MITRE-ATTCK-Techniques
type: CodeSystem
node role: treeRoot
id:
  v: MITRE-ATTCK-Techniques
language:
  v: en
text:
  status:
    v: generated
  div:
    v: Generated Narrative: CodeSystem MITRE-ATTCK-Techniques Properties This code system defines the following properties for its concepts Name Code URI Type Description tactic tactic https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Tactics code The tactic(s) this technique or subtechnique contributes to, referenced by tactic ID parentTechnique parentTechnique https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Techniques code The parent technique of this subtechnique, referenced by ATT&CK ID isSubtechnique isSubtechnique boolean Whether this concept is a subtechnique Concepts This case-sensitive code system https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Techniques defines the following codes: Code Display tactic parentTechnique isSubtechnique T1047 Windows Management Instrumentation TA0002 false T1113 Screen Capture TA0009 false T1037 Boot or Logon Initialization Scripts TA0003, TA0004 false T1037.004 RC Scripts TA0003, TA0004 T1037 true T1037.001 Logon Script (Windows) TA0003, TA0004 T1037 true T1037.003 Network Logon Script TA0003, TA0004 T1037 true T1037.005 Startup Items TA0003, TA0004 T1037 true T1037.002 Login Hook TA0003, TA0004 T1037 true T1557 Adversary-in-the-Middle TA0006, TA0009 false T1557.003 DHCP Spoofing TA0006, TA0009 T1557 true T1557.002 ARP Cache Poisoning TA0006, TA0009 T1557 true T1557.001 LLMNR/NBT-NS Poisoning and SMB Relay TA0006, TA0009 T1557 true T1557.004 Evil Twin TA0006, TA0009 T1557 true T1033 System Owner/User Discovery TA0007 false T1583 Acquire Infrastructure TA0042 false T1583.008 Malvertising TA0042 T1583 true T1583.001 Domains TA0042 T1583 true T1583.005 Botnet TA0042 T1583 true T1583.004 Server TA0042 T1583 true T1583.002 DNS Server TA0042 T1583 true T1583.003 Virtual Private Server TA0042 T1583 true T1583.007 Serverless TA0042 T1583 true T1583.006 Web Services TA0042 T1583 true T1613 Container and Resource Discovery TA0007 false T1592 Gather Victim Host Information TA0043 false T1592.001 Hardware TA…
url:
  v: https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Techniques
  l: MITRE-ATTCK-Techniques
version:
  v: 0.0.5
name:
  v: MITRE-ATTCK-Techniques
title:
  v: CS MITRE ATT&CK Techniques and Subtechniques
status:
  v: draft
experimental:
  v: false
date:
  v: 2026-04-26T20:36:59+00:00
publisher:
  v: ATTCK2FHIR IG
contact:
  name:
    v: ATTCK2FHIR IG
  telecom:
    system:
      v: url
    value:
      v: https://constir1.github.io/ATTCK2FHIR
description:
  v: This Code System contains all MITRE ATT&CK Enterprise Techniques and Subtechniques with their tactic and parent-technique relationships expressed as properties.
case sensitive:
  v: true
content:
  v: complete
count:
  v: 691
property:
  code:
    v: tactic
  uri:
    v: https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Tactics
    l: MITRE-ATTCK-Tactics
  description:
    v: The tactic(s) this technique or subtechnique contributes to, referenced by tactic ID
  type:
    v: code
property:
  code:
    v: parentTechnique
  uri:
    v: https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Techniques
    l: MITRE-ATTCK-Techniques
  description:
    v: The parent technique of this subtechnique, referenced by ATT&CK ID
  type:
    v: code
property:
  code:
    v: isSubtechnique
  description:
    v: Whether this concept is a subtechnique
  type:
    v: boolean
concept:
  code:
    v: T1047
  display:
    v: Windows Management Instrumentation
  property:
    code:
      v: tactic
    value: Code
      v: TA0002
  property:
    code:
      v: isSubtechnique
    value: Boolean
      v: false
concept:
  code:
    v: T1113
  display:
    v: Screen Capture
  property:
    code:
      v: tactic
    value: Code
      v: TA0009
  property:
    code:
      v: isSubtechnique
    value: Boolean
      v: false
concept:
  code:
    v: T1037
  display:
    v: Boot or Logon Initialization Scripts
  property:
    code:
      v: tactic
    value: Code
      v: TA0003
  property:
    code:
      v: tactic
    value: Code
      v: TA0004
  property:
    code:
      v: isSubtechnique
    value: Boolean
      v: false
concept:
  code:
    v: T1037.004
  display:
    v: RC Scripts
  property:
    code:
      v: parentTechnique
    value: Code
      v: T1037
  property:
    code:
      v: tactic
    value: Code
      v: TA0003
  property:
    code:
      v: tactic
    value: Code
      v: TA0004
  property:
    code:
      v: isSubtechnique
    value: Boolean
      v: true
concept:
  code:
    v: T1037.001
  display:
    v: Logon Script (Windows)
  property:
    code:
      v: parentTechnique
    value: Code
      v: T1037
  property:
    code:
      v: tactic
    value: Code
      v: TA0003
  property:
    code:
      v: tactic
    value: Code
      v: TA0004
  property:
    code:
      v: isSubtechnique
    value: Boolean
      v: true
concept:
  code:
    v: T1037.003
  display:
    v: Network Logon Script
  property:
    code:
      v: parentTechnique
    value: Code
      v: T1037
  property:
    code:
      v: tactic
    value: Code
      v: TA0003
  property:
    code:
      v: tactic
    value: Code
      v: TA0004
  property:
    code:
      v: isSubtechnique
    value: Boolean
      v: true
concept:
  code:
    v: T1037.005
  display:
    v: Startup Items

code:
  v: parentTechnique
value: Code
  v: T1037

code:
  v: tactic
value: Code
  v: TA0003

code:
  v: tactic
value: Code
  v: TA0004

code:
  v: isSubtechnique
value: Boolean
  v: true

code:
  v: T1037.002
display:
  v: Login Hook
property:
  code:
    v: parentTechnique
  value: Code
    v: T1037
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1557
display:
  v: Adversary-in-the-Middle
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1557.003
display:
  v: DHCP Spoofing
property:
  code:
    v: parentTechnique
  value: Code
    v: T1557
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1557.002
display:
  v: ARP Cache Poisoning
property:
  code:
    v: parentTechnique
  value: Code
    v: T1557
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1557.001
display:
  v: LLMNR/NBT-NS Poisoning and SMB Relay
property:
  code:
    v: parentTechnique
  value: Code
    v: T1557
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1557.004
display:
  v: Evil Twin
property:
  code:
    v: parentTechnique
  value: Code
    v: T1557
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1033
display:
  v: System Owner/User Discovery
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1583
display:
  v: Acquire Infrastructure
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1583.008
display:
  v: Malvertising
property:
  code:
    v: parentTechnique
  value: Code
    v: T1583
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1583.001
display:
  v: Domains
property:
  code:
    v: parentTechnique
  value: Code
    v: T1583
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1583.005
display:
  v: Botnet
property:
  code:
    v: parentTechnique
  value: Code
    v: T1583
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1583.004
display:
  v: Server
property:
  code:
    v: parentTechnique
  value: Code
    v: T1583
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1583.002
display:
  v: DNS Server
property:
  code:
    v: parentTechnique
  value: Code
    v: T1583
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1583.003
display:
  v: Virtual Private Server
property:
  code:
    v: parentTechnique
  value: Code
    v: T1583
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1583.007
display:
  v: Serverless
property:
  code:
    v: parentTechnique
  value: Code
    v: T1583
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1583.006
display:
  v: Web Services
property:
  code:
    v: parentTechnique
  value: Code
    v: T1583
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1613
display:
  v: Container and Resource Discovery
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1592
display:
  v: Gather Victim Host Information
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1592.001
display:
  v: Hardware
property:
  code:
    v: parentTechnique
  value: Code
    v: T1592
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1592.003
display:
  v: Firmware
property:
  code:
    v: parentTechnique
  value: Code
    v: T1592
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1592.002
display:
  v: Software
property:
  code:
    v: parentTechnique
  value: Code
