ATTCK2FHIR Implementation Guide
0.0.5 - ci-build
ATTCK2FHIR Implementation Guide - Local Development build (v0.0.5) built by the FHIR (HL7® FHIR® Standard) Build Tools. See the Directory of published versions
| Draft as of 2026-04-26 |
@prefix fhir: <http://hl7.org/fhir/> . @prefix owl: <http://www.w3.org/2002/07/owl#> . @prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> . @prefix rdfs: <http://www.w3.org/2000/01/rdf-schema#> . @prefix xsd: <http://www.w3.org/2001/XMLSchema#> . # - resource ------------------------------------------------------------------- a fhir:CodeSystem ; fhir:nodeRole fhir:treeRoot ; fhir:id [ fhir:v "MITRE-ATTCK-Techniques"] ; # fhir:language [ fhir:v "en"] ; # fhir:text [ fhir:status [ fhir:v "generated" ] ; fhir:div [ fhir:v "<div xmlns=\"http://www.w3.org/1999/xhtml\"><p class=\"res-header-id\"><b>Generated Narrative: CodeSystem MITRE-ATTCK-Techniques</b></p><a name=\"MITRE-ATTCK-Techniques\"> </a><a name=\"hcMITRE-ATTCK-Techniques\"> </a><p><b>Properties</b></p><p><b>This code system defines the following properties for its concepts</b></p><table class=\"grid\"><tr><td><b>Name</b></td><td><b>Code</b></td><td><b>URI</b></td><td><b>Type</b></td><td><b>Description</b></td></tr><tr><td>tactic</td><td>tactic</td><td>https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Tactics</td><td>code</td><td>The tactic(s) this technique or subtechnique contributes to, referenced by tactic ID</td></tr><tr><td>parentTechnique</td><td>parentTechnique</td><td>https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Techniques</td><td>code</td><td>The parent technique of this subtechnique, referenced by ATT&CK ID</td></tr><tr><td>isSubtechnique</td><td>isSubtechnique</td><td/><td>boolean</td><td>Whether this concept is a subtechnique</td></tr></table><p><b>Concepts</b></p><p>This case-sensitive code system <code>https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Techniques</code> defines the following codes:</p><table class=\"codes\"><tr><td style=\"white-space:nowrap\"><b>Code</b></td><td><b>Display</b></td><td><b>tactic</b></td><td><b>parentTechnique</b></td><td><b>isSubtechnique</b></td></tr><tr><td style=\"white-space:nowrap\">T1047<a name=\"MITRE-ATTCK-Techniques-T1047\"> </a></td><td>Windows Management Instrumentation</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1113<a name=\"MITRE-ATTCK-Techniques-T1113\"> </a></td><td>Screen Capture</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1037<a name=\"MITRE-ATTCK-Techniques-T1037\"> </a></td><td>Boot or Logon Initialization Scripts</td><td>TA0003, TA0004</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1037.004<a name=\"MITRE-ATTCK-Techniques-T1037.46004\"> </a></td><td>RC Scripts</td><td>TA0003, TA0004</td><td>T1037</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1037.001<a name=\"MITRE-ATTCK-Techniques-T1037.46001\"> </a></td><td>Logon Script (Windows)</td><td>TA0003, TA0004</td><td>T1037</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1037.003<a name=\"MITRE-ATTCK-Techniques-T1037.46003\"> </a></td><td>Network Logon Script</td><td>TA0003, TA0004</td><td>T1037</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1037.005<a name=\"MITRE-ATTCK-Techniques-T1037.46005\"> </a></td><td>Startup Items</td><td>TA0003, TA0004</td><td>T1037</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1037.002<a name=\"MITRE-ATTCK-Techniques-T1037.46002\"> </a></td><td>Login Hook</td><td>TA0003, TA0004</td><td>T1037</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1557<a name=\"MITRE-ATTCK-Techniques-T1557\"> </a></td><td>Adversary-in-the-Middle</td><td>TA0006, TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1557.003<a name=\"MITRE-ATTCK-Techniques-T1557.46003\"> </a></td><td>DHCP Spoofing</td><td>TA0006, TA0009</td><td>T1557</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1557.002<a name=\"MITRE-ATTCK-Techniques-T1557.46002\"> </a></td><td>ARP Cache Poisoning</td><td>TA0006, TA0009</td><td>T1557</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1557.001<a name=\"MITRE-ATTCK-Techniques-T1557.46001\"> </a></td><td>LLMNR/NBT-NS Poisoning and SMB Relay</td><td>TA0006, TA0009</td><td>T1557</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1557.004<a name=\"MITRE-ATTCK-Techniques-T1557.46004\"> </a></td><td>Evil Twin</td><td>TA0006, TA0009</td><td>T1557</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1033<a name=\"MITRE-ATTCK-Techniques-T1033\"> </a></td><td>System Owner/User Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1583<a name=\"MITRE-ATTCK-Techniques-T1583\"> </a></td><td>Acquire Infrastructure</td><td>TA0042</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1583.008<a name=\"MITRE-ATTCK-Techniques-T1583.46008\"> </a></td><td>Malvertising</td><td>TA0042</td><td>T1583</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1583.001<a name=\"MITRE-ATTCK-Techniques-T1583.46001\"> </a></td><td>Domains</td><td>TA0042</td><td>T1583</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1583.005<a name=\"MITRE-ATTCK-Techniques-T1583.46005\"> </a></td><td>Botnet</td><td>TA0042</td><td>T1583</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1583.004<a name=\"MITRE-ATTCK-Techniques-T1583.46004\"> </a></td><td>Server</td><td>TA0042</td><td>T1583</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1583.002<a name=\"MITRE-ATTCK-Techniques-T1583.46002\"> </a></td><td>DNS Server</td><td>TA0042</td><td>T1583</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1583.003<a name=\"MITRE-ATTCK-Techniques-T1583.46003\"> </a></td><td>Virtual Private Server</td><td>TA0042</td><td>T1583</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1583.007<a name=\"MITRE-ATTCK-Techniques-T1583.46007\"> </a></td><td>Serverless</td><td>TA0042</td><td>T1583</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1583.006<a name=\"MITRE-ATTCK-Techniques-T1583.46006\"> </a></td><td>Web Services</td><td>TA0042</td><td>T1583</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1613<a name=\"MITRE-ATTCK-Techniques-T1613\"> </a></td><td>Container and Resource Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1592<a name=\"MITRE-ATTCK-Techniques-T1592\"> </a></td><td>Gather Victim Host Information</td><td>TA0043</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1592.001<a name=\"MITRE-ATTCK-Techniques-T1592.46001\"> </a></td><td>Hardware</td><td>TA0043</td><td>T1592</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1592.003<a name=\"MITRE-ATTCK-Techniques-T1592.46003\"> </a></td><td>Firmware</td><td>TA0043</td><td>T1592</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1592.002<a name=\"MITRE-ATTCK-Techniques-T1592.46002\"> </a></td><td>Software</td><td>TA0043</td><td>T1592</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1592.004<a name=\"MITRE-ATTCK-Techniques-T1592.46004\"> </a></td><td>Client Configurations</td><td>TA0043</td><td>T1592</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1003<a name=\"MITRE-ATTCK-Techniques-T1003\"> </a></td><td>OS Credential Dumping</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1003.002<a name=\"MITRE-ATTCK-Techniques-T1003.46002\"> </a></td><td>Security Account Manager</td><td>TA0006</td><td>T1003</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1003.004<a name=\"MITRE-ATTCK-Techniques-T1003.46004\"> </a></td><td>LSA Secrets</td><td>TA0006</td><td>T1003</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1003.006<a name=\"MITRE-ATTCK-Techniques-T1003.46006\"> </a></td><td>DCSync</td><td>TA0006</td><td>T1003</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1003.007<a name=\"MITRE-ATTCK-Techniques-T1003.46007\"> </a></td><td>Proc Filesystem</td><td>TA0006</td><td>T1003</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1003.003<a name=\"MITRE-ATTCK-Techniques-T1003.46003\"> </a></td><td>NTDS</td><td>TA0006</td><td>T1003</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1003.005<a name=\"MITRE-ATTCK-Techniques-T1003.46005\"> </a></td><td>Cached Domain Credentials</td><td>TA0006</td><td>T1003</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1003.001<a name=\"MITRE-ATTCK-Techniques-T1003.46001\"> </a></td><td>LSASS Memory</td><td>TA0006</td><td>T1003</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1003.008<a name=\"MITRE-ATTCK-Techniques-T1003.46008\"> </a></td><td>/etc/passwd and /etc/shadow</td><td>TA0006</td><td>T1003</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1129<a name=\"MITRE-ATTCK-Techniques-T1129\"> </a></td><td>Shared Modules</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1602<a name=\"MITRE-ATTCK-Techniques-T1602\"> </a></td><td>Data from Configuration Repository</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1602.002<a name=\"MITRE-ATTCK-Techniques-T1602.46002\"> </a></td><td>Network Device Configuration Dump</td><td>TA0009</td><td>T1602</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1602.001<a name=\"MITRE-ATTCK-Techniques-T1602.46001\"> </a></td><td>SNMP (MIB Dump)</td><td>TA0009</td><td>T1602</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1006<a name=\"MITRE-ATTCK-Techniques-T1006\"> </a></td><td>Direct Volume Access</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1666<a name=\"MITRE-ATTCK-Techniques-T1666\"> </a></td><td>Modify Cloud Resource Hierarchy</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1014<a name=\"MITRE-ATTCK-Techniques-T1014\"> </a></td><td>Rootkit</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1123<a name=\"MITRE-ATTCK-Techniques-T1123\"> </a></td><td>Audio Capture</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1543<a name=\"MITRE-ATTCK-Techniques-T1543\"> </a></td><td>Create or Modify System Process</td><td>TA0003, TA0004</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1543.004<a name=\"MITRE-ATTCK-Techniques-T1543.46004\"> </a></td><td>Launch Daemon</td><td>TA0003, TA0004</td><td>T1543</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1543.005<a name=\"MITRE-ATTCK-Techniques-T1543.46005\"> </a></td><td>Container Service</td><td>TA0003, TA0004</td><td>T1543</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1543.001<a name=\"MITRE-ATTCK-Techniques-T1543.46001\"> </a></td><td>Launch Agent</td><td>TA0003, TA0004</td><td>T1543</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1543.002<a name=\"MITRE-ATTCK-Techniques-T1543.46002\"> </a></td><td>Systemd Service</td><td>TA0003, TA0004</td><td>T1543</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1543.003<a name=\"MITRE-ATTCK-Techniques-T1543.46003\"> </a></td><td>Windows Service</td><td>TA0003, TA0004</td><td>T1543</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1133<a name=\"MITRE-ATTCK-Techniques-T1133\"> </a></td><td>External Remote Services</td><td>TA0003, TA0001</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1539<a name=\"MITRE-ATTCK-Techniques-T1539\"> </a></td><td>Steal Web Session Cookie</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1578<a name=\"MITRE-ATTCK-Techniques-T1578\"> </a></td><td>Modify Cloud Compute Infrastructure</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1578.001<a name=\"MITRE-ATTCK-Techniques-T1578.46001\"> </a></td><td>Create Snapshot</td><td>TA0005</td><td>T1578</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1578.003<a name=\"MITRE-ATTCK-Techniques-T1578.46003\"> </a></td><td>Delete Cloud Instance</td><td>TA0005</td><td>T1578</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1578.004<a name=\"MITRE-ATTCK-Techniques-T1578.46004\"> </a></td><td>Revert Cloud Instance</td><td>TA0005</td><td>T1578</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1578.002<a name=\"MITRE-ATTCK-Techniques-T1578.46002\"> </a></td><td>Create Cloud Instance</td><td>TA0005</td><td>T1578</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1578.005<a name=\"MITRE-ATTCK-Techniques-T1578.46005\"> </a></td><td>Modify Cloud Compute Configurations</td><td>TA0005</td><td>T1578</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1069<a name=\"MITRE-ATTCK-Techniques-T1069\"> </a></td><td>Permission Groups Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1069.003<a name=\"MITRE-ATTCK-Techniques-T1069.46003\"> </a></td><td>Cloud Groups</td><td>TA0007</td><td>T1069</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1069.002<a name=\"MITRE-ATTCK-Techniques-T1069.46002\"> </a></td><td>Domain Groups</td><td>TA0007</td><td>T1069</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1069.001<a name=\"MITRE-ATTCK-Techniques-T1069.46001\"> </a></td><td>Local Groups</td><td>TA0007</td><td>T1069</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1114<a name=\"MITRE-ATTCK-Techniques-T1114\"> </a></td><td>Email Collection</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1114.002<a name=\"MITRE-ATTCK-Techniques-T1114.46002\"> </a></td><td>Remote Email Collection</td><td>TA0009</td><td>T1114</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1114.003<a name=\"MITRE-ATTCK-Techniques-T1114.46003\"> </a></td><td>Email Forwarding Rule</td><td>TA0009</td><td>T1114</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1114.001<a name=\"MITRE-ATTCK-Techniques-T1114.46001\"> </a></td><td>Local Email Collection</td><td>TA0009</td><td>T1114</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1594<a name=\"MITRE-ATTCK-Techniques-T1594\"> </a></td><td>Search Victim-Owned Websites</td><td>TA0043</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1561<a name=\"MITRE-ATTCK-Techniques-T1561\"> </a></td><td>Disk Wipe</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1561.002<a name=\"MITRE-ATTCK-Techniques-T1561.46002\"> </a></td><td>Disk Structure Wipe</td><td>TA0040</td><td>T1561</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1561.001<a name=\"MITRE-ATTCK-Techniques-T1561.46001\"> </a></td><td>Disk Content Wipe</td><td>TA0040</td><td>T1561</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1615<a name=\"MITRE-ATTCK-Techniques-T1615\"> </a></td><td>Group Policy Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1025<a name=\"MITRE-ATTCK-Techniques-T1025\"> </a></td><td>Data from Removable Media</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1547<a name=\"MITRE-ATTCK-Techniques-T1547\"> </a></td><td>Boot or Logon Autostart Execution</td><td>TA0003, TA0004</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1547.009<a name=\"MITRE-ATTCK-Techniques-T1547.46009\"> </a></td><td>Shortcut Modification</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.006<a name=\"MITRE-ATTCK-Techniques-T1547.46006\"> </a></td><td>Kernel Modules and Extensions</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.007<a name=\"MITRE-ATTCK-Techniques-T1547.46007\"> </a></td><td>Re-opened Applications</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.004<a name=\"MITRE-ATTCK-Techniques-T1547.46004\"> </a></td><td>Winlogon Helper DLL</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.005<a name=\"MITRE-ATTCK-Techniques-T1547.46005\"> </a></td><td>Security Support Provider</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.001<a name=\"MITRE-ATTCK-Techniques-T1547.46001\"> </a></td><td>Registry Run Keys / Startup Folder</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.008<a name=\"MITRE-ATTCK-Techniques-T1547.46008\"> </a></td><td>LSASS Driver</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.012<a name=\"MITRE-ATTCK-Techniques-T1547.46012\"> </a></td><td>Print Processors</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.014<a name=\"MITRE-ATTCK-Techniques-T1547.46014\"> </a></td><td>Active Setup</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.015<a name=\"MITRE-ATTCK-Techniques-T1547.46015\"> </a></td><td>Login Items</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.013<a name=\"MITRE-ATTCK-Techniques-T1547.46013\"> </a></td><td>XDG Autostart Entries</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.003<a name=\"MITRE-ATTCK-Techniques-T1547.46003\"> </a></td><td>Time Providers</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.002<a name=\"MITRE-ATTCK-Techniques-T1547.46002\"> </a></td><td>Authentication Package</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1547.010<a name=\"MITRE-ATTCK-Techniques-T1547.46010\"> </a></td><td>Port Monitors</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1600<a name=\"MITRE-ATTCK-Techniques-T1600\"> </a></td><td>Weaken Encryption</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1600.001<a name=\"MITRE-ATTCK-Techniques-T1600.46001\"> </a></td><td>Reduce Key Space</td><td>TA0005</td><td>T1600</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1600.002<a name=\"MITRE-ATTCK-Techniques-T1600.46002\"> </a></td><td>Disable Crypto Hardware</td><td>TA0005</td><td>T1600</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1489<a name=\"MITRE-ATTCK-Techniques-T1489\"> </a></td><td>Service Stop</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1652<a name=\"MITRE-ATTCK-Techniques-T1652\"> </a></td><td>Device Driver Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1564<a name=\"MITRE-ATTCK-Techniques-T1564\"> </a></td><td>Hide Artifacts</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1564.003<a name=\"MITRE-ATTCK-Techniques-T1564.46003\"> </a></td><td>Hidden Window</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.011<a name=\"MITRE-ATTCK-Techniques-T1564.46011\"> </a></td><td>Ignore Process Interrupts</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.002<a name=\"MITRE-ATTCK-Techniques-T1564.46002\"> </a></td><td>Hidden Users</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.012<a name=\"MITRE-ATTCK-Techniques-T1564.46012\"> </a></td><td>File/Path Exclusions</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.014<a name=\"MITRE-ATTCK-Techniques-T1564.46014\"> </a></td><td>Extended Attributes</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.008<a name=\"MITRE-ATTCK-Techniques-T1564.46008\"> </a></td><td>Email Hiding Rules</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.009<a name=\"MITRE-ATTCK-Techniques-T1564.46009\"> </a></td><td>Resource Forking</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.013<a name=\"MITRE-ATTCK-Techniques-T1564.46013\"> </a></td><td>Bind Mounts</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.006<a name=\"MITRE-ATTCK-Techniques-T1564.46006\"> </a></td><td>Run Virtual Instance</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.010<a name=\"MITRE-ATTCK-Techniques-T1564.46010\"> </a></td><td>Process Argument Spoofing</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.001<a name=\"MITRE-ATTCK-Techniques-T1564.46001\"> </a></td><td>Hidden Files and Directories</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.004<a name=\"MITRE-ATTCK-Techniques-T1564.46004\"> </a></td><td>NTFS File Attributes</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.007<a name=\"MITRE-ATTCK-Techniques-T1564.46007\"> </a></td><td>VBA Stomping</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1564.005<a name=\"MITRE-ATTCK-Techniques-T1564.46005\"> </a></td><td>Hidden File System</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1080<a name=\"MITRE-ATTCK-Techniques-T1080\"> </a></td><td>Taint Shared Content</td><td>TA0008</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1137<a name=\"MITRE-ATTCK-Techniques-T1137\"> </a></td><td>Office Application Startup</td><td>TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1137.002<a name=\"MITRE-ATTCK-Techniques-T1137.46002\"> </a></td><td>Office Test</td><td>TA0003</td><td>T1137</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1137.001<a name=\"MITRE-ATTCK-Techniques-T1137.46001\"> </a></td><td>Office Template Macros</td><td>TA0003</td><td>T1137</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1137.004<a name=\"MITRE-ATTCK-Techniques-T1137.46004\"> </a></td><td>Outlook Home Page</td><td>TA0003</td><td>T1137</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1137.003<a name=\"MITRE-ATTCK-Techniques-T1137.46003\"> </a></td><td>Outlook Forms</td><td>TA0003</td><td>T1137</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1137.006<a name=\"MITRE-ATTCK-Techniques-T1137.46006\"> </a></td><td>Add-ins</td><td>TA0003</td><td>T1137</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1137.005<a name=\"MITRE-ATTCK-Techniques-T1137.46005\"> </a></td><td>Outlook Rules</td><td>TA0003</td><td>T1137</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1119<a name=\"MITRE-ATTCK-Techniques-T1119\"> </a></td><td>Automated Collection</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1115<a name=\"MITRE-ATTCK-Techniques-T1115\"> </a></td><td>Clipboard Data</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1675<a name=\"MITRE-ATTCK-Techniques-T1675\"> </a></td><td>ESXi Administration Command</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1007<a name=\"MITRE-ATTCK-Techniques-T1007\"> </a></td><td>System Service Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1040<a name=\"MITRE-ATTCK-Techniques-T1040\"> </a></td><td>Network Sniffing</td><td>TA0006, TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1530<a name=\"MITRE-ATTCK-Techniques-T1530\"> </a></td><td>Data from Cloud Storage</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1135<a name=\"MITRE-ATTCK-Techniques-T1135\"> </a></td><td>Network Share Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1120<a name=\"MITRE-ATTCK-Techniques-T1120\"> </a></td><td>Peripheral Device Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1082<a name=\"MITRE-ATTCK-Techniques-T1082\"> </a></td><td>System Information Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1071<a name=\"MITRE-ATTCK-Techniques-T1071\"> </a></td><td>Application Layer Protocol</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1071.002<a name=\"MITRE-ATTCK-Techniques-T1071.46002\"> </a></td><td>File Transfer Protocols</td><td>TA0011</td><td>T1071</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1071.004<a name=\"MITRE-ATTCK-Techniques-T1071.46004\"> </a></td><td>DNS</td><td>TA0011</td><td>T1071</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1071.005<a name=\"MITRE-ATTCK-Techniques-T1071.46005\"> </a></td><td>Publish/Subscribe Protocols</td><td>TA0011</td><td>T1071</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1071.003<a name=\"MITRE-ATTCK-Techniques-T1071.46003\"> </a></td><td>Mail Protocols</td><td>TA0011</td><td>T1071</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1071.001<a name=\"MITRE-ATTCK-Techniques-T1071.46001\"> </a></td><td>Web Protocols</td><td>TA0011</td><td>T1071</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1053<a name=\"MITRE-ATTCK-Techniques-T1053\"> </a></td><td>Scheduled Task/Job</td><td>TA0002, TA0003, TA0004</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1053.003<a name=\"MITRE-ATTCK-Techniques-T1053.46003\"> </a></td><td>Cron</td><td>TA0002, TA0003, TA0004</td><td>T1053</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1053.005<a name=\"MITRE-ATTCK-Techniques-T1053.46005\"> </a></td><td>Scheduled Task</td><td>TA0002, TA0003, TA0004</td><td>T1053</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1053.006<a name=\"MITRE-ATTCK-Techniques-T1053.46006\"> </a></td><td>Systemd Timers</td><td>TA0002, TA0003, TA0004</td><td>T1053</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1053.007<a name=\"MITRE-ATTCK-Techniques-T1053.46007\"> </a></td><td>Container Orchestration Job</td><td>TA0002, TA0003, TA0004</td><td>T1053</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1053.002<a name=\"MITRE-ATTCK-Techniques-T1053.46002\"> </a></td><td>At</td><td>TA0002, TA0003, TA0004</td><td>T1053</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1176<a name=\"MITRE-ATTCK-Techniques-T1176\"> </a></td><td>Software Extensions</td><td>TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1176.002<a name=\"MITRE-ATTCK-Techniques-T1176.46002\"> </a></td><td>IDE Extensions</td><td>TA0003</td><td>T1176</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1176.001<a name=\"MITRE-ATTCK-Techniques-T1176.46001\"> </a></td><td>Browser Extensions</td><td>TA0003</td><td>T1176</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1106<a name=\"MITRE-ATTCK-Techniques-T1106\"> </a></td><td>Native API</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1202<a name=\"MITRE-ATTCK-Techniques-T1202\"> </a></td><td>Indirect Command Execution</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1091<a name=\"MITRE-ATTCK-Techniques-T1091\"> </a></td><td>Replication Through Removable Media</td><td>TA0008, TA0001</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1005<a name=\"MITRE-ATTCK-Techniques-T1005\"> </a></td><td>Data from Local System</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1140<a name=\"MITRE-ATTCK-Techniques-T1140\"> </a></td><td>Deobfuscate/Decode Files or Information</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1562<a name=\"MITRE-ATTCK-Techniques-T1562\"> </a></td><td>Impair Defenses</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1562.003<a name=\"MITRE-ATTCK-Techniques-T1562.46003\"> </a></td><td>Impair Command History Logging</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1562.013<a name=\"MITRE-ATTCK-Techniques-T1562.46013\"> </a></td><td>Disable or Modify Network Device Firewall</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1562.004<a name=\"MITRE-ATTCK-Techniques-T1562.46004\"> </a></td><td>Disable or Modify System Firewall</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1562.002<a name=\"MITRE-ATTCK-Techniques-T1562.46002\"> </a></td><td>Disable Windows Event Logging</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1562.001<a name=\"MITRE-ATTCK-Techniques-T1562.46001\"> </a></td><td>Disable or Modify Tools</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1562.006<a name=\"MITRE-ATTCK-Techniques-T1562.46006\"> </a></td><td>Indicator Blocking</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1562.012<a name=\"MITRE-ATTCK-Techniques-T1562.46012\"> </a></td><td>Disable or Modify Linux Audit System</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1562.011<a name=\"MITRE-ATTCK-Techniques-T1562.46011\"> </a></td><td>Spoof Security Alerting</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1562.008<a name=\"MITRE-ATTCK-Techniques-T1562.46008\"> </a></td><td>Disable or Modify Cloud Logs</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1562.010<a name=\"MITRE-ATTCK-Techniques-T1562.46010\"> </a></td><td>Downgrade Attack</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1562.007<a name=\"MITRE-ATTCK-Techniques-T1562.46007\"> </a></td><td>Disable or Modify Cloud Firewall</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1562.009<a name=\"MITRE-ATTCK-Techniques-T1562.46009\"> </a></td><td>Safe Mode Boot</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1195<a name=\"MITRE-ATTCK-Techniques-T1195\"> </a></td><td>Supply Chain Compromise</td><td>TA0001</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1195.001<a name=\"MITRE-ATTCK-Techniques-T1195.46001\"> </a></td><td>Compromise Software Dependencies and Development Tools</td><td>TA0001</td><td>T1195</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1195.002<a name=\"MITRE-ATTCK-Techniques-T1195.46002\"> </a></td><td>Compromise Software Supply Chain</td><td>TA0001</td><td>T1195</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1195.003<a name=\"MITRE-ATTCK-Techniques-T1195.46003\"> </a></td><td>Compromise Hardware Supply Chain</td><td>TA0001</td><td>T1195</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1190<a