ATTCK2FHIR Implementation Guide - Local Development build (v0.0.5) built by the FHIR (HL7® FHIR® Standard) Build Tools. See the Directory of published versions

• Narrative Content
• XML
• JSON
• TTL

: CS MITRE ATT&CK Techniques and Subtechniques

Draft as of 2026-04-26

Raw json | Download

{
  "resourceType" : "CodeSystem",
  "id" : "MITRE-ATTCK-Techniques",
  "language" : "en",
  "text" : {
    "status" : "generated",
    "div" : "<div xmlns=\"http://www.w3.org/1999/xhtml\"><p class=\"res-header-id\"><b>Generated Narrative: CodeSystem MITRE-ATTCK-Techniques</b></p><a name=\"MITRE-ATTCK-Techniques\"> </a><a name=\"hcMITRE-ATTCK-Techniques\"> </a><p><b>Properties</b></p><p><b>This code system defines the following properties for its concepts</b></p><table class=\"grid\"><tr><td><b>Name</b></td><td><b>Code</b></td><td><b>URI</b></td><td><b>Type</b></td><td><b>Description</b></td></tr><tr><td>tactic</td><td>tactic</td><td>https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Tactics</td><td>code</td><td>The tactic(s) this technique or subtechnique contributes to, referenced by tactic ID</td></tr><tr><td>parentTechnique</td><td>parentTechnique</td><td>https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Techniques</td><td>code</td><td>The parent technique of this subtechnique, referenced by ATT&amp;CK ID</td></tr><tr><td>isSubtechnique</td><td>isSubtechnique</td><td/><td>boolean</td><td>Whether this concept is a subtechnique</td></tr></table><p><b>Concepts</b></p><p>This case-sensitive code system <code>https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Techniques</code> defines the following codes:</p><table class=\"codes\"><tr><td style=\"white-space:nowrap\"><b>Code</b></td><td><b>Display</b></td><td><b>tactic</b></td><td><b>parentTechnique</b></td><td><b>isSubtechnique</b></td></tr><tr><td style=\"white-space:nowrap\">T1047<a name=\"MITRE-ATTCK-Techniques-T1047\"> </a></td><td>Windows Management Instrumentation</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1113<a name=\"MITRE-ATTCK-Techniques-T1113\"> </a></td><td>Screen Capture</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1037<a name=\"MITRE-ATTCK-Techniques-T1037\"> </a></td><td>Boot or Logon Initialization Scripts</td><td>TA0003, TA0004</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1037.004<a name=\"MITRE-ATTCK-Techniques-T1037.46004\"> </a></td><td>RC Scripts</td><td>TA0003, TA0004</td><td>T1037</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1037.001<a name=\"MITRE-ATTCK-Techniques-T1037.46001\"> </a></td><td>Logon Script (Windows)</td><td>TA0003, TA0004</td><td>T1037</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1037.003<a name=\"MITRE-ATTCK-Techniques-T1037.46003\"> </a></td><td>Network Logon Script</td><td>TA0003, TA0004</td><td>T1037</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1037.005<a name=\"MITRE-ATTCK-Techniques-T1037.46005\"> </a></td><td>Startup Items</td><td>TA0003, TA0004</td><td>T1037</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1037.002<a name=\"MITRE-ATTCK-Techniques-T1037.46002\"> </a></td><td>Login Hook</td><td>TA0003, TA0004</td><td>T1037</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1557<a name=\"MITRE-ATTCK-Techniques-T1557\"> </a></td><td>Adversary-in-the-Middle</td><td>TA0006, TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1557.003<a name=\"MITRE-ATTCK-Techniques-T1557.46003\"> </a></td><td>DHCP Spoofing</td><td>TA0006, TA0009</td><td>T1557</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1557.002<a name=\"MITRE-ATTCK-Techniques-T1557.46002\"> </a></td><td>ARP Cache Poisoning</td><td>TA0006, TA0009</td><td>T1557</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1557.001<a name=\"MITRE-ATTCK-Techniques-T1557.46001\"> </a></td><td>LLMNR/NBT-NS Poisoning and SMB Relay</td><td>TA0006, TA0009</td><td>T1557</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1557.004<a name=\"MITRE-ATTCK-Techniques-T1557.46004\"> </a></td><td>Evil Twin</td><td>TA0006, TA0009</td><td>T1557</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1033<a name=\"MITRE-ATTCK-Techniques-T1033\"> </a></td><td>System Owner/User Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1583<a name=\"MITRE-ATTCK-Techniques-T1583\"> </a></td><td>Acquire Infrastructure</td><td>TA0042</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1583.008<a name=\"MITRE-ATTCK-Techniques-T1583.46008\"> </a></td><td>Malvertising</td><td>TA0042</td><td>T1583</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1583.001<a name=\"MITRE-ATTCK-Techniques-T1583.46001\"> </a></td><td>Domains</td><td>TA0042</td><td>T1583</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1583.005<a name=\"MITRE-ATTCK-Techniques-T1583.46005\"> </a></td><td>Botnet</td><td>TA0042</td><td>T1583</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1583.004<a name=\"MITRE-ATTCK-Techniques-T1583.46004\"> </a></td><td>Server</td><td>TA0042</td><td>T1583</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1583.002<a name=\"MITRE-ATTCK-Techniques-T1583.46002\"> </a></td><td>DNS Server</td><td>TA0042</td><td>T1583</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1583.003<a name=\"MITRE-ATTCK-Techniques-T1583.46003\"> </a></td><td>Virtual Private Server</td><td>TA0042</td><td>T1583</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1583.007<a name=\"MITRE-ATTCK-Techniques-T1583.46007\"> </a></td><td>Serverless</td><td>TA0042</td><td>T1583</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1583.006<a name=\"MITRE-ATTCK-Techniques-T1583.46006\"> </a></td><td>Web Services</td><td>TA0042</td><td>T1583</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1613<a name=\"MITRE-ATTCK-Techniques-T1613\"> </a></td><td>Container and Resource Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1592<a name=\"MITRE-ATTCK-Techniques-T1592\"> </a></td><td>Gather Victim Host Information</td><td>TA0043</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1592.001<a name=\"MITRE-ATTCK-Techniques-T1592.46001\"> </a></td><td>Hardware</td><td>TA0043</td><td>T1592</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1592.003<a name=\"MITRE-ATTCK-Techniques-T1592.46003\"> </a></td><td>Firmware</td><td>TA0043</td><td>T1592</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1592.002<a name=\"MITRE-ATTCK-Techniques-T1592.46002\"> </a></td><td>Software</td><td>TA0043</td><td>T1592</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1592.004<a name=\"MITRE-ATTCK-Techniques-T1592.46004\"> </a></td><td>Client Configurations</td><td>TA0043</td><td>T1592</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1003<a name=\"MITRE-ATTCK-Techniques-T1003\"> </a></td><td>OS Credential Dumping</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1003.002<a name=\"MITRE-ATTCK-Techniques-T1003.46002\"> </a></td><td>Security Account Manager</td><td>TA0006</td><td>T1003</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1003.004<a name=\"MITRE-ATTCK-Techniques-T1003.46004\"> </a></td><td>LSA Secrets</td><td>TA0006</td><td>T1003</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1003.006<a name=\"MITRE-ATTCK-Techniques-T1003.46006\"> </a></td><td>DCSync</td><td>TA0006</td><td>T1003</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1003.007<a name=\"MITRE-ATTCK-Techniques-T1003.46007\"> </a></td><td>Proc Filesystem</td><td>TA0006</td><td>T1003</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1003.003<a name=\"MITRE-ATTCK-Techniques-T1003.46003\"> </a></td><td>NTDS</td><td>TA0006</td><td>T1003</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1003.005<a name=\"MITRE-ATTCK-Techniques-T1003.46005\"> </a></td><td>Cached Domain Credentials</td><td>TA0006</td><td>T1003</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1003.001<a name=\"MITRE-ATTCK-Techniques-T1003.46001\"> </a></td><td>LSASS Memory</td><td>TA0006</td><td>T1003</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1003.008<a name=\"MITRE-ATTCK-Techniques-T1003.46008\"> </a></td><td>/etc/passwd and /etc/shadow</td><td>TA0006</td><td>T1003</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1129<a name=\"MITRE-ATTCK-Techniques-T1129\"> </a></td><td>Shared Modules</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1602<a name=\"MITRE-ATTCK-Techniques-T1602\"> </a></td><td>Data from Configuration Repository</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1602.002<a name=\"MITRE-ATTCK-Techniques-T1602.46002\"> </a></td><td>Network Device Configuration Dump</td><td>TA0009</td><td>T1602</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1602.001<a name=\"MITRE-ATTCK-Techniques-T1602.46001\"> </a></td><td>SNMP (MIB Dump)</td><td>TA0009</td><td>T1602</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1006<a name=\"MITRE-ATTCK-Techniques-T1006\"> </a></td><td>Direct Volume Access</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1666<a name=\"MITRE-ATTCK-Techniques-T1666\"> </a></td><td>Modify Cloud Resource Hierarchy</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1014<a name=\"MITRE-ATTCK-Techniques-T1014\"> </a></td><td>Rootkit</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1123<a name=\"MITRE-ATTCK-Techniques-T1123\"> </a></td><td>Audio Capture</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1543<a name=\"MITRE-ATTCK-Techniques-T1543\"> </a></td><td>Create or Modify System Process</td><td>TA0003, TA0004</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1543.004<a name=\"MITRE-ATTCK-Techniques-T1543.46004\"> </a></td><td>Launch Daemon</td><td>TA0003, TA0004</td><td>T1543</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1543.005<a name=\"MITRE-ATTCK-Techniques-T1543.46005\"> </a></td><td>Container Service</td><td>TA0003, TA0004</td><td>T1543</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1543.001<a name=\"MITRE-ATTCK-Techniques-T1543.46001\"> </a></td><td>Launch Agent</td><td>TA0003, TA0004</td><td>T1543</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1543.002<a name=\"MITRE-ATTCK-Techniques-T1543.46002\"> </a></td><td>Systemd Service</td><td>TA0003, TA0004</td><td>T1543</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1543.003<a name=\"MITRE-ATTCK-Techniques-T1543.46003\"> </a></td><td>Windows Service</td><td>TA0003, TA0004</td><td>T1543</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1133<a name=\"MITRE-ATTCK-Techniques-T1133\"> </a></td><td>External Remote Services</td><td>TA0003, TA0001</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1539<a name=\"MITRE-ATTCK-Techniques-T1539\"> </a></td><td>Steal Web Session Cookie</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1578<a name=\"MITRE-ATTCK-Techniques-T1578\"> </a></td><td>Modify Cloud Compute Infrastructure</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1578.001<a name=\"MITRE-ATTCK-Techniques-T1578.46001\"> </a></td><td>Create Snapshot</td><td>TA0005</td><td>T1578</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1578.003<a name=\"MITRE-ATTCK-Techniques-T1578.46003\"> </a></td><td>Delete Cloud Instance</td><td>TA0005</td><td>T1578</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1578.004<a name=\"MITRE-ATTCK-Techniques-T1578.46004\"> </a></td><td>Revert Cloud Instance</td><td>TA0005</td><td>T1578</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1578.002<a name=\"MITRE-ATTCK-Techniques-T1578.46002\"> </a></td><td>Create Cloud Instance</td><td>TA0005</td><td>T1578</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1578.005<a name=\"MITRE-ATTCK-Techniques-T1578.46005\"> </a></td><td>Modify Cloud Compute Configurations</td><td>TA0005</td><td>T1578</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1069<a name=\"MITRE-ATTCK-Techniques-T1069\"> </a></td><td>Permission Groups Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1069.003<a name=\"MITRE-ATTCK-Techniques-T1069.46003\"> </a></td><td>Cloud Groups</td><td>TA0007</td><td>T1069</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1069.002<a name=\"MITRE-ATTCK-Techniques-T1069.46002\"> </a></td><td>Domain Groups</td><td>TA0007</td><td>T1069</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1069.001<a name=\"MITRE-ATTCK-Techniques-T1069.46001\"> </a></td><td>Local Groups</td><td>TA0007</td><td>T1069</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1114<a name=\"MITRE-ATTCK-Techniques-T1114\"> </a></td><td>Email Collection</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1114.002<a name=\"MITRE-ATTCK-Techniques-T1114.46002\"> </a></td><td>Remote Email Collection</td><td>TA0009</td><td>T1114</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1114.003<a name=\"MITRE-ATTCK-Techniques-T1114.46003\"> </a></td><td>Email Forwarding Rule</td><td>TA0009</td><td>T1114</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1114.001<a name=\"MITRE-ATTCK-Techniques-T1114.46001\"> </a></td><td>Local Email Collection</td><td>TA0009</td><td>T1114</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1594<a name=\"MITRE-ATTCK-Techniques-T1594\"> </a></td><td>Search Victim-Owned Websites</td><td>TA0043</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1561<a name=\"MITRE-ATTCK-Techniques-T1561\"> </a></td><td>Disk Wipe</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1561.002<a name=\"MITRE-ATTCK-Techniques-T1561.46002\"> </a></td><td>Disk Structure Wipe</td><td>TA0040</td><td>T1561</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1561.001<a name=\"MITRE-ATTCK-Techniques-T1561.46001\"> </a></td><td>Disk Content Wipe</td><td>TA0040</td><td>T1561</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1615<a name=\"MITRE-ATTCK-Techniques-T1615\"> </a></td><td>Group Policy Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1025<a name=\"MITRE-ATTCK-Techniques-T1025\"> </a></td><td>Data from Removable Media</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1547<a name=\"MITRE-ATTCK-Techniques-T1547\"> </a></td><td>Boot or Logon Autostart Execution</td><td>TA0003, TA0004</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1547.009<a name=\"MITRE-ATTCK-Techniques-T1547.46009\"> </a></td><td>Shortcut Modification</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.006<a name=\"MITRE-ATTCK-Techniques-T1547.46006\"> </a></td><td>Kernel Modules and Extensions</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.007<a name=\"MITRE-ATTCK-Techniques-T1547.46007\"> </a></td><td>Re-opened Applications</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.004<a name=\"MITRE-ATTCK-Techniques-T1547.46004\"> </a></td><td>Winlogon Helper DLL</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.005<a name=\"MITRE-ATTCK-Techniques-T1547.46005\"> </a></td><td>Security Support Provider</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.001<a name=\"MITRE-ATTCK-Techniques-T1547.46001\"> </a></td><td>Registry Run Keys / Startup Folder</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.008<a name=\"MITRE-ATTCK-Techniques-T1547.46008\"> </a></td><td>LSASS Driver</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.012<a name=\"MITRE-ATTCK-Techniques-T1547.46012\"> </a></td><td>Print Processors</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.014<a name=\"MITRE-ATTCK-Techniques-T1547.46014\"> </a></td><td>Active Setup</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.015<a name=\"MITRE-ATTCK-Techniques-T1547.46015\"> </a></td><td>Login Items</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.013<a name=\"MITRE-ATTCK-Techniques-T1547.46013\"> </a></td><td>XDG Autostart Entries</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.003<a name=\"MITRE-ATTCK-Techniques-T1547.46003\"> </a></td><td>Time Providers</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.002<a name=\"MITRE-ATTCK-Techniques-T1547.46002\"> </a></td><td>Authentication Package</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.010<a name=\"MITRE-ATTCK-Techniques-T1547.46010\"> </a></td><td>Port Monitors</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1600<a name=\"MITRE-ATTCK-Techniques-T1600\"> </a></td><td>Weaken Encryption</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1600.001<a name=\"MITRE-ATTCK-Techniques-T1600.46001\"> </a></td><td>Reduce Key Space</td><td>TA0005</td><td>T1600</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1600.002<a name=\"MITRE-ATTCK-Techniques-T1600.46002\"> </a></td><td>Disable Crypto Hardware</td><td>TA0005</td><td>T1600</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1489<a name=\"MITRE-ATTCK-Techniques-T1489\"> </a></td><td>Service Stop</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1652<a name=\"MITRE-ATTCK-Techniques-T1652\"> </a></td><td>Device Driver Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1564<a name=\"MITRE-ATTCK-Techniques-T1564\"> </a></td><td>Hide Artifacts</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1564.003<a name=\"MITRE-ATTCK-Techniques-T1564.46003\"> </a></td><td>Hidden Window</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.011<a name=\"MITRE-ATTCK-Techniques-T1564.46011\"> </a></td><td>Ignore Process Interrupts</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.002<a name=\"MITRE-ATTCK-Techniques-T1564.46002\"> </a></td><td>Hidden Users</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.012<a name=\"MITRE-ATTCK-Techniques-T1564.46012\"> </a></td><td>File/Path Exclusions</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.014<a name=\"MITRE-ATTCK-Techniques-T1564.46014\"> </a></td><td>Extended Attributes</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.008<a name=\"MITRE-ATTCK-Techniques-T1564.46008\"> </a></td><td>Email Hiding Rules</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.009<a name=\"MITRE-ATTCK-Techniques-T1564.46009\"> </a></td><td>Resource Forking</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.013<a name=\"MITRE-ATTCK-Techniques-T1564.46013\"> </a></td><td>Bind Mounts</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.006<a name=\"MITRE-ATTCK-Techniques-T1564.46006\"> </a></td><td>Run Virtual Instance</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.010<a name=\"MITRE-ATTCK-Techniques-T1564.46010\"> </a></td><td>Process Argument Spoofing</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.001<a name=\"MITRE-ATTCK-Techniques-T1564.46001\"> </a></td><td>Hidden Files and Directories</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.004<a name=\"MITRE-ATTCK-Techniques-T1564.46004\"> </a></td><td>NTFS File Attributes</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.007<a name=\"MITRE-ATTCK-Techniques-T1564.46007\"> </a></td><td>VBA Stomping</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.005<a name=\"MITRE-ATTCK-Techniques-T1564.46005\"> </a></td><td>Hidden File System</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1080<a name=\"MITRE-ATTCK-Techniques-T1080\"> </a></td><td>Taint Shared Content</td><td>TA0008</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1137<a name=\"MITRE-ATTCK-Techniques-T1137\"> </a></td><td>Office Application Startup</td><td>TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1137.002<a name=\"MITRE-ATTCK-Techniques-T1137.46002\"> </a></td><td>Office Test</td><td>TA0003</td><td>T1137</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1137.001<a name=\"MITRE-ATTCK-Techniques-T1137.46001\"> </a></td><td>Office Template Macros</td><td>TA0003</td><td>T1137</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1137.004<a name=\"MITRE-ATTCK-Techniques-T1137.46004\"> </a></td><td>Outlook Home Page</td><td>TA0003</td><td>T1137</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1137.003<a name=\"MITRE-ATTCK-Techniques-T1137.46003\"> </a></td><td>Outlook Forms</td><td>TA0003</td><td>T1137</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1137.006<a name=\"MITRE-ATTCK-Techniques-T1137.46006\"> </a></td><td>Add-ins</td><td>TA0003</td><td>T1137</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1137.005<a name=\"MITRE-ATTCK-Techniques-T1137.46005\"> </a></td><td>Outlook Rules</td><td>TA0003</td><td>T1137</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1119<a name=\"MITRE-ATTCK-Techniques-T1119\"> </a></td><td>Automated Collection</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1115<a name=\"MITRE-ATTCK-Techniques-T1115\"> </a></td><td>Clipboard Data</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1675<a name=\"MITRE-ATTCK-Techniques-T1675\"> </a></td><td>ESXi Administration Command</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1007<a name=\"MITRE-ATTCK-Techniques-T1007\"> </a></td><td>System Service Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1040<a name=\"MITRE-ATTCK-Techniques-T1040\"> </a></td><td>Network Sniffing</td><td>TA0006, TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1530<a name=\"MITRE-ATTCK-Techniques-T1530\"> </a></td><td>Data from Cloud Storage</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1135<a name=\"MITRE-ATTCK-Techniques-T1135\"> </a></td><td>Network Share Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1120<a name=\"MITRE-ATTCK-Techniques-T1120\"> </a></td><td>Peripheral Device Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1082<a name=\"MITRE-ATTCK-Techniques-T1082\"> </a></td><td>System Information Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1071<a name=\"MITRE-ATTCK-Techniques-T1071\"> </a></td><td>Application Layer Protocol</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1071.002<a name=\"MITRE-ATTCK-Techniques-T1071.46002\"> </a></td><td>File Transfer Protocols</td><td>TA0011</td><td>T1071</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1071.004<a name=\"MITRE-ATTCK-Techniques-T1071.46004\"> </a></td><td>DNS</td><td>TA0011</td><td>T1071</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1071.005<a name=\"MITRE-ATTCK-Techniques-T1071.46005\"> </a></td><td>Publish/Subscribe Protocols</td><td>TA0011</td><td>T1071</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1071.003<a name=\"MITRE-ATTCK-Techniques-T1071.46003\"> </a></td><td>Mail Protocols</td><td>TA0011</td><td>T1071</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1071.001<a name=\"MITRE-ATTCK-Techniques-T1071.46001\"> </a></td><td>Web Protocols</td><td>TA0011</td><td>T1071</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1053<a name=\"MITRE-ATTCK-Techniques-T1053\"> </a></td><td>Scheduled Task/Job</td><td>TA0002, TA0003, TA0004</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1053.003<a name=\"MITRE-ATTCK-Techniques-T1053.46003\"> </a></td><td>Cron</td><td>TA0002, TA0003, TA0004</td><td>T1053</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1053.005<a name=\"MITRE-ATTCK-Techniques-T1053.46005\"> </a></td><td>Scheduled Task</td><td>TA0002, TA0003, TA0004</td><td>T1053</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1053.006<a name=\"MITRE-ATTCK-Techniques-T1053.46006\"> </a></td><td>Systemd Timers</td><td>TA0002, TA0003, TA0004</td><td>T1053</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1053.007<a name=\"MITRE-ATTCK-Techniques-T1053.46007\"> </a></td><td>Container Orchestration Job</td><td>TA0002, TA0003, TA0004</td><td>T1053</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1053.002<a name=\"MITRE-ATTCK-Techniques-T1053.46002\"> </a></td><td>At</td><td>TA0002, TA0003, TA0004</td><td>T1053</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1176<a name=\"MITRE-ATTCK-Techniques-T1176\"> </a></td><td>Software Extensions</td><td>TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1176.002<a name=\"MITRE-ATTCK-Techniques-T1176.46002\"> </a></td><td>IDE Extensions</td><td>TA0003</td><td>T1176</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1176.001<a name=\"MITRE-ATTCK-Techniques-T1176.46001\"> </a></td><td>Browser Extensions</td><td>TA0003</td><td>T1176</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1106<a name=\"MITRE-ATTCK-Techniques-T1106\"> </a></td><td>Native API</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1202<a name=\"MITRE-ATTCK-Techniques-T1202\"> </a></td><td>Indirect Command Execution</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1091<a name=\"MITRE-ATTCK-Techniques-T1091\"> </a></td><td>Replication Through Removable Media</td><td>TA0008, TA0001</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1005<a name=\"MITRE-ATTCK-Techniques-T1005\"> </a></td><td>Data from Local System</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1140<a name=\"MITRE-ATTCK-Techniques-T1140\"> </a></td><td>Deobfuscate/Decode Files or Information</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1562<a name=\"MITRE-ATTCK-Techniques-T1562\"> </a></td><td>Impair Defenses</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1562.003<a name=\"MITRE-ATTCK-Techniques-T1562.46003\"> </a></td><td>Impair Command History Logging</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1562.013<a name=\"MITRE-ATTCK-Techniques-T1562.46013\"> </a></td><td>Disable or Modify Network Device Firewall</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1562.004<a name=\"MITRE-ATTCK-Techniques-T1562.46004\"> </a></td><td>Disable or Modify System Firewall</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1562.002<a name=\"MITRE-ATTCK-Techniques-T1562.46002\"> </a></td><td>Disable Windows Event Logging</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1562.001<a name=\"MITRE-ATTCK-Techniques-T1562.46001\"> </a></td><td>Disable or Modify Tools</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1562.006<a name=\"MITRE-ATTCK-Techniques-T1562.46006\"> </a></td><td>Indicator Blocking</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1562.012<a name=\"MITRE-ATTCK-Techniques-T1562.46012\"> </a></td><td>Disable or Modify Linux Audit System</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1562.011<a name=\"MITRE-ATTCK-Techniques-T1562.46011\"> </a></td><td>Spoof Security Alerting</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1562.008<a name=\"MITRE-ATTCK-Techniques-T1562.46008\"> </a></td><td>Disable or Modify Cloud Logs</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1562.010<a name=\"MITRE-ATTCK-Techniques-T1562.46010\"> </a></td><td>Downgrade Attack</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1562.007<a name=\"MITRE-ATTCK-Techniques-T1562.46007\"> </a></td><td>Disable or Modify Cloud Firewall</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1562.009<a name=\"MITRE-ATTCK-Techniques-T1562.46009\"> </a></td><td>Safe Mode Boot</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1195<a name=\"MITRE-ATTCK-Techniques-T1195\"> </a></td><td>Supply Chain Compromise</td><td>TA0001</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1195.001<a name=\"MITRE-ATTCK-Techniques-T1195.46001\"> </a></td><td>Compromise Software Dependencies and Development Tools</td><td>TA0001</td><td>T1195</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1195.002<a name=\"MITRE-ATTCK-Techniques-T1195.46002\"> </a></td><td>Compromise