RAZOR TIGER

T1001 - Data Obfuscation T1003 - OS Credential Dumping T1005 - Data from Local System T1007 T1008 T1010 T1011 - Exfiltration Over Other Network Medium T1012 - Query Registry T1014 - Rootkit T1016 - System Network Configuration Discovery T1018 T1020 T1021 - Remote Services T1027 - Obfuscated Files or Information T1027.004 - Compile After Delivery T1027.010 T1027.013 T1033 - System Owner/User Discovery T1036 - Masquerading T1036.005 T1041 - Exfiltration Over C2 Channel T1047 - Windows Management Instrumentation T1048 T1049 T1053 - Scheduled Task/Job T1055 - Process Injection T1056 - Input Capture T1057 - Process Discovery T1059 - Command and Scripting Interpreter T1059.001 - PowerShell T1059.003 - Windows Command Shell T1059.005 T1059.007 - JavaScript T1060 T1068 - Exploitation for Privilege Escalation T1070 - Indicator Removal on Host T1070.006 T1071 - Application Layer Protocol T1071.001 - Web Protocols T1074 - Data Staged T1074.001 T1078 - Valid Accounts T1081 T1082 - System Information Discovery T1083 - File and Directory Discovery T1085 T1087 T1090 - Proxy T1095 T1102 - Web Service T1104 - Multi-Stage Channels T1105 - Ingress Tool Transfer T1106 T1107 T1110 T1112 T1113 - Screen Capture T1114 T1114.001 T1115 T1119 T1120 T1124 T1127 T1130 T1132 - Data Encoding T1133 - External Remote Services T1134 - Access Token Manipulation T1136 T1137 T1140 - Deobfuscate/Decode Files or Information T1170 T1176 - Browser Extensions T1189 - Drive-by Compromise T1190 - Exploit Public-Facing Application T1192 - Spearphishing Link T1193 - Spearphishing Attachment T1195 T1203 - Exploitation for Client Execution T1204 - User Execution T1204.001 T1204.002 - Malicious File T1216 T1217 T1218 - Signed Binary Proxy Execution T1218.005 T1219 T1221 - Template Injection T1480 - Execution Guardrails T1485 T1486 T1489 T1490 - Inhibit System Recovery T1496 - Resource Hijacking T1497 - Virtualization/Sandbox Evasion T1497.003 T1498 - Network Denial of Service T1503 T1505 - Server Software Component T1518 - Software Discovery T1518.001 - Security Software Discovery T1529 T1530 T1531 T1539 - Steal Web Session Cookie T1542 - Pre-OS Boot T1543 T1546 - Event Triggered Execution T1546.004 T1547 - Boot or Logon Autostart Execution T1547.001 T1548 - Abuse Elevation Control Mechanism T1550 - Use Alternate Authentication Material T1552 T1553 - Subvert Trust Controls T1555 T1559 - Inter-Process Communication T1559.002 T1560 T1561 T1562 T1562.001 T1564 - Hide Artifacts T1564.001 T1566 - Phishing T1566.001 - Spearphishing Attachment T1566.002 - Spearphishing Link T1568 - Dynamic Resolution T1569 T1571 T1572 - Protocol Tunneling T1573 T1574 - Hijack Execution Flow T1574.001 T1574.002 - DLL Side-Loading T1583 - Acquire Infrastructure T1583.001 - Domains T1584 - Compromise Infrastructure T1584.001 - Domains T1587 T1587.001 - Malware T1588 - Obtain Capabilities T1588.002 - Tool T1592 - Gather Victim Host Information T1593 - Search Open Websites/Domains T1595 T1598 - Phishing for Information T1598.002 T1598.003 T1608 - Stage Capabilities TA0003 TA0004 TA0005 TA0006 TA0007 TA0009 TA0011 - Command and Control