name=\"MITRE-ATTCK-Techniques-T1190\"> </a></td><td>Exploit Public-Facing Application</td><td>TA0001</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1558<a name=\"MITRE-ATTCK-Techniques-T1558\"> </a></td><td>Steal or Forge Kerberos Tickets</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1558.003<a name=\"MITRE-ATTCK-Techniques-T1558.46003\"> </a></td><td>Kerberoasting</td><td>TA0006</td><td>T1558</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1558.002<a name=\"MITRE-ATTCK-Techniques-T1558.46002\"> </a></td><td>Silver Ticket</td><td>TA0006</td><td>T1558</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1558.005<a name=\"MITRE-ATTCK-Techniques-T1558.46005\"> </a></td><td>Ccache Files</td><td>TA0006</td><td>T1558</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1558.004<a name=\"MITRE-ATTCK-Techniques-T1558.46004\"> </a></td><td>AS-REP Roasting</td><td>TA0006</td><td>T1558</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1558.001<a name=\"MITRE-ATTCK-Techniques-T1558.46001\"> </a></td><td>Golden Ticket</td><td>TA0006</td><td>T1558</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1555<a name=\"MITRE-ATTCK-Techniques-T1555\"> </a></td><td>Credentials from Password Stores</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1555.004<a name=\"MITRE-ATTCK-Techniques-T1555.46004\"> </a></td><td>Windows Credential Manager</td><td>TA0006</td><td>T1555</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1555.001<a name=\"MITRE-ATTCK-Techniques-T1555.46001\"> </a></td><td>Keychain</td><td>TA0006</td><td>T1555</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1555.005<a name=\"MITRE-ATTCK-Techniques-T1555.46005\"> </a></td><td>Password Managers</td><td>TA0006</td><td>T1555</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1555.006<a name=\"MITRE-ATTCK-Techniques-T1555.46006\"> </a></td><td>Cloud Secrets Management Stores</td><td>TA0006</td><td>T1555</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1555.003<a name=\"MITRE-ATTCK-Techniques-T1555.46003\"> </a></td><td>Credentials from Web Browsers</td><td>TA0006</td><td>T1555</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1555.002<a name=\"MITRE-ATTCK-Techniques-T1555.46002\"> </a></td><td>Securityd Memory</td><td>TA0006</td><td>T1555</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1567<a name=\"MITRE-ATTCK-Techniques-T1567\"> </a></td><td>Exfiltration Over Web Service</td><td>TA0010</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1567.001<a name=\"MITRE-ATTCK-Techniques-T1567.46001\"> </a></td><td>Exfiltration to Code Repository</td><td>TA0010</td><td>T1567</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1567.003<a name=\"MITRE-ATTCK-Techniques-T1567.46003\"> </a></td><td>Exfiltration to Text Storage Sites</td><td>TA0010</td><td>T1567</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1567.002<a name=\"MITRE-ATTCK-Techniques-T1567.46002\"> </a></td><td>Exfiltration to Cloud Storage</td><td>TA0010</td><td>T1567</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1567.004<a name=\"MITRE-ATTCK-Techniques-T1567.46004\"> </a></td><td>Exfiltration Over Webhook</td><td>TA0010</td><td>T1567</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1219<a name=\"MITRE-ATTCK-Techniques-T1219\"> </a></td><td>Remote Access Tools</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1219.003<a name=\"MITRE-ATTCK-Techniques-T1219.46003\"> </a></td><td>Remote Access Hardware</td><td>TA0011</td><td>T1219</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1219.001<a name=\"MITRE-ATTCK-Techniques-T1219.46001\"> </a></td><td>IDE Tunneling</td><td>TA0011</td><td>T1219</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1219.002<a name=\"MITRE-ATTCK-Techniques-T1219.46002\"> </a></td><td>Remote Desktop Software</td><td>TA0011</td><td>T1219</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1036<a name=\"MITRE-ATTCK-Techniques-T1036\"> </a></td><td>Masquerading</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1036.008<a name=\"MITRE-ATTCK-Techniques-T1036.46008\"> </a></td><td>Masquerade File Type</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1036.003<a name=\"MITRE-ATTCK-Techniques-T1036.46003\"> </a></td><td>Rename Legitimate Utilities</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1036.006<a name=\"MITRE-ATTCK-Techniques-T1036.46006\"> </a></td><td>Space after Filename</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1036.004<a name=\"MITRE-ATTCK-Techniques-T1036.46004\"> </a></td><td>Masquerade Task or Service</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1036.002<a name=\"MITRE-ATTCK-Techniques-T1036.46002\"> </a></td><td>Right-to-Left Override</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1036.005<a name=\"MITRE-ATTCK-Techniques-T1036.46005\"> </a></td><td>Match Legitimate Resource Name or Location</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1036.011<a name=\"MITRE-ATTCK-Techniques-T1036.46011\"> </a></td><td>Overwrite Process Arguments</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1036.007<a name=\"MITRE-ATTCK-Techniques-T1036.46007\"> </a></td><td>Double File Extension</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1036.010<a name=\"MITRE-ATTCK-Techniques-T1036.46010\"> </a></td><td>Masquerade Account Name</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1036.001<a name=\"MITRE-ATTCK-Techniques-T1036.46001\"> </a></td><td>Invalid Code Signature</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1036.012<a name=\"MITRE-ATTCK-Techniques-T1036.46012\"> </a></td><td>Browser Fingerprint</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1036.009<a name=\"MITRE-ATTCK-Techniques-T1036.46009\"> </a></td><td>Break Process Trees</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1552<a name=\"MITRE-ATTCK-Techniques-T1552\"> </a></td><td>Unsecured Credentials</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1552.006<a name=\"MITRE-ATTCK-Techniques-T1552.46006\"> </a></td><td>Group Policy Preferences</td><td>TA0006</td><td>T1552</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1552.004<a name=\"MITRE-ATTCK-Techniques-T1552.46004\"> </a></td><td>Private Keys</td><td>TA0006</td><td>T1552</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1552.007<a name=\"MITRE-ATTCK-Techniques-T1552.46007\"> </a></td><td>Container API</td><td>TA0006</td><td>T1552</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1552.001<a name=\"MITRE-ATTCK-Techniques-T1552.46001\"> </a></td><td>Credentials In Files</td><td>TA0006</td><td>T1552</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1552.002<a name=\"MITRE-ATTCK-Techniques-T1552.46002\"> </a></td><td>Credentials in Registry</td><td>TA0006</td><td>T1552</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1552.003<a name=\"MITRE-ATTCK-Techniques-T1552.46003\"> </a></td><td>Shell History</td><td>TA0006</td><td>T1552</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1552.008<a name=\"MITRE-ATTCK-Techniques-T1552.46008\"> </a></td><td>Chat Messages</td><td>TA0006</td><td>T1552</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1552.005<a name=\"MITRE-ATTCK-Techniques-T1552.46005\"> </a></td><td>Cloud Instance Metadata API</td><td>TA0006</td><td>T1552</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1659<a name=\"MITRE-ATTCK-Techniques-T1659\"> </a></td><td>Content Injection</td><td>TA0001, TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1055<a name=\"MITRE-ATTCK-Techniques-T1055\"> </a></td><td>Process Injection</td><td>TA0005, TA0004</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1055.013<a name=\"MITRE-ATTCK-Techniques-T1055.46013\"> </a></td><td>Process Doppelgänging</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1055.012<a name=\"MITRE-ATTCK-Techniques-T1055.46012\"> </a></td><td>Process Hollowing</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1055.009<a name=\"MITRE-ATTCK-Techniques-T1055.46009\"> </a></td><td>Proc Memory</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1055.015<a name=\"MITRE-ATTCK-Techniques-T1055.46015\"> </a></td><td>ListPlanting</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1055.014<a name=\"MITRE-ATTCK-Techniques-T1055.46014\"> </a></td><td>VDSO Hijacking</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1055.005<a name=\"MITRE-ATTCK-Techniques-T1055.46005\"> </a></td><td>Thread Local Storage</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1055.011<a name=\"MITRE-ATTCK-Techniques-T1055.46011\"> </a></td><td>Extra Window Memory Injection</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1055.001<a name=\"MITRE-ATTCK-Techniques-T1055.46001\"> </a></td><td>Dynamic-link Library Injection</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1055.003<a name=\"MITRE-ATTCK-Techniques-T1055.46003\"> </a></td><td>Thread Execution Hijacking</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1055.008<a name=\"MITRE-ATTCK-Techniques-T1055.46008\"> </a></td><td>Ptrace System Calls</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1055.004<a name=\"MITRE-ATTCK-Techniques-T1055.46004\"> </a></td><td>Asynchronous Procedure Call</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1055.002<a name=\"MITRE-ATTCK-Techniques-T1055.46002\"> </a></td><td>Portable Executable Injection</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1205<a name=\"MITRE-ATTCK-Techniques-T1205\"> </a></td><td>Traffic Signaling</td><td>TA0005, TA0003, TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1205.001<a name=\"MITRE-ATTCK-Techniques-T1205.46001\"> </a></td><td>Port Knocking</td><td>TA0005, TA0003, TA0011</td><td>T1205</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1205.002<a name=\"MITRE-ATTCK-Techniques-T1205.46002\"> </a></td><td>Socket Filters</td><td>TA0005, TA0003, TA0011</td><td>T1205</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218<a name=\"MITRE-ATTCK-Techniques-T1218\"> </a></td><td>System Binary Proxy Execution</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1218.005<a name=\"MITRE-ATTCK-Techniques-T1218.46005\"> </a></td><td>Mshta</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.014<a name=\"MITRE-ATTCK-Techniques-T1218.46014\"> </a></td><td>MMC</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.008<a name=\"MITRE-ATTCK-Techniques-T1218.46008\"> </a></td><td>Odbcconf</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.015<a name=\"MITRE-ATTCK-Techniques-T1218.46015\"> </a></td><td>Electron Applications</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.012<a name=\"MITRE-ATTCK-Techniques-T1218.46012\"> </a></td><td>Verclsid</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.013<a name=\"MITRE-ATTCK-Techniques-T1218.46013\"> </a></td><td>Mavinject</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.002<a name=\"MITRE-ATTCK-Techniques-T1218.46002\"> </a></td><td>Control Panel</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.001<a name=\"MITRE-ATTCK-Techniques-T1218.46001\"> </a></td><td>Compiled HTML File</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.010<a name=\"MITRE-ATTCK-Techniques-T1218.46010\"> </a></td><td>Regsvr32</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.004<a name=\"MITRE-ATTCK-Techniques-T1218.46004\"> </a></td><td>InstallUtil</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.011<a name=\"MITRE-ATTCK-Techniques-T1218.46011\"> </a></td><td>Rundll32</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.009<a name=\"MITRE-ATTCK-Techniques-T1218.46009\"> </a></td><td>Regsvcs/Regasm</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.003<a name=\"MITRE-ATTCK-Techniques-T1218.46003\"> </a></td><td>CMSTP</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1218.007<a name=\"MITRE-ATTCK-Techniques-T1218.46007\"> </a></td><td>Msiexec</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1620<a name=\"MITRE-ATTCK-Techniques-T1620\"> </a></td><td>Reflective Code Loading</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1611<a name=\"MITRE-ATTCK-Techniques-T1611\"> </a></td><td>Escape to Host</td><td>TA0004</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1010<a name=\"MITRE-ATTCK-Techniques-T1010\"> </a></td><td>Application Window Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1029<a name=\"MITRE-ATTCK-Techniques-T1029\"> </a></td><td>Scheduled Transfer</td><td>TA0010</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1525<a name=\"MITRE-ATTCK-Techniques-T1525\"> </a></td><td>Implant Internal Image</td><td>TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1572<a name=\"MITRE-ATTCK-Techniques-T1572\"> </a></td><td>Protocol Tunneling</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1550<a name=\"MITRE-ATTCK-Techniques-T1550\"> </a></td><td>Use Alternate Authentication Material</td><td>TA0005, TA0008</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1550.004<a name=\"MITRE-ATTCK-Techniques-T1550.46004\"> </a></td><td>Web Session Cookie</td><td>TA0005, TA0008</td><td>T1550</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1550.001<a name=\"MITRE-ATTCK-Techniques-T1550.46001\"> </a></td><td>Application Access Token</td><td>TA0005, TA0008</td><td>T1550</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1550.003<a name=\"MITRE-ATTCK-Techniques-T1550.46003\"> </a></td><td>Pass the Ticket</td><td>TA0005, TA0008</td><td>T1550</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1550.002<a name=\"MITRE-ATTCK-Techniques-T1550.46002\"> </a></td><td>Pass the Hash</td><td>TA0005, TA0008</td><td>T1550</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1011<a name=\"MITRE-ATTCK-Techniques-T1011\"> </a></td><td>Exfiltration Over Other Network Medium</td><td>TA0010</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1011.001<a name=\"MITRE-ATTCK-Techniques-T1011.46001\"> </a></td><td>Exfiltration Over Bluetooth</td><td>TA0010</td><td>T1011</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1589<a name=\"MITRE-ATTCK-Techniques-T1589\"> </a></td><td>Gather Victim Identity Information</td><td>TA0043</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1589.003<a name=\"MITRE-ATTCK-Techniques-T1589.46003\"> </a></td><td>Employee Names</td><td>TA0043</td><td>T1589</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1589.002<a name=\"MITRE-ATTCK-Techniques-T1589.46002\"> </a></td><td>Email Addresses</td><td>TA0043</td><td>T1589</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1589.001<a name=\"MITRE-ATTCK-Techniques-T1589.46001\"> </a></td><td>Credentials</td><td>TA0043</td><td>T1589</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1560<a name=\"MITRE-ATTCK-Techniques-T1560\"> </a></td><td>Archive Collected Data</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1560.002<a name=\"MITRE-ATTCK-Techniques-T1560.46002\"> </a></td><td>Archive via Library</td><td>TA0009</td><td>T1560</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1560.001<a name=\"MITRE-ATTCK-Techniques-T1560.46001\"> </a></td><td>Archive via Utility</td><td>TA0009</td><td>T1560</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1560.003<a name=\"MITRE-ATTCK-Techniques-T1560.46003\"> </a></td><td>Archive via Custom Method</td><td>TA0009</td><td>T1560</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1185<a name=\"MITRE-ATTCK-Techniques-T1185\"> </a></td><td>Browser Session Hijacking</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1021<a name=\"MITRE-ATTCK-Techniques-T1021\"> </a></td><td>Remote Services</td><td>TA0008</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1021.006<a name=\"MITRE-ATTCK-Techniques-T1021.46006\"> </a></td><td>Windows Remote Management</td><td>TA0008</td><td>T1021</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1021.005<a name=\"MITRE-ATTCK-Techniques-T1021.46005\"> </a></td><td>VNC</td><td>TA0008</td><td>T1021</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1021.002<a name=\"MITRE-ATTCK-Techniques-T1021.46002\"> </a></td><td>SMB/Windows Admin Shares</td><td>TA0008</td><td>T1021</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1021.007<a name=\"MITRE-ATTCK-Techniques-T1021.46007\"> </a></td><td>Cloud Services</td><td>TA0008</td><td>T1021</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1021.001<a name=\"MITRE-ATTCK-Techniques-T1021.46001\"> </a></td><td>Remote Desktop Protocol</td><td>TA0008</td><td>T1021</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1021.003<a name=\"MITRE-ATTCK-Techniques-T1021.46003\"> </a></td><td>Distributed Component Object Model</td><td>TA0008</td><td>T1021</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1021.008<a name=\"MITRE-ATTCK-Techniques-T1021.46008\"> </a></td><td>Direct Cloud VM Connections</td><td>TA0008</td><td>T1021</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1021.004<a name=\"MITRE-ATTCK-Techniques-T1021.46004\"> </a></td><td>SSH</td><td>TA0008</td><td>T1021</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1596<a name=\"MITRE-ATTCK-Techniques-T1596\"> </a></td><td>Search Open Technical Databases</td><td>TA0043</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1596.003<a name=\"MITRE-ATTCK-Techniques-T1596.46003\"> </a></td><td>Digital Certificates</td><td>TA0043</td><td>T1596</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1596.005<a name=\"MITRE-ATTCK-Techniques-T1596.46005\"> </a></td><td>Scan Databases</td><td>TA0043</td><td>T1596</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1596.001<a name=\"MITRE-ATTCK-Techniques-T1596.46001\"> </a></td><td>DNS/Passive DNS</td><td>TA0043</td><td>T1596</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1596.004<a name=\"MITRE-ATTCK-Techniques-T1596.46004\"> </a></td><td>CDNs</td><td>TA0043</td><td>T1596</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1596.002<a name=\"MITRE-ATTCK-Techniques-T1596.46002\"> </a></td><td>WHOIS</td><td>TA0043</td><td>T1596</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1207<a name=\"MITRE-ATTCK-Techniques-T1207\"> </a></td><td>Rogue Domain Controller</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1610<a name=\"MITRE-ATTCK-Techniques-T1610\"> </a></td><td>Deploy Container</td><td>TA0005, TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1112<a name=\"MITRE-ATTCK-Techniques-T1112\"> </a></td><td>Modify Registry</td><td>TA0005, TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1580<a name=\"MITRE-ATTCK-Techniques-T1580\"> </a></td><td>Cloud Infrastructure Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1491<a name=\"MITRE-ATTCK-Techniques-T1491\"> </a></td><td>Defacement</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1491.002<a name=\"MITRE-ATTCK-Techniques-T1491.46002\"> </a></td><td>External Defacement</td><td>TA0040</td><td>T1491</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1491.001<a name=\"MITRE-ATTCK-Techniques-T1491.46001\"> </a></td><td>Internal Defacement</td><td>TA0040</td><td>T1491</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1535<a name=\"MITRE-ATTCK-Techniques-T1535\"> </a></td><td>Unused/Unsupported Cloud Regions</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1563<a name=\"MITRE-ATTCK-Techniques-T1563\"> </a></td><td>Remote Service Session Hijacking</td><td>TA0008</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1563.002<a name=\"MITRE-ATTCK-Techniques-T1563.46002\"> </a></td><td>RDP Hijacking</td><td>TA0008</td><td>T1563</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1563.001<a name=\"MITRE-ATTCK-Techniques-T1563.46001\"> </a></td><td>SSH Hijacking</td><td>TA0008</td><td>T1563</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1217<a name=\"MITRE-ATTCK-Techniques-T1217\"> </a></td><td>Browser Information Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1681<a name=\"MITRE-ATTCK-Techniques-T1681\"> </a></td><td>Search Threat Vendor Data</td><td>TA0043</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1674<a name=\"MITRE-ATTCK-Techniques-T1674\"> </a></td><td>Input Injection</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1092<a name=\"MITRE-ATTCK-Techniques-T1092\"> </a></td><td>Communication Through Removable Media</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1222<a name=\"MITRE-ATTCK-Techniques-T1222\"> </a></td><td>File and Directory Permissions Modification</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1222.002<a name=\"MITRE-ATTCK-Techniques-T1222.46002\"> </a></td><td>Linux and Mac File and Directory Permissions Modification</td><td>TA0005</td><td>T1222</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1222.001<a name=\"MITRE-ATTCK-Techniques-T1222.46001\"> </a></td><td>Windows File and Directory Permissions Modification</td><td>TA0005</td><td>T1222</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1595<a name=\"MITRE-ATTCK-Techniques-T1595\"> </a></td><td>Active Scanning</td><td>TA0043</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1595.003<a name=\"MITRE-ATTCK-Techniques-T1595.46003\"> </a></td><td>Wordlist Scanning</td><td>TA0043</td><td>T1595</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1595.001<a name=\"MITRE-ATTCK-Techniques-T1595.46001\"> </a></td><td>Scanning IP Blocks</td><td>TA0043</td><td>T1595</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1595.002<a name=\"MITRE-ATTCK-Techniques-T1595.46002\"> </a></td><td>Vulnerability Scanning</td><td>TA0043</td><td>T1595</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1548<a name=\"MITRE-ATTCK-Techniques-T1548\"> </a></td><td>Abuse Elevation Control Mechanism</td><td>TA0004, TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1548.001<a name=\"MITRE-ATTCK-Techniques-T1548.46001\"> </a></td><td>Setuid and Setgid</td><td>TA0004, TA0005</td><td>T1548</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1548.005<a name=\"MITRE-ATTCK-Techniques-T1548.46005\"> </a></td><td>Temporary Elevated Cloud Access</td><td>TA0004, TA0005</td><td>T1548</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1548.002<a name=\"MITRE-ATTCK-Techniques-T1548.46002\"> </a></td><td>Bypass User Account Control</td><td>TA0004, TA0005</td><td>T1548</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1548.004<a name=\"MITRE-ATTCK-Techniques-T1548.46004\"> </a></td><td>Elevated Execution with Prompt</td><td>TA0004, TA0005</td><td>T1548</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1548.003<a name=\"MITRE-ATTCK-Techniques-T1548.46003\"> </a></td><td>Sudo and Sudo Caching</td><td>TA0004, TA0005</td><td>T1548</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1548.006<a name=\"MITRE-ATTCK-Techniques-T1548.46006\"> </a></td><td>TCC Manipulation</td><td>TA0004, TA0005</td><td>T1548</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1673<a name=\"MITRE-ATTCK-Techniques-T1673\"> </a></td><td>Virtual Machine Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1125<a name=\"MITRE-ATTCK-Techniques-T1125\"> </a></td><td>Video Capture</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1016<a name=\"MITRE-ATTCK-Techniques-T1016\"> </a></td><td>System Network Configuration Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1016.002<a name=\"MITRE-ATTCK-Techniques-T1016.46002\"> </a></td><td>Wi-Fi Discovery</td><td>TA0007</td><td>T1016</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1016.001<a name=\"MITRE-ATTCK-Techniques-T1016.46001\"> </a></td><td>Internet Connection Discovery</td><td>TA0007</td><td>T1016</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1087<a name=\"MITRE-ATTCK-Techniques-T1087\"> </a></td><td>Account Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1087.003<a name=\"MITRE-ATTCK-Techniques-T1087.46003\"> </a></td><td>Email Account</td><td>TA0007</td><td>T1087</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1087.004<a name=\"MITRE-ATTCK-Techniques-T1087.46004\"> </a></td><td>Cloud Account</td><td>TA0007</td><td>T1087</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1087.002<a name=\"MITRE-ATTCK-Techniques-T1087.46002\"> </a></td><td>Domain Account</td><td>TA0007</td><td>T1087</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1087.001<a name=\"MITRE-ATTCK-Techniques-T1087.46001\"> </a></td><td>Local Account</td><td>TA0007</td><td>T1087</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1090<a name=\"MITRE-ATTCK-Techniques-T1090\"> </a></td><td>Proxy</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1090.001<a name=\"MITRE-ATTCK-Techniques-T1090.46001\"> </a></td><td>Internal Proxy</td><td>TA0011</td><td>T1090</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1090.003<a name=\"MITRE-ATTCK-Techniques-T1090.46003\"> </a></td><td>Multi-hop Proxy</td><td>TA0011</td><td>T1090</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1090.004<a name=\"MITRE-ATTCK-Techniques-T1090.46004\"> </a></td><td>Domain Fronting</td><td>TA0011</td><td>T1090</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1090.002<a name=\"MITRE-ATTCK-Techniques-T1090.46002\"> </a></td><td>External Proxy</td><td>TA0011</td><td>T1090</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059<a name=\"MITRE-ATTCK-Techniques-T1059\"> </a></td><td>Command and Scripting Interpreter</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1059.005<a name=\"MITRE-ATTCK-Techniques-T1059.46005\"> </a></td><td>Visual Basic</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059.002<a name=\"MITRE-ATTCK-Techniques-T1059.46002\"> </a></td><td>AppleScript</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059.003<a name=\"MITRE-ATTCK-Techniques-T1059.46003\"> </a></td><td>Windows Command Shell</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059.013<a name=\"MITRE-ATTCK-Techniques-T1059.46013\"> </a></td><td>Container CLI/API</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059.004<a name=\"MITRE-ATTCK-Techniques-T1059.46004\"> </a></td><td>Unix Shell</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059.010<a name=\"MITRE-ATTCK-Techniques-T1059.46010\"> </a></td><td>AutoHotKey & AutoIT</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059.008<a name=\"MITRE-ATTCK-Techniques-T1059.46008\"> </a></td><td>Network Device CLI</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059.012<a name=\"MITRE-ATTCK-Techniques-T1059.46012\"> </a></td><td>Hypervisor CLI</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059.006<a name=\"MITRE-ATTCK-Techniques-T1059.46006\"> </a></td><td>Python</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059.001<a name=\"MITRE-ATTCK-Techniques-T1059.46001\"> </a></td><td>PowerShell</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059.009<a name=\"MITRE-ATTCK-Techniques-T1059.46009\"> </a></td><td>Cloud API</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059.011<a name=\"MITRE-ATTCK-Techniques-T1059.46011\"> </a></td><td>Lua</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1059.007<a name=\"MITRE-ATTCK-Techniques-T1059.46007\"> </a></td><td>JavaScript</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1677<a name=\"MITRE-ATTCK-Techniques-T1677\"> </a></td><td>Poisoned Pipeline Execution</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1482<a name=\"MITRE-ATTCK-Techniques-T1482\"> </a></td><td>Domain Trust Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1020<a name=\"MITRE-ATTCK-Techniques-T1020\"> </a></td><td>Automated Exfiltration</td><td>TA0010</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1020.001<a name=\"MITRE-ATTCK-Techniques-T1020.46001\"> </a></td><td>Traffic Duplication</td><td>TA0010</td><td>T1020</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1070<a name=\"MITRE-ATTCK-Techniques-T1070\"> </a></td><td>Indicator