Software Supply Chain</td><td>TA0001</td><td>T1195</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1195.003<a name=\"MITRE-ATTCK-Techniques-T1195.46003\"> </a></td><td>Compromise Hardware Supply Chain</td><td>TA0001</td><td>T1195</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1190<a name=\"MITRE-ATTCK-Techniques-T1190\"> </a></td><td>Exploit Public-Facing Application</td><td>TA0001</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1558<a name=\"MITRE-ATTCK-Techniques-T1558\"> </a></td><td>Steal or Forge Kerberos Tickets</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1558.003<a name=\"MITRE-ATTCK-Techniques-T1558.46003\"> </a></td><td>Kerberoasting</td><td>TA0006</td><td>T1558</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1558.002<a name=\"MITRE-ATTCK-Techniques-T1558.46002\"> </a></td><td>Silver Ticket</td><td>TA0006</td><td>T1558</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1558.005<a name=\"MITRE-ATTCK-Techniques-T1558.46005\"> </a></td><td>Ccache Files</td><td>TA0006</td><td>T1558</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1558.004<a name=\"MITRE-ATTCK-Techniques-T1558.46004\"> </a></td><td>AS-REP Roasting</td><td>TA0006</td><td>T1558</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1558.001<a name=\"MITRE-ATTCK-Techniques-T1558.46001\"> </a></td><td>Golden Ticket</td><td>TA0006</td><td>T1558</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1555<a name=\"MITRE-ATTCK-Techniques-T1555\"> </a></td><td>Credentials from Password Stores</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1555.004<a name=\"MITRE-ATTCK-Techniques-T1555.46004\"> </a></td><td>Windows Credential Manager</td><td>TA0006</td><td>T1555</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1555.001<a name=\"MITRE-ATTCK-Techniques-T1555.46001\"> </a></td><td>Keychain</td><td>TA0006</td><td>T1555</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1555.005<a name=\"MITRE-ATTCK-Techniques-T1555.46005\"> </a></td><td>Password Managers</td><td>TA0006</td><td>T1555</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1555.006<a name=\"MITRE-ATTCK-Techniques-T1555.46006\"> </a></td><td>Cloud Secrets Management Stores</td><td>TA0006</td><td>T1555</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1555.003<a name=\"MITRE-ATTCK-Techniques-T1555.46003\"> </a></td><td>Credentials from Web Browsers</td><td>TA0006</td><td>T1555</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1555.002<a name=\"MITRE-ATTCK-Techniques-T1555.46002\"> </a></td><td>Securityd Memory</td><td>TA0006</td><td>T1555</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1567<a name=\"MITRE-ATTCK-Techniques-T1567\"> </a></td><td>Exfiltration Over Web Service</td><td>TA0010</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1567.001<a name=\"MITRE-ATTCK-Techniques-T1567.46001\"> </a></td><td>Exfiltration to Code Repository</td><td>TA0010</td><td>T1567</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1567.003<a name=\"MITRE-ATTCK-Techniques-T1567.46003\"> </a></td><td>Exfiltration to Text Storage Sites</td><td>TA0010</td><td>T1567</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1567.002<a name=\"MITRE-ATTCK-Techniques-T1567.46002\"> </a></td><td>Exfiltration to Cloud Storage</td><td>TA0010</td><td>T1567</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1567.004<a name=\"MITRE-ATTCK-Techniques-T1567.46004\"> </a></td><td>Exfiltration Over Webhook</td><td>TA0010</td><td>T1567</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1219<a name=\"MITRE-ATTCK-Techniques-T1219\"> </a></td><td>Remote Access Tools</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1219.003<a name=\"MITRE-ATTCK-Techniques-T1219.46003\"> </a></td><td>Remote Access Hardware</td><td>TA0011</td><td>T1219</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1219.001<a name=\"MITRE-ATTCK-Techniques-T1219.46001\"> </a></td><td>IDE Tunneling</td><td>TA0011</td><td>T1219</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1219.002<a name=\"MITRE-ATTCK-Techniques-T1219.46002\"> </a></td><td>Remote Desktop Software</td><td>TA0011</td><td>T1219</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1036<a name=\"MITRE-ATTCK-Techniques-T1036\"> </a></td><td>Masquerading</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1036.008<a name=\"MITRE-ATTCK-Techniques-T1036.46008\"> </a></td><td>Masquerade File Type</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1036.003<a name=\"MITRE-ATTCK-Techniques-T1036.46003\"> </a></td><td>Rename Legitimate Utilities</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1036.006<a name=\"MITRE-ATTCK-Techniques-T1036.46006\"> </a></td><td>Space after Filename</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1036.004<a name=\"MITRE-ATTCK-Techniques-T1036.46004\"> </a></td><td>Masquerade Task or Service</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1036.002<a name=\"MITRE-ATTCK-Techniques-T1036.46002\"> </a></td><td>Right-to-Left Override</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1036.005<a name=\"MITRE-ATTCK-Techniques-T1036.46005\"> </a></td><td>Match Legitimate Resource Name or Location</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1036.011<a name=\"MITRE-ATTCK-Techniques-T1036.46011\"> </a></td><td>Overwrite Process Arguments</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1036.007<a name=\"MITRE-ATTCK-Techniques-T1036.46007\"> </a></td><td>Double File Extension</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1036.010<a name=\"MITRE-ATTCK-Techniques-T1036.46010\"> </a></td><td>Masquerade Account Name</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1036.001<a name=\"MITRE-ATTCK-Techniques-T1036.46001\"> </a></td><td>Invalid Code Signature</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1036.012<a name=\"MITRE-ATTCK-Techniques-T1036.46012\"> </a></td><td>Browser Fingerprint</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1036.009<a name=\"MITRE-ATTCK-Techniques-T1036.46009\"> </a></td><td>Break Process Trees</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1552<a name=\"MITRE-ATTCK-Techniques-T1552\"> </a></td><td>Unsecured Credentials</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1552.006<a name=\"MITRE-ATTCK-Techniques-T1552.46006\"> </a></td><td>Group Policy Preferences</td><td>TA0006</td><td>T1552</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1552.004<a name=\"MITRE-ATTCK-Techniques-T1552.46004\"> </a></td><td>Private Keys</td><td>TA0006</td><td>T1552</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1552.007<a name=\"MITRE-ATTCK-Techniques-T1552.46007\"> </a></td><td>Container API</td><td>TA0006</td><td>T1552</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1552.001<a name=\"MITRE-ATTCK-Techniques-T1552.46001\"> </a></td><td>Credentials In Files</td><td>TA0006</td><td>T1552</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1552.002<a name=\"MITRE-ATTCK-Techniques-T1552.46002\"> </a></td><td>Credentials in Registry</td><td>TA0006</td><td>T1552</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1552.003<a name=\"MITRE-ATTCK-Techniques-T1552.46003\"> </a></td><td>Shell History</td><td>TA0006</td><td>T1552</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1552.008<a name=\"MITRE-ATTCK-Techniques-T1552.46008\"> </a></td><td>Chat Messages</td><td>TA0006</td><td>T1552</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1552.005<a name=\"MITRE-ATTCK-Techniques-T1552.46005\"> </a></td><td>Cloud Instance Metadata API</td><td>TA0006</td><td>T1552</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1659<a name=\"MITRE-ATTCK-Techniques-T1659\"> </a></td><td>Content Injection</td><td>TA0001, TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1055<a name=\"MITRE-ATTCK-Techniques-T1055\"> </a></td><td>Process Injection</td><td>TA0005, TA0004</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1055.013<a name=\"MITRE-ATTCK-Techniques-T1055.46013\"> </a></td><td>Process Doppelgänging</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1055.012<a name=\"MITRE-ATTCK-Techniques-T1055.46012\"> </a></td><td>Process Hollowing</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1055.009<a name=\"MITRE-ATTCK-Techniques-T1055.46009\"> </a></td><td>Proc Memory</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1055.015<a name=\"MITRE-ATTCK-Techniques-T1055.46015\"> </a></td><td>ListPlanting</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1055.014<a name=\"MITRE-ATTCK-Techniques-T1055.46014\"> </a></td><td>VDSO Hijacking</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1055.005<a name=\"MITRE-ATTCK-Techniques-T1055.46005\"> </a></td><td>Thread Local Storage</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1055.011<a name=\"MITRE-ATTCK-Techniques-T1055.46011\"> </a></td><td>Extra Window Memory Injection</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1055.001<a name=\"MITRE-ATTCK-Techniques-T1055.46001\"> </a></td><td>Dynamic-link Library Injection</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1055.003<a name=\"MITRE-ATTCK-Techniques-T1055.46003\"> </a></td><td>Thread Execution Hijacking</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1055.008<a name=\"MITRE-ATTCK-Techniques-T1055.46008\"> </a></td><td>Ptrace System Calls</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1055.004<a name=\"MITRE-ATTCK-Techniques-T1055.46004\"> </a></td><td>Asynchronous Procedure Call</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1055.002<a name=\"MITRE-ATTCK-Techniques-T1055.46002\"> </a></td><td>Portable Executable Injection</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1205<a name=\"MITRE-ATTCK-Techniques-T1205\"> </a></td><td>Traffic Signaling</td><td>TA0005, TA0003, TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1205.001<a name=\"MITRE-ATTCK-Techniques-T1205.46001\"> </a></td><td>Port Knocking</td><td>TA0005, TA0003, TA0011</td><td>T1205</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1205.002<a name=\"MITRE-ATTCK-Techniques-T1205.46002\"> </a></td><td>Socket Filters</td><td>TA0005, TA0003, TA0011</td><td>T1205</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218<a name=\"MITRE-ATTCK-Techniques-T1218\"> </a></td><td>System Binary Proxy Execution</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1218.005<a name=\"MITRE-ATTCK-Techniques-T1218.46005\"> </a></td><td>Mshta</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.014<a name=\"MITRE-ATTCK-Techniques-T1218.46014\"> </a></td><td>MMC</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.008<a name=\"MITRE-ATTCK-Techniques-T1218.46008\"> </a></td><td>Odbcconf</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.015<a name=\"MITRE-ATTCK-Techniques-T1218.46015\"> </a></td><td>Electron Applications</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.012<a name=\"MITRE-ATTCK-Techniques-T1218.46012\"> </a></td><td>Verclsid</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.013<a name=\"MITRE-ATTCK-Techniques-T1218.46013\"> </a></td><td>Mavinject</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.002<a name=\"MITRE-ATTCK-Techniques-T1218.46002\"> </a></td><td>Control Panel</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.001<a name=\"MITRE-ATTCK-Techniques-T1218.46001\"> </a></td><td>Compiled HTML File</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.010<a name=\"MITRE-ATTCK-Techniques-T1218.46010\"> </a></td><td>Regsvr32</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.004<a name=\"MITRE-ATTCK-Techniques-T1218.46004\"> </a></td><td>InstallUtil</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.011<a name=\"MITRE-ATTCK-Techniques-T1218.46011\"> </a></td><td>Rundll32</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.009<a name=\"MITRE-ATTCK-Techniques-T1218.46009\"> </a></td><td>Regsvcs/Regasm</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.003<a name=\"MITRE-ATTCK-Techniques-T1218.46003\"> </a></td><td>CMSTP</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.007<a name=\"MITRE-ATTCK-Techniques-T1218.46007\"> </a></td><td>Msiexec</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1620<a name=\"MITRE-ATTCK-Techniques-T1620\"> </a></td><td>Reflective Code Loading</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1611<a name=\"MITRE-ATTCK-Techniques-T1611\"> </a></td><td>Escape to Host</td><td>TA0004</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1010<a name=\"MITRE-ATTCK-Techniques-T1010\"> </a></td><td>Application Window Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1029<a name=\"MITRE-ATTCK-Techniques-T1029\"> </a></td><td>Scheduled Transfer</td><td>TA0010</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1525<a name=\"MITRE-ATTCK-Techniques-T1525\"> </a></td><td>Implant Internal Image</td><td>TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1572<a name=\"MITRE-ATTCK-Techniques-T1572\"> </a></td><td>Protocol Tunneling</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1550<a name=\"MITRE-ATTCK-Techniques-T1550\"> </a></td><td>Use Alternate Authentication Material</td><td>TA0005, TA0008</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1550.004<a name=\"MITRE-ATTCK-Techniques-T1550.46004\"> </a></td><td>Web Session Cookie</td><td>TA0005, TA0008</td><td>T1550</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1550.001<a name=\"MITRE-ATTCK-Techniques-T1550.46001\"> </a></td><td>Application Access Token</td><td>TA0005, TA0008</td><td>T1550</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1550.003<a name=\"MITRE-ATTCK-Techniques-T1550.46003\"> </a></td><td>Pass the Ticket</td><td>TA0005, TA0008</td><td>T1550</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1550.002<a name=\"MITRE-ATTCK-Techniques-T1550.46002\"> </a></td><td>Pass the Hash</td><td>TA0005, TA0008</td><td>T1550</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1011<a name=\"MITRE-ATTCK-Techniques-T1011\"> </a></td><td>Exfiltration Over Other Network Medium</td><td>TA0010</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1011.001<a name=\"MITRE-ATTCK-Techniques-T1011.46001\"> </a></td><td>Exfiltration Over Bluetooth</td><td>TA0010</td><td>T1011</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1589<a name=\"MITRE-ATTCK-Techniques-T1589\"> </a></td><td>Gather Victim Identity Information</td><td>TA0043</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1589.003<a name=\"MITRE-ATTCK-Techniques-T1589.46003\"> </a></td><td>Employee Names</td><td>TA0043</td><td>T1589</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1589.002<a name=\"MITRE-ATTCK-Techniques-T1589.46002\"> </a></td><td>Email Addresses</td><td>TA0043</td><td>T1589</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1589.001<a name=\"MITRE-ATTCK-Techniques-T1589.46001\"> </a></td><td>Credentials</td><td>TA0043</td><td>T1589</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1560<a name=\"MITRE-ATTCK-Techniques-T1560\"> </a></td><td>Archive Collected Data</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1560.002<a name=\"MITRE-ATTCK-Techniques-T1560.46002\"> </a></td><td>Archive via Library</td><td>TA0009</td><td>T1560</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1560.001<a name=\"MITRE-ATTCK-Techniques-T1560.46001\"> </a></td><td>Archive via Utility</td><td>TA0009</td><td>T1560</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1560.003<a name=\"MITRE-ATTCK-Techniques-T1560.46003\"> </a></td><td>Archive via Custom Method</td><td>TA0009</td><td>T1560</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1185<a name=\"MITRE-ATTCK-Techniques-T1185\"> </a></td><td>Browser Session Hijacking</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1021<a name=\"MITRE-ATTCK-Techniques-T1021\"> </a></td><td>Remote Services</td><td>TA0008</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1021.006<a name=\"MITRE-ATTCK-Techniques-T1021.46006\"> </a></td><td>Windows Remote Management</td><td>TA0008</td><td>T1021</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1021.005<a name=\"MITRE-ATTCK-Techniques-T1021.46005\"> </a></td><td>VNC</td><td>TA0008</td><td>T1021</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1021.002<a name=\"MITRE-ATTCK-Techniques-T1021.46002\"> </a></td><td>SMB/Windows Admin Shares</td><td>TA0008</td><td>T1021</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1021.007<a name=\"MITRE-ATTCK-Techniques-T1021.46007\"> </a></td><td>Cloud Services</td><td>TA0008</td><td>T1021</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1021.001<a name=\"MITRE-ATTCK-Techniques-T1021.46001\"> </a></td><td>Remote Desktop Protocol</td><td>TA0008</td><td>T1021</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1021.003<a name=\"MITRE-ATTCK-Techniques-T1021.46003\"> </a></td><td>Distributed Component Object Model</td><td>TA0008</td><td>T1021</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1021.008<a name=\"MITRE-ATTCK-Techniques-T1021.46008\"> </a></td><td>Direct Cloud VM Connections</td><td>TA0008</td><td>T1021</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1021.004<a name=\"MITRE-ATTCK-Techniques-T1021.46004\"> </a></td><td>SSH</td><td>TA0008</td><td>T1021</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1596<a name=\"MITRE-ATTCK-Techniques-T1596\"> </a></td><td>Search Open Technical Databases</td><td>TA0043</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1596.003<a name=\"MITRE-ATTCK-Techniques-T1596.46003\"> </a></td><td>Digital Certificates</td><td>TA0043</td><td>T1596</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1596.005<a name=\"MITRE-ATTCK-Techniques-T1596.46005\"> </a></td><td>Scan Databases</td><td>TA0043</td><td>T1596</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1596.001<a name=\"MITRE-ATTCK-Techniques-T1596.46001\"> </a></td><td>DNS/Passive DNS</td><td>TA0043</td><td>T1596</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1596.004<a name=\"MITRE-ATTCK-Techniques-T1596.46004\"> </a></td><td>CDNs</td><td>TA0043</td><td>T1596</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1596.002<a name=\"MITRE-ATTCK-Techniques-T1596.46002\"> </a></td><td>WHOIS</td><td>TA0043</td><td>T1596</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1207<a name=\"MITRE-ATTCK-Techniques-T1207\"> </a></td><td>Rogue Domain Controller</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1610<a name=\"MITRE-ATTCK-Techniques-T1610\"> </a></td><td>Deploy Container</td><td>TA0005, TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1112<a name=\"MITRE-ATTCK-Techniques-T1112\"> </a></td><td>Modify Registry</td><td>TA0005, TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1580<a name=\"MITRE-ATTCK-Techniques-T1580\"> </a></td><td>Cloud Infrastructure Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1491<a name=\"MITRE-ATTCK-Techniques-T1491\"> </a></td><td>Defacement</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1491.002<a name=\"MITRE-ATTCK-Techniques-T1491.46002\"> </a></td><td>External Defacement</td><td>TA0040</td><td>T1491</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1491.001<a name=\"MITRE-ATTCK-Techniques-T1491.46001\"> </a></td><td>Internal Defacement</td><td>TA0040</td><td>T1491</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1535<a name=\"MITRE-ATTCK-Techniques-T1535\"> </a></td><td>Unused/Unsupported Cloud Regions</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1563<a name=\"MITRE-ATTCK-Techniques-T1563\"> </a></td><td>Remote Service Session Hijacking</td><td>TA0008</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1563.002<a name=\"MITRE-ATTCK-Techniques-T1563.46002\"> </a></td><td>RDP Hijacking</td><td>TA0008</td><td>T1563</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1563.001<a name=\"MITRE-ATTCK-Techniques-T1563.46001\"> </a></td><td>SSH Hijacking</td><td>TA0008</td><td>T1563</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1217<a name=\"MITRE-ATTCK-Techniques-T1217\"> </a></td><td>Browser Information Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1681<a name=\"MITRE-ATTCK-Techniques-T1681\"> </a></td><td>Search Threat Vendor Data</td><td>TA0043</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1674<a name=\"MITRE-ATTCK-Techniques-T1674\"> </a></td><td>Input Injection</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1092<a name=\"MITRE-ATTCK-Techniques-T1092\"> </a></td><td>Communication Through Removable Media</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1222<a name=\"MITRE-ATTCK-Techniques-T1222\"> </a></td><td>File and Directory Permissions Modification</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1222.002<a name=\"MITRE-ATTCK-Techniques-T1222.46002\"> </a></td><td>Linux and Mac File and Directory Permissions Modification</td><td>TA0005</td><td>T1222</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1222.001<a name=\"MITRE-ATTCK-Techniques-T1222.46001\"> </a></td><td>Windows File and Directory Permissions Modification</td><td>TA0005</td><td>T1222</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1595<a name=\"MITRE-ATTCK-Techniques-T1595\"> </a></td><td>Active Scanning</td><td>TA0043</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1595.003<a name=\"MITRE-ATTCK-Techniques-T1595.46003\"> </a></td><td>Wordlist Scanning</td><td>TA0043</td><td>T1595</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1595.001<a name=\"MITRE-ATTCK-Techniques-T1595.46001\"> </a></td><td>Scanning IP Blocks</td><td>TA0043</td><td>T1595</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1595.002<a name=\"MITRE-ATTCK-Techniques-T1595.46002\"> </a></td><td>Vulnerability Scanning</td><td>TA0043</td><td>T1595</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1548<a name=\"MITRE-ATTCK-Techniques-T1548\"> </a></td><td>Abuse Elevation Control Mechanism</td><td>TA0004, TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1548.001<a name=\"MITRE-ATTCK-Techniques-T1548.46001\"> </a></td><td>Setuid and Setgid</td><td>TA0004, TA0005</td><td>T1548</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1548.005<a name=\"MITRE-ATTCK-Techniques-T1548.46005\"> </a></td><td>Temporary Elevated Cloud Access</td><td>TA0004, TA0005</td><td>T1548</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1548.002<a name=\"MITRE-ATTCK-Techniques-T1548.46002\"> </a></td><td>Bypass User Account Control</td><td>TA0004, TA0005</td><td>T1548</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1548.004<a name=\"MITRE-ATTCK-Techniques-T1548.46004\"> </a></td><td>Elevated Execution with Prompt</td><td>TA0004, TA0005</td><td>T1548</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1548.003<a name=\"MITRE-ATTCK-Techniques-T1548.46003\"> </a></td><td>Sudo and Sudo Caching</td><td>TA0004, TA0005</td><td>T1548</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1548.006<a name=\"MITRE-ATTCK-Techniques-T1548.46006\"> </a></td><td>TCC Manipulation</td><td>TA0004, TA0005</td><td>T1548</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1673<a name=\"MITRE-ATTCK-Techniques-T1673\"> </a></td><td>Virtual Machine Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1125<a name=\"MITRE-ATTCK-Techniques-T1125\"> </a></td><td>Video Capture</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1016<a name=\"MITRE-ATTCK-Techniques-T1016\"> </a></td><td>System Network Configuration Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1016.002<a name=\"MITRE-ATTCK-Techniques-T1016.46002\"> </a></td><td>Wi-Fi Discovery</td><td>TA0007</td><td>T1016</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1016.001<a name=\"MITRE-ATTCK-Techniques-T1016.46001\"> </a></td><td>Internet Connection Discovery</td><td>TA0007</td><td>T1016</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1087<a name=\"MITRE-ATTCK-Techniques-T1087\"> </a></td><td>Account Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1087.003<a name=\"MITRE-ATTCK-Techniques-T1087.46003\"> </a></td><td>Email Account</td><td>TA0007</td><td>T1087</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1087.004<a name=\"MITRE-ATTCK-Techniques-T1087.46004\"> </a></td><td>Cloud Account</td><td>TA0007</td><td>T1087</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1087.002<a name=\"MITRE-ATTCK-Techniques-T1087.46002\"> </a></td><td>Domain Account</td><td>TA0007</td><td>T1087</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1087.001<a name=\"MITRE-ATTCK-Techniques-T1087.46001\"> </a></td><td>Local Account</td><td>TA0007</td><td>T1087</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1090<a name=\"MITRE-ATTCK-Techniques-T1090\"> </a></td><td>Proxy</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1090.001<a name=\"MITRE-ATTCK-Techniques-T1090.46001\"> </a></td><td>Internal Proxy</td><td>TA0011</td><td>T1090</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1090.003<a name=\"MITRE-ATTCK-Techniques-T1090.46003\"> </a></td><td>Multi-hop Proxy</td><td>TA0011</td><td>T1090</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1090.004<a name=\"MITRE-ATTCK-Techniques-T1090.46004\"> </a></td><td>Domain Fronting</td><td>TA0011</td><td>T1090</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1090.002<a name=\"MITRE-ATTCK-Techniques-T1090.46002\"> </a></td><td>External Proxy</td><td>TA0011</td><td>T1090</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059<a name=\"MITRE-ATTCK-Techniques-T1059\"> </a></td><td>Command and Scripting Interpreter</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1059.005<a name=\"MITRE-ATTCK-Techniques-T1059.46005\"> </a></td><td>Visual Basic</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059.002<a name=\"MITRE-ATTCK-Techniques-T1059.46002\"> </a></td><td>AppleScript</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059.003<a name=\"MITRE-ATTCK-Techniques-T1059.46003\"> </a></td><td>Windows Command Shell</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059.013<a name=\"MITRE-ATTCK-Techniques-T1059.46013\"> </a></td><td>Container CLI/API</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059.004<a name=\"MITRE-ATTCK-Techniques-T1059.46004\"> </a></td><td>Unix Shell</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059.010<a name=\"MITRE-ATTCK-Techniques-T1059.46010\"> </a></td><td>AutoHotKey &amp; AutoIT</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059.008<a name=\"MITRE-ATTCK-Techniques-T1059.46008\"> </a></td><td>Network Device CLI</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059.012<a name=\"MITRE-ATTCK-Techniques-T1059.46012\"> </a></td><td>Hypervisor CLI</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059.006<a name=\"MITRE-ATTCK-Techniques-T1059.46006\"> </a></td><td>Python</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059.001<a name=\"MITRE-ATTCK-Techniques-T1059.46001\"> </a></td><td>PowerShell</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059.009<a name=\"MITRE-ATTCK-Techniques-T1059.46009\"> </a></td><td>Cloud