ATTCK2FHIR Implementation Guide - Local Development build (v0.0.5) built by the FHIR (HL7® FHIR® Standard) Build Tools. See the Directory of published versions

• Narrative Content
• XML
• JSON
• TTL

: CS MITRE ATT&CK Techniques and Subtechniques

Draft as of 2026-04-26

Raw xml | Download

<CodeSystem xmlns="http://hl7.org/fhir">
  <id value="MITRE-ATTCK-Techniques"/>
  <language value="en"/>
  <text>
    <status value="generated"/>
    <div xmlns="http://www.w3.org/1999/xhtml"><p class="res-header-id"><b>Generated Narrative: CodeSystem MITRE-ATTCK-Techniques</b></p><a name="MITRE-ATTCK-Techniques"> </a><a name="hcMITRE-ATTCK-Techniques"> </a><p><b>Properties</b></p><p><b>This code system defines the following properties for its concepts</b></p><table class="grid"><tr><td><b>Name</b></td><td><b>Code</b></td><td><b>URI</b></td><td><b>Type</b></td><td><b>Description</b></td></tr><tr><td>tactic</td><td>tactic</td><td>https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Tactics</td><td>code</td><td>The tactic(s) this technique or subtechnique contributes to, referenced by tactic ID</td></tr><tr><td>parentTechnique</td><td>parentTechnique</td><td>https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Techniques</td><td>code</td><td>The parent technique of this subtechnique, referenced by ATT&amp;CK ID</td></tr><tr><td>isSubtechnique</td><td>isSubtechnique</td><td/><td>boolean</td><td>Whether this concept is a subtechnique</td></tr></table><p><b>Concepts</b></p><p>This case-sensitive code system <code>https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Techniques</code> defines the following codes:</p><table class="codes"><tr><td style="white-space:nowrap"><b>Code</b></td><td><b>Display</b></td><td><b>tactic</b></td><td><b>parentTechnique</b></td><td><b>isSubtechnique</b></td></tr><tr><td style="white-space:nowrap">T1047<a name="MITRE-ATTCK-Techniques-T1047"> </a></td><td>Windows Management Instrumentation</td><td>TA0002</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1113<a name="MITRE-ATTCK-Techniques-T1113"> </a></td><td>Screen Capture</td><td>TA0009</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1037<a name="MITRE-ATTCK-Techniques-T1037"> </a></td><td>Boot or Logon Initialization Scripts</td><td>TA0003, TA0004</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1037.004<a name="MITRE-ATTCK-Techniques-T1037.46004"> </a></td><td>RC Scripts</td><td>TA0003, TA0004</td><td>T1037</td><td>true</td></tr><tr><td style="white-space:nowrap">T1037.001<a name="MITRE-ATTCK-Techniques-T1037.46001"> </a></td><td>Logon Script (Windows)</td><td>TA0003, TA0004</td><td>T1037</td><td>true</td></tr><tr><td style="white-space:nowrap">T1037.003<a name="MITRE-ATTCK-Techniques-T1037.46003"> </a></td><td>Network Logon Script</td><td>TA0003, TA0004</td><td>T1037</td><td>true</td></tr><tr><td style="white-space:nowrap">T1037.005<a name="MITRE-ATTCK-Techniques-T1037.46005"> </a></td><td>Startup Items</td><td>TA0003, TA0004</td><td>T1037</td><td>true</td></tr><tr><td style="white-space:nowrap">T1037.002<a name="MITRE-ATTCK-Techniques-T1037.46002"> </a></td><td>Login Hook</td><td>TA0003, TA0004</td><td>T1037</td><td>true</td></tr><tr><td style="white-space:nowrap">T1557<a name="MITRE-ATTCK-Techniques-T1557"> </a></td><td>Adversary-in-the-Middle</td><td>TA0006, TA0009</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1557.003<a name="MITRE-ATTCK-Techniques-T1557.46003"> </a></td><td>DHCP Spoofing</td><td>TA0006, TA0009</td><td>T1557</td><td>true</td></tr><tr><td style="white-space:nowrap">T1557.002<a name="MITRE-ATTCK-Techniques-T1557.46002"> </a></td><td>ARP Cache