Removal</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1070.004<a name=\"MITRE-ATTCK-Techniques-T1070.46004\"> </a></td><td>File Deletion</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1070.006<a name=\"MITRE-ATTCK-Techniques-T1070.46006\"> </a></td><td>Timestomp</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1070.008<a name=\"MITRE-ATTCK-Techniques-T1070.46008\"> </a></td><td>Clear Mailbox Data</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1070.002<a name=\"MITRE-ATTCK-Techniques-T1070.46002\"> </a></td><td>Clear Linux or Mac System Logs</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1070.001<a name=\"MITRE-ATTCK-Techniques-T1070.46001\"> </a></td><td>Clear Windows Event Logs</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1070.009<a name=\"MITRE-ATTCK-Techniques-T1070.46009\"> </a></td><td>Clear Persistence</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1070.003<a name=\"MITRE-ATTCK-Techniques-T1070.46003\"> </a></td><td>Clear Command History</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1070.010<a name=\"MITRE-ATTCK-Techniques-T1070.46010\"> </a></td><td>Relocate Malware</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1070.007<a name=\"MITRE-ATTCK-Techniques-T1070.46007\"> </a></td><td>Clear Network Connection History and Configurations</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1070.005<a name=\"MITRE-ATTCK-Techniques-T1070.46005\"> </a></td><td>Network Share Connection Removal</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1609<a name=\"MITRE-ATTCK-Techniques-T1609\"> </a></td><td>Container Administration Command</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1083<a name=\"MITRE-ATTCK-Techniques-T1083\"> </a></td><td>File and Directory Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1568<a name=\"MITRE-ATTCK-Techniques-T1568\"> </a></td><td>Dynamic Resolution</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1568.001<a name=\"MITRE-ATTCK-Techniques-T1568.46001\"> </a></td><td>Fast Flux DNS</td><td>TA0011</td><td>T1568</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1568.002<a name=\"MITRE-ATTCK-Techniques-T1568.46002\"> </a></td><td>Domain Generation Algorithms</td><td>TA0011</td><td>T1568</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1568.003<a name=\"MITRE-ATTCK-Techniques-T1568.46003\"> </a></td><td>DNS Calculation</td><td>TA0011</td><td>T1568</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1647<a name=\"MITRE-ATTCK-Techniques-T1647\"> </a></td><td>Plist File Modification</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1074<a name=\"MITRE-ATTCK-Techniques-T1074\"> </a></td><td>Data Staged</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1074.001<a name=\"MITRE-ATTCK-Techniques-T1074.46001\"> </a></td><td>Local Data Staging</td><td>TA0009</td><td>T1074</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1074.002<a name=\"MITRE-ATTCK-Techniques-T1074.46002\"> </a></td><td>Remote Data Staging</td><td>TA0009</td><td>T1074</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1649<a name=\"MITRE-ATTCK-Techniques-T1649\"> </a></td><td>Steal or Forge Authentication Certificates</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1049<a name=\"MITRE-ATTCK-Techniques-T1049\"> </a></td><td>System Network Connections Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1584<a name=\"MITRE-ATTCK-Techniques-T1584\"> </a></td><td>Compromise Infrastructure</td><td>TA0042</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1584.003<a name=\"MITRE-ATTCK-Techniques-T1584.46003\"> </a></td><td>Virtual Private Server</td><td>TA0042</td><td>T1584</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1584.002<a name=\"MITRE-ATTCK-Techniques-T1584.46002\"> </a></td><td>DNS Server</td><td>TA0042</td><td>T1584</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1584.006<a name=\"MITRE-ATTCK-Techniques-T1584.46006\"> </a></td><td>Web Services</td><td>TA0042</td><td>T1584</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1584.007<a name=\"MITRE-ATTCK-Techniques-T1584.46007\"> </a></td><td>Serverless</td><td>TA0042</td><td>T1584</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1584.005<a name=\"MITRE-ATTCK-Techniques-T1584.46005\"> </a></td><td>Botnet</td><td>TA0042</td><td>T1584</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1584.004<a name=\"MITRE-ATTCK-Techniques-T1584.46004\"> </a></td><td>Server</td><td>TA0042</td><td>T1584</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1584.008<a name=\"MITRE-ATTCK-Techniques-T1584.46008\"> </a></td><td>Network Devices</td><td>TA0042</td><td>T1584</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1584.001<a name=\"MITRE-ATTCK-Techniques-T1584.46001\"> </a></td><td>Domains</td><td>TA0042</td><td>T1584</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1542<a name=\"MITRE-ATTCK-Techniques-T1542\"> </a></td><td>Pre-OS Boot</td><td>TA0005, TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1542.003<a name=\"MITRE-ATTCK-Techniques-T1542.46003\"> </a></td><td>Bootkit</td><td>TA0005, TA0003</td><td>T1542</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1542.005<a name=\"MITRE-ATTCK-Techniques-T1542.46005\"> </a></td><td>TFTP Boot</td><td>TA0005, TA0003</td><td>T1542</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1542.002<a name=\"MITRE-ATTCK-Techniques-T1542.46002\"> </a></td><td>Component Firmware</td><td>TA0005, TA0003</td><td>T1542</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1542.004<a name=\"MITRE-ATTCK-Techniques-T1542.46004\"> </a></td><td>ROMMONkit</td><td>TA0005, TA0003</td><td>T1542</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1542.001<a name=\"MITRE-ATTCK-Techniques-T1542.46001\"> </a></td><td>System Firmware</td><td>TA0005, TA0003</td><td>T1542</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1612<a name=\"MITRE-ATTCK-Techniques-T1612\"> </a></td><td>Build Image on Host</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1586<a name=\"MITRE-ATTCK-Techniques-T1586\"> </a></td><td>Compromise Accounts</td><td>TA0042</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1586.003<a name=\"MITRE-ATTCK-Techniques-T1586.46003\"> </a></td><td>Cloud Accounts</td><td>TA0042</td><td>T1586</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1586.002<a name=\"MITRE-ATTCK-Techniques-T1586.46002\"> </a></td><td>Email Accounts</td><td>TA0042</td><td>T1586</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1586.001<a name=\"MITRE-ATTCK-Techniques-T1586.46001\"> </a></td><td>Social Media Accounts</td><td>TA0042</td><td>T1586</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1497<a name=\"MITRE-ATTCK-Techniques-T1497\"> </a></td><td>Virtualization/Sandbox Evasion</td><td>TA0005, TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1497.002<a name=\"MITRE-ATTCK-Techniques-T1497.46002\"> </a></td><td>User Activity Based Checks</td><td>TA0005, TA0007</td><td>T1497</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1497.001<a name=\"MITRE-ATTCK-Techniques-T1497.46001\"> </a></td><td>System Checks</td><td>TA0005, TA0007</td><td>T1497</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1497.003<a name=\"MITRE-ATTCK-Techniques-T1497.46003\"> </a></td><td>Time Based Checks</td><td>TA0005, TA0007</td><td>T1497</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1102<a name=\"MITRE-ATTCK-Techniques-T1102\"> </a></td><td>Web Service</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1102.003<a name=\"MITRE-ATTCK-Techniques-T1102.46003\"> </a></td><td>One-Way Communication</td><td>TA0011</td><td>T1102</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1102.001<a name=\"MITRE-ATTCK-Techniques-T1102.46001\"> </a></td><td>Dead Drop Resolver</td><td>TA0011</td><td>T1102</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1102.002<a name=\"MITRE-ATTCK-Techniques-T1102.46002\"> </a></td><td>Bidirectional Communication</td><td>TA0011</td><td>T1102</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1608<a name=\"MITRE-ATTCK-Techniques-T1608\"> </a></td><td>Stage Capabilities</td><td>TA0042</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1608.004<a name=\"MITRE-ATTCK-Techniques-T1608.46004\"> </a></td><td>Drive-by Target</td><td>TA0042</td><td>T1608</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1608.005<a name=\"MITRE-ATTCK-Techniques-T1608.46005\"> </a></td><td>Link Target</td><td>TA0042</td><td>T1608</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1608.006<a name=\"MITRE-ATTCK-Techniques-T1608.46006\"> </a></td><td>SEO Poisoning</td><td>TA0042</td><td>T1608</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1608.003<a name=\"MITRE-ATTCK-Techniques-T1608.46003\"> </a></td><td>Install Digital Certificate</td><td>TA0042</td><td>T1608</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1608.002<a name=\"MITRE-ATTCK-Techniques-T1608.46002\"> </a></td><td>Upload Tool</td><td>TA0042</td><td>T1608</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1608.001<a name=\"MITRE-ATTCK-Techniques-T1608.46001\"> </a></td><td>Upload Malware</td><td>TA0042</td><td>T1608</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1104<a name=\"MITRE-ATTCK-Techniques-T1104\"> </a></td><td>Multi-Stage Channels</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1657<a name=\"MITRE-ATTCK-Techniques-T1657\"> </a></td><td>Financial Theft</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1480<a name=\"MITRE-ATTCK-Techniques-T1480\"> </a></td><td>Execution Guardrails</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1480.001<a name=\"MITRE-ATTCK-Techniques-T1480.46001\"> </a></td><td>Environmental Keying</td><td>TA0005</td><td>T1480</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1480.002<a name=\"MITRE-ATTCK-Techniques-T1480.46002\"> </a></td><td>Mutual Exclusion</td><td>TA0005</td><td>T1480</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1619<a name=\"MITRE-ATTCK-Techniques-T1619\"> </a></td><td>Cloud Storage Object Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1654<a name=\"MITRE-ATTCK-Techniques-T1654\"> </a></td><td>Log Enumeration</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1528<a name=\"MITRE-ATTCK-Techniques-T1528\"> </a></td><td>Steal Application Access Token</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1204<a name=\"MITRE-ATTCK-Techniques-T1204\"> </a></td><td>User Execution</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1204.005<a name=\"MITRE-ATTCK-Techniques-T1204.46005\"> </a></td><td>Malicious Library</td><td>TA0002</td><td>T1204</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1204.002<a name=\"MITRE-ATTCK-Techniques-T1204.46002\"> </a></td><td>Malicious File</td><td>TA0002</td><td>T1204</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1204.003<a name=\"MITRE-ATTCK-Techniques-T1204.46003\"> </a></td><td>Malicious Image</td><td>TA0002</td><td>T1204</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1204.001<a name=\"MITRE-ATTCK-Techniques-T1204.46001\"> </a></td><td>Malicious Link</td><td>TA0002</td><td>T1204</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1204.004<a name=\"MITRE-ATTCK-Techniques-T1204.46004\"> </a></td><td>Malicious Copy and Paste</td><td>TA0002</td><td>T1204</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1057<a name=\"MITRE-ATTCK-Techniques-T1057\"> </a></td><td>Process Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1072<a name=\"MITRE-ATTCK-Techniques-T1072\"> </a></td><td>Software Deployment Tools</td><td>TA0002, TA0008</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1041<a name=\"MITRE-ATTCK-Techniques-T1041\"> </a></td><td>Exfiltration Over C2 Channel</td><td>TA0010</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1591<a name=\"MITRE-ATTCK-Techniques-T1591\"> </a></td><td>Gather Victim Org Information</td><td>TA0043</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1591.002<a name=\"MITRE-ATTCK-Techniques-T1591.46002\"> </a></td><td>Business Relationships</td><td>TA0043</td><td>T1591</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1591.001<a name=\"MITRE-ATTCK-Techniques-T1591.46001\"> </a></td><td>Determine Physical Locations</td><td>TA0043</td><td>T1591</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1591.004<a name=\"MITRE-ATTCK-Techniques-T1591.46004\"> </a></td><td>Identify Roles</td><td>TA0043</td><td>T1591</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1591.003<a name=\"MITRE-ATTCK-Techniques-T1591.46003\"> </a></td><td>Identify Business Tempo</td><td>TA0043</td><td>T1591</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1606<a name=\"MITRE-ATTCK-Techniques-T1606\"> </a></td><td>Forge Web Credentials</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1606.001<a name=\"MITRE-ATTCK-Techniques-T1606.46001\"> </a></td><td>Web Cookies</td><td>TA0006</td><td>T1606</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1606.002<a name=\"MITRE-ATTCK-Techniques-T1606.46002\"> </a></td><td>SAML Tokens</td><td>TA0006</td><td>T1606</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1621<a name=\"MITRE-ATTCK-Techniques-T1621\"> </a></td><td>Multi-Factor Authentication Request Generation</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1554<a name=\"MITRE-ATTCK-Techniques-T1554\"> </a></td><td>Compromise Host Software Binary</td><td>TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1679<a name=\"MITRE-ATTCK-Techniques-T1679\"> </a></td><td>Selective Exclusion</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1212<a name=\"MITRE-ATTCK-Techniques-T1212\"> </a></td><td>Exploitation for Credential Access</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1590<a name=\"MITRE-ATTCK-Techniques-T1590\"> </a></td><td>Gather Victim Network Information</td><td>TA0043</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1590.001<a name=\"MITRE-ATTCK-Techniques-T1590.46001\"> </a></td><td>Domain Properties</td><td>TA0043</td><td>T1590</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1590.002<a name=\"MITRE-ATTCK-Techniques-T1590.46002\"> </a></td><td>DNS</td><td>TA0043</td><td>T1590</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1590.005<a name=\"MITRE-ATTCK-Techniques-T1590.46005\"> </a></td><td>IP Addresses</td><td>TA0043</td><td>T1590</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1590.003<a name=\"MITRE-ATTCK-Techniques-T1590.46003\"> </a></td><td>Network Trust Dependencies</td><td>TA0043</td><td>T1590</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1590.004<a name=\"MITRE-ATTCK-Techniques-T1590.46004\"> </a></td><td>Network Topology</td><td>TA0043</td><td>T1590</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1590.006<a name=\"MITRE-ATTCK-Techniques-T1590.46006\"> </a></td><td>Network Security Appliances</td><td>TA0043</td><td>T1590</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1210<a name=\"MITRE-ATTCK-Techniques-T1210\"> </a></td><td>Exploitation of Remote Services</td><td>TA0008</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1534<a name=\"MITRE-ATTCK-Techniques-T1534\"> </a></td><td>Internal Spearphishing</td><td>TA0008</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1199<a name=\"MITRE-ATTCK-Techniques-T1199\"> </a></td><td>Trusted Relationship</td><td>TA0001</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1593<a name=\"MITRE-ATTCK-Techniques-T1593\"> </a></td><td>Search Open Websites/Domains</td><td>TA0043</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1593.002<a name=\"MITRE-ATTCK-Techniques-T1593.46002\"> </a></td><td>Search Engines</td><td>TA0043</td><td>T1593</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1593.003<a name=\"MITRE-ATTCK-Techniques-T1593.46003\"> </a></td><td>Code Repositories</td><td>TA0043</td><td>T1593</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1593.001<a name=\"MITRE-ATTCK-Techniques-T1593.46001\"> </a></td><td>Social Media</td><td>TA0043</td><td>T1593</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1098<a name=\"MITRE-ATTCK-Techniques-T1098\"> </a></td><td>Account Manipulation</td><td>TA0003, TA0004</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1098.001<a name=\"MITRE-ATTCK-Techniques-T1098.46001\"> </a></td><td>Additional Cloud Credentials</td><td>TA0003, TA0004</td><td>T1098</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1098.002<a name=\"MITRE-ATTCK-Techniques-T1098.46002\"> </a></td><td>Additional Email Delegate Permissions</td><td>TA0003, TA0004</td><td>T1098</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1098.003<a name=\"MITRE-ATTCK-Techniques-T1098.46003\"> </a></td><td>Additional Cloud Roles</td><td>TA0003, TA0004</td><td>T1098</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1098.005<a name=\"MITRE-ATTCK-Techniques-T1098.46005\"> </a></td><td>Device Registration</td><td>TA0003, TA0004</td><td>T1098</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1098.006<a name=\"MITRE-ATTCK-Techniques-T1098.46006\"> </a></td><td>Additional Container Cluster Roles</td><td>TA0003, TA0004</td><td>T1098</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1098.004<a name=\"MITRE-ATTCK-Techniques-T1098.46004\"> </a></td><td>SSH Authorized Keys</td><td>TA0003, TA0004</td><td>T1098</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1098.007<a name=\"MITRE-ATTCK-Techniques-T1098.46007\"> </a></td><td>Additional Local or Domain Groups</td><td>TA0003, TA0004</td><td>T1098</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1048<a name=\"MITRE-ATTCK-Techniques-T1048\"> </a></td><td>Exfiltration Over Alternative Protocol</td><td>TA0010</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1048.002<a name=\"MITRE-ATTCK-Techniques-T1048.46002\"> </a></td><td>Exfiltration Over Asymmetric Encrypted Non-C2 Protocol</td><td>TA0010</td><td>T1048</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1048.003<a name=\"MITRE-ATTCK-Techniques-T1048.46003\"> </a></td><td>Exfiltration Over Unencrypted Non-C2 Protocol</td><td>TA0010</td><td>T1048</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1048.001<a name=\"MITRE-ATTCK-Techniques-T1048.46001\"> </a></td><td>Exfiltration Over Symmetric Encrypted Non-C2 Protocol</td><td>TA0010</td><td>T1048</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1678<a name=\"MITRE-ATTCK-Techniques-T1678\"> </a></td><td>Delay Execution</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1597<a name=\"MITRE-ATTCK-Techniques-T1597\"> </a></td><td>Search Closed Sources</td><td>TA0043</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1597.001<a name=\"MITRE-ATTCK-Techniques-T1597.46001\"> </a></td><td>Threat Intel Vendors</td><td>TA0043</td><td>T1597</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1597.002<a name=\"MITRE-ATTCK-Techniques-T1597.46002\"> </a></td><td>Purchase Technical Data</td><td>TA0043</td><td>T1597</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1566<a name=\"MITRE-ATTCK-Techniques-T1566\"> </a></td><td>Phishing</td><td>TA0001</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1566.002<a name=\"MITRE-ATTCK-Techniques-T1566.46002\"> </a></td><td>Spearphishing Link</td><td>TA0001</td><td>T1566</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1566.001<a name=\"MITRE-ATTCK-Techniques-T1566.46001\"> </a></td><td>Spearphishing Attachment</td><td>TA0001</td><td>T1566</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1566.004<a name=\"MITRE-ATTCK-Techniques-T1566.46004\"> </a></td><td>Spearphishing Voice</td><td>TA0001</td><td>T1566</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1566.003<a name=\"MITRE-ATTCK-Techniques-T1566.46003\"> </a></td><td>Spearphishing via Service</td><td>TA0001</td><td>T1566</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1110<a name=\"MITRE-ATTCK-Techniques-T1110\"> </a></td><td>Brute Force</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1110.004<a name=\"MITRE-ATTCK-Techniques-T1110.46004\"> </a></td><td>Credential Stuffing</td><td>TA0006</td><td>T1110</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1110.002<a name=\"MITRE-ATTCK-Techniques-T1110.46002\"> </a></td><td>Password Cracking</td><td>TA0006</td><td>T1110</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1110.001<a name=\"MITRE-ATTCK-Techniques-T1110.46001\"> </a></td><td>Password Guessing</td><td>TA0006</td><td>T1110</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1110.003<a name=\"MITRE-ATTCK-Techniques-T1110.46003\"> </a></td><td>Password Spraying</td><td>TA0006</td><td>T1110</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1565<a name=\"MITRE-ATTCK-Techniques-T1565\"> </a></td><td>Data Manipulation</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1565.002<a name=\"MITRE-ATTCK-Techniques-T1565.46002\"> </a></td><td>Transmitted Data Manipulation</td><td>TA0040</td><td>T1565</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1565.003<a name=\"MITRE-ATTCK-Techniques-T1565.46003\"> </a></td><td>Runtime Data Manipulation</td><td>TA0040</td><td>T1565</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1565.001<a name=\"MITRE-ATTCK-Techniques-T1565.46001\"> </a></td><td>Stored Data Manipulation</td><td>TA0040</td><td>T1565</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1559<a name=\"MITRE-ATTCK-Techniques-T1559\"> </a></td><td>Inter-Process Communication</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1559.003<a name=\"MITRE-ATTCK-Techniques-T1559.46003\"> </a></td><td>XPC Services</td><td>TA0002</td><td>T1559</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1559.002<a name=\"MITRE-ATTCK-Techniques-T1559.46002\"> </a></td><td>Dynamic Data Exchange</td><td>TA0002</td><td>T1559</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1559.001<a name=\"MITRE-ATTCK-Techniques-T1559.46001\"> </a></td><td>Component Object Model</td><td>TA0002</td><td>T1559</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1001<a name=\"MITRE-ATTCK-Techniques-T1001\"> </a></td><td>Data Obfuscation</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1001.001<a name=\"MITRE-ATTCK-Techniques-T1001.46001\"> </a></td><td>Junk Data</td><td>TA0011</td><td>T1001</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1001.003<a name=\"MITRE-ATTCK-Techniques-T1001.46003\"> </a></td><td>Protocol or Service Impersonation</td><td>TA0011</td><td>T1001</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1001.002<a name=\"MITRE-ATTCK-Techniques-T1001.46002\"> </a></td><td>Steganography</td><td>TA0011</td><td>T1001</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1039<a name=\"MITRE-ATTCK-Techniques-T1039\"> </a></td><td>Data from Network Shared Drive</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1601<a name=\"MITRE-ATTCK-Techniques-T1601\"> </a></td><td>Modify System Image</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1601.002<a name=\"MITRE-ATTCK-Techniques-T1601.46002\"> </a></td><td>Downgrade System Image</td><td>TA0005</td><td>T1601</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1601.001<a name=\"MITRE-ATTCK-Techniques-T1601.46001\"> </a></td><td>Patch System Image</td><td>TA0005</td><td>T1601</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1574<a name=\"MITRE-ATTCK-Techniques-T1574\"> </a></td><td>Hijack Execution Flow</td><td>TA0003, TA0004, TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1574.010<a name=\"MITRE-ATTCK-Techniques-T1574.46010\"> </a></td><td>Services File Permissions Weakness</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1574.013<a name=\"MITRE-ATTCK-Techniques-T1574.46013\"> </a></td><td>KernelCallbackTable</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1574.007<a name=\"MITRE-ATTCK-Techniques-T1574.46007\"> </a></td><td>Path Interception by PATH Environment Variable</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1574.005<a name=\"MITRE-ATTCK-Techniques-T1574.46005\"> </a></td><td>Executable Installer File Permissions Weakness</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1574.009<a name=\"MITRE-ATTCK-Techniques-T1574.46009\"> </a></td><td>Path Interception by Unquoted Path</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1574.004<a name=\"MITRE-ATTCK-Techniques-T1574.46004\"> </a></td><td>Dylib Hijacking</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1574.006<a name=\"MITRE-ATTCK-Techniques-T1574.46006\"> </a></td><td>Dynamic Linker Hijacking</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1574.014<a name=\"MITRE-ATTCK-Techniques-T1574.46014\"> </a></td><td>AppDomainManager</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1574.001<a name=\"MITRE-ATTCK-Techniques-T1574.46001\"> </a></td><td>DLL</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1574.008<a name=\"MITRE-ATTCK-Techniques-T1574.46008\"> </a></td><td>Path Interception by Search Order Hijacking</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1574.011<a name=\"MITRE-ATTCK-Techniques-T1574.46011\"> </a></td><td>Services Registry Permissions Weakness</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1574.012<a name=\"MITRE-ATTCK-Techniques-T1574.46012\"> </a></td><td>COR_PROFILER</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1078<a name=\"MITRE-ATTCK-Techniques-T1078\"> </a></td><td>Valid Accounts</td><td>TA0005, TA0003, TA0004, TA0001</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1078.004<a name=\"MITRE-ATTCK-Techniques-T1078.46004\"> </a></td><td>Cloud Accounts</td><td>TA0005, TA0003, TA0004, TA0001</td><td>T1078</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1078.002<a name=\"MITRE-ATTCK-Techniques-T1078.46002\"> </a></td><td>Domain Accounts</td><td>TA0005, TA0003, TA0004, TA0001</td><td>T1078</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1078.003<a name=\"MITRE-ATTCK-Techniques-T1078.46003\"> </a></td><td>Local Accounts</td><td>TA0005, TA0003, TA0004, TA0001</td><td>T1078</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1078.001<a name=\"MITRE-ATTCK-Techniques-T1078.46001\"> </a></td><td>Default Accounts</td><td>TA0005, TA0003, TA0004, TA0001</td><td>T1078</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1571<a name=\"MITRE-ATTCK-Techniques-T1571\"> </a></td><td>Non-Standard Port</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1068<a name=\"MITRE-ATTCK-Techniques-T1068\"> </a></td><td>Exploitation for Privilege Escalation</td><td>TA0004</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1531<a name=\"MITRE-ATTCK-Techniques-T1531\"> </a></td><td>Account Access Removal</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1027<a name=\"MITRE-ATTCK-Techniques-T1027\"> </a></td><td>Obfuscated Files or Information</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1027.005<a name=\"MITRE-ATTCK-Techniques-T1027.46005\"> </a></td><td>Indicator Removal from Tools</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.009<a name=\"MITRE-ATTCK-Techniques-T1027.46009\"> </a></td><td>Embedded Payloads</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.013<a name=\"MITRE-ATTCK-Techniques-T1027.46013\"> </a></td><td>Encrypted/Encoded File</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.012<a name=\"MITRE-ATTCK-Techniques-T1027.46012\"> </a></td><td>LNK Icon Smuggling</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.017<a name=\"MITRE-ATTCK-Techniques-T1027.46017\"> </a></td><td>SVG Smuggling</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.006<a name=\"MITRE-ATTCK-Techniques-T1027.46006\"> </a></td><td>HTML Smuggling</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.011<a name=\"MITRE-ATTCK-Techniques-T1027.46011\"> </a></td><td>Fileless Storage</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.014<a