API</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059.011<a name=\"MITRE-ATTCK-Techniques-T1059.46011\"> </a></td><td>Lua</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059.007<a name=\"MITRE-ATTCK-Techniques-T1059.46007\"> </a></td><td>JavaScript</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1677<a name=\"MITRE-ATTCK-Techniques-T1677\"> </a></td><td>Poisoned Pipeline Execution</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1482<a name=\"MITRE-ATTCK-Techniques-T1482\"> </a></td><td>Domain Trust Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1020<a name=\"MITRE-ATTCK-Techniques-T1020\"> </a></td><td>Automated Exfiltration</td><td>TA0010</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1020.001<a name=\"MITRE-ATTCK-Techniques-T1020.46001\"> </a></td><td>Traffic Duplication</td><td>TA0010</td><td>T1020</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1070<a name=\"MITRE-ATTCK-Techniques-T1070\"> </a></td><td>Indicator Removal</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1070.004<a name=\"MITRE-ATTCK-Techniques-T1070.46004\"> </a></td><td>File Deletion</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1070.006<a name=\"MITRE-ATTCK-Techniques-T1070.46006\"> </a></td><td>Timestomp</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1070.008<a name=\"MITRE-ATTCK-Techniques-T1070.46008\"> </a></td><td>Clear Mailbox Data</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1070.002<a name=\"MITRE-ATTCK-Techniques-T1070.46002\"> </a></td><td>Clear Linux or Mac System Logs</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1070.001<a name=\"MITRE-ATTCK-Techniques-T1070.46001\"> </a></td><td>Clear Windows Event Logs</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1070.009<a name=\"MITRE-ATTCK-Techniques-T1070.46009\"> </a></td><td>Clear Persistence</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1070.003<a name=\"MITRE-ATTCK-Techniques-T1070.46003\"> </a></td><td>Clear Command History</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1070.010<a name=\"MITRE-ATTCK-Techniques-T1070.46010\"> </a></td><td>Relocate Malware</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1070.007<a name=\"MITRE-ATTCK-Techniques-T1070.46007\"> </a></td><td>Clear Network Connection History and Configurations</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1070.005<a name=\"MITRE-ATTCK-Techniques-T1070.46005\"> </a></td><td>Network Share Connection Removal</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1609<a name=\"MITRE-ATTCK-Techniques-T1609\"> </a></td><td>Container Administration Command</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1083<a name=\"MITRE-ATTCK-Techniques-T1083\"> </a></td><td>File and Directory Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1568<a name=\"MITRE-ATTCK-Techniques-T1568\"> </a></td><td>Dynamic Resolution</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1568.001<a name=\"MITRE-ATTCK-Techniques-T1568.46001\"> </a></td><td>Fast Flux DNS</td><td>TA0011</td><td>T1568</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1568.002<a name=\"MITRE-ATTCK-Techniques-T1568.46002\"> </a></td><td>Domain Generation Algorithms</td><td>TA0011</td><td>T1568</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1568.003<a name=\"MITRE-ATTCK-Techniques-T1568.46003\"> </a></td><td>DNS Calculation</td><td>TA0011</td><td>T1568</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1647<a name=\"MITRE-ATTCK-Techniques-T1647\"> </a></td><td>Plist File Modification</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1074<a name=\"MITRE-ATTCK-Techniques-T1074\"> </a></td><td>Data Staged</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1074.001<a name=\"MITRE-ATTCK-Techniques-T1074.46001\"> </a></td><td>Local Data Staging</td><td>TA0009</td><td>T1074</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1074.002<a name=\"MITRE-ATTCK-Techniques-T1074.46002\"> </a></td><td>Remote Data Staging</td><td>TA0009</td><td>T1074</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1649<a name=\"MITRE-ATTCK-Techniques-T1649\"> </a></td><td>Steal or Forge Authentication Certificates</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1049<a name=\"MITRE-ATTCK-Techniques-T1049\"> </a></td><td>System Network Connections Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1584<a name=\"MITRE-ATTCK-Techniques-T1584\"> </a></td><td>Compromise Infrastructure</td><td>TA0042</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1584.003<a name=\"MITRE-ATTCK-Techniques-T1584.46003\"> </a></td><td>Virtual Private Server</td><td>TA0042</td><td>T1584</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1584.002<a name=\"MITRE-ATTCK-Techniques-T1584.46002\"> </a></td><td>DNS Server</td><td>TA0042</td><td>T1584</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1584.006<a name=\"MITRE-ATTCK-Techniques-T1584.46006\"> </a></td><td>Web Services</td><td>TA0042</td><td>T1584</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1584.007<a name=\"MITRE-ATTCK-Techniques-T1584.46007\"> </a></td><td>Serverless</td><td>TA0042</td><td>T1584</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1584.005<a name=\"MITRE-ATTCK-Techniques-T1584.46005\"> </a></td><td>Botnet</td><td>TA0042</td><td>T1584</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1584.004<a name=\"MITRE-ATTCK-Techniques-T1584.46004\"> </a></td><td>Server</td><td>TA0042</td><td>T1584</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1584.008<a name=\"MITRE-ATTCK-Techniques-T1584.46008\"> </a></td><td>Network Devices</td><td>TA0042</td><td>T1584</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1584.001<a name=\"MITRE-ATTCK-Techniques-T1584.46001\"> </a></td><td>Domains</td><td>TA0042</td><td>T1584</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1542<a name=\"MITRE-ATTCK-Techniques-T1542\"> </a></td><td>Pre-OS Boot</td><td>TA0005, TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1542.003<a name=\"MITRE-ATTCK-Techniques-T1542.46003\"> </a></td><td>Bootkit</td><td>TA0005, TA0003</td><td>T1542</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1542.005<a name=\"MITRE-ATTCK-Techniques-T1542.46005\"> </a></td><td>TFTP Boot</td><td>TA0005, TA0003</td><td>T1542</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1542.002<a name=\"MITRE-ATTCK-Techniques-T1542.46002\"> </a></td><td>Component Firmware</td><td>TA0005, TA0003</td><td>T1542</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1542.004<a name=\"MITRE-ATTCK-Techniques-T1542.46004\"> </a></td><td>ROMMONkit</td><td>TA0005, TA0003</td><td>T1542</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1542.001<a name=\"MITRE-ATTCK-Techniques-T1542.46001\"> </a></td><td>System Firmware</td><td>TA0005, TA0003</td><td>T1542</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1612<a name=\"MITRE-ATTCK-Techniques-T1612\"> </a></td><td>Build Image on Host</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1586<a name=\"MITRE-ATTCK-Techniques-T1586\"> </a></td><td>Compromise Accounts</td><td>TA0042</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1586.003<a name=\"MITRE-ATTCK-Techniques-T1586.46003\"> </a></td><td>Cloud Accounts</td><td>TA0042</td><td>T1586</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1586.002<a name=\"MITRE-ATTCK-Techniques-T1586.46002\"> </a></td><td>Email Accounts</td><td>TA0042</td><td>T1586</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1586.001<a name=\"MITRE-ATTCK-Techniques-T1586.46001\"> </a></td><td>Social Media Accounts</td><td>TA0042</td><td>T1586</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1497<a name=\"MITRE-ATTCK-Techniques-T1497\"> </a></td><td>Virtualization/Sandbox Evasion</td><td>TA0005, TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1497.002<a name=\"MITRE-ATTCK-Techniques-T1497.46002\"> </a></td><td>User Activity Based Checks</td><td>TA0005, TA0007</td><td>T1497</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1497.001<a name=\"MITRE-ATTCK-Techniques-T1497.46001\"> </a></td><td>System Checks</td><td>TA0005, TA0007</td><td>T1497</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1497.003<a name=\"MITRE-ATTCK-Techniques-T1497.46003\"> </a></td><td>Time Based Checks</td><td>TA0005, TA0007</td><td>T1497</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1102<a name=\"MITRE-ATTCK-Techniques-T1102\"> </a></td><td>Web Service</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1102.003<a name=\"MITRE-ATTCK-Techniques-T1102.46003\"> </a></td><td>One-Way Communication</td><td>TA0011</td><td>T1102</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1102.001<a name=\"MITRE-ATTCK-Techniques-T1102.46001\"> </a></td><td>Dead Drop Resolver</td><td>TA0011</td><td>T1102</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1102.002<a name=\"MITRE-ATTCK-Techniques-T1102.46002\"> </a></td><td>Bidirectional Communication</td><td>TA0011</td><td>T1102</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1608<a name=\"MITRE-ATTCK-Techniques-T1608\"> </a></td><td>Stage Capabilities</td><td>TA0042</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1608.004<a name=\"MITRE-ATTCK-Techniques-T1608.46004\"> </a></td><td>Drive-by Target</td><td>TA0042</td><td>T1608</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1608.005<a name=\"MITRE-ATTCK-Techniques-T1608.46005\"> </a></td><td>Link Target</td><td>TA0042</td><td>T1608</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1608.006<a name=\"MITRE-ATTCK-Techniques-T1608.46006\"> </a></td><td>SEO Poisoning</td><td>TA0042</td><td>T1608</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1608.003<a name=\"MITRE-ATTCK-Techniques-T1608.46003\"> </a></td><td>Install Digital Certificate</td><td>TA0042</td><td>T1608</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1608.002<a name=\"MITRE-ATTCK-Techniques-T1608.46002\"> </a></td><td>Upload Tool</td><td>TA0042</td><td>T1608</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1608.001<a name=\"MITRE-ATTCK-Techniques-T1608.46001\"> </a></td><td>Upload Malware</td><td>TA0042</td><td>T1608</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1104<a name=\"MITRE-ATTCK-Techniques-T1104\"> </a></td><td>Multi-Stage Channels</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1657<a name=\"MITRE-ATTCK-Techniques-T1657\"> </a></td><td>Financial Theft</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1480<a name=\"MITRE-ATTCK-Techniques-T1480\"> </a></td><td>Execution Guardrails</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1480.001<a name=\"MITRE-ATTCK-Techniques-T1480.46001\"> </a></td><td>Environmental Keying</td><td>TA0005</td><td>T1480</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1480.002<a name=\"MITRE-ATTCK-Techniques-T1480.46002\"> </a></td><td>Mutual Exclusion</td><td>TA0005</td><td>T1480</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1619<a name=\"MITRE-ATTCK-Techniques-T1619\"> </a></td><td>Cloud Storage Object Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1654<a name=\"MITRE-ATTCK-Techniques-T1654\"> </a></td><td>Log Enumeration</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1528<a name=\"MITRE-ATTCK-Techniques-T1528\"> </a></td><td>Steal Application Access Token</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1204<a name=\"MITRE-ATTCK-Techniques-T1204\"> </a></td><td>User Execution</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1204.005<a name=\"MITRE-ATTCK-Techniques-T1204.46005\"> </a></td><td>Malicious Library</td><td>TA0002</td><td>T1204</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1204.002<a name=\"MITRE-ATTCK-Techniques-T1204.46002\"> </a></td><td>Malicious File</td><td>TA0002</td><td>T1204</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1204.003<a name=\"MITRE-ATTCK-Techniques-T1204.46003\"> </a></td><td>Malicious Image</td><td>TA0002</td><td>T1204</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1204.001<a name=\"MITRE-ATTCK-Techniques-T1204.46001\"> </a></td><td>Malicious Link</td><td>TA0002</td><td>T1204</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1204.004<a name=\"MITRE-ATTCK-Techniques-T1204.46004\"> </a></td><td>Malicious Copy and Paste</td><td>TA0002</td><td>T1204</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1057<a name=\"MITRE-ATTCK-Techniques-T1057\"> </a></td><td>Process Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1072<a name=\"MITRE-ATTCK-Techniques-T1072\"> </a></td><td>Software Deployment Tools</td><td>TA0002, TA0008</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1041<a name=\"MITRE-ATTCK-Techniques-T1041\"> </a></td><td>Exfiltration Over C2 Channel</td><td>TA0010</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1591<a name=\"MITRE-ATTCK-Techniques-T1591\"> </a></td><td>Gather Victim Org Information</td><td>TA0043</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1591.002<a name=\"MITRE-ATTCK-Techniques-T1591.46002\"> </a></td><td>Business Relationships</td><td>TA0043</td><td>T1591</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1591.001<a name=\"MITRE-ATTCK-Techniques-T1591.46001\"> </a></td><td>Determine Physical Locations</td><td>TA0043</td><td>T1591</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1591.004<a name=\"MITRE-ATTCK-Techniques-T1591.46004\"> </a></td><td>Identify Roles</td><td>TA0043</td><td>T1591</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1591.003<a name=\"MITRE-ATTCK-Techniques-T1591.46003\"> </a></td><td>Identify Business Tempo</td><td>TA0043</td><td>T1591</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1606<a name=\"MITRE-ATTCK-Techniques-T1606\"> </a></td><td>Forge Web Credentials</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1606.001<a name=\"MITRE-ATTCK-Techniques-T1606.46001\"> </a></td><td>Web Cookies</td><td>TA0006</td><td>T1606</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1606.002<a name=\"MITRE-ATTCK-Techniques-T1606.46002\"> </a></td><td>SAML Tokens</td><td>TA0006</td><td>T1606</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1621<a name=\"MITRE-ATTCK-Techniques-T1621\"> </a></td><td>Multi-Factor Authentication Request Generation</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1554<a name=\"MITRE-ATTCK-Techniques-T1554\"> </a></td><td>Compromise Host Software Binary</td><td>TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1679<a name=\"MITRE-ATTCK-Techniques-T1679\"> </a></td><td>Selective Exclusion</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1212<a name=\"MITRE-ATTCK-Techniques-T1212\"> </a></td><td>Exploitation for Credential Access</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1590<a name=\"MITRE-ATTCK-Techniques-T1590\"> </a></td><td>Gather Victim Network Information</td><td>TA0043</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1590.001<a name=\"MITRE-ATTCK-Techniques-T1590.46001\"> </a></td><td>Domain Properties</td><td>TA0043</td><td>T1590</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1590.002<a name=\"MITRE-ATTCK-Techniques-T1590.46002\"> </a></td><td>DNS</td><td>TA0043</td><td>T1590</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1590.005<a name=\"MITRE-ATTCK-Techniques-T1590.46005\"> </a></td><td>IP Addresses</td><td>TA0043</td><td>T1590</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1590.003<a name=\"MITRE-ATTCK-Techniques-T1590.46003\"> </a></td><td>Network Trust Dependencies</td><td>TA0043</td><td>T1590</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1590.004<a name=\"MITRE-ATTCK-Techniques-T1590.46004\"> </a></td><td>Network Topology</td><td>TA0043</td><td>T1590</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1590.006<a name=\"MITRE-ATTCK-Techniques-T1590.46006\"> </a></td><td>Network Security Appliances</td><td>TA0043</td><td>T1590</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1210<a name=\"MITRE-ATTCK-Techniques-T1210\"> </a></td><td>Exploitation of Remote Services</td><td>TA0008</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1534<a name=\"MITRE-ATTCK-Techniques-T1534\"> </a></td><td>Internal Spearphishing</td><td>TA0008</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1199<a name=\"MITRE-ATTCK-Techniques-T1199\"> </a></td><td>Trusted Relationship</td><td>TA0001</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1593<a name=\"MITRE-ATTCK-Techniques-T1593\"> </a></td><td>Search Open Websites/Domains</td><td>TA0043</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1593.002<a name=\"MITRE-ATTCK-Techniques-T1593.46002\"> </a></td><td>Search Engines</td><td>TA0043</td><td>T1593</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1593.003<a name=\"MITRE-ATTCK-Techniques-T1593.46003\"> </a></td><td>Code Repositories</td><td>TA0043</td><td>T1593</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1593.001<a name=\"MITRE-ATTCK-Techniques-T1593.46001\"> </a></td><td>Social Media</td><td>TA0043</td><td>T1593</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1098<a name=\"MITRE-ATTCK-Techniques-T1098\"> </a></td><td>Account Manipulation</td><td>TA0003, TA0004</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1098.001<a name=\"MITRE-ATTCK-Techniques-T1098.46001\"> </a></td><td>Additional Cloud Credentials</td><td>TA0003, TA0004</td><td>T1098</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1098.002<a name=\"MITRE-ATTCK-Techniques-T1098.46002\"> </a></td><td>Additional Email Delegate Permissions</td><td>TA0003, TA0004</td><td>T1098</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1098.003<a name=\"MITRE-ATTCK-Techniques-T1098.46003\"> </a></td><td>Additional Cloud Roles</td><td>TA0003, TA0004</td><td>T1098</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1098.005<a name=\"MITRE-ATTCK-Techniques-T1098.46005\"> </a></td><td>Device Registration</td><td>TA0003, TA0004</td><td>T1098</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1098.006<a name=\"MITRE-ATTCK-Techniques-T1098.46006\"> </a></td><td>Additional Container Cluster Roles</td><td>TA0003, TA0004</td><td>T1098</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1098.004<a name=\"MITRE-ATTCK-Techniques-T1098.46004\"> </a></td><td>SSH Authorized Keys</td><td>TA0003, TA0004</td><td>T1098</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1098.007<a name=\"MITRE-ATTCK-Techniques-T1098.46007\"> </a></td><td>Additional Local or Domain Groups</td><td>TA0003, TA0004</td><td>T1098</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1048<a name=\"MITRE-ATTCK-Techniques-T1048\"> </a></td><td>Exfiltration Over Alternative Protocol</td><td>TA0010</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1048.002<a name=\"MITRE-ATTCK-Techniques-T1048.46002\"> </a></td><td>Exfiltration Over Asymmetric Encrypted Non-C2 Protocol</td><td>TA0010</td><td>T1048</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1048.003<a name=\"MITRE-ATTCK-Techniques-T1048.46003\"> </a></td><td>Exfiltration Over Unencrypted Non-C2 Protocol</td><td>TA0010</td><td>T1048</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1048.001<a name=\"MITRE-ATTCK-Techniques-T1048.46001\"> </a></td><td>Exfiltration Over Symmetric Encrypted Non-C2 Protocol</td><td>TA0010</td><td>T1048</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1678<a name=\"MITRE-ATTCK-Techniques-T1678\"> </a></td><td>Delay Execution</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1597<a name=\"MITRE-ATTCK-Techniques-T1597\"> </a></td><td>Search Closed Sources</td><td>TA0043</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1597.001<a name=\"MITRE-ATTCK-Techniques-T1597.46001\"> </a></td><td>Threat Intel Vendors</td><td>TA0043</td><td>T1597</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1597.002<a name=\"MITRE-ATTCK-Techniques-T1597.46002\"> </a></td><td>Purchase Technical Data</td><td>TA0043</td><td>T1597</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1566<a name=\"MITRE-ATTCK-Techniques-T1566\"> </a></td><td>Phishing</td><td>TA0001</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1566.002<a name=\"MITRE-ATTCK-Techniques-T1566.46002\"> </a></td><td>Spearphishing Link</td><td>TA0001</td><td>T1566</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1566.001<a name=\"MITRE-ATTCK-Techniques-T1566.46001\"> </a></td><td>Spearphishing Attachment</td><td>TA0001</td><td>T1566</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1566.004<a name=\"MITRE-ATTCK-Techniques-T1566.46004\"> </a></td><td>Spearphishing Voice</td><td>TA0001</td><td>T1566</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1566.003<a name=\"MITRE-ATTCK-Techniques-T1566.46003\"> </a></td><td>Spearphishing via Service</td><td>TA0001</td><td>T1566</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1110<a name=\"MITRE-ATTCK-Techniques-T1110\"> </a></td><td>Brute Force</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1110.004<a name=\"MITRE-ATTCK-Techniques-T1110.46004\"> </a></td><td>Credential Stuffing</td><td>TA0006</td><td>T1110</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1110.002<a name=\"MITRE-ATTCK-Techniques-T1110.46002\"> </a></td><td>Password Cracking</td><td>TA0006</td><td>T1110</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1110.001<a name=\"MITRE-ATTCK-Techniques-T1110.46001\"> </a></td><td>Password Guessing</td><td>TA0006</td><td>T1110</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1110.003<a name=\"MITRE-ATTCK-Techniques-T1110.46003\"> </a></td><td>Password Spraying</td><td>TA0006</td><td>T1110</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1565<a name=\"MITRE-ATTCK-Techniques-T1565\"> </a></td><td>Data Manipulation</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1565.002<a name=\"MITRE-ATTCK-Techniques-T1565.46002\"> </a></td><td>Transmitted Data Manipulation</td><td>TA0040</td><td>T1565</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1565.003<a name=\"MITRE-ATTCK-Techniques-T1565.46003\"> </a></td><td>Runtime Data Manipulation</td><td>TA0040</td><td>T1565</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1565.001<a name=\"MITRE-ATTCK-Techniques-T1565.46001\"> </a></td><td>Stored Data Manipulation</td><td>TA0040</td><td>T1565</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1559<a name=\"MITRE-ATTCK-Techniques-T1559\"> </a></td><td>Inter-Process Communication</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1559.003<a name=\"MITRE-ATTCK-Techniques-T1559.46003\"> </a></td><td>XPC Services</td><td>TA0002</td><td>T1559</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1559.002<a name=\"MITRE-ATTCK-Techniques-T1559.46002\"> </a></td><td>Dynamic Data Exchange</td><td>TA0002</td><td>T1559</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1559.001<a name=\"MITRE-ATTCK-Techniques-T1559.46001\"> </a></td><td>Component Object Model</td><td>TA0002</td><td>T1559</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1001<a name=\"MITRE-ATTCK-Techniques-T1001\"> </a></td><td>Data Obfuscation</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1001.001<a name=\"MITRE-ATTCK-Techniques-T1001.46001\"> </a></td><td>Junk Data</td><td>TA0011</td><td>T1001</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1001.003<a name=\"MITRE-ATTCK-Techniques-T1001.46003\"> </a></td><td>Protocol or Service Impersonation</td><td>TA0011</td><td>T1001</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1001.002<a name=\"MITRE-ATTCK-Techniques-T1001.46002\"> </a></td><td>Steganography</td><td>TA0011</td><td>T1001</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1039<a name=\"MITRE-ATTCK-Techniques-T1039\"> </a></td><td>Data from Network Shared Drive</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1601<a name=\"MITRE-ATTCK-Techniques-T1601\"> </a></td><td>Modify System Image</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1601.002<a name=\"MITRE-ATTCK-Techniques-T1601.46002\"> </a></td><td>Downgrade System Image</td><td>TA0005</td><td>T1601</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1601.001<a name=\"MITRE-ATTCK-Techniques-T1601.46001\"> </a></td><td>Patch System Image</td><td>TA0005</td><td>T1601</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1574<a name=\"MITRE-ATTCK-Techniques-T1574\"> </a></td><td>Hijack Execution Flow</td><td>TA0003, TA0004, TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1574.010<a name=\"MITRE-ATTCK-Techniques-T1574.46010\"> </a></td><td>Services File Permissions Weakness</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1574.013<a name=\"MITRE-ATTCK-Techniques-T1574.46013\"> </a></td><td>KernelCallbackTable</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1574.007<a name=\"MITRE-ATTCK-Techniques-T1574.46007\"> </a></td><td>Path Interception by PATH Environment Variable</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1574.005<a name=\"MITRE-ATTCK-Techniques-T1574.46005\"> </a></td><td>Executable Installer File Permissions Weakness</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1574.009<a name=\"MITRE-ATTCK-Techniques-T1574.46009\"> </a></td><td>Path Interception by Unquoted Path</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1574.004<a name=\"MITRE-ATTCK-Techniques-T1574.46004\"> </a></td><td>Dylib Hijacking</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1574.006<a name=\"MITRE-ATTCK-Techniques-T1574.46006\"> </a></td><td>Dynamic Linker Hijacking</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1574.014<a name=\"MITRE-ATTCK-Techniques-T1574.46014\"> </a></td><td>AppDomainManager</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1574.001<a name=\"MITRE-ATTCK-Techniques-T1574.46001\"> </a></td><td>DLL</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1574.008<a name=\"MITRE-ATTCK-Techniques-T1574.46008\"> </a></td><td>Path Interception by Search Order Hijacking</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1574.011<a name=\"MITRE-ATTCK-Techniques-T1574.46011\"> </a></td><td>Services Registry Permissions Weakness</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1574.012<a name=\"MITRE-ATTCK-Techniques-T1574.46012\"> </a></td><td>COR_PROFILER</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1078<a name=\"MITRE-ATTCK-Techniques-T1078\"> </a></td><td>Valid Accounts</td><td>TA0005, TA0003, TA0004, TA0001</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1078.004<a name=\"MITRE-ATTCK-Techniques-T1078.46004\"> </a></td><td>Cloud Accounts</td><td>TA0005, TA0003, TA0004, TA0001</td><td>T1078</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1078.002<a name=\"MITRE-ATTCK-Techniques-T1078.46002\"> </a></td><td>Domain Accounts</td><td>TA0005, TA0003, TA0004, TA0001</td><td>T1078</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1078.003<a name=\"MITRE-ATTCK-Techniques-T1078.46003\"> </a></td><td>Local Accounts</td><td>TA0005, TA0003, TA0004, TA0001</td><td>T1078</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1078.001<a name=\"MITRE-ATTCK-Techniques-T1078.46001\"> </a></td><td>Default Accounts</td><td>TA0005, TA0003, TA0004, TA0001</td><td>T1078</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1571<a