Poisoning</td><td>TA0006, TA0009</td><td>T1557</td><td>true</td></tr><tr><td style="white-space:nowrap">T1557.001<a name="MITRE-ATTCK-Techniques-T1557.46001"> </a></td><td>LLMNR/NBT-NS Poisoning and SMB Relay</td><td>TA0006, TA0009</td><td>T1557</td><td>true</td></tr><tr><td style="white-space:nowrap">T1557.004<a name="MITRE-ATTCK-Techniques-T1557.46004"> </a></td><td>Evil Twin</td><td>TA0006, TA0009</td><td>T1557</td><td>true</td></tr><tr><td style="white-space:nowrap">T1033<a name="MITRE-ATTCK-Techniques-T1033"> </a></td><td>System Owner/User Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1583<a name="MITRE-ATTCK-Techniques-T1583"> </a></td><td>Acquire Infrastructure</td><td>TA0042</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1583.008<a name="MITRE-ATTCK-Techniques-T1583.46008"> </a></td><td>Malvertising</td><td>TA0042</td><td>T1583</td><td>true</td></tr><tr><td style="white-space:nowrap">T1583.001<a name="MITRE-ATTCK-Techniques-T1583.46001"> </a></td><td>Domains</td><td>TA0042</td><td>T1583</td><td>true</td></tr><tr><td style="white-space:nowrap">T1583.005<a name="MITRE-ATTCK-Techniques-T1583.46005"> </a></td><td>Botnet</td><td>TA0042</td><td>T1583</td><td>true</td></tr><tr><td style="white-space:nowrap">T1583.004<a name="MITRE-ATTCK-Techniques-T1583.46004"> </a></td><td>Server</td><td>TA0042</td><td>T1583</td><td>true</td></tr><tr><td style="white-space:nowrap">T1583.002<a name="MITRE-ATTCK-Techniques-T1583.46002"> </a></td><td>DNS Server</td><td>TA0042</td><td>T1583</td><td>true</td></tr><tr><td style="white-space:nowrap">T1583.003<a name="MITRE-ATTCK-Techniques-T1583.46003"> </a></td><td>Virtual Private Server</td><td>TA0042</td><td>T1583</td><td>true</td></tr><tr><td style="white-space:nowrap">T1583.007<a name="MITRE-ATTCK-Techniques-T1583.46007"> </a></td><td>Serverless</td><td>TA0042</td><td>T1583</td><td>true</td></tr><tr><td style="white-space:nowrap">T1583.006<a name="MITRE-ATTCK-Techniques-T1583.46006"> </a></td><td>Web Services</td><td>TA0042</td><td>T1583</td><td>true</td></tr><tr><td style="white-space:nowrap">T1613<a name="MITRE-ATTCK-Techniques-T1613"> </a></td><td>Container and Resource Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1592<a name="MITRE-ATTCK-Techniques-T1592"> </a></td><td>Gather Victim Host Information</td><td>TA0043</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1592.001<a name="MITRE-ATTCK-Techniques-T1592.46001"> </a></td><td>Hardware</td><td>TA0043</td><td>T1592</td><td>true</td></tr><tr><td style="white-space:nowrap">T1592.003<a name="MITRE-ATTCK-Techniques-T1592.46003"> </a></td><td>Firmware</td><td>TA0043</td><td>T1592</td><td>true</td></tr><tr><td style="white-space:nowrap">T1592.002<a name="MITRE-ATTCK-Techniques-T1592.46002"> </a></td><td>Software</td><td>TA0043</td><td>T1592</td><td>true</td></tr><tr><td style="white-space:nowrap">T1592.004<a name="MITRE-ATTCK-Techniques-T1592.46004"> </a></td><td>Client Configurations</td><td>TA0043</td><td>T1592</td><td>true</td></tr><tr><td style="white-space:nowrap">T1003<a name="MITRE-ATTCK-Techniques-T1003"> </a></td><td>OS Credential Dumping</td><td>TA0006</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1003.002<a name="MITRE-ATTCK-Techniques-T1003.46002"> </a></td><td>Security Account Manager</td><td>TA0006</td><td>T1003</td><td>true</td></tr><tr><td style="white-space:nowrap">T1003.004<a name="MITRE-ATTCK-Techniques-T1003.46004"> </a></td><td>LSA Secrets</td><td>TA0006</td><td>T1003</td><td>true</td></tr><tr><td style="white-space:nowrap">T1003.006<a name="MITRE-ATTCK-Techniques-T1003.46006"> </a></td><td>DCSync</td><td>TA0006</td><td>T1003</td><td>true</td></tr><tr><td style="white-space:nowrap">T1003.007<a