name=\"MITRE-ATTCK-Techniques-T1027.46014\"> </a></td><td>Polymorphic Code</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.010<a name=\"MITRE-ATTCK-Techniques-T1027.46010\"> </a></td><td>Command Obfuscation</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.004<a name=\"MITRE-ATTCK-Techniques-T1027.46004\"> </a></td><td>Compile After Delivery</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.007<a name=\"MITRE-ATTCK-Techniques-T1027.46007\"> </a></td><td>Dynamic API Resolution</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.003<a name=\"MITRE-ATTCK-Techniques-T1027.46003\"> </a></td><td>Steganography</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.015<a name=\"MITRE-ATTCK-Techniques-T1027.46015\"> </a></td><td>Compression</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.016<a name=\"MITRE-ATTCK-Techniques-T1027.46016\"> </a></td><td>Junk Code Insertion</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.008<a name=\"MITRE-ATTCK-Techniques-T1027.46008\"> </a></td><td>Stripped Payloads</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.002<a name=\"MITRE-ATTCK-Techniques-T1027.46002\"> </a></td><td>Software Packing</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1027.001<a name=\"MITRE-ATTCK-Techniques-T1027.46001\"> </a></td><td>Binary Padding</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1201<a name=\"MITRE-ATTCK-Techniques-T1201\"> </a></td><td>Password Policy Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1546<a name=\"MITRE-ATTCK-Techniques-T1546\"> </a></td><td>Event Triggered Execution</td><td>TA0004, TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1546.002<a name=\"MITRE-ATTCK-Techniques-T1546.46002\"> </a></td><td>Screensaver</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.013<a name=\"MITRE-ATTCK-Techniques-T1546.46013\"> </a></td><td>PowerShell Profile</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.016<a name=\"MITRE-ATTCK-Techniques-T1546.46016\"> </a></td><td>Installer Packages</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.003<a name=\"MITRE-ATTCK-Techniques-T1546.46003\"> </a></td><td>Windows Management Instrumentation Event Subscription</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.006<a name=\"MITRE-ATTCK-Techniques-T1546.46006\"> </a></td><td>LC_LOAD_DYLIB Addition</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.018<a name=\"MITRE-ATTCK-Techniques-T1546.46018\"> </a></td><td>Python Startup Hooks</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.011<a name=\"MITRE-ATTCK-Techniques-T1546.46011\"> </a></td><td>Application Shimming</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.015<a name=\"MITRE-ATTCK-Techniques-T1546.46015\"> </a></td><td>Component Object Model Hijacking</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.004<a name=\"MITRE-ATTCK-Techniques-T1546.46004\"> </a></td><td>Unix Shell Configuration Modification</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.010<a name=\"MITRE-ATTCK-Techniques-T1546.46010\"> </a></td><td>AppInit DLLs</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.005<a name=\"MITRE-ATTCK-Techniques-T1546.46005\"> </a></td><td>Trap</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.007<a name=\"MITRE-ATTCK-Techniques-T1546.46007\"> </a></td><td>Netsh Helper DLL</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.012<a name=\"MITRE-ATTCK-Techniques-T1546.46012\"> </a></td><td>Image File Execution Options Injection</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.001<a name=\"MITRE-ATTCK-Techniques-T1546.46001\"> </a></td><td>Change Default File Association</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.009<a name=\"MITRE-ATTCK-Techniques-T1546.46009\"> </a></td><td>AppCert DLLs</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.017<a name=\"MITRE-ATTCK-Techniques-T1546.46017\"> </a></td><td>Udev Rules</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.014<a name=\"MITRE-ATTCK-Techniques-T1546.46014\"> </a></td><td>Emond</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1546.008<a name=\"MITRE-ATTCK-Techniques-T1546.46008\"> </a></td><td>Accessibility Features</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1187<a name=\"MITRE-ATTCK-Techniques-T1187\"> </a></td><td>Forced Authentication</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1599<a name=\"MITRE-ATTCK-Techniques-T1599\"> </a></td><td>Network Boundary Bridging</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1599.001<a name=\"MITRE-ATTCK-Techniques-T1599.46001\"> </a></td><td>Network Address Translation Traversal</td><td>TA0005</td><td>T1599</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1486<a name=\"MITRE-ATTCK-Techniques-T1486\"> </a></td><td>Data Encrypted for Impact</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1553<a name=\"MITRE-ATTCK-Techniques-T1553\"> </a></td><td>Subvert Trust Controls</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1553.005<a name=\"MITRE-ATTCK-Techniques-T1553.46005\"> </a></td><td>Mark-of-the-Web Bypass</td><td>TA0005</td><td>T1553</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1553.002<a name=\"MITRE-ATTCK-Techniques-T1553.46002\"> </a></td><td>Code Signing</td><td>TA0005</td><td>T1553</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1553.004<a name=\"MITRE-ATTCK-Techniques-T1553.46004\"> </a></td><td>Install Root Certificate</td><td>TA0005</td><td>T1553</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1553.003<a name=\"MITRE-ATTCK-Techniques-T1553.46003\"> </a></td><td>SIP and Trust Provider Hijacking</td><td>TA0005</td><td>T1553</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1553.006<a name=\"MITRE-ATTCK-Techniques-T1553.46006\"> </a></td><td>Code Signing Policy Modification</td><td>TA0005</td><td>T1553</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1553.001<a name=\"MITRE-ATTCK-Techniques-T1553.46001\"> </a></td><td>Gatekeeper Bypass</td><td>TA0005</td><td>T1553</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1573<a name=\"MITRE-ATTCK-Techniques-T1573\"> </a></td><td>Encrypted Channel</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1573.002<a name=\"MITRE-ATTCK-Techniques-T1573.46002\"> </a></td><td>Asymmetric Cryptography</td><td>TA0011</td><td>T1573</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1573.001<a name=\"MITRE-ATTCK-Techniques-T1573.46001\"> </a></td><td>Symmetric Cryptography</td><td>TA0011</td><td>T1573</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1056<a name=\"MITRE-ATTCK-Techniques-T1056\"> </a></td><td>Input Capture</td><td>TA0009, TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1056.001<a name=\"MITRE-ATTCK-Techniques-T1056.46001\"> </a></td><td>Keylogging</td><td>TA0009, TA0006</td><td>T1056</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1056.002<a name=\"MITRE-ATTCK-Techniques-T1056.46002\"> </a></td><td>GUI Input Capture</td><td>TA0009, TA0006</td><td>T1056</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1056.004<a name=\"MITRE-ATTCK-Techniques-T1056.46004\"> </a></td><td>Credential API Hooking</td><td>TA0009, TA0006</td><td>T1056</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1056.003<a name=\"MITRE-ATTCK-Techniques-T1056.46003\"> </a></td><td>Web Portal Capture</td><td>TA0009, TA0006</td><td>T1056</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1203<a name=\"MITRE-ATTCK-Techniques-T1203\"> </a></td><td>Exploitation for Client Execution</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1667<a name=\"MITRE-ATTCK-Techniques-T1667\"> </a></td><td>Email Bombing</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1570<a name=\"MITRE-ATTCK-Techniques-T1570\"> </a></td><td>Lateral Tool Transfer</td><td>TA0008</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1095<a name=\"MITRE-ATTCK-Techniques-T1095\"> </a></td><td>Non-Application Layer Protocol</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1671<a name=\"MITRE-ATTCK-Techniques-T1671\"> </a></td><td>Cloud Application Integration</td><td>TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1012<a name=\"MITRE-ATTCK-Techniques-T1012\"> </a></td><td>Query Registry</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1030<a name=\"MITRE-ATTCK-Techniques-T1030\"> </a></td><td>Data Transfer Size Limits</td><td>TA0010</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1499<a name=\"MITRE-ATTCK-Techniques-T1499\"> </a></td><td>Endpoint Denial of Service</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1499.003<a name=\"MITRE-ATTCK-Techniques-T1499.46003\"> </a></td><td>Application Exhaustion Flood</td><td>TA0040</td><td>T1499</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1499.002<a name=\"MITRE-ATTCK-Techniques-T1499.46002\"> </a></td><td>Service Exhaustion Flood</td><td>TA0040</td><td>T1499</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1499.004<a name=\"MITRE-ATTCK-Techniques-T1499.46004\"> </a></td><td>Application or System Exploitation</td><td>TA0040</td><td>T1499</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1499.001<a name=\"MITRE-ATTCK-Techniques-T1499.46001\"> </a></td><td>OS Exhaustion Flood</td><td>TA0040</td><td>T1499</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1614<a name=\"MITRE-ATTCK-Techniques-T1614\"> </a></td><td>System Location Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1614.001<a name=\"MITRE-ATTCK-Techniques-T1614.46001\"> </a></td><td>System Language Discovery</td><td>TA0007</td><td>T1614</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1197<a name=\"MITRE-ATTCK-Techniques-T1197\"> </a></td><td>BITS Jobs</td><td>TA0005, TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1656<a name=\"MITRE-ATTCK-Techniques-T1656\"> </a></td><td>Impersonation</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1132<a name=\"MITRE-ATTCK-Techniques-T1132\"> </a></td><td>Data Encoding</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1132.001<a name=\"MITRE-ATTCK-Techniques-T1132.46001\"> </a></td><td>Standard Encoding</td><td>TA0011</td><td>T1132</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1132.002<a name=\"MITRE-ATTCK-Techniques-T1132.46002\"> </a></td><td>Non-Standard Encoding</td><td>TA0011</td><td>T1132</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1598<a name=\"MITRE-ATTCK-Techniques-T1598\"> </a></td><td>Phishing for Information</td><td>TA0043</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1598.004<a name=\"MITRE-ATTCK-Techniques-T1598.46004\"> </a></td><td>Spearphishing Voice</td><td>TA0043</td><td>T1598</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1598.001<a name=\"MITRE-ATTCK-Techniques-T1598.46001\"> </a></td><td>Spearphishing Service</td><td>TA0043</td><td>T1598</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1598.002<a name=\"MITRE-ATTCK-Techniques-T1598.46002\"> </a></td><td>Spearphishing Attachment</td><td>TA0043</td><td>T1598</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1598.003<a name=\"MITRE-ATTCK-Techniques-T1598.46003\"> </a></td><td>Spearphishing Link</td><td>TA0043</td><td>T1598</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1496<a name=\"MITRE-ATTCK-Techniques-T1496\"> </a></td><td>Resource Hijacking</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1496.001<a name=\"MITRE-ATTCK-Techniques-T1496.46001\"> </a></td><td>Compute Hijacking</td><td>TA0040</td><td>T1496</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1496.002<a name=\"MITRE-ATTCK-Techniques-T1496.46002\"> </a></td><td>Bandwidth Hijacking</td><td>TA0040</td><td>T1496</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1496.004<a name=\"MITRE-ATTCK-Techniques-T1496.46004\"> </a></td><td>Cloud Service Hijacking</td><td>TA0040</td><td>T1496</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1496.003<a name=\"MITRE-ATTCK-Techniques-T1496.46003\"> </a></td><td>SMS Pumping</td><td>TA0040</td><td>T1496</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1585<a name=\"MITRE-ATTCK-Techniques-T1585\"> </a></td><td>Establish Accounts</td><td>TA0042</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1585.003<a name=\"MITRE-ATTCK-Techniques-T1585.46003\"> </a></td><td>Cloud Accounts</td><td>TA0042</td><td>T1585</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1585.002<a name=\"MITRE-ATTCK-Techniques-T1585.46002\"> </a></td><td>Email Accounts</td><td>TA0042</td><td>T1585</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1585.001<a name=\"MITRE-ATTCK-Techniques-T1585.46001\"> </a></td><td>Social Media Accounts</td><td>TA0042</td><td>T1585</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1588<a name=\"MITRE-ATTCK-Techniques-T1588\"> </a></td><td>Obtain Capabilities</td><td>TA0042</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1588.006<a name=\"MITRE-ATTCK-Techniques-T1588.46006\"> </a></td><td>Vulnerabilities</td><td>TA0042</td><td>T1588</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1588.005<a name=\"MITRE-ATTCK-Techniques-T1588.46005\"> </a></td><td>Exploits</td><td>TA0042</td><td>T1588</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1588.007<a name=\"MITRE-ATTCK-Techniques-T1588.46007\"> </a></td><td>Artificial Intelligence</td><td>TA0042</td><td>T1588</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1588.004<a name=\"MITRE-ATTCK-Techniques-T1588.46004\"> </a></td><td>Digital Certificates</td><td>TA0042</td><td>T1588</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1588.002<a name=\"MITRE-ATTCK-Techniques-T1588.46002\"> </a></td><td>Tool</td><td>TA0042</td><td>T1588</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1588.003<a name=\"MITRE-ATTCK-Techniques-T1588.46003\"> </a></td><td>Code Signing Certificates</td><td>TA0042</td><td>T1588</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1588.001<a name=\"MITRE-ATTCK-Techniques-T1588.46001\"> </a></td><td>Malware</td><td>TA0042</td><td>T1588</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1569<a name=\"MITRE-ATTCK-Techniques-T1569\"> </a></td><td>System Services</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1569.003<a name=\"MITRE-ATTCK-Techniques-T1569.46003\"> </a></td><td>Systemctl</td><td>TA0002</td><td>T1569</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1569.002<a name=\"MITRE-ATTCK-Techniques-T1569.46002\"> </a></td><td>Service Execution</td><td>TA0002</td><td>T1569</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1569.001<a name=\"MITRE-ATTCK-Techniques-T1569.46001\"> </a></td><td>Launchctl</td><td>TA0002</td><td>T1569</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1650<a name=\"MITRE-ATTCK-Techniques-T1650\"> </a></td><td>Acquire Access</td><td>TA0042</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1213<a name=\"MITRE-ATTCK-Techniques-T1213\"> </a></td><td>Data from Information Repositories</td><td>TA0009</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1213.003<a name=\"MITRE-ATTCK-Techniques-T1213.46003\"> </a></td><td>Code Repositories</td><td>TA0009</td><td>T1213</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1213.006<a name=\"MITRE-ATTCK-Techniques-T1213.46006\"> </a></td><td>Databases</td><td>TA0009</td><td>T1213</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1213.005<a name=\"MITRE-ATTCK-Techniques-T1213.46005\"> </a></td><td>Messaging Applications</td><td>TA0009</td><td>T1213</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1213.004<a name=\"MITRE-ATTCK-Techniques-T1213.46004\"> </a></td><td>Customer Relationship Management Software</td><td>TA0009</td><td>T1213</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1213.002<a name=\"MITRE-ATTCK-Techniques-T1213.46002\"> </a></td><td>Sharepoint</td><td>TA0009</td><td>T1213</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1213.001<a name=\"MITRE-ATTCK-Techniques-T1213.46001\"> </a></td><td>Confluence</td><td>TA0009</td><td>T1213</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1200<a name=\"MITRE-ATTCK-Techniques-T1200\"> </a></td><td>Hardware Additions</td><td>TA0001</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1505<a name=\"MITRE-ATTCK-Techniques-T1505\"> </a></td><td>Server Software Component</td><td>TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1505.002<a name=\"MITRE-ATTCK-Techniques-T1505.46002\"> </a></td><td>Transport Agent</td><td>TA0003</td><td>T1505</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1505.004<a name=\"MITRE-ATTCK-Techniques-T1505.46004\"> </a></td><td>IIS Components</td><td>TA0003</td><td>T1505</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1505.003<a name=\"MITRE-ATTCK-Techniques-T1505.46003\"> </a></td><td>Web Shell</td><td>TA0003</td><td>T1505</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1505.005<a name=\"MITRE-ATTCK-Techniques-T1505.46005\"> </a></td><td>Terminal Services DLL</td><td>TA0003</td><td>T1505</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1505.006<a name=\"MITRE-ATTCK-Techniques-T1505.46006\"> </a></td><td>vSphere Installation Bundles</td><td>TA0003</td><td>T1505</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1505.001<a name=\"MITRE-ATTCK-Techniques-T1505.46001\"> </a></td><td>SQL Stored Procedures</td><td>TA0003</td><td>T1505</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1485<a name=\"MITRE-ATTCK-Techniques-T1485\"> </a></td><td>Data Destruction</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1485.001<a name=\"MITRE-ATTCK-Techniques-T1485.46001\"> </a></td><td>Lifecycle-Triggered Deletion</td><td>TA0040</td><td>T1485</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1537<a name=\"MITRE-ATTCK-Techniques-T1537\"> </a></td><td>Transfer Data to Cloud Account</td><td>TA0010</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1189<a name=\"MITRE-ATTCK-Techniques-T1189\"> </a></td><td>Drive-by Compromise</td><td>TA0001</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1498<a name=\"MITRE-ATTCK-Techniques-T1498\"> </a></td><td>Network Denial of Service</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1498.002<a name=\"MITRE-ATTCK-Techniques-T1498.46002\"> </a></td><td>Reflection Amplification</td><td>TA0040</td><td>T1498</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1498.001<a name=\"MITRE-ATTCK-Techniques-T1498.46001\"> </a></td><td>Direct Network Flood</td><td>TA0040</td><td>T1498</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1651<a name=\"MITRE-ATTCK-Techniques-T1651\"> </a></td><td>Cloud Administration Command</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1221<a name=\"MITRE-ATTCK-Techniques-T1221\"> </a></td><td>Template Injection</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1134<a name=\"MITRE-ATTCK-Techniques-T1134\"> </a></td><td>Access Token Manipulation</td><td>TA0005, TA0004</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1134.001<a name=\"MITRE-ATTCK-Techniques-T1134.46001\"> </a></td><td>Token Impersonation/Theft</td><td>TA0005, TA0004</td><td>T1134</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1134.004<a name=\"MITRE-ATTCK-Techniques-T1134.46004\"> </a></td><td>Parent PID Spoofing</td><td>TA0005, TA0004</td><td>T1134</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1134.005<a name=\"MITRE-ATTCK-Techniques-T1134.46005\"> </a></td><td>SID-History Injection</td><td>TA0005, TA0004</td><td>T1134</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1134.002<a name=\"MITRE-ATTCK-Techniques-T1134.46002\"> </a></td><td>Create Process with Token</td><td>TA0005, TA0004</td><td>T1134</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1134.003<a name=\"MITRE-ATTCK-Techniques-T1134.46003\"> </a></td><td>Make and Impersonate Token</td><td>TA0005, TA0004</td><td>T1134</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1111<a name=\"MITRE-ATTCK-Techniques-T1111\"> </a></td><td>Multi-Factor Authentication Interception</td><td>TA0006</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1668<a name=\"MITRE-ATTCK-Techniques-T1668\"> </a></td><td>Exclusive Control</td><td>TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1136<a name=\"MITRE-ATTCK-Techniques-T1136\"> </a></td><td>Create Account</td><td>TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1136.003<a name=\"MITRE-ATTCK-Techniques-T1136.46003\"> </a></td><td>Cloud Account</td><td>TA0003</td><td>T1136</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1136.001<a name=\"MITRE-ATTCK-Techniques-T1136.46001\"> </a></td><td>Local Account</td><td>TA0003</td><td>T1136</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1136.002<a name=\"MITRE-ATTCK-Techniques-T1136.46002\"> </a></td><td>Domain Account</td><td>TA0003</td><td>T1136</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1672<a name=\"MITRE-ATTCK-Techniques-T1672\"> </a></td><td>Email Spoofing</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1526<a name=\"MITRE-ATTCK-Techniques-T1526\"> </a></td><td>Cloud Service Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1018<a name=\"MITRE-ATTCK-Techniques-T1018\"> </a></td><td>Remote System Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1046<a name=\"MITRE-ATTCK-Techniques-T1046\"> </a></td><td>Network Service Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1518<a name=\"MITRE-ATTCK-Techniques-T1518\"> </a></td><td>Software Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1518.001<a name=\"MITRE-ATTCK-Techniques-T1518.46001\"> </a></td><td>Security Software Discovery</td><td>TA0007</td><td>T1518</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1518.002<a name=\"MITRE-ATTCK-Techniques-T1518.46002\"> </a></td><td>Backup Software Discovery</td><td>TA0007</td><td>T1518</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1538<a name=\"MITRE-ATTCK-Techniques-T1538\"> </a></td><td>Cloud Service Dashboard</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1622<a name=\"MITRE-ATTCK-Techniques-T1622\"> </a></td><td>Debugger Evasion</td><td>TA0005, TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1052<a name=\"MITRE-ATTCK-Techniques-T1052\"> </a></td><td>Exfiltration Over Physical Medium</td><td>TA0010</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1052.001<a name=\"MITRE-ATTCK-Techniques-T1052.46001\"> </a></td><td>Exfiltration over USB</td><td>TA0010</td><td>T1052</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1105<a name=\"MITRE-ATTCK-Techniques-T1105\"> </a></td><td>Ingress Tool Transfer</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1648<a name=\"MITRE-ATTCK-Techniques-T1648\"> </a></td><td>Serverless Execution</td><td>TA0002</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1653<a name=\"MITRE-ATTCK-Techniques-T1653\"> </a></td><td>Power Settings</td><td>TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1665<a name=\"MITRE-ATTCK-Techniques-T1665\"> </a></td><td>Hide Infrastructure</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1484<a name=\"MITRE-ATTCK-Techniques-T1484\"> </a></td><td>Domain or Tenant Policy Modification</td><td>TA0005, TA0004</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1484.002<a name=\"MITRE-ATTCK-Techniques-T1484.46002\"> </a></td><td>Trust Modification</td><td>TA0005, TA0004</td><td>T1484</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1484.001<a name=\"MITRE-ATTCK-Techniques-T1484.46001\"> </a></td><td>Group Policy Modification</td><td>TA0005, TA0004</td><td>T1484</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1220<a name=\"MITRE-ATTCK-Techniques-T1220\"> </a></td><td>XSL Script Processing</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1587<a name=\"MITRE-ATTCK-Techniques-T1587\"> </a></td><td>Develop Capabilities</td><td>TA0042</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1587.002<a name=\"MITRE-ATTCK-Techniques-T1587.46002\"> </a></td><td>Code Signing Certificates</td><td>TA0042</td><td>T1587</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1587.003<a name=\"MITRE-ATTCK-Techniques-T1587.46003\"> </a></td><td>Digital Certificates</td><td>TA0042</td><td>T1587</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1587.004<a name=\"MITRE-ATTCK-Techniques-T1587.46004\"> </a></td><td>Exploits</td><td>TA0042</td><td>T1587</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1587.001<a name=\"MITRE-ATTCK-Techniques-T1587.46001\"> </a></td><td>Malware</td><td>TA0042</td><td>T1587</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1008<a name=\"MITRE-ATTCK-Techniques-T1008\"> </a></td><td>Fallback Channels</td><td>TA0011</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1680<a name=\"MITRE-ATTCK-Techniques-T1680\"> </a></td><td>Local Storage Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1124<a name=\"MITRE-ATTCK-Techniques-T1124\"> </a></td><td>System Time Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1556<a name=\"MITRE-ATTCK-Techniques-T1556\"> </a></td><td>Modify Authentication Process</td><td>TA0006, TA0005, TA0003</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1556.004<a name=\"MITRE-ATTCK-Techniques-T1556.46004\"> </a></td><td>Network Device Authentication</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1556.001<a name=\"MITRE-ATTCK-Techniques-T1556.46001\"> </a></td><td>Domain Controller Authentication</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1556.009<a name=\"MITRE-ATTCK-Techniques-T1556.46009\"> </a></td><td>Conditional Access Policies</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1556.008<a name=\"MITRE-ATTCK-Techniques-T1556.46008\"> </a></td><td>Network Provider DLL</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1556.002<a name=\"MITRE-ATTCK-Techniques-T1556.46002\"> </a></td><td>Password Filter DLL</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1556.006<a name=\"MITRE-ATTCK-Techniques-T1556.46006\"> </a></td><td>Multi-Factor Authentication</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1556.007<a name=\"MITRE-ATTCK-Techniques-T1556.46007\"> </a></td><td>Hybrid Identity</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1556.005<a name=\"MITRE-ATTCK-Techniques-T1556.46005\"> </a></td><td>Reversible Encryption</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1556.003<a name=\"MITRE-ATTCK-Techniques-T1556.46003\"> </a></td><td>Pluggable Authentication Modules</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1495<a name=\"MITRE-ATTCK-Techniques-T1495\"> </a></td><td>Firmware Corruption</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1490<a name=\"MITRE-ATTCK-Techniques-T1490\"> </a></td><td>Inhibit System Recovery</td><td>TA0040</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1216<a name=\"MITRE-ATTCK-Techniques-T1216\"> </a></td><td>System Script Proxy Execution</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1216.001<a name=\"MITRE-ATTCK-Techniques-T1216.46001\"> </a></td><td>PubPrn</td><td>TA0005</td><td>T1216</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1216.002<a name=\"MITRE-ATTCK-Techniques-T1216.46002\"> </a></td><td>SyncAppvPublishingServer</td><td>TA0005</td><td>T1216</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1669<a name=\"MITRE-ATTCK-Techniques-T1669\"> </a></td><td>Wi-Fi Networks</td><td>TA0001</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1211<a name=\"MITRE-ATTCK-Techniques-T1211\"> </a></td><td>Exploitation for Defense Evasion</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1127<a name=\"MITRE-ATTCK-Techniques-T1127\"> </a></td><td>Trusted Developer Utilities Proxy Execution</td><td>TA0005</td><td/><td>false</td></tr><tr><td style=\"white-space:nowrap\">T1127.001<a name=\"MITRE-ATTCK-Techniques-T1127.46001\"> </a></td><td>MSBuild</td><td>TA0005</td><td>T1127</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1127.002<a