name=\"MITRE-ATTCK-Techniques-T1571\"> </a></td><td>Non-Standard Port</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1068<a name=\"MITRE-ATTCK-Techniques-T1068\"> </a></td><td>Exploitation for Privilege Escalation</td><td>TA0004</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1531<a name=\"MITRE-ATTCK-Techniques-T1531\"> </a></td><td>Account Access Removal</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1027<a name=\"MITRE-ATTCK-Techniques-T1027\"> </a></td><td>Obfuscated Files or Information</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1027.005<a name=\"MITRE-ATTCK-Techniques-T1027.46005\"> </a></td><td>Indicator Removal from Tools</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.009<a name=\"MITRE-ATTCK-Techniques-T1027.46009\"> </a></td><td>Embedded Payloads</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.013<a name=\"MITRE-ATTCK-Techniques-T1027.46013\"> </a></td><td>Encrypted/Encoded File</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.012<a name=\"MITRE-ATTCK-Techniques-T1027.46012\"> </a></td><td>LNK Icon Smuggling</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.017<a name=\"MITRE-ATTCK-Techniques-T1027.46017\"> </a></td><td>SVG Smuggling</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.006<a name=\"MITRE-ATTCK-Techniques-T1027.46006\"> </a></td><td>HTML Smuggling</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.011<a name=\"MITRE-ATTCK-Techniques-T1027.46011\"> </a></td><td>Fileless Storage</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.014<a name=\"MITRE-ATTCK-Techniques-T1027.46014\"> </a></td><td>Polymorphic Code</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.010<a name=\"MITRE-ATTCK-Techniques-T1027.46010\"> </a></td><td>Command Obfuscation</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.004<a name=\"MITRE-ATTCK-Techniques-T1027.46004\"> </a></td><td>Compile After Delivery</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.007<a name=\"MITRE-ATTCK-Techniques-T1027.46007\"> </a></td><td>Dynamic API Resolution</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.003<a name=\"MITRE-ATTCK-Techniques-T1027.46003\"> </a></td><td>Steganography</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.015<a name=\"MITRE-ATTCK-Techniques-T1027.46015\"> </a></td><td>Compression</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.016<a name=\"MITRE-ATTCK-Techniques-T1027.46016\"> </a></td><td>Junk Code Insertion</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.008<a name=\"MITRE-ATTCK-Techniques-T1027.46008\"> </a></td><td>Stripped Payloads</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.002<a name=\"MITRE-ATTCK-Techniques-T1027.46002\"> </a></td><td>Software Packing</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.001<a name=\"MITRE-ATTCK-Techniques-T1027.46001\"> </a></td><td>Binary Padding</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1201<a name=\"MITRE-ATTCK-Techniques-T1201\"> </a></td><td>Password Policy Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1546<a name=\"MITRE-ATTCK-Techniques-T1546\"> </a></td><td>Event Triggered Execution</td><td>TA0004, TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1546.002<a name=\"MITRE-ATTCK-Techniques-T1546.46002\"> </a></td><td>Screensaver</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.013<a name=\"MITRE-ATTCK-Techniques-T1546.46013\"> </a></td><td>PowerShell Profile</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.016<a name=\"MITRE-ATTCK-Techniques-T1546.46016\"> </a></td><td>Installer Packages</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.003<a name=\"MITRE-ATTCK-Techniques-T1546.46003\"> </a></td><td>Windows Management Instrumentation Event Subscription</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.006<a name=\"MITRE-ATTCK-Techniques-T1546.46006\"> </a></td><td>LC_LOAD_DYLIB Addition</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.018<a name=\"MITRE-ATTCK-Techniques-T1546.46018\"> </a></td><td>Python Startup Hooks</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.011<a name=\"MITRE-ATTCK-Techniques-T1546.46011\"> </a></td><td>Application Shimming</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.015<a name=\"MITRE-ATTCK-Techniques-T1546.46015\"> </a></td><td>Component Object Model Hijacking</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.004<a name=\"MITRE-ATTCK-Techniques-T1546.46004\"> </a></td><td>Unix Shell Configuration Modification</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.010<a name=\"MITRE-ATTCK-Techniques-T1546.46010\"> </a></td><td>AppInit DLLs</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.005<a name=\"MITRE-ATTCK-Techniques-T1546.46005\"> </a></td><td>Trap</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.007<a name=\"MITRE-ATTCK-Techniques-T1546.46007\"> </a></td><td>Netsh Helper DLL</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.012<a name=\"MITRE-ATTCK-Techniques-T1546.46012\"> </a></td><td>Image File Execution Options Injection</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.001<a name=\"MITRE-ATTCK-Techniques-T1546.46001\"> </a></td><td>Change Default File Association</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.009<a name=\"MITRE-ATTCK-Techniques-T1546.46009\"> </a></td><td>AppCert DLLs</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.017<a name=\"MITRE-ATTCK-Techniques-T1546.46017\"> </a></td><td>Udev Rules</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.014<a name=\"MITRE-ATTCK-Techniques-T1546.46014\"> </a></td><td>Emond</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.008<a name=\"MITRE-ATTCK-Techniques-T1546.46008\"> </a></td><td>Accessibility Features</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1187<a name=\"MITRE-ATTCK-Techniques-T1187\"> </a></td><td>Forced Authentication</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1599<a name=\"MITRE-ATTCK-Techniques-T1599\"> </a></td><td>Network Boundary Bridging</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1599.001<a name=\"MITRE-ATTCK-Techniques-T1599.46001\"> </a></td><td>Network Address Translation Traversal</td><td>TA0005</td><td>T1599</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1486<a name=\"MITRE-ATTCK-Techniques-T1486\"> </a></td><td>Data Encrypted for Impact</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1553<a name=\"MITRE-ATTCK-Techniques-T1553\"> </a></td><td>Subvert Trust Controls</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1553.005<a name=\"MITRE-ATTCK-Techniques-T1553.46005\"> </a></td><td>Mark-of-the-Web Bypass</td><td>TA0005</td><td>T1553</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1553.002<a name=\"MITRE-ATTCK-Techniques-T1553.46002\"> </a></td><td>Code Signing</td><td>TA0005</td><td>T1553</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1553.004<a name=\"MITRE-ATTCK-Techniques-T1553.46004\"> </a></td><td>Install Root Certificate</td><td>TA0005</td><td>T1553</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1553.003<a name=\"MITRE-ATTCK-Techniques-T1553.46003\"> </a></td><td>SIP and Trust Provider Hijacking</td><td>TA0005</td><td>T1553</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1553.006<a name=\"MITRE-ATTCK-Techniques-T1553.46006\"> </a></td><td>Code Signing Policy Modification</td><td>TA0005</td><td>T1553</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1553.001<a name=\"MITRE-ATTCK-Techniques-T1553.46001\"> </a></td><td>Gatekeeper Bypass</td><td>TA0005</td><td>T1553</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1573<a name=\"MITRE-ATTCK-Techniques-T1573\"> </a></td><td>Encrypted Channel</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1573.002<a name=\"MITRE-ATTCK-Techniques-T1573.46002\"> </a></td><td>Asymmetric Cryptography</td><td>TA0011</td><td>T1573</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1573.001<a name=\"MITRE-ATTCK-Techniques-T1573.46001\"> </a></td><td>Symmetric Cryptography</td><td>TA0011</td><td>T1573</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1056<a name=\"MITRE-ATTCK-Techniques-T1056\"> </a></td><td>Input Capture</td><td>TA0009, TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1056.001<a name=\"MITRE-ATTCK-Techniques-T1056.46001\"> </a></td><td>Keylogging</td><td>TA0009, TA0006</td><td>T1056</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1056.002<a name=\"MITRE-ATTCK-Techniques-T1056.46002\"> </a></td><td>GUI Input Capture</td><td>TA0009, TA0006</td><td>T1056</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1056.004<a name=\"MITRE-ATTCK-Techniques-T1056.46004\"> </a></td><td>Credential API Hooking</td><td>TA0009, TA0006</td><td>T1056</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1056.003<a name=\"MITRE-ATTCK-Techniques-T1056.46003\"> </a></td><td>Web Portal Capture</td><td>TA0009, TA0006</td><td>T1056</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1203<a name=\"MITRE-ATTCK-Techniques-T1203\"> </a></td><td>Exploitation for Client Execution</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1667<a name=\"MITRE-ATTCK-Techniques-T1667\"> </a></td><td>Email Bombing</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1570<a name=\"MITRE-ATTCK-Techniques-T1570\"> </a></td><td>Lateral Tool Transfer</td><td>TA0008</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1095<a name=\"MITRE-ATTCK-Techniques-T1095\"> </a></td><td>Non-Application Layer Protocol</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1671<a name=\"MITRE-ATTCK-Techniques-T1671\"> </a></td><td>Cloud Application Integration</td><td>TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1012<a name=\"MITRE-ATTCK-Techniques-T1012\"> </a></td><td>Query Registry</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1030<a name=\"MITRE-ATTCK-Techniques-T1030\"> </a></td><td>Data Transfer Size Limits</td><td>TA0010</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1499<a name=\"MITRE-ATTCK-Techniques-T1499\"> </a></td><td>Endpoint Denial of Service</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1499.003<a name=\"MITRE-ATTCK-Techniques-T1499.46003\"> </a></td><td>Application Exhaustion Flood</td><td>TA0040</td><td>T1499</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1499.002<a name=\"MITRE-ATTCK-Techniques-T1499.46002\"> </a></td><td>Service Exhaustion Flood</td><td>TA0040</td><td>T1499</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1499.004<a name=\"MITRE-ATTCK-Techniques-T1499.46004\"> </a></td><td>Application or System Exploitation</td><td>TA0040</td><td>T1499</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1499.001<a name=\"MITRE-ATTCK-Techniques-T1499.46001\"> </a></td><td>OS Exhaustion Flood</td><td>TA0040</td><td>T1499</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1614<a name=\"MITRE-ATTCK-Techniques-T1614\"> </a></td><td>System Location Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1614.001<a name=\"MITRE-ATTCK-Techniques-T1614.46001\"> </a></td><td>System Language Discovery</td><td>TA0007</td><td>T1614</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1197<a name=\"MITRE-ATTCK-Techniques-T1197\"> </a></td><td>BITS Jobs</td><td>TA0005, TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1656<a name=\"MITRE-ATTCK-Techniques-T1656\"> </a></td><td>Impersonation</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1132<a name=\"MITRE-ATTCK-Techniques-T1132\"> </a></td><td>Data Encoding</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1132.001<a name=\"MITRE-ATTCK-Techniques-T1132.46001\"> </a></td><td>Standard Encoding</td><td>TA0011</td><td>T1132</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1132.002<a name=\"MITRE-ATTCK-Techniques-T1132.46002\"> </a></td><td>Non-Standard Encoding</td><td>TA0011</td><td>T1132</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1598<a name=\"MITRE-ATTCK-Techniques-T1598\"> </a></td><td>Phishing for Information</td><td>TA0043</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1598.004<a name=\"MITRE-ATTCK-Techniques-T1598.46004\"> </a></td><td>Spearphishing Voice</td><td>TA0043</td><td>T1598</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1598.001<a name=\"MITRE-ATTCK-Techniques-T1598.46001\"> </a></td><td>Spearphishing Service</td><td>TA0043</td><td>T1598</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1598.002<a name=\"MITRE-ATTCK-Techniques-T1598.46002\"> </a></td><td>Spearphishing Attachment</td><td>TA0043</td><td>T1598</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1598.003<a name=\"MITRE-ATTCK-Techniques-T1598.46003\"> </a></td><td>Spearphishing Link</td><td>TA0043</td><td>T1598</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1496<a name=\"MITRE-ATTCK-Techniques-T1496\"> </a></td><td>Resource Hijacking</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1496.001<a name=\"MITRE-ATTCK-Techniques-T1496.46001\"> </a></td><td>Compute Hijacking</td><td>TA0040</td><td>T1496</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1496.002<a name=\"MITRE-ATTCK-Techniques-T1496.46002\"> </a></td><td>Bandwidth Hijacking</td><td>TA0040</td><td>T1496</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1496.004<a name=\"MITRE-ATTCK-Techniques-T1496.46004\"> </a></td><td>Cloud Service Hijacking</td><td>TA0040</td><td>T1496</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1496.003<a name=\"MITRE-ATTCK-Techniques-T1496.46003\"> </a></td><td>SMS Pumping</td><td>TA0040</td><td>T1496</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1585<a name=\"MITRE-ATTCK-Techniques-T1585\"> </a></td><td>Establish Accounts</td><td>TA0042</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1585.003<a name=\"MITRE-ATTCK-Techniques-T1585.46003\"> </a></td><td>Cloud Accounts</td><td>TA0042</td><td>T1585</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1585.002<a name=\"MITRE-ATTCK-Techniques-T1585.46002\"> </a></td><td>Email Accounts</td><td>TA0042</td><td>T1585</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1585.001<a name=\"MITRE-ATTCK-Techniques-T1585.46001\"> </a></td><td>Social Media Accounts</td><td>TA0042</td><td>T1585</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1588<a name=\"MITRE-ATTCK-Techniques-T1588\"> </a></td><td>Obtain Capabilities</td><td>TA0042</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1588.006<a name=\"MITRE-ATTCK-Techniques-T1588.46006\"> </a></td><td>Vulnerabilities</td><td>TA0042</td><td>T1588</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1588.005<a name=\"MITRE-ATTCK-Techniques-T1588.46005\"> </a></td><td>Exploits</td><td>TA0042</td><td>T1588</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1588.007<a name=\"MITRE-ATTCK-Techniques-T1588.46007\"> </a></td><td>Artificial Intelligence</td><td>TA0042</td><td>T1588</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1588.004<a name=\"MITRE-ATTCK-Techniques-T1588.46004\"> </a></td><td>Digital Certificates</td><td>TA0042</td><td>T1588</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1588.002<a name=\"MITRE-ATTCK-Techniques-T1588.46002\"> </a></td><td>Tool</td><td>TA0042</td><td>T1588</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1588.003<a name=\"MITRE-ATTCK-Techniques-T1588.46003\"> </a></td><td>Code Signing Certificates</td><td>TA0042</td><td>T1588</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1588.001<a name=\"MITRE-ATTCK-Techniques-T1588.46001\"> </a></td><td>Malware</td><td>TA0042</td><td>T1588</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1569<a name=\"MITRE-ATTCK-Techniques-T1569\"> </a></td><td>System Services</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1569.003<a name=\"MITRE-ATTCK-Techniques-T1569.46003\"> </a></td><td>Systemctl</td><td>TA0002</td><td>T1569</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1569.002<a name=\"MITRE-ATTCK-Techniques-T1569.46002\"> </a></td><td>Service Execution</td><td>TA0002</td><td>T1569</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1569.001<a name=\"MITRE-ATTCK-Techniques-T1569.46001\"> </a></td><td>Launchctl</td><td>TA0002</td><td>T1569</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1650<a name=\"MITRE-ATTCK-Techniques-T1650\"> </a></td><td>Acquire Access</td><td>TA0042</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1213<a name=\"MITRE-ATTCK-Techniques-T1213\"> </a></td><td>Data from Information Repositories</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1213.003<a name=\"MITRE-ATTCK-Techniques-T1213.46003\"> </a></td><td>Code Repositories</td><td>TA0009</td><td>T1213</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1213.006<a name=\"MITRE-ATTCK-Techniques-T1213.46006\"> </a></td><td>Databases</td><td>TA0009</td><td>T1213</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1213.005<a name=\"MITRE-ATTCK-Techniques-T1213.46005\"> </a></td><td>Messaging Applications</td><td>TA0009</td><td>T1213</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1213.004<a name=\"MITRE-ATTCK-Techniques-T1213.46004\"> </a></td><td>Customer Relationship Management Software</td><td>TA0009</td><td>T1213</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1213.002<a name=\"MITRE-ATTCK-Techniques-T1213.46002\"> </a></td><td>Sharepoint</td><td>TA0009</td><td>T1213</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1213.001<a name=\"MITRE-ATTCK-Techniques-T1213.46001\"> </a></td><td>Confluence</td><td>TA0009</td><td>T1213</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1200<a name=\"MITRE-ATTCK-Techniques-T1200\"> </a></td><td>Hardware Additions</td><td>TA0001</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1505<a name=\"MITRE-ATTCK-Techniques-T1505\"> </a></td><td>Server Software Component</td><td>TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1505.002<a name=\"MITRE-ATTCK-Techniques-T1505.46002\"> </a></td><td>Transport Agent</td><td>TA0003</td><td>T1505</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1505.004<a name=\"MITRE-ATTCK-Techniques-T1505.46004\"> </a></td><td>IIS Components</td><td>TA0003</td><td>T1505</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1505.003<a name=\"MITRE-ATTCK-Techniques-T1505.46003\"> </a></td><td>Web Shell</td><td>TA0003</td><td>T1505</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1505.005<a name=\"MITRE-ATTCK-Techniques-T1505.46005\"> </a></td><td>Terminal Services DLL</td><td>TA0003</td><td>T1505</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1505.006<a name=\"MITRE-ATTCK-Techniques-T1505.46006\"> </a></td><td>vSphere Installation Bundles</td><td>TA0003</td><td>T1505</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1505.001<a name=\"MITRE-ATTCK-Techniques-T1505.46001\"> </a></td><td>SQL Stored Procedures</td><td>TA0003</td><td>T1505</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1485<a name=\"MITRE-ATTCK-Techniques-T1485\"> </a></td><td>Data Destruction</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1485.001<a name=\"MITRE-ATTCK-Techniques-T1485.46001\"> </a></td><td>Lifecycle-Triggered Deletion</td><td>TA0040</td><td>T1485</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1537<a name=\"MITRE-ATTCK-Techniques-T1537\"> </a></td><td>Transfer Data to Cloud Account</td><td>TA0010</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1189<a name=\"MITRE-ATTCK-Techniques-T1189\"> </a></td><td>Drive-by Compromise</td><td>TA0001</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1498<a name=\"MITRE-ATTCK-Techniques-T1498\"> </a></td><td>Network Denial of Service</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1498.002<a name=\"MITRE-ATTCK-Techniques-T1498.46002\"> </a></td><td>Reflection Amplification</td><td>TA0040</td><td>T1498</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1498.001<a name=\"MITRE-ATTCK-Techniques-T1498.46001\"> </a></td><td>Direct Network Flood</td><td>TA0040</td><td>T1498</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1651<a name=\"MITRE-ATTCK-Techniques-T1651\"> </a></td><td>Cloud Administration Command</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1221<a name=\"MITRE-ATTCK-Techniques-T1221\"> </a></td><td>Template Injection</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1134<a name=\"MITRE-ATTCK-Techniques-T1134\"> </a></td><td>Access Token Manipulation</td><td>TA0005, TA0004</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1134.001<a name=\"MITRE-ATTCK-Techniques-T1134.46001\"> </a></td><td>Token Impersonation/Theft</td><td>TA0005, TA0004</td><td>T1134</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1134.004<a name=\"MITRE-ATTCK-Techniques-T1134.46004\"> </a></td><td>Parent PID Spoofing</td><td>TA0005, TA0004</td><td>T1134</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1134.005<a name=\"MITRE-ATTCK-Techniques-T1134.46005\"> </a></td><td>SID-History Injection</td><td>TA0005, TA0004</td><td>T1134</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1134.002<a name=\"MITRE-ATTCK-Techniques-T1134.46002\"> </a></td><td>Create Process with Token</td><td>TA0005, TA0004</td><td>T1134</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1134.003<a name=\"MITRE-ATTCK-Techniques-T1134.46003\"> </a></td><td>Make and Impersonate Token</td><td>TA0005, TA0004</td><td>T1134</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1111<a name=\"MITRE-ATTCK-Techniques-T1111\"> </a></td><td>Multi-Factor Authentication Interception</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1668<a name=\"MITRE-ATTCK-Techniques-T1668\"> </a></td><td>Exclusive Control</td><td>TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1136<a name=\"MITRE-ATTCK-Techniques-T1136\"> </a></td><td>Create Account</td><td>TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1136.003<a name=\"MITRE-ATTCK-Techniques-T1136.46003\"> </a></td><td>Cloud Account</td><td>TA0003</td><td>T1136</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1136.001<a name=\"MITRE-ATTCK-Techniques-T1136.46001\"> </a></td><td>Local Account</td><td>TA0003</td><td>T1136</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1136.002<a name=\"MITRE-ATTCK-Techniques-T1136.46002\"> </a></td><td>Domain Account</td><td>TA0003</td><td>T1136</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1672<a name=\"MITRE-ATTCK-Techniques-T1672\"> </a></td><td>Email Spoofing</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1526<a name=\"MITRE-ATTCK-Techniques-T1526\"> </a></td><td>Cloud Service Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1018<a name=\"MITRE-ATTCK-Techniques-T1018\"> </a></td><td>Remote System Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1046<a name=\"MITRE-ATTCK-Techniques-T1046\"> </a></td><td>Network Service Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1518<a name=\"MITRE-ATTCK-Techniques-T1518\"> </a></td><td>Software Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1518.001<a name=\"MITRE-ATTCK-Techniques-T1518.46001\"> </a></td><td>Security Software Discovery</td><td>TA0007</td><td>T1518</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1518.002<a name=\"MITRE-ATTCK-Techniques-T1518.46002\"> </a></td><td>Backup Software Discovery</td><td>TA0007</td><td>T1518</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1538<a name=\"MITRE-ATTCK-Techniques-T1538\"> </a></td><td>Cloud Service Dashboard</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1622<a name=\"MITRE-ATTCK-Techniques-T1622\"> </a></td><td>Debugger Evasion</td><td>TA0005, TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1052<a name=\"MITRE-ATTCK-Techniques-T1052\"> </a></td><td>Exfiltration Over Physical Medium</td><td>TA0010</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1052.001<a name=\"MITRE-ATTCK-Techniques-T1052.46001\"> </a></td><td>Exfiltration over USB</td><td>TA0010</td><td>T1052</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1105<a name=\"MITRE-ATTCK-Techniques-T1105\"> </a></td><td>Ingress Tool Transfer</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1648<a name=\"MITRE-ATTCK-Techniques-T1648\"> </a></td><td>Serverless Execution</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1653<a name=\"MITRE-ATTCK-Techniques-T1653\"> </a></td><td>Power Settings</td><td>TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1665<a name=\"MITRE-ATTCK-Techniques-T1665\"> </a></td><td>Hide Infrastructure</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1484<a name=\"MITRE-ATTCK-Techniques-T1484\"> </a></td><td>Domain or Tenant Policy Modification</td><td>TA0005, TA0004</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1484.002<a name=\"MITRE-ATTCK-Techniques-T1484.46002\"> </a></td><td>Trust Modification</td><td>TA0005, TA0004</td><td>T1484</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1484.001<a name=\"MITRE-ATTCK-Techniques-T1484.46001\"> </a></td><td>Group Policy Modification</td><td>TA0005, TA0004</td><td>T1484</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1220<a name=\"MITRE-ATTCK-Techniques-T1220\"> </a></td><td>XSL Script Processing</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1587<a name=\"MITRE-ATTCK-Techniques-T1587\"> </a></td><td>Develop Capabilities</td><td>TA0042</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1587.002<a name=\"MITRE-ATTCK-Techniques-T1587.46002\"> </a></td><td>Code Signing Certificates</td><td>TA0042</td><td>T1587</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1587.003<a name=\"MITRE-ATTCK-Techniques-T1587.46003\"> </a></td><td>Digital Certificates</td><td>TA0042</td><td>T1587</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1587.004<a name=\"MITRE-ATTCK-Techniques-T1587.46004\"> </a></td><td>Exploits</td><td>TA0042</td><td>T1587</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1587.001<a name=\"MITRE-ATTCK-Techniques-T1587.46001\"> </a></td><td>Malware</td><td>TA0042</td><td>T1587</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1008<a name=\"MITRE-ATTCK-Techniques-T1008\"> </a></td><td>Fallback Channels</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1680<a name=\"MITRE-ATTCK-Techniques-T1680\"> </a></td><td>Local Storage Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1124<a name=\"MITRE-ATTCK-Techniques-T1124\"> </a></td><td>System Time Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1556<a name=\"MITRE-ATTCK-Techniques-T1556\"> </a></td><td>Modify Authentication Process</td><td>TA0006, TA0005, TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1556.004<a name=\"MITRE-ATTCK-Techniques-T1556.46004\"> </a></td><td>Network Device Authentication</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1556.001<a name=\"MITRE-ATTCK-Techniques-T1556.46001\"> </a></td><td>Domain Controller Authentication</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1556.009<a name=\"MITRE-ATTCK-Techniques-T1556.46009\"> </a></td><td>Conditional Access Policies</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1556.008<a name=\"MITRE-ATTCK-Techniques-T1556.46008\"> </a></td><td>Network Provider DLL</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1556.002<a name=\"MITRE-ATTCK-Techniques-T1556.46002\"> </a></td><td>Password Filter DLL</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1556.006<a name=\"MITRE-ATTCK-Techniques-T1556.46006\"> </a></td><td>Multi-Factor Authentication</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1556.007<a name=\"MITRE-ATTCK-Techniques-T1556.46007\"> </a></td><td>Hybrid Identity</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1556.005<a name=\"MITRE-ATTCK-Techniques-T1556.46005\"> </a></td><td>Reversible Encryption</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1556.003<a name=\"MITRE-ATTCK-Techniques-T1556.46003\"> </a></td><td>Pluggable Authentication Modules</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1495<a name=\"MITRE-ATTCK-Techniques-T1495\"> </a></td><td>Firmware Corruption</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1490<a name=\"MITRE-ATTCK-Techniques-T1490\"> </a></td><td>Inhibit System Recovery</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1216<a name=\"MITRE-ATTCK-Techniques-T1216\"> </a></td><td>System Script Proxy Execution</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1216.001<a name=\"MITRE-ATTCK-Techniques-T1216.46001\"> </a></td><td>PubPrn</td><td>TA0005</td><td>T1216</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1216.002<a name=\"MITRE-ATTCK-Techniques-T1216.46002\"> </a></td><td>SyncAppvPublishingServer</td><td>TA0005</td><td>T1216</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1669<a name=\"MITRE-ATTCK-Techniques-T1669\"> </a></td><td>Wi-Fi Networks</td><td>TA0001</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1211<a name=\"MITRE-ATTCK-Techniques-T1211\"> </a></td><td>Exploitation for Defense Evasion</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1127<a name=\"MITRE-ATTCK-Techniques-T1127\"> </a></td><td>Trusted Developer Utilities Proxy Execution</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1127.001<a name=\"MITRE-ATTCK-Techniques-T1127.46001\"> </a></td><td>MSBuild</td><td>TA0005</td><td>T1127</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1127.002<a name=\"MITRE-ATTCK-Techniques-T1127.46002\"> </a></td><td>ClickOnce</td><td>TA0005</td><td>T1127</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1127.003<a name=\"MITRE-ATTCK-Techniques-T1127.46003\"> </a></td><td>JamPlus</td><td>TA0005</td><td>T1127</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1529<a name=\"MITRE-ATTCK-Techniques-T1529\"> </a></td><td>System Shutdown/Reboot</td><td>TA0040</td><td/><td>false</td></tr></table></div>"