    v: T1592
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1592.004
display:
  v: Client Configurations
property:
  code:
    v: parentTechnique
  value: Code
    v: T1592
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1003
display:
  v: OS Credential Dumping
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1003.002
display:
  v: Security Account Manager
property:
  code:
    v: parentTechnique
  value: Code
    v: T1003
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1003.004
display:
  v: LSA Secrets
property:
  code:
    v: parentTechnique
  value: Code
    v: T1003
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1003.006
display:
  v: DCSync
property:
  code:
    v: parentTechnique
  value: Code
    v: T1003
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1003.007
display:
  v: Proc Filesystem
property:
  code:
    v: parentTechnique
  value: Code
    v: T1003
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1003.003
display:
  v: NTDS
property:
  code:
    v: parentTechnique
  value: Code
    v: T1003
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1003.005
display:
  v: Cached Domain Credentials
property:
  code:
    v: parentTechnique
  value: Code
    v: T1003
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1003.001
display:
  v: LSASS Memory
property:
  code:
    v: parentTechnique
  value: Code
    v: T1003
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1003.008
display:
  v: /etc/passwd and /etc/shadow
property:
  code:
    v: parentTechnique
  value: Code
    v: T1003
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1129
display:
  v: Shared Modules
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1602
display:
  v: Data from Configuration Repository
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1602.002
display:
  v: Network Device Configuration Dump
property:
  code:
    v: parentTechnique
  value: Code
    v: T1602
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1602.001
display:
  v: SNMP (MIB Dump)
property:
  code:
    v: parentTechnique
  value: Code
    v: T1602
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1006
display:
  v: Direct Volume Access
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1666
display:
  v: Modify Cloud Resource Hierarchy
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1014
display:
  v: Rootkit
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1123
display:
  v: Audio Capture
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1543
display:
  v: Create or Modify System Process
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1543.004
display:
  v: Launch Daemon
property:
  code:
    v: parentTechnique
  value: Code
    v: T1543
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1543.005
display:
  v: Container Service
property:
  code:
    v: parentTechnique
  value: Code
    v: T1543
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1543.001
display:
  v: Launch Agent
property:
  code:
    v: parentTechnique
  value: Code
    v: T1543
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1543.002
display:
  v: Systemd Service
property:
  code:
    v: parentTechnique
  value: Code
    v: T1543
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1543.003
display:
  v: Windows Service
property:
  code:
    v: parentTechnique
  value: Code
    v: T1543
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1133
display:
  v: External Remote Services
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0001
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1539
display:
  v: Steal Web Session Cookie
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1578
display:
  v: Modify Cloud Compute Infrastructure
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1578.001
display:
  v: Create Snapshot
property:
  code:
    v: parentTechnique
  value: Code
    v: T1578
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1578.003
display:
  v: Delete Cloud Instance
property:
  code:
    v: parentTechnique
  value: Code
    v: T1578
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1578.004
display:
  v: Revert Cloud Instance
property:
  code:
    v: parentTechnique
  value: Code
    v: T1578
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1578.002
display:
  v: Create Cloud Instance
property:
  code:
    v: parentTechnique
  value: Code
    v: T1578
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1578.005
display:
  v: Modify Cloud Compute Configurations
property:
  code:
    v: parentTechnique
  value: Code
    v: T1578
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1069
display:
  v: Permission Groups Discovery
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1069.003
display:
  v: Cloud Groups
property:
  code:
    v: parentTechnique
  value: Code
    v: T1069
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1069.002
display:
  v: Domain Groups
property:
  code:
    v: parentTechnique
  value: Code
    v: T1069
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1069.001
display:
  v: Local Groups
property:
  code:
    v: parentTechnique
  value: Code
    v: T1069
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1114
display:
  v: Email Collection
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1114.002
display:
  v: Remote Email Collection
property:
  code:
    v: parentTechnique
  value: Code
    v: T1114
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1114.003
display:
  v: Email Forwarding Rule
property:
  code:
    v: parentTechnique
  value: Code
    v: T1114
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1114.001
display:
  v: Local Email Collection
property:
  code:
    v: parentTechnique
  value: Code
    v: T1114
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1594
display:
  v: Search Victim-Owned Websites
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1561
display:
  v: Disk Wipe
property:
  code:
    v: tactic
  value: Code
    v: TA0040
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1561.002
display:
  v: Disk Structure Wipe
property:
  code:
    v: parentTechnique
  value: Code
    v: T1561
property:
  code:
    v: tactic
  value: Code
    v: TA0040
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1561.001
display:
  v: Disk Content Wipe
property:
  code:
    v: parentTechnique
  value: Code
    v: T1561
property:
  code:
    v: tactic
  value: Code
    v: TA0040
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1615
display:
  v: Group Policy Discovery
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1025
display:
  v: Data from Removable Media
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1547
display:
  v: Boot or Logon Autostart Execution
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1547.009
display:
  v: Shortcut Modification
property:
  code:
    v: parentTechnique
  value: Code
    v: T1547
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1547.006
display:
  v: Kernel Modules and Extensions
property:
  code:
    v: parentTechnique
  value: Code
    v: T1547
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1547.007
display:
  v: Re-opened Applications
property:
  code:
    v: parentTechnique
  value: Code
    v: T1547
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1547.004
display:
  v: Winlogon Helper DLL
property:
  code:
    v: parentTechnique
  value: Code
    v: T1547
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1547.005
display:
  v: Security Support Provider
property:
  code:
    v: parentTechnique
  value: Code
    v: T1547
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1547.001
display:
  v: Registry Run Keys / Startup Folder
property:
  code:
    v: parentTechnique
  value: Code
    v: T1547
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1547.008
display:
  v: LSASS Driver
property:
  code:
    v: parentTechnique
  value: Code
    v: T1547
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1547.012
display:
  v: Print Processors
property:
  code:
    v: parentTechnique
  value: Code
    v: T1547
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1547.014
display:
  v: Active Setup
property:
  code:
    v: parentTechnique
  value: Code
    v: T1547
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1547.015
display:
  v: Login Items
property:
  code:
    v: parentTechnique
  value: Code
    v: T1547
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1547.013
display:
  v: XDG Autostart Entries
property:
  code:
    v: parentTechnique
  value: Code
    v: T1547
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1547.003