name="MITRE-ATTCK-Techniques-T1003.46007"> </a></td><td>Proc Filesystem</td><td>TA0006</td><td>T1003</td><td>true</td></tr><tr><td style="white-space:nowrap">T1003.003<a name="MITRE-ATTCK-Techniques-T1003.46003"> </a></td><td>NTDS</td><td>TA0006</td><td>T1003</td><td>true</td></tr><tr><td style="white-space:nowrap">T1003.005<a name="MITRE-ATTCK-Techniques-T1003.46005"> </a></td><td>Cached Domain Credentials</td><td>TA0006</td><td>T1003</td><td>true</td></tr><tr><td style="white-space:nowrap">T1003.001<a name="MITRE-ATTCK-Techniques-T1003.46001"> </a></td><td>LSASS Memory</td><td>TA0006</td><td>T1003</td><td>true</td></tr><tr><td style="white-space:nowrap">T1003.008<a name="MITRE-ATTCK-Techniques-T1003.46008"> </a></td><td>/etc/passwd and /etc/shadow</td><td>TA0006</td><td>T1003</td><td>true</td></tr><tr><td style="white-space:nowrap">T1129<a name="MITRE-ATTCK-Techniques-T1129"> </a></td><td>Shared Modules</td><td>TA0002</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1602<a name="MITRE-ATTCK-Techniques-T1602"> </a></td><td>Data from Configuration Repository</td><td>TA0009</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1602.002<a name="MITRE-ATTCK-Techniques-T1602.46002"> </a></td><td>Network Device Configuration Dump</td><td>TA0009</td><td>T1602</td><td>true</td></tr><tr><td style="white-space:nowrap">T1602.001<a name="MITRE-ATTCK-Techniques-T1602.46001"> </a></td><td>SNMP (MIB Dump)</td><td>TA0009</td><td>T1602</td><td>true</td></tr><tr><td style="white-space:nowrap">T1006<a name="MITRE-ATTCK-Techniques-T1006"> </a></td><td>Direct Volume Access</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1666<a name="MITRE-ATTCK-Techniques-T1666"> </a></td><td>Modify Cloud Resource Hierarchy</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1014<a name="MITRE-ATTCK-Techniques-T1014"> </a></td><td>Rootkit</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1123<a name="MITRE-ATTCK-Techniques-T1123"> </a></td><td>Audio Capture</td><td>TA0009</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1543<a name="MITRE-ATTCK-Techniques-T1543"> </a></td><td>Create or Modify System Process</td><td>TA0003, TA0004</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1543.004<a name="MITRE-ATTCK-Techniques-T1543.46004"> </a></td><td>Launch Daemon</td><td>TA0003, TA0004</td><td>T1543</td><td>true</td></tr><tr><td style="white-space:nowrap">T1543.005<a name="MITRE-ATTCK-Techniques-T1543.46005"> </a></td><td>Container Service</td><td>TA0003, TA0004</td><td>T1543</td><td>true</td></tr><tr><td style="white-space:nowrap">T1543.001<a name="MITRE-ATTCK-Techniques-T1543.46001"> </a></td><td>Launch Agent</td><td>TA0003, TA0004</td><td>T1543</td><td>true</td></tr><tr><td style="white-space:nowrap">T1543.002<a name="MITRE-ATTCK-Techniques-T1543.46002"> </a></td><td>Systemd Service</td><td>TA0003, TA0004</td><td>T1543</td><td>true</td></tr><tr><td style="white-space:nowrap">T1543.003<a name="MITRE-ATTCK-Techniques-T1543.46003"> </a></td><td>Windows Service</td><td>TA0003, TA0004</td><td>T1543</td><td>true</td></tr><tr><td style="white-space:nowrap">T1133<a name="MITRE-ATTCK-Techniques-T1133"> </a></td><td>External Remote Services</td><td>TA0003, TA0001</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1539<a name="MITRE-ATTCK-Techniques-T1539"> </a></td><td>Steal Web Session Cookie</td><td>TA0006</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1578<a name="MITRE-ATTCK-Techniques-T1578"> </a></td><td>Modify Cloud Compute Infrastructure</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1578.001<a name="MITRE-ATTCK-Techniques-T1578.46001"> </a></td><td>Create