  },
  "url" : "https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Techniques",
  "version" : "0.0.5",
  "name" : "MITRE-ATTCK-Techniques",
  "title" : "CS MITRE ATT&CK Techniques and Subtechniques",
  "status" : "draft",
  "experimental" : false,
  "date" : "2026-04-26T20:36:59+00:00",
  "publisher" : "ATTCK2FHIR IG",
  "contact" : [
    {
      "name" : "ATTCK2FHIR IG",
      "telecom" : [
        {
          "system" : "url",
          "value" : "https://constir1.github.io/ATTCK2FHIR"
        }
      ]
    }
  ],
  "description" : "This Code System contains all MITRE ATT&CK Enterprise Techniques and Subtechniques with their tactic and parent-technique relationships expressed as properties.",
  "caseSensitive" : true,
  "content" : "complete",
  "count" : 691,
  "property" : [
    {
      "code" : "tactic",
      "uri" : "https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Tactics",
      "description" : "The tactic(s) this technique or subtechnique contributes to, referenced by tactic ID",
      "type" : "code"
    },
    {
      "code" : "parentTechnique",
      "uri" : "https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Techniques",
      "description" : "The parent technique of this subtechnique, referenced by ATT&CK ID",
      "type" : "code"
    },
    {
      "code" : "isSubtechnique",
      "description" : "Whether this concept is a subtechnique",
      "type" : "boolean"
    }
  ],
  "concept" : [
    {
      "code" : "T1047",
      "display" : "Windows Management Instrumentation",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1113",
      "display" : "Screen Capture",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1037",
      "display" : "Boot or Logon Initialization Scripts",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1037.004",
      "display" : "RC Scripts",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1037"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1037.001",
      "display" : "Logon Script (Windows)",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1037"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1037.003",
      "display" : "Network Logon Script",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1037"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1037.005",
      "display" : "Startup Items",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1037"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1037.002",
      "display" : "Login Hook",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1037"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1557",
      "display" : "Adversary-in-the-Middle",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1557.003",
      "display" : "DHCP Spoofing",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1557"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1557.002",
      "display" : "ARP Cache Poisoning",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1557"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1557.001",
      "display" : "LLMNR/NBT-NS Poisoning and SMB Relay",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1557"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1557.004",
      "display" : "Evil Twin",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1557"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1033",
      "display" : "System Owner/User Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1583",
      "display" : "Acquire Infrastructure",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1583.008",
      "display" : "Malvertising",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1583"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1583.001",
      "display" : "Domains",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1583"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1583.005",
      "display" : "Botnet",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1583"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1583.004",
      "display" : "Server",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1583"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1583.002",
      "display" : "DNS Server",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1583"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1583.003",
      "display" : "Virtual Private Server",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1583"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1583.007",
      "display" : "Serverless",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1583"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1583.006",
      "display" : "Web Services",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1583"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1613",
      "display" : "Container and Resource Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1592",
      "display" : "Gather Victim Host Information",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1592.001",
      "display" : "Hardware",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1592"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1592.003",
      "display" : "Firmware",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1592"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1592.002",
      "display" : "Software",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1592"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1592.004",
      "display" : "Client Configurations",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1592"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1003",
      "display" : "OS Credential Dumping",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1003.002",
      "display" : "Security Account Manager",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1003.004",
      "display" : "LSA Secrets",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1003.006",
      "display" : "DCSync",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1003.007",
      "display" : "Proc Filesystem",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1003.003",
      "display" : "NTDS",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1003.005",
      "display" : "Cached Domain Credentials",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1003.001",
      "display" : "LSASS Memory",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1003.008",
      "display" : "/etc/passwd and /etc/shadow",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1129",
      "display" : "Shared Modules",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1602",
      "display" : "Data from Configuration Repository",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1602.002",
      "display" : "Network Device Configuration Dump",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1602"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1602.001",
      "display" : "SNMP (MIB Dump)",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1602"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1006",
      "display" : "Direct Volume Access",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1666",
      "display" : "Modify Cloud Resource Hierarchy",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1014",
      "display" : "Rootkit",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1123",
      "display" : "Audio Capture",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1543",
      "display" : "Create or Modify System Process",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1543.004",
      "display" : "Launch Daemon",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1543"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1543.005",
      "display" : "Container Service",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1543"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1543.001",
      "display" : "Launch Agent",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1543"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1543.002",
      "display" : "Systemd Service",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1543"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1543.003",
      "display" : "Windows Service",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1543"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1133",
      "display" : "External Remote Services",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0001"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1539",
      "display" : "Steal Web Session Cookie",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1578",
      "display" : "Modify Cloud Compute Infrastructure",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1578.001",
      "display" : "Create Snapshot",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1578"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1578.003",
      "display" : "Delete Cloud Instance",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1578"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1578.004",
      "display" : "Revert Cloud Instance",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1578"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1578.002",
      "display" : "Create Cloud Instance",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1578"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1578.005",
      "display" : "Modify Cloud Compute Configurations",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1578"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1069",
      "display" : "Permission Groups Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1069.003",
      "display" : "Cloud Groups",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1069"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1069.002",
      "display" : "Domain Groups",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1069"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1069.001",
      "display" : "Local Groups",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1069"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1114",
      "display" : "Email Collection",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1114.002",
      "display" : "Remote Email Collection",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1114"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1114.003",
      "display" : "Email Forwarding Rule",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1114"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1114.001",
      "display" : "Local Email Collection",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1114"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1594",
      "display" : "Search Victim-Owned Websites",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1561",
      "display" : "Disk Wipe",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1561.002",
      "display" : "Disk Structure Wipe",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1561"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1561.001",
      "display" : "Disk Content Wipe",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1561"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1615",
      "display" : "Group Policy Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1025",
      "display" : "Data from Removable Media",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1547",
      "display" : "Boot or Logon Autostart Execution",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1547.009",
      "display" : "Shortcut Modification",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1547"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1547.006",
      "display" : "Kernel Modules and Extensions",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1547"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1547.007",
      "display" : "Re-opened Applications",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1547"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1547.004",
      "display" : "Winlogon Helper DLL",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1547"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1547.005",
      "display" : "Security Support Provider",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1547"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1547.001",
      "display" : "Registry Run Keys / Startup Folder",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1547"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1547.008",
      "display" : "LSASS Driver",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1547"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1547.012",
      "display" : "Print Processors",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1547"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1547.014",
      "display" : "Active Setup",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1547"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1547.015",
      "display" : "Login Items",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1547"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1547.013",
      "display" : "XDG Autostart Entries",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1547"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1547.003",
      "display" : "Time Providers",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1547"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1547.002",
      "display" : "Authentication Package",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1547"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1547.010",
      "display" : "Port Monitors",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1547"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1600",
      "display" : "Weaken Encryption",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1600.001",
      "display" : "Reduce Key Space",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1600"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1600.002",
      "display" : "Disable Crypto Hardware",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1600"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1489",
      "display" : "Service Stop",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1652",
      "display" : "Device Driver Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1564",
      "display" : "Hide Artifacts",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1564.003",
      "display" : "Hidden Window",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1564"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1564.011",
      "display" : "Ignore Process Interrupts",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1564"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1564.002",
      "display" : "Hidden Users",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1564"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1564.012",
      "display" : "File/Path Exclusions",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1564"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1564.014",
      "display" : "Extended Attributes",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1564"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1564.008",
      "display" : "Email Hiding Rules",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1564"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1564.009",
      "display" : "Resource Forking",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1564"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1564.013",
      "display" : "Bind Mounts",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1564"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1564.006",
      "display" : "Run Virtual Instance",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1564"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1564.010",
      "display" : "Process Argument Spoofing",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1564"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1564.001",
      "display" : "Hidden Files and Directories",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1564"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1564.004",
      "display" : "NTFS File Attributes",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1564"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1564.007",
      "display" : "VBA Stomping",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1564"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1564.005",
      "display" : "Hidden File System",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1564"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1080",
      "display" : "Taint Shared Content",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0008"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1137",
      "display" : "Office Application Startup",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1137.002",
      "display" : "Office Test",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1137"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1137.001",
      "display" : "Office Template Macros",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1137"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1137.004",
      "display" : "Outlook Home Page",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1137"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1137.003",
      "display" : "Outlook Forms",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1137"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1137.006",
      "display" : "Add-ins",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1137"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1137.005",
      "display" : "Outlook Rules",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1137"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1119",
      "display" : "Automated Collection",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1115",
      "display" : "Clipboard Data",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1675",
      "display" : "ESXi Administration Command",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1007",
      "display" : "System Service Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1040",
      "display" : "Network Sniffing",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1530",
      "display" : "Data from Cloud Storage",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1135",
      "display" : "Network Share Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1120",
      "display" : "Peripheral Device Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1082",
      "display" : "System Information Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1071",
      "display" : "Application Layer Protocol",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1071.002",
      "display" : "File Transfer Protocols",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1071"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1071.004",
      "display" : "DNS",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1071"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1071.005",
      "display" : "Publish/Subscribe Protocols",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1071"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1071.003",
      "display" : "Mail Protocols",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1071"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1071.001",
      "display" : "Web Protocols",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1071"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1053",
      "display" : "Scheduled Task/Job",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1053.003",
      "display" : "Cron",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1053"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1053.005",
      "display" : "Scheduled Task",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1053"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1053.006",
      "display" : "Systemd Timers",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1053"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1053.007",
      "display" : "Container Orchestration Job",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1053"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1053.002",
      "display" : "At",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1053"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1176",
      "display" : "Software Extensions",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1176.002",
      "display" : "IDE Extensions",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1176"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1176.001",
      "display" : "Browser Extensions",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1176"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1106",
      "display" : "Native API",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1202",
      "display" : "Indirect Command Execution",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1091",
      "display" : "Replication Through Removable Media",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0008"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0001"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1005",
      "display" : "Data from Local System",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1140",
      "display" : "Deobfuscate/Decode Files or Information",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1562",
      "display" : "Impair Defenses",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1562.003",
      "display" : "Impair Command History Logging",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1562"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1562.013",
      "display" : "Disable or Modify Network Device Firewall",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1562"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1562.004",
      "display" : "Disable or Modify System Firewall",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1562"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1562.002",
      "display" : "Disable Windows Event Logging",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1562"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1562.001",
      "display" : "Disable or Modify Tools",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1562"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1562.006",
      "display" : "Indicator Blocking",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1562"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1562.012",
      "display" : "Disable or Modify Linux Audit System",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1562"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1562.011",
      "display" : "Spoof Security Alerting",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1562"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1562.008",
      "display" : "Disable or Modify Cloud Logs",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1562"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1562.010",
      "display" : "Downgrade Attack",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1562"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1562.007",
      "display" : "Disable or Modify Cloud Firewall",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1562"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1562.009",
      "display" : "Safe Mode Boot",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1562"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1195",
      "display" : "Supply Chain Compromise",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0001"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1195.001",
      "display" : "Compromise Software Dependencies and Development Tools",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1195"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0001"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1195.002",