display:
  v: Time Providers
property:
  code:
    v: parentTechnique
  value: Code
    v: T1547
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1547.002
display:
  v: Authentication Package
property:
  code:
    v: parentTechnique
  value: Code
    v: T1547
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1547.010
display:
  v: Port Monitors
property:
  code:
    v: parentTechnique
  value: Code
    v: T1547
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1600
display:
  v: Weaken Encryption
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1600.001
display:
  v: Reduce Key Space
property:
  code:
    v: parentTechnique
  value: Code
    v: T1600
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1600.002
display:
  v: Disable Crypto Hardware
property:
  code:
    v: parentTechnique
  value: Code
    v: T1600
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1489
display:
  v: Service Stop
property:
  code:
    v: tactic
  value: Code
    v: TA0040
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1652
display:
  v: Device Driver Discovery
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1564
display:
  v: Hide Artifacts
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1564.003
display:
  v: Hidden Window
property:
  code:
    v: parentTechnique
  value: Code
    v: T1564
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1564.011
display:
  v: Ignore Process Interrupts
property:
  code:
    v: parentTechnique
  value: Code
    v: T1564
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1564.002
display:
  v: Hidden Users
property:
  code:
    v: parentTechnique
  value: Code
    v: T1564
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1564.012
display:
  v: File/Path Exclusions
property:
  code:
    v: parentTechnique
  value: Code
    v: T1564
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1564.014
display:
  v: Extended Attributes
property:
  code:
    v: parentTechnique
  value: Code
    v: T1564
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1564.008
display:
  v: Email Hiding Rules
property:
  code:
    v: parentTechnique
  value: Code
    v: T1564
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1564.009
display:
  v: Resource Forking
property:
  code:
    v: parentTechnique
  value: Code
    v: T1564
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1564.013
display:
  v: Bind Mounts
property:
  code:
    v: parentTechnique
  value: Code
    v: T1564
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1564.006
display:
  v: Run Virtual Instance
property:
  code:
    v: parentTechnique
  value: Code
    v: T1564
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1564.010
display:
  v: Process Argument Spoofing
property:
  code:
    v: parentTechnique
  value: Code
    v: T1564
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1564.001
display:
  v: Hidden Files and Directories
property:
  code:
    v: parentTechnique
  value: Code
    v: T1564
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1564.004
display:
  v: NTFS File Attributes
property:
  code:
    v: parentTechnique
  value: Code
    v: T1564
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1564.007
display:
  v: VBA Stomping
property:
  code:
    v: parentTechnique
  value: Code
    v: T1564
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1564.005
display:
  v: Hidden File System
property:
  code:
    v: parentTechnique
  value: Code
    v: T1564
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1080
display:
  v: Taint Shared Content
property:
  code:
    v: tactic
  value: Code
    v: TA0008
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1137
display:
  v: Office Application Startup
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1137.002
display:
  v: Office Test
property:
  code:
    v: parentTechnique
  value: Code
    v: T1137
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1137.001
display:
  v: Office Template Macros
property:
  code:
    v: parentTechnique
  value: Code
    v: T1137
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1137.004
display:
  v: Outlook Home Page
property:
  code:
    v: parentTechnique
  value: Code
    v: T1137
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1137.003
display:
  v: Outlook Forms
property:
  code:
    v: parentTechnique
  value: Code
    v: T1137
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1137.006
display:
  v: Add-ins
property:
  code:
    v: parentTechnique
  value: Code
    v: T1137
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1137.005
display:
  v: Outlook Rules
property:
  code:
    v: parentTechnique
  value: Code
    v: T1137
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1119
display:
  v: Automated Collection
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1115
display:
  v: Clipboard Data
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1675
display:
  v: ESXi Administration Command
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1007
display:
  v: System Service Discovery
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1040
display:
  v: Network Sniffing
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1530
display:
  v: Data from Cloud Storage
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1135
display:
  v: Network Share Discovery
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1120
display:
  v: Peripheral Device Discovery
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1082
display:
  v: System Information Discovery
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1071
display:
  v: Application Layer Protocol
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1071.002
display:
  v: File Transfer Protocols
property:
  code:
    v: parentTechnique
  value: Code
    v: T1071
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1071.004
display:
  v: DNS
property:
  code:
    v: parentTechnique
  value: Code
    v: T1071
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1071.005
display:
  v: Publish/Subscribe Protocols
property:
  code:
    v: parentTechnique
  value: Code
    v: T1071
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1071.003
display:
  v: Mail Protocols
property:
  code:
    v: parentTechnique
  value: Code
    v: T1071
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1071.001
display:
  v: Web Protocols
property:
  code:
    v: parentTechnique
  value: Code
    v: T1071
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1053
display:
  v: Scheduled Task/Job
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1053.003
display:
  v: Cron
property:
  code:
    v: parentTechnique
  value: Code
    v: T1053
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1053.005
display:
  v: Scheduled Task
property:
  code:
    v: parentTechnique
  value: Code
    v: T1053
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1053.006
display:
  v: Systemd Timers
property:
  code:
    v: parentTechnique
  value: Code
    v: T1053
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1053.007
display:
  v: Container Orchestration Job
property:
  code:
    v: parentTechnique
  value: Code
    v: T1053
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1053.002
display:
  v: At
property:
  code:
    v: parentTechnique
  value: Code
    v: T1053
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1176
display:
  v: Software Extensions
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1176.002
display:
  v: IDE Extensions
property:
  code:
    v: parentTechnique
  value: Code
    v: T1176
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1176.001
display:
  v: Browser Extensions
property:
  code:
    v: parentTechnique
  value: Code
    v: T1176
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1106
display:
  v: Native API
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1202
display:
  v: Indirect Command Execution
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1091
display:
  v: Replication Through Removable Media
property:
  code:
    v: tactic
  value: Code
    v: TA0008
property:
  code:
    v: tactic
  value: Code
    v: TA0001
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1005
display:
  v: Data from Local System
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1140
display:
  v: Deobfuscate/Decode Files or Information
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1562
display:
  v: Impair Defenses
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1562.003
display:
  v: Impair Command History Logging
property:
  code:
    v: parentTechnique