name=\"MITRE-ATTCK-Techniques-T1127.46002\"> </a></td><td>ClickOnce</td><td>TA0005</td><td>T1127</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1127.003<a name=\"MITRE-ATTCK-Techniques-T1127.46003\"> </a></td><td>JamPlus</td><td>TA0005</td><td>T1127</td><td>true</td></tr><tr><td style=\"white-space:nowrap\">T1529<a name=\"MITRE-ATTCK-Techniques-T1529\"> </a></td><td>System Shutdown/Reboot</td><td>TA0040</td><td/><td>false</td></tr></table></div>"^^rdf:XMLLiteral ] ] ; # fhir:url [ fhir:v "https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Techniques"^^xsd:anyURI ; fhir:l <https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Techniques> ] ; # fhir:version [ fhir:v "0.0.5"] ; # fhir:name [ fhir:v "MITRE-ATTCK-Techniques"] ; # fhir:title [ fhir:v "CS MITRE ATT&CK Techniques and Subtechniques"] ; # fhir:status [ fhir:v "draft"] ; # fhir:experimental [ fhir:v false] ; # fhir:date [ fhir:v "2026-04-26T20:36:59+00:00"^^xsd:dateTime] ; # fhir:publisher [ fhir:v "ATTCK2FHIR IG"] ; # fhir:contact ( [ fhir:name [ fhir:v "ATTCK2FHIR IG" ] ; ( fhir:telecom [ fhir:system [ fhir:v "url" ] ; fhir:value [ fhir:v "https://constir1.github.io/ATTCK2FHIR" ] ] ) ] ) ; # fhir:description [ fhir:v "This Code System contains all MITRE ATT&CK Enterprise Techniques and Subtechniques with their tactic and parent-technique relationships expressed as properties."] ; # fhir:caseSensitive [ fhir:v true] ; # fhir:content [ fhir:v "complete"] ; # fhir:count [ fhir:v "691"^^xsd:nonNegativeInteger] ; # fhir:property ( [ fhir:code [ fhir:v "tactic" ] ; fhir:uri [ fhir:v "https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Tactics"^^xsd:anyURI ; fhir:l <https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Tactics> ] ; fhir:description [ fhir:v "The tactic(s) this technique or subtechnique contributes to, referenced by tactic ID" ] ; fhir:type [ fhir:v "code" ] ] [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:uri [ fhir:v "https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Techniques"^^xsd:anyURI ; fhir:l <https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Techniques> ] ; fhir:description [ fhir:v "The parent technique of this subtechnique, referenced by ATT&CK ID" ] ; fhir:type [ fhir:v "code" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:description [ fhir:v "Whether this concept is a subtechnique" ] ; fhir:type [ fhir:v "boolean" ] ] ) ; # fhir:concept ( [ fhir:code [ fhir:v "T1047" ] ; fhir:display [ fhir:v "Windows Management Instrumentation" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1113" ] ; fhir:display [ fhir:v "Screen Capture" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1037" ] ; fhir:display [ fhir:v "Boot or Logon Initialization Scripts" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1037.004" ] ; fhir:display [ fhir:v "RC Scripts" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1037" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1037.001" ] ; fhir:display [ fhir:v "Logon Script (Windows)" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1037" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1037.003" ] ; fhir:display [ fhir:v "Network Logon Script" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1037" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1037.005" ] ; fhir:display [ fhir:v "Startup Items" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1037" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1037.002" ] ; fhir:display [ fhir:v "Login Hook" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1037" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1557" ] ; fhir:display [ fhir:v "Adversary-in-the-Middle" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1557.003" ] ; fhir:display [ fhir:v "DHCP Spoofing" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1557" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1557.002" ] ; fhir:display [ fhir:v "ARP Cache Poisoning" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1557" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1557.001" ] ; fhir:display [ fhir:v "LLMNR/NBT-NS Poisoning and SMB Relay" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1557" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1557.004" ] ; fhir:display [ fhir:v "Evil Twin" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1557" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1033" ] ; fhir:display [ fhir:v "System Owner/User Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1583" ] ; fhir:display [ fhir:v "Acquire Infrastructure" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1583.008" ] ; fhir:display [ fhir:v "Malvertising" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1583" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1583.001" ] ; fhir:display [ fhir:v "Domains" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1583" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1583.005" ] ; fhir:display [ fhir:v "Botnet" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1583" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1583.004" ] ; fhir:display [ fhir:v "Server" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1583" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1583.002" ] ; fhir:display [ fhir:v "DNS Server" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1583" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1583.003" ] ; fhir:display [ fhir:v "Virtual Private Server" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1583" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1583.007" ] ; fhir:display [ fhir:v "Serverless" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1583" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1583.006" ] ; fhir:display [ fhir:v "Web Services" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1583" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1613" ] ; fhir:display [ fhir:v "Container and Resource Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1592" ] ; fhir:display [ fhir:v "Gather Victim Host Information" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1592.001" ] ; fhir:display [ fhir:v "Hardware" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1592" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1592.003" ] ; fhir:display [ fhir:v "Firmware" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1592" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1592.002" ] ; fhir:display [ fhir:v "Software" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1592" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1592.004" ] ; fhir:display [ fhir:v "Client Configurations" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1592" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1003" ] ; fhir:display [ fhir:v "OS Credential Dumping" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1003.002" ] ; fhir:display [ fhir:v "Security Account Manager" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1003.004" ] ; fhir:display [ fhir:v "LSA Secrets" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1003.006" ] ; fhir:display [ fhir:v "DCSync" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1003.007" ] ; fhir:display [ fhir:v "Proc Filesystem" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1003.003" ] ; fhir:display [ fhir:v "NTDS" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1003.005" ] ; fhir:display [ fhir:v "Cached Domain Credentials" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1003.001" ] ; fhir:display [ fhir:v "LSASS Memory" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1003.008" ] ; fhir:display [ fhir:v "/etc/passwd and /etc/shadow" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1129" ] ; fhir:display [ fhir:v "Shared Modules" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1602" ] ; fhir:display [ fhir:v "Data from Configuration Repository" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1602.002" ] ; fhir:display [ fhir:v "Network Device Configuration Dump" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1602" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1602.001" ] ; fhir:display [ fhir:v "SNMP (MIB Dump)" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1602" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1006" ] ; fhir:display [ fhir:v "Direct Volume Access" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1666" ] ; fhir:display [ fhir:v "Modify Cloud Resource Hierarchy" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1014" ] ; fhir:display [ fhir:v "Rootkit" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1123" ] ; fhir:display [ fhir:v "Audio Capture" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1543" ] ; fhir:display [ fhir:v "Create or Modify System Process" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1543.004" ] ; fhir:display [ fhir:v "Launch Daemon" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1543" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1543.005" ] ; fhir:display [ fhir:v "Container Service" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1543" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1543.001" ] ; fhir:display [ fhir:v "Launch Agent" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1543" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1543.002" ] ; fhir:display [ fhir:v "Systemd Service" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1543" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1543.003" ] ; fhir:display [ fhir:v "Windows Service" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1543" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1133" ] ; fhir:display [ fhir:v "External Remote Services" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0001" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1539" ] ; fhir:display [ fhir:v "Steal Web Session Cookie" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1578" ] ; fhir:display [ fhir:v "Modify Cloud Compute Infrastructure" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1578.001" ] ; fhir:display [ fhir:v "Create Snapshot" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1578" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1578.003" ] ; fhir:display [ fhir:v "Delete Cloud Instance" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1578" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1578.004" ] ; fhir:display [ fhir:v "Revert Cloud Instance" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1578" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1578.002" ] ; fhir:display [ fhir:v "Create Cloud Instance" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1578" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1578.005" ] ; fhir:display [ fhir:v "Modify Cloud Compute Configurations" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1578" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1069" ] ; fhir:display [ fhir:v "Permission Groups Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1069.003" ] ; fhir:display [ fhir:v "Cloud Groups" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1069" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1069.002" ] ; fhir:display [ fhir:v "Domain Groups" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1069" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1069.001" ] ; fhir:display [ fhir:v "Local Groups" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1069" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1114" ] ; fhir:display [ fhir:v "Email Collection" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1114.002" ] ; fhir:display [ fhir:v "Remote Email Collection" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1114" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1114.003" ] ; fhir:display [ fhir:v "Email Forwarding Rule" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1114" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1114.001" ] ; fhir:display [ fhir:v "Local Email Collection" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1114" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1594" ] ; fhir:display [ fhir:v "Search Victim-Owned Websites" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1561" ] ; fhir:display [ fhir:v "Disk Wipe" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1561.002" ] ; fhir:display [ fhir:v "Disk Structure Wipe" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1561" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1561.001" ] ; fhir:display [ fhir:v "Disk Content Wipe" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1561" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1615" ] ; fhir:display [ fhir:v "Group Policy Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1025" ] ; fhir:display [ fhir:v "Data from Removable Media" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1547" ] ; fhir:display [ fhir:v "Boot or Logon Autostart Execution" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1547.009" ] ; fhir:display [ fhir:v "Shortcut Modification" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1547" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1547.006" ] ; fhir:display [ fhir:v "Kernel Modules and Extensions" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1547" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1547.007" ] ; fhir:display [ fhir:v "Re-opened Applications" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1547" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1547.004" ] ; fhir:display [ fhir:v "Winlogon Helper DLL" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1547" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1547.005" ] ; fhir:display [ fhir:v "Security Support Provider" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1547" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1547.001" ] ; fhir:display [ fhir:v "Registry Run Keys / Startup Folder" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1547" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1547.008" ] ; fhir:display [ fhir:v "LSASS Driver" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1547" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1547.012" ] ; fhir:display [ fhir:v "Print Processors" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1547" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1547.014" ] ; fhir:display [ fhir:v "Active Setup" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1547" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1547.015" ] ; fhir:display [ fhir:v "Login Items" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1547" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1547.013" ] ; fhir:display [ fhir:v "XDG Autostart Entries" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1547" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1547.003" ] ; fhir:display [ fhir:v "Time Providers" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1547" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1547.002" ] ; fhir:display [ fhir:v "Authentication Package" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1547" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1547.010" ] ; fhir:display [ fhir:v "Port Monitors" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1547" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1600" ] ; fhir:display [ fhir:v "Weaken Encryption" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1600.001" ] ; fhir:display [ fhir:v "Reduce Key Space" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1600" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1600.002" ] ; fhir:display [ fhir:v "Disable Crypto Hardware" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1600" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1489" ] ; fhir:display [ fhir:v "Service Stop" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1652" ] ; fhir:display [ fhir:v "Device Driver Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1564" ] ; fhir:display [ fhir:v "Hide Artifacts" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1564.003" ] ; fhir:display [ fhir:v "Hidden Window" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1564" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1564.011" ] ; fhir:display [ fhir:v "Ignore Process Interrupts" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1564" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1564.002" ] ; fhir:display [ fhir:v "Hidden Users" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1564" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1564.012" ] ; fhir:display [ fhir:v "File/Path Exclusions" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1564" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1564.014" ] ; fhir:display [ fhir:v "Extended Attributes" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1564" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1564.008" ] ; fhir:display [ fhir:v "Email Hiding Rules" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1564" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1564.009" ] ; fhir:display [ fhir:v "Resource Forking" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1564" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1564.013" ] ; fhir:display [ fhir:v "Bind Mounts" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1564" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1564.006" ] ; fhir:display [ fhir:v "Run Virtual Instance" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1564" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1564.010" ] ; fhir:display [ fhir:v "Process Argument Spoofing" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1564" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1564.001" ] ; fhir:display [ fhir:v "Hidden Files and Directories" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1564" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1564.004" ] ; fhir:display [ fhir:v "NTFS File Attributes" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1564" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1564.007" ] ; fhir:display [ fhir:v "VBA Stomping" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1564" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1564.005" ] ; fhir:display [ fhir:v "Hidden File System" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1564" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1080" ] ; fhir:display [ fhir:v "Taint Shared Content" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0008" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1137" ] ; fhir:display [ fhir:v "Office Application Startup" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1137.002" ] ; fhir:display [ fhir:v "Office Test" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1137" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1137.001" ] ; fhir:display [ fhir:v "Office Template Macros" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1137" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1137.004" ] ; fhir:display [ fhir:v "Outlook Home Page" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1137" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1137.003" ] ; fhir:display [ fhir:v "Outlook Forms" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1137" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1137.006" ] ; fhir:display [ fhir:v "Add-ins" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1137" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1137.005" ] ; fhir:display [ fhir:v "Outlook Rules" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1137" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1119" ] ; fhir:display [ fhir:v "Automated Collection" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1115" ] ; fhir:display [ fhir:v "Clipboard Data" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1675" ] ; fhir:display [ fhir:v "ESXi Administration Command" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1007" ] ; fhir:display [ fhir:v "System Service Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1040" ] ; fhir:display [ fhir:v "Network Sniffing" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1530" ] ; fhir:display [ fhir:v "Data from Cloud Storage" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1135" ] ; fhir:display [ fhir:v "Network Share Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1120" ] ; fhir:display [ fhir:v "Peripheral Device Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1082" ] ; fhir:display [ fhir:v "System Information Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1071" ] ; fhir:display [ fhir:v "Application Layer Protocol" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1071.002" ] ; fhir:display [ fhir:v "File Transfer Protocols" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1071" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1071.004" ] ; fhir:display [ fhir:v "DNS" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1071" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1071.005" ] ; fhir:display [ fhir:v "Publish/Subscribe Protocols" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1071" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1071.003" ] ; fhir:display [ fhir:v "Mail Protocols" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1071" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1071.001" ] ; fhir:display [ fhir:v "Web Protocols" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1071" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1053" ] ; fhir:display [ fhir:v "Scheduled Task/Job" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1053.003" ] ; fhir:display [ fhir:v "Cron" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1053" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1053.005" ] ; fhir:display [ fhir:v "Scheduled Task" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1053" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1053.006" ] ; fhir:display [ fhir:v "Systemd Timers" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1053" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1053.007" ] ; fhir:display [ fhir:v "Container Orchestration Job" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1053" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1053.002" ] ; fhir:display [ fhir:v "At" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1053" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1176" ] ; fhir:display [ fhir:v "Software Extensions" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1176.002" ] ; fhir:display [ fhir:v "IDE Extensions" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1176" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1176.001" ] ; fhir:display [ fhir:v "Browser Extensions" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1176" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1106" ] ; fhir:display [ fhir:v "Native API" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1202" ] ; fhir:display [ fhir:v "Indirect Command Execution" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1091" ] ; fhir:display [ fhir:v "Replication Through Removable Media" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0008" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0001" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1005" ] ; fhir:display [ fhir:v "Data from Local System" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1140" ] ; fhir:display [ fhir:v "Deobfuscate/Decode Files or Information" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1562" ] ; fhir:display [ fhir:v "Impair Defenses" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1562.003" ] ; fhir:display [ fhir:v "Impair Command History Logging" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1562" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1562.013" ] ; fhir:display [ fhir:v "Disable or Modify Network Device Firewall" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1562" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1562.004" ] ; fhir:display [ fhir:v "Disable or Modify System Firewall" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1562" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1562.002" ] ; fhir:display [ fhir:v "Disable Windows Event Logging" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1562" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1562.001" ] ; fhir:display [ fhir:v "Disable or Modify Tools" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1562" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1562.006" ] ; fhir:display [ fhir:v "Indicator Blocking" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1562" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1562.012" ] ; fhir:display [ fhir:v "Disable or Modify Linux Audit System" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1562" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1562.011" ] ; fhir:display [ fhir:v "Spoof Security Alerting" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1562" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1562.008" ] ; fhir:display [ fhir:v "Disable or Modify Cloud Logs" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1562" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1562.010" ] ; fhir:display [ fhir:v "Downgrade Attack" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1562" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1562.007" ] ; fhir:display [ fhir:v "Disable or Modify Cloud Firewall" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1562" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1562.009" ] ; fhir:display [ fhir:v "Safe Mode Boot" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1562" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1195" ] ; fhir:display [ fhir:v "Supply Chain Compromise" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0001" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1195.001" ] ; fhir:display [ fhir:v "Compromise Software Dependencies and Development Tools" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1195" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0001" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1195.002" ] ; fhir:display [ fhir:v "Compromise Software Supply Chain" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1195" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0001" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1195.003" ] ; fhir:display [ fhir:v "Compromise Hardware Supply Chain" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1195" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0001" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1190" ] ; fhir:display [ fhir:v "Exploit Public-Facing Application" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0001" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1558" ] ; fhir:display [ fhir:v "Steal or Forge Kerberos Tickets" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1558.003" ] ; fhir:display [ fhir:v "Kerberoasting" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1558" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1558.002" ] ; fhir:display [ fhir:v "Silver Ticket" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1558" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1558.005" ] ; fhir:display [ fhir:v "Ccache Files" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1558" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1558.004" ] ; fhir:display [ fhir:v "AS-REP Roasting" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1558" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1558.001" ] ; fhir:display [ fhir:v "Golden Ticket" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1558" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1555" ] ; fhir:display [ fhir:v "Credentials from Password Stores" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1555.004" ] ; fhir:display [ fhir:v "Windows Credential Manager" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1555" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1555.001" ] ; fhir:display [ fhir:v "Keychain" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1555" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1555.005" ] ; fhir:display [ fhir:v "Password Managers" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1555" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1555.006" ] ; fhir:display [ fhir:v "Cloud Secrets Management Stores" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1555" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1555.003" ] ; fhir:display [ fhir:v "Credentials from Web Browsers" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1555" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1555.002" ] ; fhir:display [ fhir:v "Securityd Memory" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1555" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1567" ] ; fhir:display [ fhir:v "Exfiltration Over Web Service" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0010" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1567.001" ] ; fhir:display [ fhir:v "Exfiltration to Code Repository" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1567" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0010" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1567.003" ] ; fhir:display [ fhir:v "Exfiltration to Text Storage Sites" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1567" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0010" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1567.002" ] ; fhir:display [ fhir:v "Exfiltration to Cloud Storage" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1567" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0010" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1567.004" ] ; fhir:display [ fhir:v "Exfiltration Over Webhook" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1567" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0010" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1219" ] ; fhir:display [ fhir:v "Remote Access Tools" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1219.003" ] ; fhir:display [ fhir:v "Remote Access Hardware" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1219" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1219.001" ] ; fhir:display [ fhir:v "IDE Tunneling" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1219" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1219.002" ] ; fhir:display [ fhir:v "Remote Desktop Software" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1219" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1036" ] ; fhir:display [ fhir:v "Masquerading" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1036.008" ] ; fhir:display [ fhir:v "Masquerade File Type" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1036" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1036.003" ] ; fhir:display [ fhir:v "Rename Legitimate Utilities" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1036" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1036.006" ] ; fhir:display [ fhir:v "Space after Filename" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1036" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1036.004" ] ; fhir:display [ fhir:v "Masquerade Task or Service" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1036" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1036.002" ] ; fhir:display [ fhir:v "Right-to-Left Override" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1036" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1036.005" ] ; fhir:display [ fhir:v "Match Legitimate Resource Name or Location" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1036" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1036.011" ] ; fhir:display [ fhir:v "Overwrite Process Arguments" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1036" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1036.007" ] ; fhir:display [ fhir:v "Double File Extension" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1036" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1036.010" ] ; fhir:display [ fhir:v "Masquerade Account Name" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1036" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1036.001" ] ; fhir:display [ fhir:v "Invalid Code Signature" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1036" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1036.012" ] ; fhir:display [ fhir:v "Browser Fingerprint" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1036" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1036.009" ] ; fhir:display [ fhir:v "Break Process Trees" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1036" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1552" ] ; fhir:display [ fhir:v "Unsecured Credentials" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1552.006" ] ; fhir:display [ fhir:v "Group Policy Preferences" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1552" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1552.004" ] ; fhir:display [ fhir:v "Private Keys" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1552" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1552.007" ] ; fhir:display [ fhir:v "Container API" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1552" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1552.001" ] ; fhir:display [ fhir:v "Credentials In Files" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1552" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1552.002" ] ; fhir:display [ fhir:v "Credentials in Registry" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1552" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1552.003" ] ; fhir:display [ fhir:v "Shell History" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1552" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1552.008" ] ; fhir:display [ fhir:v "Chat Messages" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1552" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1552.005" ] ; fhir:display [ fhir:v "Cloud Instance Metadata API" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1552" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1659" ] ; fhir:display [ fhir:v "Content Injection" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0001" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1055" ] ; fhir:display [ fhir:v "Process Injection" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1055.013" ] ; fhir:display [ fhir:v "Process Doppelgänging" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1055" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1055.012" ] ; fhir:display [ fhir:v "Process Hollowing" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1055" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1055.009" ] ; fhir:display [ fhir:v "Proc Memory" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1055" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1055.015" ] ; fhir:display [ fhir:v "ListPlanting" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1055" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1055.014" ] ; fhir:display [ fhir:v "VDSO Hijacking" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1055" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1055.005" ] ; fhir:display [ fhir:v "Thread Local Storage" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1055" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1055.011" ] ; fhir:display [ fhir:v "Extra Window Memory Injection" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1055" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1055.001" ] ; fhir:display [ fhir:v "Dynamic-link Library Injection" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1055" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1055.003" ] ; fhir:display [ fhir:v "Thread Execution Hijacking" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1055" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1055.008" ] ; fhir:display [ fhir:v "Ptrace System Calls" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1055" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1055.004" ] ; fhir:display [ fhir:v "Asynchronous Procedure Call" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1055" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1055.002" ] ; fhir:display [ fhir:v "Portable Executable Injection" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1055" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1205" ] ; fhir:display [ fhir:v "Traffic Signaling" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1205.001" ] ; fhir:display [ fhir:v "Port Knocking" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1205" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1205.002" ] ; fhir:display [ fhir:v "Socket Filters" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1205" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1218" ] ; fhir:display [ fhir:v "System Binary Proxy Execution" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1218.005" ] ; fhir:display [ fhir:v "Mshta" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1218" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1218.014" ] ; fhir:display [ fhir:v "MMC" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1218" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1218.008" ] ; fhir:display [ fhir:v "Odbcconf" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1218" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1218.015" ] ; fhir:display [ fhir:v "Electron Applications" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1218" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1218.012" ] ; fhir:display [ fhir:v "Verclsid" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1218" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1218.013" ] ; fhir:display [ fhir:v "Mavinject" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1218" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1218.002" ] ; fhir:display [ fhir:v "Control Panel" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1218" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1218.001" ] ; fhir:display [ fhir:v "Compiled HTML File" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1218" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1218.010" ] ; fhir:display [ fhir:v "Regsvr32" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1218" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1218.004" ] ; fhir:display [ fhir:v "InstallUtil" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1218" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1218.011" ] ; fhir:display [ fhir:v "Rundll32" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1218" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1218.009" ] ; fhir:display [ fhir:v "Regsvcs/Regasm" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1218" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1218.003" ] ; fhir:display [ fhir:v "CMSTP" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1218" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1218.007" ] ; fhir:display [ fhir:v "Msiexec" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1218" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1620" ] ; fhir:display [ fhir:v "Reflective Code Loading" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1611" ] ; fhir:display [ fhir:v "Escape to Host" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1010" ] ; fhir:display [ fhir:v "Application Window Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1029" ] ; fhir:display [ fhir:v "Scheduled Transfer" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0010" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1525" ] ; fhir:display [ fhir:v "Implant Internal Image" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1572" ] ; fhir:display [ fhir:v "Protocol Tunneling" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1550" ] ; fhir:display [ fhir:v "Use Alternate Authentication Material" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0008" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1550.004" ] ; fhir:display [ fhir:v "Web Session Cookie" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1550" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0008" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1550.001" ] ; fhir:display [ fhir:v "Application Access Token" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1550" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0008" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1550.003" ] ; fhir:display [ fhir:v "Pass the Ticket" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1550" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0008" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1550.002" ] ; fhir:display [ fhir:v "Pass the Hash" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1550" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0008" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1011" ] ; fhir:display [ fhir:v "Exfiltration Over Other Network Medium" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0010" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1011.001" ] ; fhir:display [ fhir:v "Exfiltration Over Bluetooth" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1011" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0010" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1589" ] ; fhir:display [ fhir:v "Gather Victim Identity Information" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1589.003" ] ; fhir:display [ fhir:v "Employee Names" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1589" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1589.002" ] ; fhir:display [ fhir:v "Email Addresses" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1589" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1589.001" ] ; fhir:display [ fhir:v "Credentials" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1589" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1560" ] ; fhir:display [ fhir:v "Archive Collected Data" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1560.002" ] ; fhir:display [ fhir:v "Archive via Library" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1560" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1560.001" ] ; fhir:display [ fhir:v "Archive via Utility" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1560" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1560.003" ] ; fhir:display [ fhir:v "Archive via Custom Method" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1560" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1185" ] ; fhir:display [ fhir:v "Browser Session Hijacking" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1021" ] ; fhir:display [ fhir:v "Remote Services" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0008" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1021.006" ] ; fhir:display [ fhir:v "Windows Remote Management" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1021" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0008" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1021.005" ] ; fhir:display [ fhir:v "VNC" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1021" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0008" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1021.002" ] ; fhir:display [ fhir:v "SMB/Windows Admin Shares" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1021" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0008" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1021.007" ] ; fhir:display [ fhir:v "Cloud Services" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1021" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0008" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1021.001" ] ; fhir:display [ fhir:v "Remote Desktop Protocol" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1021" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0008" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1021.003" ] ; fhir:display [ fhir:v "Distributed Component Object Model" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1021" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0008" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1021.008" ] ; fhir:display [ fhir:v "Direct Cloud VM Connections" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1021" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0008" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1021.004" ] ; fhir:display [ fhir:v "SSH" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1021" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0008" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1596" ] ; fhir:display [ fhir:v "Search Open Technical Databases" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1596.003" ] ; fhir:display [ fhir:v "Digital Certificates" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1596" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1596.005" ] ; fhir:display [ fhir:v "Scan Databases" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1596" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1596.001" ] ; fhir:display [ fhir:v "DNS/Passive DNS" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1596" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1596.004" ] ; fhir:display [ fhir:v "CDNs" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1596" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1596.002" ] ; fhir:display [ fhir:v "WHOIS" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1596" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1207" ] ; fhir:display [ fhir:v "Rogue Domain Controller" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1610" ] ; fhir:display [ fhir:v "Deploy Container" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1112" ] ; fhir:display [ fhir:v "Modify Registry" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1580" ] ; fhir:display [ fhir:v "Cloud Infrastructure Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1491" ] ; fhir:display [ fhir:v "Defacement" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1491.002" ] ; fhir:display [ fhir:v "External Defacement" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1491" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1491.001" ] ; fhir:display [ fhir:v "Internal Defacement" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1491" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1535" ] ; fhir:display [ fhir:v "Unused/Unsupported Cloud Regions" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1563" ] ; fhir:display [ fhir:v "Remote Service Session Hijacking" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0008" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1563.002" ] ; fhir:display [ fhir:v "RDP Hijacking" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1563" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0008" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1563.001" ] ; fhir:display [ fhir:v "SSH Hijacking" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1563" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0008" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1217" ] ; fhir:display [ fhir:v "Browser Information Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1681" ] ; fhir:display [ fhir:v "Search Threat Vendor Data" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1674" ] ; fhir:display [ fhir:v "Input Injection" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1092" ] ; fhir:display [ fhir:v "Communication Through Removable Media" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1222" ] ; fhir:display [ fhir:v "File and Directory Permissions Modification" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1222.002" ] ; fhir:display [ fhir:v "Linux and Mac File and Directory Permissions Modification" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1222" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1222.001" ] ; fhir:display [ fhir:v "Windows File and Directory Permissions Modification" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1222" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1595" ] ; fhir:display [ fhir:v "Active Scanning" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1595.003" ] ; fhir:display [ fhir:v "Wordlist Scanning" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1595" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1595.001" ] ; fhir:display [ fhir:v "Scanning IP Blocks" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1595" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1595.002" ] ; fhir:display [ fhir:v "Vulnerability Scanning" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1595" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1548" ] ; fhir:display [ fhir:v "Abuse Elevation Control Mechanism" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1548.001" ] ; fhir:display [ fhir:v "Setuid and Setgid" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1548" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1548.005" ] ; fhir:display [ fhir:v "Temporary Elevated Cloud Access" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1548" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1548.002" ] ; fhir:display [ fhir:v "Bypass User Account Control" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1548" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1548.004" ] ; fhir:display [ fhir:v "Elevated Execution with Prompt" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1548" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1548.003" ] ; fhir:display [ fhir:v "Sudo and Sudo Caching" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1548" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1548.006" ] ; fhir:display [ fhir:v "TCC Manipulation" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1548" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1673" ] ; fhir:display [ fhir:v "Virtual Machine Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1125" ] ; fhir:display [ fhir:v "Video Capture" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1016" ] ; fhir:display [ fhir:v "System Network Configuration Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1016.002" ] ; fhir:display [ fhir:v "Wi-Fi Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1016" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1016.001" ] ; fhir:display [ fhir:v "Internet Connection Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1016" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1087" ] ; fhir:display [ fhir:v "Account Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1087.003" ] ; fhir:display [ fhir:v "Email Account" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1087" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1087.004" ] ; fhir:display [ fhir:v "Cloud Account" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1087" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1087.002" ] ; fhir:display [ fhir:v "Domain Account" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1087" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1087.001" ] ; fhir:display [ fhir:v "Local Account" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1087" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1090" ] ; fhir:display [ fhir:v "Proxy" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1090.001" ] ; fhir:display [ fhir:v "Internal Proxy" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1090" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1090.003" ] ; fhir:display [ fhir:v "Multi-hop Proxy" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1090" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1090.004" ] ; fhir:display [ fhir:v "Domain Fronting" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1090" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1090.002" ] ; fhir:display [ fhir:v "External Proxy" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1090" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1059" ] ; fhir:display [ fhir:v "Command and Scripting Interpreter" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1059.005" ] ; fhir:display [ fhir:v "Visual Basic" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1059" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1059.002" ] ; fhir:display [ fhir:v "AppleScript" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1059" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1059.003" ] ; fhir:display [ fhir:v "Windows Command Shell" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1059" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1059.013" ] ; fhir:display [ fhir:v "Container CLI/API" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1059" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1059.004" ] ; fhir:display [ fhir:v "Unix Shell" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1059" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1059.010" ] ; fhir:display [ fhir:v "AutoHotKey & AutoIT" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1059" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1059.008" ] ; fhir:display [ fhir:v "Network Device CLI" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1059" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1059.012" ] ; fhir:display [ fhir:v "Hypervisor CLI" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1059" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1059.006" ] ; fhir:display [ fhir:v "Python" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1059" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1059.001" ] ; fhir:display [ fhir:v "PowerShell" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1059" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1059.009" ] ; fhir:display [ fhir:v "Cloud API" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1059" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1059.011" ] ; fhir:display [ fhir:v "Lua" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1059" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1059.007" ] ; fhir:display [ fhir:v "JavaScript" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1059" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1677" ] ; fhir:display [ fhir:v "Poisoned Pipeline Execution" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1482" ] ; fhir:display [ fhir:v "Domain Trust Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1020" ] ; fhir:display [ fhir:v "Automated Exfiltration" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0010" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1020.001" ] ; fhir:display [ fhir:v "Traffic