      "display" : "Compromise Software Supply Chain",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1195"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0001"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1195.003",
      "display" : "Compromise Hardware Supply Chain",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1195"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0001"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1190",
      "display" : "Exploit Public-Facing Application",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0001"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1558",
      "display" : "Steal or Forge Kerberos Tickets",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1558.003",
      "display" : "Kerberoasting",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1558"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1558.002",
      "display" : "Silver Ticket",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1558"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1558.005",
      "display" : "Ccache Files",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1558"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1558.004",
      "display" : "AS-REP Roasting",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1558"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1558.001",
      "display" : "Golden Ticket",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1558"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1555",
      "display" : "Credentials from Password Stores",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1555.004",
      "display" : "Windows Credential Manager",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1555"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1555.001",
      "display" : "Keychain",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1555"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1555.005",
      "display" : "Password Managers",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1555"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1555.006",
      "display" : "Cloud Secrets Management Stores",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1555"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1555.003",
      "display" : "Credentials from Web Browsers",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1555"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1555.002",
      "display" : "Securityd Memory",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1555"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1567",
      "display" : "Exfiltration Over Web Service",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0010"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1567.001",
      "display" : "Exfiltration to Code Repository",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1567"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0010"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1567.003",
      "display" : "Exfiltration to Text Storage Sites",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1567"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0010"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1567.002",
      "display" : "Exfiltration to Cloud Storage",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1567"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0010"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1567.004",
      "display" : "Exfiltration Over Webhook",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1567"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0010"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1219",
      "display" : "Remote Access Tools",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1219.003",
      "display" : "Remote Access Hardware",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1219"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1219.001",
      "display" : "IDE Tunneling",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1219"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1219.002",
      "display" : "Remote Desktop Software",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1219"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1036",
      "display" : "Masquerading",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1036.008",
      "display" : "Masquerade File Type",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1036"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1036.003",
      "display" : "Rename Legitimate Utilities",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1036"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1036.006",
      "display" : "Space after Filename",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1036"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1036.004",
      "display" : "Masquerade Task or Service",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1036"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1036.002",
      "display" : "Right-to-Left Override",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1036"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1036.005",
      "display" : "Match Legitimate Resource Name or Location",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1036"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1036.011",
      "display" : "Overwrite Process Arguments",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1036"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1036.007",
      "display" : "Double File Extension",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1036"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1036.010",
      "display" : "Masquerade Account Name",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1036"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1036.001",
      "display" : "Invalid Code Signature",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1036"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1036.012",
      "display" : "Browser Fingerprint",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1036"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1036.009",
      "display" : "Break Process Trees",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1036"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1552",
      "display" : "Unsecured Credentials",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1552.006",
      "display" : "Group Policy Preferences",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1552"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1552.004",
      "display" : "Private Keys",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1552"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1552.007",
      "display" : "Container API",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1552"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1552.001",
      "display" : "Credentials In Files",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1552"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1552.002",
      "display" : "Credentials in Registry",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1552"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1552.003",
      "display" : "Shell History",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1552"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1552.008",
      "display" : "Chat Messages",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1552"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1552.005",
      "display" : "Cloud Instance Metadata API",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1552"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1659",
      "display" : "Content Injection",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0001"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1055",
      "display" : "Process Injection",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1055.013",
      "display" : "Process Doppelgänging",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1055"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1055.012",
      "display" : "Process Hollowing",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1055"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1055.009",
      "display" : "Proc Memory",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1055"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1055.015",
      "display" : "ListPlanting",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1055"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1055.014",
      "display" : "VDSO Hijacking",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1055"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1055.005",
      "display" : "Thread Local Storage",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1055"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1055.011",
      "display" : "Extra Window Memory Injection",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1055"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1055.001",
      "display" : "Dynamic-link Library Injection",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1055"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1055.003",
      "display" : "Thread Execution Hijacking",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1055"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1055.008",
      "display" : "Ptrace System Calls",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1055"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1055.004",
      "display" : "Asynchronous Procedure Call",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1055"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1055.002",
      "display" : "Portable Executable Injection",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1055"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1205",
      "display" : "Traffic Signaling",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1205.001",
      "display" : "Port Knocking",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1205"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1205.002",
      "display" : "Socket Filters",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1205"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1218",
      "display" : "System Binary Proxy Execution",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1218.005",
      "display" : "Mshta",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1218"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1218.014",
      "display" : "MMC",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1218"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1218.008",
      "display" : "Odbcconf",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1218"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1218.015",
      "display" : "Electron Applications",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1218"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1218.012",
      "display" : "Verclsid",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1218"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1218.013",
      "display" : "Mavinject",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1218"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1218.002",
      "display" : "Control Panel",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1218"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1218.001",
      "display" : "Compiled HTML File",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1218"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1218.010",
      "display" : "Regsvr32",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1218"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1218.004",
      "display" : "InstallUtil",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1218"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1218.011",
      "display" : "Rundll32",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1218"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1218.009",
      "display" : "Regsvcs/Regasm",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1218"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1218.003",
      "display" : "CMSTP",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1218"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1218.007",
      "display" : "Msiexec",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1218"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1620",
      "display" : "Reflective Code Loading",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1611",
      "display" : "Escape to Host",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1010",
      "display" : "Application Window Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1029",
      "display" : "Scheduled Transfer",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0010"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1525",
      "display" : "Implant Internal Image",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1572",
      "display" : "Protocol Tunneling",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1550",
      "display" : "Use Alternate Authentication Material",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0008"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1550.004",
      "display" : "Web Session Cookie",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1550"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0008"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1550.001",
      "display" : "Application Access Token",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1550"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0008"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1550.003",
      "display" : "Pass the Ticket",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1550"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0008"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1550.002",
      "display" : "Pass the Hash",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1550"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0008"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1011",
      "display" : "Exfiltration Over Other Network Medium",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0010"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1011.001",
      "display" : "Exfiltration Over Bluetooth",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1011"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0010"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1589",
      "display" : "Gather Victim Identity Information",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1589.003",
      "display" : "Employee Names",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1589"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1589.002",
      "display" : "Email Addresses",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1589"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1589.001",
      "display" : "Credentials",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1589"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1560",
      "display" : "Archive Collected Data",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1560.002",
      "display" : "Archive via Library",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1560"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1560.001",
      "display" : "Archive via Utility",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1560"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1560.003",
      "display" : "Archive via Custom Method",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1560"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1185",
      "display" : "Browser Session Hijacking",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1021",
      "display" : "Remote Services",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0008"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1021.006",
      "display" : "Windows Remote Management",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1021"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0008"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1021.005",
      "display" : "VNC",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1021"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0008"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1021.002",
      "display" : "SMB/Windows Admin Shares",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1021"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0008"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1021.007",
      "display" : "Cloud Services",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1021"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0008"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1021.001",
      "display" : "Remote Desktop Protocol",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1021"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0008"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1021.003",
      "display" : "Distributed Component Object Model",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1021"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0008"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1021.008",
      "display" : "Direct Cloud VM Connections",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1021"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0008"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1021.004",
      "display" : "SSH",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1021"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0008"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1596",
      "display" : "Search Open Technical Databases",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1596.003",
      "display" : "Digital Certificates",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1596"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1596.005",
      "display" : "Scan Databases",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1596"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1596.001",
      "display" : "DNS/Passive DNS",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1596"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1596.004",
      "display" : "CDNs",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1596"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1596.002",
      "display" : "WHOIS",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1596"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1207",
      "display" : "Rogue Domain Controller",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1610",
      "display" : "Deploy Container",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1112",
      "display" : "Modify Registry",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1580",
      "display" : "Cloud Infrastructure Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1491",
      "display" : "Defacement",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1491.002",
      "display" : "External Defacement",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1491"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1491.001",
      "display" : "Internal Defacement",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1491"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1535",
      "display" : "Unused/Unsupported Cloud Regions",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1563",
      "display" : "Remote Service Session Hijacking",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0008"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1563.002",
      "display" : "RDP Hijacking",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1563"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0008"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1563.001",
      "display" : "SSH Hijacking",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1563"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0008"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1217",
      "display" : "Browser Information Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1681",
      "display" : "Search Threat Vendor Data",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1674",
      "display" : "Input Injection",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1092",
      "display" : "Communication Through Removable Media",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1222",
      "display" : "File and Directory Permissions Modification",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1222.002",
      "display" : "Linux and Mac File and Directory Permissions Modification",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1222"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1222.001",
      "display" : "Windows File and Directory Permissions Modification",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1222"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1595",
      "display" : "Active Scanning",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1595.003",
      "display" : "Wordlist Scanning",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1595"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1595.001",
      "display" : "Scanning IP Blocks",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1595"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1595.002",
      "display" : "Vulnerability Scanning",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1595"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1548",
      "display" : "Abuse Elevation Control Mechanism",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1548.001",
      "display" : "Setuid and Setgid",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1548"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1548.005",
      "display" : "Temporary Elevated Cloud Access",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1548"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1548.002",
      "display" : "Bypass User Account Control",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1548"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1548.004",
      "display" : "Elevated Execution with Prompt",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1548"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1548.003",
      "display" : "Sudo and Sudo Caching",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1548"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1548.006",
      "display" : "TCC Manipulation",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1548"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1673",
      "display" : "Virtual Machine Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1125",
      "display" : "Video Capture",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1016",
      "display" : "System Network Configuration Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1016.002",
      "display" : "Wi-Fi Discovery",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1016"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1016.001",
      "display" : "Internet Connection Discovery",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1016"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1087",
      "display" : "Account Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1087.003",
      "display" : "Email Account",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1087"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1087.004",
      "display" : "Cloud Account",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1087"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1087.002",
      "display" : "Domain Account",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1087"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1087.001",
      "display" : "Local Account",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1087"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1090",
      "display" : "Proxy",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1090.001",
      "display" : "Internal Proxy",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1090"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1090.003",
      "display" : "Multi-hop Proxy",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1090"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1090.004",
      "display" : "Domain Fronting",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1090"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1090.002",
      "display" : "External Proxy",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1090"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1059",
      "display" : "Command and Scripting Interpreter",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1059.005",
      "display" : "Visual Basic",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1059"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1059.002",
      "display" : "AppleScript",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1059"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1059.003",
      "display" : "Windows Command Shell",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1059"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1059.013",
      "display" : "Container CLI/API",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1059"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1059.004",
      "display" : "Unix Shell",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1059"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1059.010",
      "display" : "AutoHotKey & AutoIT",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1059"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1059.008",
      "display" : "Network Device CLI",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1059"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1059.012",
      "display" : "Hypervisor CLI",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1059"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1059.006",
      "display" : "Python",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1059"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1059.001",
      "display" : "PowerShell",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1059"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1059.009",