  value: Code
    v: T1562
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1562.013
display:
  v: Disable or Modify Network Device Firewall
property:
  code:
    v: parentTechnique
  value: Code
    v: T1562
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1562.004
display:
  v: Disable or Modify System Firewall
property:
  code:
    v: parentTechnique
  value: Code
    v: T1562
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1562.002
display:
  v: Disable Windows Event Logging
property:
  code:
    v: parentTechnique
  value: Code
    v: T1562
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1562.001
display:
  v: Disable or Modify Tools
property:
  code:
    v: parentTechnique
  value: Code
    v: T1562
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1562.006
display:
  v: Indicator Blocking
property:
  code:
    v: parentTechnique
  value: Code
    v: T1562
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1562.012
display:
  v: Disable or Modify Linux Audit System
property:
  code:
    v: parentTechnique
  value: Code
    v: T1562
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1562.011
display:
  v: Spoof Security Alerting
property:
  code:
    v: parentTechnique
  value: Code
    v: T1562
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1562.008
display:
  v: Disable or Modify Cloud Logs
property:
  code:
    v: parentTechnique
  value: Code
    v: T1562
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1562.010
display:
  v: Downgrade Attack
property:
  code:
    v: parentTechnique
  value: Code
    v: T1562
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1562.007
display:
  v: Disable or Modify Cloud Firewall
property:
  code:
    v: parentTechnique
  value: Code
    v: T1562
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1562.009
display:
  v: Safe Mode Boot
property:
  code:
    v: parentTechnique
  value: Code
    v: T1562
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1195
display:
  v: Supply Chain Compromise
property:
  code:
    v: tactic
  value: Code
    v: TA0001
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1195.001
display:
  v: Compromise Software Dependencies and Development Tools
property:
  code:
    v: parentTechnique
  value: Code
    v: T1195
property:
  code:
    v: tactic
  value: Code
    v: TA0001
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1195.002
display:
  v: Compromise Software Supply Chain
property:
  code:
    v: parentTechnique
  value: Code
    v: T1195
property:
  code:
    v: tactic
  value: Code
    v: TA0001
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1195.003
display:
  v: Compromise Hardware Supply Chain
property:
  code:
    v: parentTechnique
  value: Code
    v: T1195
property:
  code:
    v: tactic
  value: Code
    v: TA0001
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1190
display:
  v: Exploit Public-Facing Application
property:
  code:
    v: tactic
  value: Code
    v: TA0001
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1558
display:
  v: Steal or Forge Kerberos Tickets
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1558.003
display:
  v: Kerberoasting
property:
  code:
    v: parentTechnique
  value: Code
    v: T1558
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1558.002
display:
  v: Silver Ticket
property:
  code:
    v: parentTechnique
  value: Code
    v: T1558
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1558.005
display:
  v: Ccache Files
property:
  code:
    v: parentTechnique
  value: Code
    v: T1558
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1558.004
display:
  v: AS-REP Roasting
property:
  code:
    v: parentTechnique
  value: Code
    v: T1558
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1558.001
display:
  v: Golden Ticket
property:
  code:
    v: parentTechnique
  value: Code
    v: T1558
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1555
display:
  v: Credentials from Password Stores
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1555.004
display:
  v: Windows Credential Manager
property:
  code:
    v: parentTechnique
  value: Code
    v: T1555
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1555.001
display:
  v: Keychain
property:
  code:
    v: parentTechnique
  value: Code
    v: T1555
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1555.005
display:
  v: Password Managers
property:
  code:
    v: parentTechnique
  value: Code
    v: T1555
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1555.006
display:
  v: Cloud Secrets Management Stores
property:
  code:
    v: parentTechnique
  value: Code
    v: T1555
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1555.003
display:
  v: Credentials from Web Browsers
property:
  code:
    v: parentTechnique
  value: Code
    v: T1555
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1555.002
display:
  v: Securityd Memory
property:
  code:
    v: parentTechnique
  value: Code
    v: T1555
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1567
display:
  v: Exfiltration Over Web Service
property:
  code:
    v: tactic
  value: Code
    v: TA0010
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1567.001
display:
  v: Exfiltration to Code Repository
property:
  code:
    v: parentTechnique
  value: Code
    v: T1567
property:
  code:
    v: tactic
  value: Code
    v: TA0010
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1567.003
display:
  v: Exfiltration to Text Storage Sites
property:
  code:
    v: parentTechnique
  value: Code
    v: T1567
property:
  code:
    v: tactic
  value: Code
    v: TA0010
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1567.002
display:
  v: Exfiltration to Cloud Storage
property:
  code:
    v: parentTechnique
  value: Code
    v: T1567
property:
  code:
    v: tactic
  value: Code
    v: TA0010
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1567.004
display:
  v: Exfiltration Over Webhook
property:
  code:
    v: parentTechnique
  value: Code
    v: T1567
property:
  code:
    v: tactic
  value: Code
    v: TA0010
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1219
display:
  v: Remote Access Tools
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1219.003
display:
  v: Remote Access Hardware
property:
  code:
    v: parentTechnique
  value: Code
    v: T1219
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1219.001
display:
  v: IDE Tunneling
property:
  code:
    v: parentTechnique
  value: Code
    v: T1219
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1219.002
display:
  v: Remote Desktop Software
property:
  code:
    v: parentTechnique
  value: Code
    v: T1219
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1036
display:
  v: Masquerading
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1036.008
display:
  v: Masquerade File Type
property:
  code:
    v: parentTechnique
  value: Code
    v: T1036
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1036.003
display:
  v: Rename Legitimate Utilities
property:
  code:
    v: parentTechnique
  value: Code
    v: T1036
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1036.006
display:
  v: Space after Filename
property:
  code:
    v: parentTechnique
  value: Code
    v: T1036
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1036.004
display:
  v: Masquerade Task or Service
property:
  code:
    v: parentTechnique
  value: Code
    v: T1036
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1036.002
display:
  v: Right-to-Left Override
property:
  code:
    v: parentTechnique
  value: Code
    v: T1036
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1036.005
display:
  v: Match Legitimate Resource Name or Location
property:
  code:
    v: parentTechnique
  value: Code
    v: T1036
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1036.011
display:
  v: Overwrite Process Arguments
property:
  code:
    v: parentTechnique
  value: Code
    v: T1036
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1036.007
display:
  v: Double File Extension
property:
  code:
    v: parentTechnique
  value: Code
    v: T1036
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1036.010
display:
  v: Masquerade Account Name
property:
  code:
    v: parentTechnique
  value: Code
    v: T1036
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1036.001
display:
  v: Invalid Code Signature
property:
  code:
    v: parentTechnique
  value: Code
    v: T1036
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1036.012
display:
  v: Browser Fingerprint
property:
  code:
    v: parentTechnique