Snapshot</td><td>TA0005</td><td>T1578</td><td>true</td></tr><tr><td style="white-space:nowrap">T1578.003<a name="MITRE-ATTCK-Techniques-T1578.46003"> </a></td><td>Delete Cloud Instance</td><td>TA0005</td><td>T1578</td><td>true</td></tr><tr><td style="white-space:nowrap">T1578.004<a name="MITRE-ATTCK-Techniques-T1578.46004"> </a></td><td>Revert Cloud Instance</td><td>TA0005</td><td>T1578</td><td>true</td></tr><tr><td style="white-space:nowrap">T1578.002<a name="MITRE-ATTCK-Techniques-T1578.46002"> </a></td><td>Create Cloud Instance</td><td>TA0005</td><td>T1578</td><td>true</td></tr><tr><td style="white-space:nowrap">T1578.005<a name="MITRE-ATTCK-Techniques-T1578.46005"> </a></td><td>Modify Cloud Compute Configurations</td><td>TA0005</td><td>T1578</td><td>true</td></tr><tr><td style="white-space:nowrap">T1069<a name="MITRE-ATTCK-Techniques-T1069"> </a></td><td>Permission Groups Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1069.003<a name="MITRE-ATTCK-Techniques-T1069.46003"> </a></td><td>Cloud Groups</td><td>TA0007</td><td>T1069</td><td>true</td></tr><tr><td style="white-space:nowrap">T1069.002<a name="MITRE-ATTCK-Techniques-T1069.46002"> </a></td><td>Domain Groups</td><td>TA0007</td><td>T1069</td><td>true</td></tr><tr><td style="white-space:nowrap">T1069.001<a name="MITRE-ATTCK-Techniques-T1069.46001"> </a></td><td>Local Groups</td><td>TA0007</td><td>T1069</td><td>true</td></tr><tr><td style="white-space:nowrap">T1114<a name="MITRE-ATTCK-Techniques-T1114"> </a></td><td>Email Collection</td><td>TA0009</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1114.002<a name="MITRE-ATTCK-Techniques-T1114.46002"> </a></td><td>Remote Email Collection</td><td>TA0009</td><td>T1114</td><td>true</td></tr><tr><td style="white-space:nowrap">T1114.003<a name="MITRE-ATTCK-Techniques-T1114.46003"> </a></td><td>Email Forwarding Rule</td><td>TA0009</td><td>T1114</td><td>true</td></tr><tr><td style="white-space:nowrap">T1114.001<a name="MITRE-ATTCK-Techniques-T1114.46001"> </a></td><td>Local Email Collection</td><td>TA0009</td><td>T1114</td><td>true</td></tr><tr><td style="white-space:nowrap">T1594<a name="MITRE-ATTCK-Techniques-T1594"> </a></td><td>Search Victim-Owned Websites</td><td>TA0043</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1561<a name="MITRE-ATTCK-Techniques-T1561"> </a></td><td>Disk Wipe</td><td>TA0040</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1561.002<a name="MITRE-ATTCK-Techniques-T1561.46002"> </a></td><td>Disk Structure Wipe</td><td>TA0040</td><td>T1561</td><td>true</td></tr><tr><td style="white-space:nowrap">T1561.001<a name="MITRE-ATTCK-Techniques-T1561.46001"> </a></td><td>Disk Content Wipe</td><td>TA0040</td><td>T1561</td><td>true</td></tr><tr><td style="white-space:nowrap">T1615<a name="MITRE-ATTCK-Techniques-T1615"> </a></td><td>Group Policy Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1025<a name="MITRE-ATTCK-Techniques-T1025"> </a></td><td>Data from Removable Media</td><td>TA0009</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1547<a name="MITRE-ATTCK-Techniques-T1547"> </a></td><td>Boot or Logon Autostart Execution</td><td>TA0003, TA0004</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1547.009<a name="MITRE-ATTCK-Techniques-T1547.46009"> </a></td><td>Shortcut Modification</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style="white-space:nowrap">T1547.006<a name="MITRE-ATTCK-Techniques-T1547.46006"> </a></td><td>Kernel Modules and Extensions</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style="white-space:nowrap">T1547.007<a name="MITRE-ATTCK-Techniques-T1547.46007"> </a></td><td>Re-opened