Duplication" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1020" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0010" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1070" ] ; fhir:display [ fhir:v "Indicator Removal" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1070.004" ] ; fhir:display [ fhir:v "File Deletion" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1070" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1070.006" ] ; fhir:display [ fhir:v "Timestomp" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1070" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1070.008" ] ; fhir:display [ fhir:v "Clear Mailbox Data" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1070" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1070.002" ] ; fhir:display [ fhir:v "Clear Linux or Mac System Logs" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1070" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1070.001" ] ; fhir:display [ fhir:v "Clear Windows Event Logs" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1070" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1070.009" ] ; fhir:display [ fhir:v "Clear Persistence" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1070" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1070.003" ] ; fhir:display [ fhir:v "Clear Command History" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1070" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1070.010" ] ; fhir:display [ fhir:v "Relocate Malware" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1070" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1070.007" ] ; fhir:display [ fhir:v "Clear Network Connection History and Configurations" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1070" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1070.005" ] ; fhir:display [ fhir:v "Network Share Connection Removal" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1070" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1609" ] ; fhir:display [ fhir:v "Container Administration Command" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1083" ] ; fhir:display [ fhir:v "File and Directory Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1568" ] ; fhir:display [ fhir:v "Dynamic Resolution" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1568.001" ] ; fhir:display [ fhir:v "Fast Flux DNS" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1568" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1568.002" ] ; fhir:display [ fhir:v "Domain Generation Algorithms" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1568" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1568.003" ] ; fhir:display [ fhir:v "DNS Calculation" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1568" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1647" ] ; fhir:display [ fhir:v "Plist File Modification" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1074" ] ; fhir:display [ fhir:v "Data Staged" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1074.001" ] ; fhir:display [ fhir:v "Local Data Staging" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1074" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1074.002" ] ; fhir:display [ fhir:v "Remote Data Staging" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1074" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1649" ] ; fhir:display [ fhir:v "Steal or Forge Authentication Certificates" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1049" ] ; fhir:display [ fhir:v "System Network Connections Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1584" ] ; fhir:display [ fhir:v "Compromise Infrastructure" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1584.003" ] ; fhir:display [ fhir:v "Virtual Private Server" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1584" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1584.002" ] ; fhir:display [ fhir:v "DNS Server" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1584" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1584.006" ] ; fhir:display [ fhir:v "Web Services" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1584" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1584.007" ] ; fhir:display [ fhir:v "Serverless" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1584" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1584.005" ] ; fhir:display [ fhir:v "Botnet" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1584" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1584.004" ] ; fhir:display [ fhir:v "Server" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1584" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1584.008" ] ; fhir:display [ fhir:v "Network Devices" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1584" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1584.001" ] ; fhir:display [ fhir:v "Domains" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1584" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1542" ] ; fhir:display [ fhir:v "Pre-OS Boot" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1542.003" ] ; fhir:display [ fhir:v "Bootkit" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1542" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1542.005" ] ; fhir:display [ fhir:v "TFTP Boot" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1542" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1542.002" ] ; fhir:display [ fhir:v "Component Firmware" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1542" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1542.004" ] ; fhir:display [ fhir:v "ROMMONkit" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1542" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1542.001" ] ; fhir:display [ fhir:v "System Firmware" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1542" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1612" ] ; fhir:display [ fhir:v "Build Image on Host" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1586" ] ; fhir:display [ fhir:v "Compromise Accounts" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1586.003" ] ; fhir:display [ fhir:v "Cloud Accounts" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1586" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1586.002" ] ; fhir:display [ fhir:v "Email Accounts" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1586" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1586.001" ] ; fhir:display [ fhir:v "Social Media Accounts" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1586" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1497" ] ; fhir:display [ fhir:v "Virtualization/Sandbox Evasion" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1497.002" ] ; fhir:display [ fhir:v "User Activity Based Checks" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1497" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1497.001" ] ; fhir:display [ fhir:v "System Checks" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1497" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1497.003" ] ; fhir:display [ fhir:v "Time Based Checks" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1497" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1102" ] ; fhir:display [ fhir:v "Web Service" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1102.003" ] ; fhir:display [ fhir:v "One-Way Communication" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1102" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1102.001" ] ; fhir:display [ fhir:v "Dead Drop Resolver" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1102" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1102.002" ] ; fhir:display [ fhir:v "Bidirectional Communication" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1102" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1608" ] ; fhir:display [ fhir:v "Stage Capabilities" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1608.004" ] ; fhir:display [ fhir:v "Drive-by Target" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1608" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1608.005" ] ; fhir:display [ fhir:v "Link Target" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1608" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1608.006" ] ; fhir:display [ fhir:v "SEO Poisoning" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1608" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1608.003" ] ; fhir:display [ fhir:v "Install Digital Certificate" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1608" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1608.002" ] ; fhir:display [ fhir:v "Upload Tool" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1608" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1608.001" ] ; fhir:display [ fhir:v "Upload Malware" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1608" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1104" ] ; fhir:display [ fhir:v "Multi-Stage Channels" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1657" ] ; fhir:display [ fhir:v "Financial Theft" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1480" ] ; fhir:display [ fhir:v "Execution Guardrails" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1480.001" ] ; fhir:display [ fhir:v "Environmental Keying" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1480" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1480.002" ] ; fhir:display [ fhir:v "Mutual Exclusion" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1480" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1619" ] ; fhir:display [ fhir:v "Cloud Storage Object Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1654" ] ; fhir:display [ fhir:v "Log Enumeration" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1528" ] ; fhir:display [ fhir:v "Steal Application Access Token" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1204" ] ; fhir:display [ fhir:v "User Execution" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1204.005" ] ; fhir:display [ fhir:v "Malicious Library" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1204" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1204.002" ] ; fhir:display [ fhir:v "Malicious File" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1204" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1204.003" ] ; fhir:display [ fhir:v "Malicious Image" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1204" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1204.001" ] ; fhir:display [ fhir:v "Malicious Link" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1204" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1204.004" ] ; fhir:display [ fhir:v "Malicious Copy and Paste" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1204" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1057" ] ; fhir:display [ fhir:v "Process Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1072" ] ; fhir:display [ fhir:v "Software Deployment Tools" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0008" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1041" ] ; fhir:display [ fhir:v "Exfiltration Over C2 Channel" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0010" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1591" ] ; fhir:display [ fhir:v "Gather Victim Org Information" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1591.002" ] ; fhir:display [ fhir:v "Business Relationships" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1591" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1591.001" ] ; fhir:display [ fhir:v "Determine Physical Locations" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1591" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1591.004" ] ; fhir:display [ fhir:v "Identify Roles" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1591" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1591.003" ] ; fhir:display [ fhir:v "Identify Business Tempo" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1591" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1606" ] ; fhir:display [ fhir:v "Forge Web Credentials" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1606.001" ] ; fhir:display [ fhir:v "Web Cookies" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1606" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1606.002" ] ; fhir:display [ fhir:v "SAML Tokens" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1606" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1621" ] ; fhir:display [ fhir:v "Multi-Factor Authentication Request Generation" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1554" ] ; fhir:display [ fhir:v "Compromise Host Software Binary" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1679" ] ; fhir:display [ fhir:v "Selective Exclusion" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1212" ] ; fhir:display [ fhir:v "Exploitation for Credential Access" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1590" ] ; fhir:display [ fhir:v "Gather Victim Network Information" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1590.001" ] ; fhir:display [ fhir:v "Domain Properties" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1590" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1590.002" ] ; fhir:display [ fhir:v "DNS" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1590" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1590.005" ] ; fhir:display [ fhir:v "IP Addresses" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1590" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1590.003" ] ; fhir:display [ fhir:v "Network Trust Dependencies" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1590" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1590.004" ] ; fhir:display [ fhir:v "Network Topology" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1590" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1590.006" ] ; fhir:display [ fhir:v "Network Security Appliances" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1590" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1210" ] ; fhir:display [ fhir:v "Exploitation of Remote Services" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0008" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1534" ] ; fhir:display [ fhir:v "Internal Spearphishing" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0008" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1199" ] ; fhir:display [ fhir:v "Trusted Relationship" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0001" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1593" ] ; fhir:display [ fhir:v "Search Open Websites/Domains" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1593.002" ] ; fhir:display [ fhir:v "Search Engines" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1593" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1593.003" ] ; fhir:display [ fhir:v "Code Repositories" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1593" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1593.001" ] ; fhir:display [ fhir:v "Social Media" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1593" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1098" ] ; fhir:display [ fhir:v "Account Manipulation" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1098.001" ] ; fhir:display [ fhir:v "Additional Cloud Credentials" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1098" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1098.002" ] ; fhir:display [ fhir:v "Additional Email Delegate Permissions" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1098" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1098.003" ] ; fhir:display [ fhir:v "Additional Cloud Roles" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1098" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1098.005" ] ; fhir:display [ fhir:v "Device Registration" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1098" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1098.006" ] ; fhir:display [ fhir:v "Additional Container Cluster Roles" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1098" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1098.004" ] ; fhir:display [ fhir:v "SSH Authorized Keys" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1098" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1098.007" ] ; fhir:display [ fhir:v "Additional Local or Domain Groups" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1098" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1048" ] ; fhir:display [ fhir:v "Exfiltration Over Alternative Protocol" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0010" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1048.002" ] ; fhir:display [ fhir:v "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1048" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0010" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1048.003" ] ; fhir:display [ fhir:v "Exfiltration Over Unencrypted Non-C2 Protocol" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1048" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0010" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1048.001" ] ; fhir:display [ fhir:v "Exfiltration Over Symmetric Encrypted Non-C2 Protocol" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1048" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0010" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1678" ] ; fhir:display [ fhir:v "Delay Execution" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1597" ] ; fhir:display [ fhir:v "Search Closed Sources" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1597.001" ] ; fhir:display [ fhir:v "Threat Intel Vendors" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1597" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1597.002" ] ; fhir:display [ fhir:v "Purchase Technical Data" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1597" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1566" ] ; fhir:display [ fhir:v "Phishing" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0001" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1566.002" ] ; fhir:display [ fhir:v "Spearphishing Link" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1566" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0001" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1566.001" ] ; fhir:display [ fhir:v "Spearphishing Attachment" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1566" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0001" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1566.004" ] ; fhir:display [ fhir:v "Spearphishing Voice" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1566" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0001" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1566.003" ] ; fhir:display [ fhir:v "Spearphishing via Service" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1566" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0001" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1110" ] ; fhir:display [ fhir:v "Brute Force" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1110.004" ] ; fhir:display [ fhir:v "Credential Stuffing" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1110" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1110.002" ] ; fhir:display [ fhir:v "Password Cracking" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1110" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1110.001" ] ; fhir:display [ fhir:v "Password Guessing" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1110" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1110.003" ] ; fhir:display [ fhir:v "Password Spraying" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1110" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1565" ] ; fhir:display [ fhir:v "Data Manipulation" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1565.002" ] ; fhir:display [ fhir:v "Transmitted Data Manipulation" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1565" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1565.003" ] ; fhir:display [ fhir:v "Runtime Data Manipulation" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1565" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1565.001" ] ; fhir:display [ fhir:v "Stored Data Manipulation" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1565" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1559" ] ; fhir:display [ fhir:v "Inter-Process Communication" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1559.003" ] ; fhir:display [ fhir:v "XPC Services" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1559" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1559.002" ] ; fhir:display [ fhir:v "Dynamic Data Exchange" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1559" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1559.001" ] ; fhir:display [ fhir:v "Component Object Model" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1559" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1001" ] ; fhir:display [ fhir:v "Data Obfuscation" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1001.001" ] ; fhir:display [ fhir:v "Junk Data" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1001" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1001.003" ] ; fhir:display [ fhir:v "Protocol or Service Impersonation" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1001" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1001.002" ] ; fhir:display [ fhir:v "Steganography" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1001" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1039" ] ; fhir:display [ fhir:v "Data from Network Shared Drive" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1601" ] ; fhir:display [ fhir:v "Modify System Image" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1601.002" ] ; fhir:display [ fhir:v "Downgrade System Image" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1601" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1601.001" ] ; fhir:display [ fhir:v "Patch System Image" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1601" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1574" ] ; fhir:display [ fhir:v "Hijack Execution Flow" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1574.010" ] ; fhir:display [ fhir:v "Services File Permissions Weakness" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1574" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1574.013" ] ; fhir:display [ fhir:v "KernelCallbackTable" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1574" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1574.007" ] ; fhir:display [ fhir:v "Path Interception by PATH Environment Variable" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1574" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1574.005" ] ; fhir:display [ fhir:v "Executable Installer File Permissions Weakness" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1574" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1574.009" ] ; fhir:display [ fhir:v "Path Interception by Unquoted Path" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1574" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1574.004" ] ; fhir:display [ fhir:v "Dylib Hijacking" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1574" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1574.006" ] ; fhir:display [ fhir:v "Dynamic Linker Hijacking" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1574" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1574.014" ] ; fhir:display [ fhir:v "AppDomainManager" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1574" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1574.001" ] ; fhir:display [ fhir:v "DLL" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1574" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1574.008" ] ; fhir:display [ fhir:v "Path Interception by Search Order Hijacking" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1574" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1574.011" ] ; fhir:display [ fhir:v "Services Registry Permissions Weakness" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1574" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1574.012" ] ; fhir:display [ fhir:v "COR_PROFILER" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1574" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1078" ] ; fhir:display [ fhir:v "Valid Accounts" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0001" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1078.004" ] ; fhir:display [ fhir:v "Cloud Accounts" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1078" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0001" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1078.002" ] ; fhir:display [ fhir:v "Domain Accounts" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1078" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0001" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1078.003" ] ; fhir:display [ fhir:v "Local Accounts" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1078" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0001" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1078.001" ] ; fhir:display [ fhir:v "Default Accounts" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1078" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0001" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1571" ] ; fhir:display [ fhir:v "Non-Standard Port" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1068" ] ; fhir:display [ fhir:v "Exploitation for Privilege Escalation" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1531" ] ; fhir:display [ fhir:v "Account Access Removal" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1027" ] ; fhir:display [ fhir:v "Obfuscated Files or Information" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1027.005" ] ; fhir:display [ fhir:v "Indicator Removal from Tools" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1027" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1027.009" ] ; fhir:display [ fhir:v "Embedded Payloads" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1027" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1027.013" ] ; fhir:display [ fhir:v "Encrypted/Encoded File" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1027" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1027.012" ] ; fhir:display [ fhir:v "LNK Icon Smuggling" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1027" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1027.017" ] ; fhir:display [ fhir:v "SVG Smuggling" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1027" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1027.006" ] ; fhir:display [ fhir:v "HTML Smuggling" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1027" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1027.011" ] ; fhir:display [ fhir:v "Fileless Storage" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1027" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1027.014" ] ; fhir:display [ fhir:v "Polymorphic Code" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1027" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1027.010" ] ; fhir:display [ fhir:v "Command Obfuscation" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1027" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1027.004" ] ; fhir:display [ fhir:v "Compile After Delivery" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1027" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1027.007" ] ; fhir:display [ fhir:v "Dynamic API Resolution" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1027" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1027.003" ] ; fhir:display [ fhir:v "Steganography" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1027" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1027.015" ] ; fhir:display [ fhir:v "Compression" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1027" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1027.016" ] ; fhir:display [ fhir:v "Junk Code Insertion" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1027" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1027.008" ] ; fhir:display [ fhir:v "Stripped Payloads" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1027" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1027.002" ] ; fhir:display [ fhir:v "Software Packing" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1027" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1027.001" ] ; fhir:display [ fhir:v "Binary Padding" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1027" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1201" ] ; fhir:display [ fhir:v "Password Policy Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1546" ] ; fhir:display [ fhir:v "Event Triggered Execution" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1546.002" ] ; fhir:display [ fhir:v "Screensaver" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1546" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1546.013" ] ; fhir:display [ fhir:v "PowerShell Profile" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1546" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1546.016" ] ; fhir:display [ fhir:v "Installer Packages" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1546" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1546.003" ] ; fhir:display [ fhir:v "Windows Management Instrumentation Event Subscription" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1546" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1546.006" ] ; fhir:display [ fhir:v "LC_LOAD_DYLIB Addition" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1546" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1546.018" ] ; fhir:display [ fhir:v "Python Startup Hooks" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1546" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1546.011" ] ; fhir:display [ fhir:v "Application Shimming" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1546" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1546.015" ] ; fhir:display [ fhir:v "Component Object Model Hijacking" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1546" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1546.004" ] ; fhir:display [ fhir:v "Unix Shell Configuration Modification" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1546" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1546.010" ] ; fhir:display [ fhir:v "AppInit DLLs" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1546" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1546.005" ] ; fhir:display [ fhir:v "Trap" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1546" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1546.007" ] ; fhir:display [ fhir:v "Netsh Helper DLL" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1546" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1546.012" ] ; fhir:display [ fhir:v "Image File Execution Options Injection" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1546" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1546.001" ] ; fhir:display [ fhir:v "Change Default File Association" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1546" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1546.009" ] ; fhir:display [ fhir:v "AppCert DLLs" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1546" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1546.017" ] ; fhir:display [ fhir:v "Udev Rules" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1546" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1546.014" ] ; fhir:display [ fhir:v "Emond" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1546" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1546.008" ] ; fhir:display [ fhir:v "Accessibility Features" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1546" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1187" ] ; fhir:display [ fhir:v "Forced Authentication" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1599" ] ; fhir:display [ fhir:v "Network Boundary Bridging" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1599.001" ] ; fhir:display [ fhir:v "Network Address Translation Traversal" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1599" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1486" ] ; fhir:display [ fhir:v "Data Encrypted for Impact" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1553" ] ; fhir:display [ fhir:v "Subvert Trust Controls" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1553.005" ] ; fhir:display [ fhir:v "Mark-of-the-Web Bypass" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1553" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1553.002" ] ; fhir:display [ fhir:v "Code Signing" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1553" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1553.004" ] ; fhir:display [ fhir:v "Install Root Certificate" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1553" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1553.003" ] ; fhir:display [ fhir:v "SIP and Trust Provider Hijacking" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1553" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1553.006" ] ; fhir:display [ fhir:v "Code Signing Policy Modification" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1553" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1553.001" ] ; fhir:display [ fhir:v "Gatekeeper Bypass" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1553" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1573" ] ; fhir:display [ fhir:v "Encrypted Channel" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1573.002" ] ; fhir:display [ fhir:v "Asymmetric Cryptography" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1573" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1573.001" ] ; fhir:display [ fhir:v "Symmetric Cryptography" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1573" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1056" ] ; fhir:display [ fhir:v "Input Capture" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1056.001" ] ; fhir:display [ fhir:v "Keylogging" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1056" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1056.002" ] ; fhir:display [ fhir:v "GUI Input Capture" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1056" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1056.004" ] ; fhir:display [ fhir:v "Credential API Hooking" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1056" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1056.003" ] ; fhir:display [ fhir:v "Web Portal Capture" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1056" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1203" ] ; fhir:display [ fhir:v "Exploitation for Client Execution" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1667" ] ; fhir:display [ fhir:v "Email Bombing" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1570" ] ; fhir:display [ fhir:v "Lateral Tool Transfer" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0008" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1095" ] ; fhir:display [ fhir:v "Non-Application Layer Protocol" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1671" ] ; fhir:display [ fhir:v "Cloud Application Integration" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1012" ] ; fhir:display [ fhir:v "Query Registry" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1030" ] ; fhir:display [ fhir:v "Data Transfer Size Limits" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0010" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1499" ] ; fhir:display [ fhir:v "Endpoint Denial of Service" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1499.003" ] ; fhir:display [ fhir:v "Application Exhaustion Flood" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1499" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1499.002" ] ; fhir:display [ fhir:v "Service Exhaustion Flood" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1499" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1499.004" ] ; fhir:display [ fhir:v "Application or System Exploitation" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1499" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1499.001" ] ; fhir:display [ fhir:v "OS Exhaustion Flood" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1499" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1614" ] ; fhir:display [ fhir:v "System Location Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1614.001" ] ; fhir:display [ fhir:v "System Language Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1614" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1197" ] ; fhir:display [ fhir:v "BITS Jobs" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1656" ] ; fhir:display [ fhir:v "Impersonation" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1132" ] ; fhir:display [ fhir:v "Data Encoding" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1132.001" ] ; fhir:display [ fhir:v "Standard Encoding" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1132" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1132.002" ] ; fhir:display [ fhir:v "Non-Standard Encoding" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1132" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1598" ] ; fhir:display [ fhir:v "Phishing for Information" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1598.004" ] ; fhir:display [ fhir:v "Spearphishing Voice" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1598" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1598.001" ] ; fhir:display [ fhir:v "Spearphishing Service" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1598" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1598.002" ] ; fhir:display [ fhir:v "Spearphishing Attachment" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1598" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1598.003" ] ; fhir:display [ fhir:v "Spearphishing Link" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1598" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0043" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1496" ] ; fhir:display [ fhir:v "Resource Hijacking" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1496.001" ] ; fhir:display [ fhir:v "Compute Hijacking" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1496" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1496.002" ] ; fhir:display [ fhir:v "Bandwidth Hijacking" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1496" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1496.004" ] ; fhir:display [ fhir:v "Cloud Service Hijacking" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1496" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1496.003" ] ; fhir:display [ fhir:v "SMS Pumping" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1496" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1585" ] ; fhir:display [ fhir:v "Establish Accounts" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1585.003" ] ; fhir:display [ fhir:v "Cloud Accounts" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1585" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1585.002" ] ; fhir:display [ fhir:v "Email Accounts" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1585" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1585.001" ] ; fhir:display [ fhir:v "Social Media Accounts" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1585" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1588" ] ; fhir:display [ fhir:v "Obtain Capabilities" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1588.006" ] ; fhir:display [ fhir:v "Vulnerabilities" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1588" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1588.005" ] ; fhir:display [ fhir:v "Exploits" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1588" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1588.007" ] ; fhir:display [ fhir:v "Artificial Intelligence" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1588" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1588.004" ] ; fhir:display [ fhir:v "Digital Certificates" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1588" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1588.002" ] ; fhir:display [ fhir:v "Tool" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1588" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1588.003" ] ; fhir:display [ fhir:v "Code Signing Certificates" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1588" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1588.001" ] ; fhir:display [ fhir:v "Malware" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1588" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1569" ] ; fhir:display [ fhir:v "System Services" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1569.003" ] ; fhir:display [ fhir:v "Systemctl" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1569" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1569.002" ] ; fhir:display [ fhir:v "Service Execution" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1569" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1569.001" ] ; fhir:display [ fhir:v "Launchctl" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1569" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1650" ] ; fhir:display [ fhir:v "Acquire Access" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1213" ] ; fhir:display [ fhir:v "Data from Information Repositories" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1213.003" ] ; fhir:display [ fhir:v "Code Repositories" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1213" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1213.006" ] ; fhir:display [ fhir:v "Databases" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1213" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1213.005" ] ; fhir:display [ fhir:v "Messaging Applications" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1213" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1213.004" ] ; fhir:display [ fhir:v "Customer Relationship Management Software" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1213" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1213.002" ] ; fhir:display [ fhir:v "Sharepoint" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1213" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1213.001" ] ; fhir:display [ fhir:v "Confluence" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1213" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0009" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1200" ] ; fhir:display [ fhir:v "Hardware Additions" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0001" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1505" ] ; fhir:display [ fhir:v "Server Software Component" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1505.002" ] ; fhir:display [ fhir:v "Transport Agent" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1505" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1505.004" ] ; fhir:display [ fhir:v "IIS Components" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1505" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1505.003" ] ; fhir:display [ fhir:v "Web Shell" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1505" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1505.005" ] ; fhir:display [ fhir:v "Terminal Services DLL" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1505" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1505.006" ] ; fhir:display [ fhir:v "vSphere Installation Bundles" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1505" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1505.001" ] ; fhir:display [ fhir:v "SQL Stored Procedures" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1505" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1485" ] ; fhir:display [ fhir:v "Data Destruction" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1485.001" ] ; fhir:display [ fhir:v "Lifecycle-Triggered Deletion" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1485" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1537" ] ; fhir:display [ fhir:v "Transfer Data to Cloud Account" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0010" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1189" ] ; fhir:display [ fhir:v "Drive-by Compromise" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0001" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1498" ] ; fhir:display [ fhir:v "Network Denial of Service" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1498.002" ] ; fhir:display [ fhir:v "Reflection Amplification" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1498" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1498.001" ] ; fhir:display [ fhir:v "Direct Network Flood" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1498" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1651" ] ; fhir:display [ fhir:v "Cloud Administration Command" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1221" ] ; fhir:display [ fhir:v "Template Injection" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1134" ] ; fhir:display [ fhir:v "Access Token Manipulation" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1134.001" ] ; fhir:display [ fhir:v "Token Impersonation/Theft" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1134" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1134.004" ] ; fhir:display [ fhir:v "Parent PID Spoofing" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1134" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1134.005" ] ; fhir:display [ fhir:v "SID-History Injection" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1134" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1134.002" ] ; fhir:display [ fhir:v "Create Process with Token" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1134" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1134.003" ] ; fhir:display [ fhir:v "Make and Impersonate Token" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1134" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1111" ] ; fhir:display [ fhir:v "Multi-Factor Authentication Interception" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1668" ] ; fhir:display [ fhir:v "Exclusive Control" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1136" ] ; fhir:display [ fhir:v "Create Account" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1136.003" ] ; fhir:display [ fhir:v "Cloud Account" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1136" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1136.001" ] ; fhir:display [ fhir:v "Local Account" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1136" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1136.002" ] ; fhir:display [ fhir:v "Domain Account" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1136" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1672" ] ; fhir:display [ fhir:v "Email Spoofing" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1526" ] ; fhir:display [ fhir:v "Cloud Service Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1018" ] ; fhir:display [ fhir:v "Remote System Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1046" ] ; fhir:display [ fhir:v "Network Service Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1518" ] ; fhir:display [ fhir:v "Software Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1518.001" ] ; fhir:display [ fhir:v "Security Software Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1518" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1518.002" ] ; fhir:display [ fhir:v "Backup Software Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1518" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1538" ] ; fhir:display [ fhir:v "Cloud Service Dashboard" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1622" ] ; fhir:display [ fhir:v "Debugger Evasion" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1052" ] ; fhir:display [ fhir:v "Exfiltration Over Physical Medium" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0010" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1052.001" ] ; fhir:display [ fhir:v "Exfiltration over USB" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1052" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0010" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1105" ] ; fhir:display [ fhir:v "Ingress Tool Transfer" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1648" ] ; fhir:display [ fhir:v "Serverless Execution" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0002" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1653" ] ; fhir:display [ fhir:v "Power Settings" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1665" ] ; fhir:display [ fhir:v "Hide Infrastructure" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1484" ] ; fhir:display [ fhir:v "Domain or Tenant Policy Modification" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1484.002" ] ; fhir:display [ fhir:v "Trust Modification" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1484" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1484.001" ] ; fhir:display [ fhir:v "Group Policy Modification" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1484" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0004" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1220" ] ; fhir:display [ fhir:v "XSL Script Processing" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1587" ] ; fhir:display [ fhir:v "Develop Capabilities" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1587.002" ] ; fhir:display [ fhir:v "Code Signing Certificates" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1587" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1587.003" ] ; fhir:display [ fhir:v "Digital Certificates" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1587" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1587.004" ] ; fhir:display [ fhir:v "Exploits" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1587" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1587.001" ] ; fhir:display [ fhir:v "Malware" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1587" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0042" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1008" ] ; fhir:display [ fhir:v "Fallback Channels" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0011" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1680" ] ; fhir:display [ fhir:v "Local Storage Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1124" ] ; fhir:display [ fhir:v "System Time Discovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0007" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1556" ] ; fhir:display [ fhir:v "Modify Authentication Process" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1556.004" ] ; fhir:display [ fhir:v "Network Device Authentication" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1556" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1556.001" ] ; fhir:display [ fhir:v "Domain Controller Authentication" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1556" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1556.009" ] ; fhir:display [ fhir:v "Conditional Access Policies" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1556" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1556.008" ] ; fhir:display [ fhir:v "Network Provider DLL" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1556" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1556.002" ] ; fhir:display [ fhir:v "Password Filter DLL" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1556" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1556.006" ] ; fhir:display [ fhir:v "Multi-Factor Authentication" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1556" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1556.007" ] ; fhir:display [ fhir:v "Hybrid Identity" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1556" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1556.005" ] ; fhir:display [ fhir:v "Reversible Encryption" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1556" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1556.003" ] ; fhir:display [ fhir:v "Pluggable Authentication Modules" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1556" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0006" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0003" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1495" ] ; fhir:display [ fhir:v "Firmware Corruption" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1490" ] ; fhir:display [ fhir:v "Inhibit System Recovery" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1216" ] ; fhir:display [ fhir:v "System Script Proxy Execution" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1216.001" ] ; fhir:display [ fhir:v "PubPrn" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1216" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1216.002" ] ; fhir:display [ fhir:v "SyncAppvPublishingServer" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1216" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1669" ] ; fhir:display [ fhir:v "Wi-Fi Networks" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0001" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1211" ] ; fhir:display [ fhir:v "Exploitation for Defense Evasion" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1127" ] ; fhir:display [ fhir:v "Trusted Developer Utilities Proxy Execution" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] [ fhir:code [ fhir:v "T1127.001" ] ; fhir:display [ fhir:v "MSBuild" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1127" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1127.002" ] ; fhir:display [ fhir:v "ClickOnce" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1127" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1127.003" ] ; fhir:display [ fhir:v "JamPlus" ] ; ( fhir:property [ fhir:code [ fhir:v "parentTechnique" ] ; fhir:value [ a fhir:Code ; fhir:v "T1127" ] ] [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0005" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v true ] ] ) ] [ fhir:code [ fhir:v "T1529" ] ; fhir:display [ fhir:v "System Shutdown/Reboot" ] ; ( fhir:property [ fhir:code [ fhir:v "tactic" ] ; fhir:value [ a fhir:Code ; fhir:v "TA0040" ] ] [ fhir:code [ fhir:v "isSubtechnique" ] ; fhir:value [ a fhir:Boolean ; fhir:v false ] ] ) ] ) . #
IG © 2026+ ATTCK2FHIR IG.
Package fhir.attck#0.0.5 based on FHIR 4.0.1.
Generated
2026-04-26
Links: Table of Contents |
QA Report