  value: Code
    v: T1036
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1036.009
display:
  v: Break Process Trees
property:
  code:
    v: parentTechnique
  value: Code
    v: T1036
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1552
display:
  v: Unsecured Credentials
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1552.006
display:
  v: Group Policy Preferences
property:
  code:
    v: parentTechnique
  value: Code
    v: T1552
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1552.004
display:
  v: Private Keys
property:
  code:
    v: parentTechnique
  value: Code
    v: T1552
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1552.007
display:
  v: Container API
property:
  code:
    v: parentTechnique
  value: Code
    v: T1552
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1552.001
display:
  v: Credentials In Files
property:
  code:
    v: parentTechnique
  value: Code
    v: T1552
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1552.002
display:
  v: Credentials in Registry
property:
  code:
    v: parentTechnique
  value: Code
    v: T1552
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1552.003
display:
  v: Shell History
property:
  code:
    v: parentTechnique
  value: Code
    v: T1552
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1552.008
display:
  v: Chat Messages
property:
  code:
    v: parentTechnique
  value: Code
    v: T1552
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1552.005
display:
  v: Cloud Instance Metadata API
property:
  code:
    v: parentTechnique
  value: Code
    v: T1552
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1659
display:
  v: Content Injection
property:
  code:
    v: tactic
  value: Code
    v: TA0001
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1055
display:
  v: Process Injection
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1055.013
display:
  v: Process Doppelgänging
property:
  code:
    v: parentTechnique
  value: Code
    v: T1055
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1055.012
display:
  v: Process Hollowing
property:
  code:
    v: parentTechnique
  value: Code
    v: T1055
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1055.009
display:
  v: Proc Memory
property:
  code:
    v: parentTechnique
  value: Code
    v: T1055
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1055.015
display:
  v: ListPlanting
property:
  code:
    v: parentTechnique
  value: Code
    v: T1055
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1055.014
display:
  v: VDSO Hijacking
property:
  code:
    v: parentTechnique
  value: Code
    v: T1055
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1055.005
display:
  v: Thread Local Storage
property:
  code:
    v: parentTechnique
  value: Code
    v: T1055
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1055.011
display:
  v: Extra Window Memory Injection
property:
  code:
    v: parentTechnique
  value: Code
    v: T1055
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1055.001
display:
  v: Dynamic-link Library Injection
property:
  code:
    v: parentTechnique
  value: Code
    v: T1055
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1055.003
display:
  v: Thread Execution Hijacking
property:
  code:
    v: parentTechnique
  value: Code
    v: T1055
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1055.008
display:
  v: Ptrace System Calls
property:
  code:
    v: parentTechnique
  value: Code
    v: T1055
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1055.004
display:
  v: Asynchronous Procedure Call
property:
  code:
    v: parentTechnique
  value: Code
    v: T1055
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1055.002
display:
  v: Portable Executable Injection
property:
  code:
    v: parentTechnique
  value: Code
    v: T1055
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1205
display:
  v: Traffic Signaling
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1205.001
display:
  v: Port Knocking
property:
  code:
    v: parentTechnique
  value: Code
    v: T1205
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1205.002
display:
  v: Socket Filters
property:
  code:
    v: parentTechnique
  value: Code
    v: T1205
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1218
display:
  v: System Binary Proxy Execution
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1218.005
display:
  v: Mshta
property:
  code:
    v: parentTechnique
  value: Code
    v: T1218
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1218.014
display:
  v: MMC
property:
  code:
    v: parentTechnique
  value: Code
    v: T1218
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1218.008
display:
  v: Odbcconf
property:
  code:
    v: parentTechnique
  value: Code
    v: T1218
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1218.015
display:
  v: Electron Applications
property:
  code:
    v: parentTechnique
  value: Code
    v: T1218
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1218.012
display:
  v: Verclsid
property:
  code:
    v: parentTechnique
  value: Code
    v: T1218
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1218.013
display:
  v: Mavinject
property:
  code:
    v: parentTechnique
  value: Code
    v: T1218
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1218.002
display:
  v: Control Panel
property:
  code:
    v: parentTechnique
  value: Code
    v: T1218
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1218.001
display:
  v: Compiled HTML File
property:
  code:
    v: parentTechnique
  value: Code
    v: T1218
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1218.010
display:
  v: Regsvr32
property:
  code:
    v: parentTechnique
  value: Code
    v: T1218
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1218.004
display:
  v: InstallUtil
property:
  code:
    v: parentTechnique
  value: Code
    v: T1218
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1218.011
display:
  v: Rundll32
property:
  code:
    v: parentTechnique
  value: Code
    v: T1218
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1218.009
display:
  v: Regsvcs/Regasm
property:
  code:
    v: parentTechnique
  value: Code
    v: T1218
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1218.003
display:
  v: CMSTP
property:
  code:
    v: parentTechnique
  value: Code
    v: T1218
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1218.007
display:
  v: Msiexec
property:
  code:
    v: parentTechnique
  value: Code
    v: T1218
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1620
display:
  v: Reflective Code Loading
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1611
display:
  v: Escape to Host
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1010
display:
  v: Application Window Discovery
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1029
display:
  v: Scheduled Transfer
property:
  code:
    v: tactic
  value: Code
    v: TA0010
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1525
display:
  v: Implant Internal Image
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1572
display:
  v: Protocol Tunneling
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1550
display:
  v: Use Alternate Authentication Material
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0008
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1550.004
display:
  v: Web Session Cookie
property:
  code:
    v: parentTechnique
  value: Code
    v: T1550
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0008
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1550.001
display:
  v: Application Access Token
property:
  code:
    v: parentTechnique
  value: Code
    v: T1550
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0008
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1550.003
display:
  v: Pass the Ticket
property:
  code:
    v: parentTechnique
  value: Code
    v: T1550
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0008
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1550.002
display:
  v: Pass the Hash
property:
  code:
    v: parentTechnique
  value: Code
    v: T1550
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0008
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1011
display:
  v: Exfiltration Over Other Network Medium
property:
  code:
    v: tactic
  value: Code
    v: TA0010
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1011.001
display:
  v: Exfiltration Over Bluetooth
property:
  code:
    v: parentTechnique
  value: Code
    v: T1011
property:
  code:
    v: tactic
  value: Code
    v: TA0010