Applications</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style="white-space:nowrap">T1547.004<a name="MITRE-ATTCK-Techniques-T1547.46004"> </a></td><td>Winlogon Helper DLL</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style="white-space:nowrap">T1547.005<a name="MITRE-ATTCK-Techniques-T1547.46005"> </a></td><td>Security Support Provider</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style="white-space:nowrap">T1547.001<a name="MITRE-ATTCK-Techniques-T1547.46001"> </a></td><td>Registry Run Keys / Startup Folder</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style="white-space:nowrap">T1547.008<a name="MITRE-ATTCK-Techniques-T1547.46008"> </a></td><td>LSASS Driver</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style="white-space:nowrap">T1547.012<a name="MITRE-ATTCK-Techniques-T1547.46012"> </a></td><td>Print Processors</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style="white-space:nowrap">T1547.014<a name="MITRE-ATTCK-Techniques-T1547.46014"> </a></td><td>Active Setup</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style="white-space:nowrap">T1547.015<a name="MITRE-ATTCK-Techniques-T1547.46015"> </a></td><td>Login Items</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style="white-space:nowrap">T1547.013<a name="MITRE-ATTCK-Techniques-T1547.46013"> </a></td><td>XDG Autostart Entries</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style="white-space:nowrap">T1547.003<a name="MITRE-ATTCK-Techniques-T1547.46003"> </a></td><td>Time Providers</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style="white-space:nowrap">T1547.002<a name="MITRE-ATTCK-Techniques-T1547.46002"> </a></td><td>Authentication Package</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style="white-space:nowrap">T1547.010<a name="MITRE-ATTCK-Techniques-T1547.46010"> </a></td><td>Port Monitors</td><td>TA0003, TA0004</td><td>T1547</td><td>true</td></tr><tr><td style="white-space:nowrap">T1600<a name="MITRE-ATTCK-Techniques-T1600"> </a></td><td>Weaken Encryption</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1600.001<a name="MITRE-ATTCK-Techniques-T1600.46001"> </a></td><td>Reduce Key Space</td><td>TA0005</td><td>T1600</td><td>true</td></tr><tr><td style="white-space:nowrap">T1600.002<a name="MITRE-ATTCK-Techniques-T1600.46002"> </a></td><td>Disable Crypto Hardware</td><td>TA0005</td><td>T1600</td><td>true</td></tr><tr><td style="white-space:nowrap">T1489<a name="MITRE-ATTCK-Techniques-T1489"> </a></td><td>Service Stop</td><td>TA0040</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1652<a name="MITRE-ATTCK-Techniques-T1652"> </a></td><td>Device Driver Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1564<a name="MITRE-ATTCK-Techniques-T1564"> </a></td><td>Hide Artifacts</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1564.003<a name="MITRE-ATTCK-Techniques-T1564.46003"> </a></td><td>Hidden Window</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style="white-space:nowrap">T1564.011<a name="MITRE-ATTCK-Techniques-T1564.46011"> </a></td><td>Ignore Process Interrupts</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style="white-space:nowrap">T1564.002<a name="MITRE-ATTCK-Techniques-T1564.46002"> </a></td><td>Hidden Users</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style="white-space:nowrap">T1564.012<a name="MITRE-ATTCK-Techniques-T1564.46012"> </a></td><td>File/Path Exclusions</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style="white-space:nowrap">T1564.014<a name="MITRE-ATTCK-Techniques-T1564.46014"> </a></td><td>Extended Attributes</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style="white-space:nowrap">T1564.008<a