      "display" : "Cloud API",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1059"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1059.011",
      "display" : "Lua",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1059"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1059.007",
      "display" : "JavaScript",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1059"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1677",
      "display" : "Poisoned Pipeline Execution",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1482",
      "display" : "Domain Trust Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1020",
      "display" : "Automated Exfiltration",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0010"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1020.001",
      "display" : "Traffic Duplication",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1020"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0010"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1070",
      "display" : "Indicator Removal",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1070.004",
      "display" : "File Deletion",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1070"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1070.006",
      "display" : "Timestomp",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1070"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1070.008",
      "display" : "Clear Mailbox Data",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1070"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1070.002",
      "display" : "Clear Linux or Mac System Logs",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1070"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1070.001",
      "display" : "Clear Windows Event Logs",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1070"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1070.009",
      "display" : "Clear Persistence",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1070"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1070.003",
      "display" : "Clear Command History",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1070"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1070.010",
      "display" : "Relocate Malware",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1070"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1070.007",
      "display" : "Clear Network Connection History and Configurations",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1070"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1070.005",
      "display" : "Network Share Connection Removal",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1070"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1609",
      "display" : "Container Administration Command",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1083",
      "display" : "File and Directory Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1568",
      "display" : "Dynamic Resolution",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1568.001",
      "display" : "Fast Flux DNS",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1568"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1568.002",
      "display" : "Domain Generation Algorithms",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1568"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1568.003",
      "display" : "DNS Calculation",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1568"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1647",
      "display" : "Plist File Modification",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1074",
      "display" : "Data Staged",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1074.001",
      "display" : "Local Data Staging",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1074"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1074.002",
      "display" : "Remote Data Staging",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1074"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1649",
      "display" : "Steal or Forge Authentication Certificates",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1049",
      "display" : "System Network Connections Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1584",
      "display" : "Compromise Infrastructure",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1584.003",
      "display" : "Virtual Private Server",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1584"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1584.002",
      "display" : "DNS Server",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1584"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1584.006",
      "display" : "Web Services",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1584"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1584.007",
      "display" : "Serverless",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1584"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1584.005",
      "display" : "Botnet",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1584"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1584.004",
      "display" : "Server",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1584"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1584.008",
      "display" : "Network Devices",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1584"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1584.001",
      "display" : "Domains",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1584"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1542",
      "display" : "Pre-OS Boot",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1542.003",
      "display" : "Bootkit",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1542"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1542.005",
      "display" : "TFTP Boot",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1542"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1542.002",
      "display" : "Component Firmware",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1542"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1542.004",
      "display" : "ROMMONkit",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1542"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1542.001",
      "display" : "System Firmware",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1542"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1612",
      "display" : "Build Image on Host",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1586",
      "display" : "Compromise Accounts",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1586.003",
      "display" : "Cloud Accounts",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1586"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1586.002",
      "display" : "Email Accounts",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1586"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1586.001",
      "display" : "Social Media Accounts",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1586"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1497",
      "display" : "Virtualization/Sandbox Evasion",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1497.002",
      "display" : "User Activity Based Checks",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1497"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1497.001",
      "display" : "System Checks",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1497"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1497.003",
      "display" : "Time Based Checks",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1497"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1102",
      "display" : "Web Service",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1102.003",
      "display" : "One-Way Communication",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1102"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1102.001",
      "display" : "Dead Drop Resolver",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1102"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1102.002",
      "display" : "Bidirectional Communication",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1102"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1608",
      "display" : "Stage Capabilities",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1608.004",
      "display" : "Drive-by Target",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1608"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1608.005",
      "display" : "Link Target",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1608"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1608.006",
      "display" : "SEO Poisoning",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1608"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1608.003",
      "display" : "Install Digital Certificate",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1608"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1608.002",
      "display" : "Upload Tool",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1608"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1608.001",
      "display" : "Upload Malware",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1608"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1104",
      "display" : "Multi-Stage Channels",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1657",
      "display" : "Financial Theft",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1480",
      "display" : "Execution Guardrails",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1480.001",
      "display" : "Environmental Keying",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1480"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1480.002",
      "display" : "Mutual Exclusion",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1480"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1619",
      "display" : "Cloud Storage Object Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1654",
      "display" : "Log Enumeration",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1528",
      "display" : "Steal Application Access Token",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1204",
      "display" : "User Execution",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1204.005",
      "display" : "Malicious Library",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1204"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1204.002",
      "display" : "Malicious File",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1204"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1204.003",
      "display" : "Malicious Image",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1204"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1204.001",
      "display" : "Malicious Link",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1204"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1204.004",
      "display" : "Malicious Copy and Paste",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1204"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1057",
      "display" : "Process Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1072",
      "display" : "Software Deployment Tools",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0008"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1041",
      "display" : "Exfiltration Over C2 Channel",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0010"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1591",
      "display" : "Gather Victim Org Information",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1591.002",
      "display" : "Business Relationships",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1591"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1591.001",
      "display" : "Determine Physical Locations",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1591"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1591.004",
      "display" : "Identify Roles",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1591"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1591.003",
      "display" : "Identify Business Tempo",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1591"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1606",
      "display" : "Forge Web Credentials",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1606.001",
      "display" : "Web Cookies",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1606"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1606.002",
      "display" : "SAML Tokens",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1606"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1621",
      "display" : "Multi-Factor Authentication Request Generation",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1554",
      "display" : "Compromise Host Software Binary",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1679",
      "display" : "Selective Exclusion",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1212",
      "display" : "Exploitation for Credential Access",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1590",
      "display" : "Gather Victim Network Information",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1590.001",
      "display" : "Domain Properties",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1590"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1590.002",
      "display" : "DNS",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1590"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1590.005",
      "display" : "IP Addresses",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1590"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1590.003",
      "display" : "Network Trust Dependencies",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1590"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1590.004",
      "display" : "Network Topology",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1590"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1590.006",
      "display" : "Network Security Appliances",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1590"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1210",
      "display" : "Exploitation of Remote Services",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0008"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1534",
      "display" : "Internal Spearphishing",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0008"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1199",
      "display" : "Trusted Relationship",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0001"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1593",
      "display" : "Search Open Websites/Domains",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1593.002",
      "display" : "Search Engines",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1593"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1593.003",
      "display" : "Code Repositories",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1593"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1593.001",
      "display" : "Social Media",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1593"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1098",
      "display" : "Account Manipulation",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1098.001",
      "display" : "Additional Cloud Credentials",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1098"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1098.002",
      "display" : "Additional Email Delegate Permissions",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1098"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1098.003",
      "display" : "Additional Cloud Roles",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1098"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1098.005",
      "display" : "Device Registration",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1098"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1098.006",
      "display" : "Additional Container Cluster Roles",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1098"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1098.004",
      "display" : "SSH Authorized Keys",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1098"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1098.007",
      "display" : "Additional Local or Domain Groups",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1098"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1048",
      "display" : "Exfiltration Over Alternative Protocol",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0010"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1048.002",
      "display" : "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1048"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0010"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1048.003",
      "display" : "Exfiltration Over Unencrypted Non-C2 Protocol",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1048"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0010"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1048.001",
      "display" : "Exfiltration Over Symmetric Encrypted Non-C2 Protocol",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1048"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0010"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1678",
      "display" : "Delay Execution",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1597",
      "display" : "Search Closed Sources",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1597.001",
      "display" : "Threat Intel Vendors",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1597"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1597.002",
      "display" : "Purchase Technical Data",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1597"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1566",
      "display" : "Phishing",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0001"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1566.002",
      "display" : "Spearphishing Link",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1566"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0001"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1566.001",
      "display" : "Spearphishing Attachment",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1566"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0001"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1566.004",
      "display" : "Spearphishing Voice",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1566"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0001"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1566.003",
      "display" : "Spearphishing via Service",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1566"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0001"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1110",
      "display" : "Brute Force",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1110.004",
      "display" : "Credential Stuffing",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1110"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1110.002",
      "display" : "Password Cracking",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1110"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1110.001",
      "display" : "Password Guessing",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1110"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1110.003",
      "display" : "Password Spraying",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1110"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1565",
      "display" : "Data Manipulation",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1565.002",
      "display" : "Transmitted Data Manipulation",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1565"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1565.003",
      "display" : "Runtime Data Manipulation",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1565"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1565.001",
      "display" : "Stored Data Manipulation",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1565"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1559",
      "display" : "Inter-Process Communication",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1559.003",
      "display" : "XPC Services",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1559"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1559.002",
      "display" : "Dynamic Data Exchange",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1559"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1559.001",
      "display" : "Component Object Model",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1559"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1001",
      "display" : "Data Obfuscation",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1001.001",
      "display" : "Junk Data",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1001"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1001.003",
      "display" : "Protocol or Service Impersonation",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1001"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1001.002",
      "display" : "Steganography",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1001"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1039",
      "display" : "Data from Network Shared Drive",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1601",
      "display" : "Modify System Image",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1601.002",
      "display" : "Downgrade System Image",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1601"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1601.001",
      "display" : "Patch System Image",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1601"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1574",
      "display" : "Hijack Execution Flow",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1574.010",
      "display" : "Services File Permissions Weakness",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1574"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1574.013",
      "display" : "KernelCallbackTable",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1574"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1574.007",
      "display" : "Path Interception by PATH Environment Variable",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1574"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1574.005",
      "display" : "Executable Installer File Permissions Weakness",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1574"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1574.009",
      "display" : "Path Interception by Unquoted Path",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1574"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1574.004",
      "display" : "Dylib Hijacking",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1574"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1574.006",
      "display" : "Dynamic Linker Hijacking",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1574"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1574.014",
      "display" : "AppDomainManager",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1574"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1574.001",
      "display" : "DLL",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1574"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1574.008",
      "display" : "Path Interception by Search Order Hijacking",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1574"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1574.011",
      "display" : "Services Registry Permissions Weakness",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1574"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1574.012",
      "display" : "COR_PROFILER",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1574"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1078",
      "display" : "Valid Accounts",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0001"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1078.004",
      "display" : "Cloud Accounts",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1078"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0001"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1078.002",
      "display" : "Domain Accounts",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1078"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0001"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1078.003",
      "display" : "Local Accounts",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1078"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0001"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1078.001",
      "display" : "Default Accounts",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1078"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0001"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1571",
      "display" : "Non-Standard Port",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1068",
      "display" : "Exploitation for Privilege Escalation",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1531",
      "display" : "Account Access Removal",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1027",
      "display" : "Obfuscated Files or Information",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1027.005",
      "display" : "Indicator Removal from Tools",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1027"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1027.009",
      "display" : "Embedded Payloads",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1027"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1027.013",
      "display" : "Encrypted/Encoded File",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1027"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1027.012",
      "display" : "LNK Icon Smuggling",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1027"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1027.017",
      "display" : "SVG Smuggling",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1027"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1027.006",
      "display" : "HTML Smuggling",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1027"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1027.011",
