1620 T1656 T1657 T1678 T1680 T1682 T1684 T1684.001 T1685 T1686 TA0003 TA0004 TA0005 TA0006 TA0007 TA0009 TA0011 TA0034 TA0040