name="MITRE-ATTCK-Techniques-T1564.46008"> </a></td><td>Email Hiding Rules</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style="white-space:nowrap">T1564.009<a name="MITRE-ATTCK-Techniques-T1564.46009"> </a></td><td>Resource Forking</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style="white-space:nowrap">T1564.013<a name="MITRE-ATTCK-Techniques-T1564.46013"> </a></td><td>Bind Mounts</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style="white-space:nowrap">T1564.006<a name="MITRE-ATTCK-Techniques-T1564.46006"> </a></td><td>Run Virtual Instance</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style="white-space:nowrap">T1564.010<a name="MITRE-ATTCK-Techniques-T1564.46010"> </a></td><td>Process Argument Spoofing</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style="white-space:nowrap">T1564.001<a name="MITRE-ATTCK-Techniques-T1564.46001"> </a></td><td>Hidden Files and Directories</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style="white-space:nowrap">T1564.004<a name="MITRE-ATTCK-Techniques-T1564.46004"> </a></td><td>NTFS File Attributes</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style="white-space:nowrap">T1564.007<a name="MITRE-ATTCK-Techniques-T1564.46007"> </a></td><td>VBA Stomping</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style="white-space:nowrap">T1564.005<a name="MITRE-ATTCK-Techniques-T1564.46005"> </a></td><td>Hidden File System</td><td>TA0005</td><td>T1564</td><td>true</td></tr><tr><td style="white-space:nowrap">T1080<a name="MITRE-ATTCK-Techniques-T1080"> </a></td><td>Taint Shared Content</td><td>TA0008</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1137<a name="MITRE-ATTCK-Techniques-T1137"> </a></td><td>Office Application Startup</td><td>TA0003</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1137.002<a name="MITRE-ATTCK-Techniques-T1137.46002"> </a></td><td>Office Test</td><td>TA0003</td><td>T1137</td><td>true</td></tr><tr><td style="white-space:nowrap">T1137.001<a name="MITRE-ATTCK-Techniques-T1137.46001"> </a></td><td>Office Template Macros</td><td>TA0003</td><td>T1137</td><td>true</td></tr><tr><td style="white-space:nowrap">T1137.004<a name="MITRE-ATTCK-Techniques-T1137.46004"> </a></td><td>Outlook Home Page</td><td>TA0003</td><td>T1137</td><td>true</td></tr><tr><td style="white-space:nowrap">T1137.003<a name="MITRE-ATTCK-Techniques-T1137.46003"> </a></td><td>Outlook Forms</td><td>TA0003</td><td>T1137</td><td>true</td></tr><tr><td style="white-space:nowrap">T1137.006<a name="MITRE-ATTCK-Techniques-T1137.46006"> </a></td><td>Add-ins</td><td>TA0003</td><td>T1137</td><td>true</td></tr><tr><td style="white-space:nowrap">T1137.005<a name="MITRE-ATTCK-Techniques-T1137.46005"> </a></td><td>Outlook Rules</td><td>TA0003</td><td>T1137</td><td>true</td></tr><tr><td style="white-space:nowrap">T1119<a name="MITRE-ATTCK-Techniques-T1119"> </a></td><td>Automated Collection</td><td>TA0009</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1115<a name="MITRE-ATTCK-Techniques-T1115"> </a></td><td>Clipboard Data</td><td>TA0009</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1675<a name="MITRE-ATTCK-Techniques-T1675"> </a></td><td>ESXi Administration Command</td><td>TA0002</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1007<a name="MITRE-ATTCK-Techniques-T1007"> </a></td><td>System Service Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1040<a name="MITRE-ATTCK-Techniques-T1040"> </a></td><td>Network Sniffing</td><td>TA0006, TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1530<a name="MITRE-ATTCK-Techniques-T1530"> </a></td><td>Data from Cloud Storage</td><td>TA0009</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1135<a