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1589
display:
  v: Gather Victim Identity Information
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1589.003
display:
  v: Employee Names
property:
  code:
    v: parentTechnique
  value: Code
    v: T1589
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1589.002
display:
  v: Email Addresses
property:
  code:
    v: parentTechnique
  value: Code
    v: T1589
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1589.001
display:
  v: Credentials
property:
  code:
    v: parentTechnique
  value: Code
    v: T1589
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1560
display:
  v: Archive Collected Data
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1560.002
display:
  v: Archive via Library
property:
  code:
    v: parentTechnique
  value: Code
    v: T1560
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1560.001
display:
  v: Archive via Utility
property:
  code:
    v: parentTechnique
  value: Code
    v: T1560
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1560.003
display:
  v: Archive via Custom Method
property:
  code:
    v: parentTechnique
  value: Code
    v: T1560
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1185
display:
  v: Browser Session Hijacking
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1021
display:
  v: Remote Services
property:
  code:
    v: tactic
  value: Code
    v: TA0008
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1021.006
display:
  v: Windows Remote Management
property:
  code:
    v: parentTechnique
  value: Code
    v: T1021
property:
  code:
    v: tactic
  value: Code
    v: TA0008
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1021.005
display:
  v: VNC
property:
  code:
    v: parentTechnique
  value: Code
    v: T1021
property:
  code:
    v: tactic
  value: Code
    v: TA0008
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1021.002
display:
  v: SMB/Windows Admin Shares
property:
  code:
    v: parentTechnique
  value: Code
    v: T1021
property:
  code:
    v: tactic
  value: Code
    v: TA0008
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1021.007
display:
  v: Cloud Services
property:
  code:
    v: parentTechnique
  value: Code
    v: T1021
property:
  code:
    v: tactic
  value: Code
    v: TA0008
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1021.001
display:
  v: Remote Desktop Protocol
property:
  code:
    v: parentTechnique
  value: Code
    v: T1021
property:
  code:
    v: tactic
  value: Code
    v: TA0008
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1021.003
display:
  v: Distributed Component Object Model
property:
  code:
    v: parentTechnique
  value: Code
    v: T1021
property:
  code:
    v: tactic
  value: Code
    v: TA0008
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1021.008
display:
  v: Direct Cloud VM Connections
property:
  code:
    v: parentTechnique
  value: Code
    v: T1021
property:
  code:
    v: tactic
  value: Code
    v: TA0008
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1021.004
display:
  v: SSH
property:
  code:
    v: parentTechnique
  value: Code
    v: T1021
property:
  code:
    v: tactic
  value: Code
    v: TA0008
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1596
display:
  v: Search Open Technical Databases
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1596.003
display:
  v: Digital Certificates
property:
  code:
    v: parentTechnique
  value: Code
    v: T1596
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1596.005
display:
  v: Scan Databases
property:
  code:
    v: parentTechnique
  value: Code
    v: T1596
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1596.001
display:
  v: DNS/Passive DNS
property:
  code:
    v: parentTechnique
  value: Code
    v: T1596
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1596.004
display:
  v: CDNs
property:
  code:
    v: parentTechnique
  value: Code
    v: T1596
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1596.002
display:
  v: WHOIS
property:
  code:
    v: parentTechnique
  value: Code
    v: T1596
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1207
display:
  v: Rogue Domain Controller
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1610
display:
  v: Deploy Container
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1112
display:
  v: Modify Registry
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1580
display:
  v: Cloud Infrastructure Discovery
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1491
display:
  v: Defacement
property:
  code:
    v: tactic
  value: Code
    v: TA0040
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1491.002
display:
  v: External Defacement
property:
  code:
    v: parentTechnique
  value: Code
    v: T1491
property:
  code:
    v: tactic
  value: Code
    v: TA0040
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1491.001
display:
  v: Internal Defacement
property:
  code:
    v: parentTechnique
  value: Code
    v: T1491
property:
  code:
    v: tactic
  value: Code
    v: TA0040
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1535
display:
  v: Unused/Unsupported Cloud Regions
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1563
display:
  v: Remote Service Session Hijacking
property:
  code:
    v: tactic
  value: Code
    v: TA0008
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1563.002
display:
  v: RDP Hijacking
property:
  code:
    v: parentTechnique
  value: Code
    v: T1563
property:
  code:
    v: tactic
  value: Code
    v: TA0008
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1563.001
display:
  v: SSH Hijacking
property:
  code:
    v: parentTechnique
  value: Code
    v: T1563
property:
  code:
    v: tactic
  value: Code
    v: TA0008
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1217
display:
  v: Browser Information Discovery
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1681
display:
  v: Search Threat Vendor Data
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1674
display:
  v: Input Injection
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1092
display:
  v: Communication Through Removable Media
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1222
display:
  v: File and Directory Permissions Modification
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1222.002
display:
  v: Linux and Mac File and Directory Permissions Modification
property:
  code:
    v: parentTechnique
  value: Code
    v: T1222
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1222.001
display:
  v: Windows File and Directory Permissions Modification
property:
  code:
    v: parentTechnique
  value: Code
    v: T1222
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1595
display:
  v: Active Scanning
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1595.003
display:
  v: Wordlist Scanning
property:
  code:
    v: parentTechnique
  value: Code
    v: T1595
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1595.001
display:
  v: Scanning IP Blocks
property:
  code:
    v: parentTechnique
  value: Code
    v: T1595
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1595.002
display:
  v: Vulnerability Scanning
property:
  code:
    v: parentTechnique
  value: Code
    v: T1595
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1548
display:
  v: Abuse Elevation Control Mechanism
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1548.001
display:
  v: Setuid and Setgid
property:
  code:
    v: parentTechnique
  value: Code
    v: T1548
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1548.005
display:
  v: Temporary Elevated Cloud Access
property:
  code:
    v: parentTechnique
  value: Code
    v: T1548
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1548.002
display:
  v: Bypass User Account Control
property:
  code:
    v: parentTechnique
  value: Code
    v: T1548
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1548.004
display:
  v: Elevated Execution with Prompt
property:
  code:
    v: parentTechnique
  value: Code
    v: T1548
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1548.003
display:
  v: Sudo and Sudo Caching
property:
  code:
    v: parentTechnique
  value: Code
    v: T1548
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1548.006
display:
  v: TCC Manipulation
property:
  code:
    v: parentTechnique
  value: Code
    v: T1548
property:
  code:
    v: tactic
  value: Code
    v: TA0004
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1673
display:
  v: Virtual Machine Discovery