      "display" : "Fileless Storage",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1027"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1027.014",
      "display" : "Polymorphic Code",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1027"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1027.010",
      "display" : "Command Obfuscation",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1027"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1027.004",
      "display" : "Compile After Delivery",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1027"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1027.007",
      "display" : "Dynamic API Resolution",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1027"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1027.003",
      "display" : "Steganography",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1027"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1027.015",
      "display" : "Compression",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1027"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1027.016",
      "display" : "Junk Code Insertion",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1027"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1027.008",
      "display" : "Stripped Payloads",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1027"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1027.002",
      "display" : "Software Packing",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1027"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1027.001",
      "display" : "Binary Padding",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1027"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1201",
      "display" : "Password Policy Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1546",
      "display" : "Event Triggered Execution",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1546.002",
      "display" : "Screensaver",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1546"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1546.013",
      "display" : "PowerShell Profile",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1546"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1546.016",
      "display" : "Installer Packages",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1546"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1546.003",
      "display" : "Windows Management Instrumentation Event Subscription",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1546"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1546.006",
      "display" : "LC_LOAD_DYLIB Addition",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1546"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1546.018",
      "display" : "Python Startup Hooks",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1546"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1546.011",
      "display" : "Application Shimming",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1546"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1546.015",
      "display" : "Component Object Model Hijacking",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1546"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1546.004",
      "display" : "Unix Shell Configuration Modification",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1546"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1546.010",
      "display" : "AppInit DLLs",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1546"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1546.005",
      "display" : "Trap",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1546"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1546.007",
      "display" : "Netsh Helper DLL",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1546"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1546.012",
      "display" : "Image File Execution Options Injection",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1546"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1546.001",
      "display" : "Change Default File Association",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1546"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1546.009",
      "display" : "AppCert DLLs",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1546"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1546.017",
      "display" : "Udev Rules",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1546"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1546.014",
      "display" : "Emond",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1546"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1546.008",
      "display" : "Accessibility Features",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1546"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1187",
      "display" : "Forced Authentication",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1599",
      "display" : "Network Boundary Bridging",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1599.001",
      "display" : "Network Address Translation Traversal",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1599"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1486",
      "display" : "Data Encrypted for Impact",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1553",
      "display" : "Subvert Trust Controls",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1553.005",
      "display" : "Mark-of-the-Web Bypass",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1553"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1553.002",
      "display" : "Code Signing",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1553"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1553.004",
      "display" : "Install Root Certificate",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1553"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1553.003",
      "display" : "SIP and Trust Provider Hijacking",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1553"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1553.006",
      "display" : "Code Signing Policy Modification",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1553"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1553.001",
      "display" : "Gatekeeper Bypass",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1553"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1573",
      "display" : "Encrypted Channel",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1573.002",
      "display" : "Asymmetric Cryptography",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1573"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1573.001",
      "display" : "Symmetric Cryptography",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1573"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1056",
      "display" : "Input Capture",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1056.001",
      "display" : "Keylogging",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1056"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1056.002",
      "display" : "GUI Input Capture",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1056"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1056.004",
      "display" : "Credential API Hooking",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1056"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1056.003",
      "display" : "Web Portal Capture",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1056"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1203",
      "display" : "Exploitation for Client Execution",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1667",
      "display" : "Email Bombing",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1570",
      "display" : "Lateral Tool Transfer",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0008"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1095",
      "display" : "Non-Application Layer Protocol",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1671",
      "display" : "Cloud Application Integration",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1012",
      "display" : "Query Registry",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1030",
      "display" : "Data Transfer Size Limits",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0010"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1499",
      "display" : "Endpoint Denial of Service",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1499.003",
      "display" : "Application Exhaustion Flood",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1499"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1499.002",
      "display" : "Service Exhaustion Flood",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1499"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1499.004",
      "display" : "Application or System Exploitation",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1499"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1499.001",
      "display" : "OS Exhaustion Flood",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1499"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1614",
      "display" : "System Location Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1614.001",
      "display" : "System Language Discovery",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1614"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1197",
      "display" : "BITS Jobs",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1656",
      "display" : "Impersonation",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1132",
      "display" : "Data Encoding",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1132.001",
      "display" : "Standard Encoding",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1132"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1132.002",
      "display" : "Non-Standard Encoding",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1132"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1598",
      "display" : "Phishing for Information",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1598.004",
      "display" : "Spearphishing Voice",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1598"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1598.001",
      "display" : "Spearphishing Service",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1598"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1598.002",
      "display" : "Spearphishing Attachment",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1598"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1598.003",
      "display" : "Spearphishing Link",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1598"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0043"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1496",
      "display" : "Resource Hijacking",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1496.001",
      "display" : "Compute Hijacking",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1496"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1496.002",
      "display" : "Bandwidth Hijacking",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1496"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1496.004",
      "display" : "Cloud Service Hijacking",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1496"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1496.003",
      "display" : "SMS Pumping",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1496"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1585",
      "display" : "Establish Accounts",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1585.003",
      "display" : "Cloud Accounts",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1585"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1585.002",
      "display" : "Email Accounts",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1585"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1585.001",
      "display" : "Social Media Accounts",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1585"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1588",
      "display" : "Obtain Capabilities",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1588.006",
      "display" : "Vulnerabilities",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1588"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1588.005",
      "display" : "Exploits",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1588"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1588.007",
      "display" : "Artificial Intelligence",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1588"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1588.004",
      "display" : "Digital Certificates",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1588"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1588.002",
      "display" : "Tool",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1588"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1588.003",
      "display" : "Code Signing Certificates",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1588"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1588.001",
      "display" : "Malware",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1588"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1569",
      "display" : "System Services",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1569.003",
      "display" : "Systemctl",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1569"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1569.002",
      "display" : "Service Execution",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1569"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1569.001",
      "display" : "Launchctl",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1569"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1650",
      "display" : "Acquire Access",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1213",
      "display" : "Data from Information Repositories",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1213.003",
      "display" : "Code Repositories",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1213"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1213.006",
      "display" : "Databases",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1213"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1213.005",
      "display" : "Messaging Applications",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1213"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1213.004",
      "display" : "Customer Relationship Management Software",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1213"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1213.002",
      "display" : "Sharepoint",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1213"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1213.001",
      "display" : "Confluence",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1213"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0009"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1200",
      "display" : "Hardware Additions",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0001"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1505",
      "display" : "Server Software Component",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1505.002",
      "display" : "Transport Agent",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1505"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1505.004",
      "display" : "IIS Components",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1505"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1505.003",
      "display" : "Web Shell",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1505"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1505.005",
      "display" : "Terminal Services DLL",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1505"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1505.006",
      "display" : "vSphere Installation Bundles",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1505"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1505.001",
      "display" : "SQL Stored Procedures",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1505"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1485",
      "display" : "Data Destruction",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1485.001",
      "display" : "Lifecycle-Triggered Deletion",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1485"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1537",
      "display" : "Transfer Data to Cloud Account",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0010"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1189",
      "display" : "Drive-by Compromise",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0001"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1498",
      "display" : "Network Denial of Service",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1498.002",
      "display" : "Reflection Amplification",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1498"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1498.001",
      "display" : "Direct Network Flood",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1498"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1651",
      "display" : "Cloud Administration Command",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1221",
      "display" : "Template Injection",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1134",
      "display" : "Access Token Manipulation",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1134.001",
      "display" : "Token Impersonation/Theft",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1134"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1134.004",
      "display" : "Parent PID Spoofing",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1134"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1134.005",
      "display" : "SID-History Injection",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1134"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1134.002",
      "display" : "Create Process with Token",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1134"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1134.003",
      "display" : "Make and Impersonate Token",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1134"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1111",
      "display" : "Multi-Factor Authentication Interception",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1668",
      "display" : "Exclusive Control",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1136",
      "display" : "Create Account",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1136.003",
      "display" : "Cloud Account",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1136"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1136.001",
      "display" : "Local Account",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1136"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1136.002",
      "display" : "Domain Account",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1136"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1672",
      "display" : "Email Spoofing",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1526",
      "display" : "Cloud Service Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1018",
      "display" : "Remote System Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1046",
      "display" : "Network Service Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1518",
      "display" : "Software Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1518.001",
      "display" : "Security Software Discovery",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1518"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1518.002",
      "display" : "Backup Software Discovery",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1518"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1538",
      "display" : "Cloud Service Dashboard",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1622",
      "display" : "Debugger Evasion",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1052",
      "display" : "Exfiltration Over Physical Medium",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0010"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1052.001",
      "display" : "Exfiltration over USB",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1052"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0010"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1105",
      "display" : "Ingress Tool Transfer",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1648",
      "display" : "Serverless Execution",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0002"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1653",
      "display" : "Power Settings",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1665",
      "display" : "Hide Infrastructure",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1484",
      "display" : "Domain or Tenant Policy Modification",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1484.002",
      "display" : "Trust Modification",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1484"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1484.001",
      "display" : "Group Policy Modification",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1484"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0004"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1220",
      "display" : "XSL Script Processing",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1587",
      "display" : "Develop Capabilities",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1587.002",
      "display" : "Code Signing Certificates",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1587"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1587.003",
      "display" : "Digital Certificates",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1587"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1587.004",
      "display" : "Exploits",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1587"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1587.001",
      "display" : "Malware",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1587"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0042"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1008",
      "display" : "Fallback Channels",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0011"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1680",
      "display" : "Local Storage Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1124",
      "display" : "System Time Discovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0007"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1556",
      "display" : "Modify Authentication Process",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1556.004",
      "display" : "Network Device Authentication",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1556"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1556.001",
      "display" : "Domain Controller Authentication",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1556"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1556.009",
      "display" : "Conditional Access Policies",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1556"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1556.008",
      "display" : "Network Provider DLL",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1556"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1556.002",
      "display" : "Password Filter DLL",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1556"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1556.006",
      "display" : "Multi-Factor Authentication",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1556"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1556.007",
      "display" : "Hybrid Identity",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1556"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1556.005",
      "display" : "Reversible Encryption",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1556"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1556.003",
      "display" : "Pluggable Authentication Modules",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1556"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0006"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0003"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1495",
      "display" : "Firmware Corruption",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1490",
      "display" : "Inhibit System Recovery",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1216",
      "display" : "System Script Proxy Execution",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1216.001",
      "display" : "PubPrn",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1216"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1216.002",
      "display" : "SyncAppvPublishingServer",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1216"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1669",
      "display" : "Wi-Fi Networks",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0001"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1211",
      "display" : "Exploitation for Defense Evasion",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1127",
      "display" : "Trusted Developer Utilities Proxy Execution",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    },
    {
      "code" : "T1127.001",
      "display" : "MSBuild",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1127"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1127.002",
      "display" : "ClickOnce",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1127"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1127.003",
      "display" : "JamPlus",
      "property" : [
        {
          "code" : "parentTechnique",
          "valueCode" : "T1127"
        },
        {
          "code" : "tactic",
          "valueCode" : "TA0005"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : true
        }
      ]
    },
    {
      "code" : "T1529",
      "display" : "System Shutdown/Reboot",
      "property" : [
        {
          "code" : "tactic",
          "valueCode" : "TA0040"
        },
        {
          "code" : "isSubtechnique",
          "valueBoolean" : false
        }
      ]
    }
  ]
}