name="MITRE-ATTCK-Techniques-T1135"> </a></td><td>Network Share Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1120<a name="MITRE-ATTCK-Techniques-T1120"> </a></td><td>Peripheral Device Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1082<a name="MITRE-ATTCK-Techniques-T1082"> </a></td><td>System Information Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1071<a name="MITRE-ATTCK-Techniques-T1071"> </a></td><td>Application Layer Protocol</td><td>TA0011</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1071.002<a name="MITRE-ATTCK-Techniques-T1071.46002"> </a></td><td>File Transfer Protocols</td><td>TA0011</td><td>T1071</td><td>true</td></tr><tr><td style="white-space:nowrap">T1071.004<a name="MITRE-ATTCK-Techniques-T1071.46004"> </a></td><td>DNS</td><td>TA0011</td><td>T1071</td><td>true</td></tr><tr><td style="white-space:nowrap">T1071.005<a name="MITRE-ATTCK-Techniques-T1071.46005"> </a></td><td>Publish/Subscribe Protocols</td><td>TA0011</td><td>T1071</td><td>true</td></tr><tr><td style="white-space:nowrap">T1071.003<a name="MITRE-ATTCK-Techniques-T1071.46003"> </a></td><td>Mail Protocols</td><td>TA0011</td><td>T1071</td><td>true</td></tr><tr><td style="white-space:nowrap">T1071.001<a name="MITRE-ATTCK-Techniques-T1071.46001"> </a></td><td>Web Protocols</td><td>TA0011</td><td>T1071</td><td>true</td></tr><tr><td style="white-space:nowrap">T1053<a name="MITRE-ATTCK-Techniques-T1053"> </a></td><td>Scheduled Task/Job</td><td>TA0002, TA0003, TA0004</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1053.003<a name="MITRE-ATTCK-Techniques-T1053.46003"> </a></td><td>Cron</td><td>TA0002, TA0003, TA0004</td><td>T1053</td><td>true</td></tr><tr><td style="white-space:nowrap">T1053.005<a name="MITRE-ATTCK-Techniques-T1053.46005"> </a></td><td>Scheduled Task</td><td>TA0002, TA0003, TA0004</td><td>T1053</td><td>true</td></tr><tr><td style="white-space:nowrap">T1053.006<a name="MITRE-ATTCK-Techniques-T1053.46006"> </a></td><td>Systemd Timers</td><td>TA0002, TA0003, TA0004</td><td>T1053</td><td>true</td></tr><tr><td style="white-space:nowrap">T1053.007<a name="MITRE-ATTCK-Techniques-T1053.46007"> </a></td><td>Container Orchestration Job</td><td>TA0002, TA0003, TA0004</td><td>T1053</td><td>true</td></tr><tr><td style="white-space:nowrap">T1053.002<a name="MITRE-ATTCK-Techniques-T1053.46002"> </a></td><td>At</td><td>TA0002, TA0003, TA0004</td><td>T1053</td><td>true</td></tr><tr><td style="white-space:nowrap">T1176<a name="MITRE-ATTCK-Techniques-T1176"> </a></td><td>Software Extensions</td><td>TA0003</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1176.002<a name="MITRE-ATTCK-Techniques-T1176.46002"> </a></td><td>IDE Extensions</td><td>TA0003</td><td>T1176</td><td>true</td></tr><tr><td style="white-space:nowrap">T1176.001<a name="MITRE-ATTCK-Techniques-T1176.46001"> </a></td><td>Browser Extensions</td><td>TA0003</td><td>T1176</td><td>true</td></tr><tr><td style="white-space:nowrap">T1106<a name="MITRE-ATTCK-Techniques-T1106"> </a></td><td>Native API</td><td>TA0002</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1202<a name="MITRE-ATTCK-Techniques-T1202"> </a></td><td>Indirect Command Execution</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1091<a name="MITRE-ATTCK-Techniques-T1091"> </a></td><td>Replication Through Removable Media</td><td>TA0008, TA0001</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1005<a name="MITRE-ATTCK-Techniques-T1005"> </a></td><td>Data from Local System</td><td>TA0009</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1140<a name="MITRE-ATTCK-Techniques-T1140"> </a></td><td>Deobfuscate/Decode Files or