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1125
display:
  v: Video Capture
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1016
display:
  v: System Network Configuration Discovery
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1016.002
display:
  v: Wi-Fi Discovery
property:
  code:
    v: parentTechnique
  value: Code
    v: T1016
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1016.001
display:
  v: Internet Connection Discovery
property:
  code:
    v: parentTechnique
  value: Code
    v: T1016
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1087
display:
  v: Account Discovery
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1087.003
display:
  v: Email Account
property:
  code:
    v: parentTechnique
  value: Code
    v: T1087
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1087.004
display:
  v: Cloud Account
property:
  code:
    v: parentTechnique
  value: Code
    v: T1087
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1087.002
display:
  v: Domain Account
property:
  code:
    v: parentTechnique
  value: Code
    v: T1087
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1087.001
display:
  v: Local Account
property:
  code:
    v: parentTechnique
  value: Code
    v: T1087
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1090
display:
  v: Proxy
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1090.001
display:
  v: Internal Proxy
property:
  code:
    v: parentTechnique
  value: Code
    v: T1090
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1090.003
display:
  v: Multi-hop Proxy
property:
  code:
    v: parentTechnique
  value: Code
    v: T1090
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1090.004
display:
  v: Domain Fronting
property:
  code:
    v: parentTechnique
  value: Code
    v: T1090
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1090.002
display:
  v: External Proxy
property:
  code:
    v: parentTechnique
  value: Code
    v: T1090
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1059
display:
  v: Command and Scripting Interpreter
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1059.005
display:
  v: Visual Basic
property:
  code:
    v: parentTechnique
  value: Code
    v: T1059
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1059.002
display:
  v: AppleScript
property:
  code:
    v: parentTechnique
  value: Code
    v: T1059
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1059.003
display:
  v: Windows Command Shell
property:
  code:
    v: parentTechnique
  value: Code
    v: T1059
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1059.013
display:
  v: Container CLI/API
property:
  code:
    v: parentTechnique
  value: Code
    v: T1059
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1059.004
display:
  v: Unix Shell
property:
  code:
    v: parentTechnique
  value: Code
    v: T1059
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1059.010
display:
  v: AutoHotKey & AutoIT
property:
  code:
    v: parentTechnique
  value: Code
    v: T1059
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1059.008
display:
  v: Network Device CLI
property:
  code:
    v: parentTechnique
  value: Code
    v: T1059
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1059.012
display:
  v: Hypervisor CLI
property:
  code:
    v: parentTechnique
  value: Code
    v: T1059
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1059.006
display:
  v: Python
property:
  code:
    v: parentTechnique
  value: Code
    v: T1059
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1059.001
display:
  v: PowerShell
property:
  code:
    v: parentTechnique
  value: Code
    v: T1059
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1059.009
display:
  v: Cloud API
property:
  code:
    v: parentTechnique
  value: Code
    v: T1059
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1059.011
display:
  v: Lua
property:
  code:
    v: parentTechnique
  value: Code
    v: T1059
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1059.007
display:
  v: JavaScript
property:
  code:
    v: parentTechnique
  value: Code
    v: T1059
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1677
display:
  v: Poisoned Pipeline Execution
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1482
display:
  v: Domain Trust Discovery
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1020
display:
  v: Automated Exfiltration
property:
  code:
    v: tactic
  value: Code
    v: TA0010
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1020.001
display:
  v: Traffic Duplication
property:
  code:
    v: parentTechnique
  value: Code
    v: T1020
property:
  code:
    v: tactic
  value: Code
    v: TA0010
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1070
display:
  v: Indicator Removal
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1070.004
display:
  v: File Deletion
property:
  code:
    v: parentTechnique
  value: Code
    v: T1070
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1070.006
display:
  v: Timestomp
property:
  code:
    v: parentTechnique
  value: Code
    v: T1070
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1070.008
display:
  v: Clear Mailbox Data
property:
  code:
    v: parentTechnique
  value: Code
    v: T1070
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1070.002
display:
  v: Clear Linux or Mac System Logs
property:
  code:
    v: parentTechnique
  value: Code
    v: T1070
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1070.001
display:
  v: Clear Windows Event Logs
property:
  code:
    v: parentTechnique
  value: Code
    v: T1070
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1070.009
display:
  v: Clear Persistence
property:
  code:
    v: parentTechnique
  value: Code
    v: T1070
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1070.003
display:
  v: Clear Command History
property:
  code:
    v: parentTechnique
  value: Code
    v: T1070
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1070.010
display:
  v: Relocate Malware
property:
  code:
    v: parentTechnique
  value: Code
    v: T1070
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1070.007
display:
  v: Clear Network Connection History and Configurations
property:
  code:
    v: parentTechnique
  value: Code
    v: T1070
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1070.005
display:
  v: Network Share Connection Removal
property:
  code:
    v: parentTechnique
  value: Code
    v: T1070
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1609
display:
  v: Container Administration Command
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1083
display:
  v: File and Directory Discovery
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1568
display:
  v: Dynamic Resolution
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1568.001
display:
  v: Fast Flux DNS
property:
  code:
    v: parentTechnique
  value: Code
    v: T1568
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1568.002
display:
  v: Domain Generation Algorithms
property:
  code:
    v: parentTechnique
  value: Code
    v: T1568
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1568.003
display:
  v: DNS Calculation
property:
  code:
    v: parentTechnique
  value: Code
    v: T1568
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1647
display:
  v: Plist File Modification
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1074
display:
  v: Data Staged
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1074.001
display:
  v: Local Data Staging
property:
  code:
    v: parentTechnique
  value: Code
    v: T1074
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1074.002
display:
  v: Remote Data Staging
property:
  code:
    v: parentTechnique
  value: Code
    v: T1074
property:
  code:
    v: tactic
  value: Code
    v: TA0009
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1649
display:
  v: Steal or Forge Authentication Certificates
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1049
display:
  v: System Network Connections Discovery
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1584
display:
  v: Compromise Infrastructure
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1584.003
display:
  v: Virtual Private Server
property:
  code:
    v: parentTechnique
  value: Code
    v: T1584
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1584.002
display:
  v: DNS Server
property:
  code:
    v: parentTechnique
  value: Code
    v: T1584
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1584.006
display:
  v: Web Services
property:
  code:
    v: parentTechnique
  value: Code
    v: T1584
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1584.007
display:
  v: Serverless
property:
  code:
    v: parentTechnique
  value: Code
    v: T1584
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1584.005
display:
  v: Botnet
property:
  code:
    v: parentTechnique
  value: Code
    v: T1584
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1584.004
display:
  v: Server
property:
  code:
    v: parentTechnique
  value: Code
    v: T1584
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1584.008
display:
  v: Network Devices
property:
  code:
    v: parentTechnique
  value: Code
    v: T1584
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1584.001
display:
  v: Domains
property:
  code:
    v: parentTechnique
  value: Code
    v: T1584
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1542
display:
  v: Pre-OS Boot
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1542.003
display:
  v: Bootkit
property:
  code:
    v: parentTechnique
  value: Code
    v: T1542
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1542.005
display:
  v: TFTP Boot
property:
  code:
    v: parentTechnique
  value: Code
    v: T1542
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1542.002
display:
  v: Component Firmware
property:
  code:
    v: parentTechnique
  value: Code
    v: T1542
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1542.004
display:
  v: ROMMONkit
property:
  code:
    v: parentTechnique
  value: Code
    v: T1542
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1542.001
display:
  v: System Firmware
property:
  code:
    v: parentTechnique
  value: Code
    v: T1542
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0003
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1612
display:
  v: Build Image on Host
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1586
display:
  v: Compromise Accounts
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1586.003
display:
  v: Cloud Accounts
property:
  code:
    v: parentTechnique
  value: Code
    v: T1586
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1586.002
display:
  v: Email Accounts
property:
  code:
    v: parentTechnique
  value: Code
    v: T1586
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1586.001
display:
  v: Social Media Accounts
property:
  code:
    v: parentTechnique
  value: Code
    v: T1586
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1497
display:
  v: Virtualization/Sandbox Evasion
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1497.002
display:
  v: User Activity Based Checks
property:
  code:
    v: parentTechnique
  value: Code
    v: T1497
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1497.001
display:
  v: System Checks
property:
  code:
    v: parentTechnique
  value: Code
    v: T1497
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1497.003
display:
  v: Time Based Checks
property:
  code:
    v: parentTechnique
  value: Code
    v: T1497
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1102
display:
  v: Web Service
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1102.003
display:
  v: One-Way Communication
property:
  code:
    v: parentTechnique
  value: Code
    v: T1102
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1102.001
display:
  v: Dead Drop Resolver
property:
  code:
    v: parentTechnique
  value: Code
    v: T1102
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1102.002
display:
  v: Bidirectional Communication
property:
  code:
    v: parentTechnique
  value: Code
    v: T1102
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1608
display:
  v: Stage Capabilities
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1608.004
display:
  v: Drive-by Target
property:
  code:
    v: parentTechnique
  value: Code
    v: T1608
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1608.005
display:
  v: Link Target
property:
  code:
    v: parentTechnique
  value: Code
    v: T1608
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1608.006
display:
  v: SEO Poisoning
property:
  code:
    v: parentTechnique
  value: Code
    v: T1608
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1608.003
display:
  v: Install Digital Certificate
property:
  code:
    v: parentTechnique
  value: Code
    v: T1608
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1608.002
display:
  v: Upload Tool
property:
  code:
    v: parentTechnique
  value: Code
    v: T1608
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1608.001
display:
  v: Upload Malware
property:
  code:
    v: parentTechnique
  value: Code
    v: T1608
property:
  code:
    v: tactic
  value: Code
    v: TA0042
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1104
display:
  v: Multi-Stage Channels
property:
  code:
    v: tactic
  value: Code
    v: TA0011
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1657
display:
  v: Financial Theft
property:
  code:
    v: tactic
  value: Code
    v: TA0040
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1480
display:
  v: Execution Guardrails
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1480.001
display:
  v: Environmental Keying
property:
  code:
    v: parentTechnique
  value: Code
    v: T1480
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1480.002
display:
  v: Mutual Exclusion
property:
  code:
    v: parentTechnique
  value: Code
    v: T1480
property:
  code:
    v: tactic
  value: Code
    v: TA0005
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1619
display:
  v: Cloud Storage Object Discovery
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1654
display:
  v: Log Enumeration
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1528
display:
  v: Steal Application Access Token
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1204
display:
  v: User Execution
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1204.005
display:
  v: Malicious Library
property:
  code:
    v: parentTechnique
  value: Code
    v: T1204
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1204.002
display:
  v: Malicious File
property:
  code:
    v: parentTechnique
  value: Code
    v: T1204
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1204.003
display:
  v: Malicious Image
property:
  code:
    v: parentTechnique
  value: Code
    v: T1204
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1204.001
display:
  v: Malicious Link
property:
  code:
    v: parentTechnique
  value: Code
    v: T1204
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1204.004
display:
  v: Malicious Copy and Paste
property:
  code:
    v: parentTechnique
  value: Code
    v: T1204
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1057
display:
  v: Process Discovery
property:
  code:
    v: tactic
  value: Code
    v: TA0007
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1072
display:
  v: Software Deployment Tools
property:
  code:
    v: tactic
  value: Code
    v: TA0002
property:
  code:
    v: tactic
  value: Code
    v: TA0008
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1041
display:
  v: Exfiltration Over C2 Channel
property:
  code:
    v: tactic
  value: Code
    v: TA0010
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1591
display:
  v: Gather Victim Org Information
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1591.002
display:
  v: Business Relationships
property:
  code:
    v: parentTechnique
  value: Code
    v: T1591
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1591.001
display:
  v: Determine Physical Locations
property:
  code:
    v: parentTechnique
  value: Code
    v: T1591
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1591.004
display:
  v: Identify Roles
property:
  code:
    v: parentTechnique
  value: Code
    v: T1591
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1591.003
display:
  v: Identify Business Tempo
property:
  code:
    v: parentTechnique
  value: Code
    v: T1591
property:
  code:
    v: tactic
  value: Code
    v: TA0043
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1606
display:
  v: Forge Web Credentials
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: false

code:
  v: T1606.001
display:
  v: Web Cookies
property:
  code:
    v: parentTechnique
  value: Code
    v: T1606
property:
  code:
    v: tactic
  value: Code
    v: TA0006
property:
  code:
    v: isSubtechnique
  value: Boolean
    v: true

code:
  v: T1606.002
display:
  v: SAML Tokens
property:
  code:
    v: parentTechnique
  value: Code
    v: T1606
property:
  code:
    v: tactic
  value: Code
    v: TA0006