Information</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1562<a name="MITRE-ATTCK-Techniques-T1562"> </a></td><td>Impair Defenses</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1562.003<a name="MITRE-ATTCK-Techniques-T1562.46003"> </a></td><td>Impair Command History Logging</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style="white-space:nowrap">T1562.013<a name="MITRE-ATTCK-Techniques-T1562.46013"> </a></td><td>Disable or Modify Network Device Firewall</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style="white-space:nowrap">T1562.004<a name="MITRE-ATTCK-Techniques-T1562.46004"> </a></td><td>Disable or Modify System Firewall</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style="white-space:nowrap">T1562.002<a name="MITRE-ATTCK-Techniques-T1562.46002"> </a></td><td>Disable Windows Event Logging</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style="white-space:nowrap">T1562.001<a name="MITRE-ATTCK-Techniques-T1562.46001"> </a></td><td>Disable or Modify Tools</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style="white-space:nowrap">T1562.006<a name="MITRE-ATTCK-Techniques-T1562.46006"> </a></td><td>Indicator Blocking</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style="white-space:nowrap">T1562.012<a name="MITRE-ATTCK-Techniques-T1562.46012"> </a></td><td>Disable or Modify Linux Audit System</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style="white-space:nowrap">T1562.011<a name="MITRE-ATTCK-Techniques-T1562.46011"> </a></td><td>Spoof Security Alerting</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style="white-space:nowrap">T1562.008<a name="MITRE-ATTCK-Techniques-T1562.46008"> </a></td><td>Disable or Modify Cloud Logs</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style="white-space:nowrap">T1562.010<a name="MITRE-ATTCK-Techniques-T1562.46010"> </a></td><td>Downgrade Attack</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style="white-space:nowrap">T1562.007<a name="MITRE-ATTCK-Techniques-T1562.46007"> </a></td><td>Disable or Modify Cloud Firewall</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style="white-space:nowrap">T1562.009<a name="MITRE-ATTCK-Techniques-T1562.46009"> </a></td><td>Safe Mode Boot</td><td>TA0005</td><td>T1562</td><td>true</td></tr><tr><td style="white-space:nowrap">T1195<a name="MITRE-ATTCK-Techniques-T1195"> </a></td><td>Supply Chain Compromise</td><td>TA0001</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1195.001<a name="MITRE-ATTCK-Techniques-T1195.46001"> </a></td><td>Compromise Software Dependencies and Development Tools</td><td>TA0001</td><td>T1195</td><td>true</td></tr><tr><td style="white-space:nowrap">T1195.002<a name="MITRE-ATTCK-Techniques-T1195.46002"> </a></td><td>Compromise Software Supply Chain</td><td>TA0001</td><td>T1195</td><td>true</td></tr><tr><td style="white-space:nowrap">T1195.003<a name="MITRE-ATTCK-Techniques-T1195.46003"> </a></td><td>Compromise Hardware Supply Chain</td><td>TA0001</td><td>T1195</td><td>true</td></tr><tr><td style="white-space:nowrap">T1190<a name="MITRE-ATTCK-Techniques-T1190"> </a></td><td>Exploit Public-Facing Application</td><td>TA0001</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1558<a name="MITRE-ATTCK-Techniques-T1558"> </a></td><td>Steal or Forge Kerberos Tickets</td><td>TA0006</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1558.003<a name="MITRE-ATTCK-Techniques-T1558.46003"> </a></td><td>Kerberoasting</td><td>TA0006</td><td>T1558</td><td>true</td></tr><tr><td style="white-space:nowrap">T1558.002<a name="MITRE-ATTCK-Techniques-T1558.46002"> </a></td><td>Silver Ticket</td><td>TA0006</td><td>T1558</td><td>true</td></tr><tr><td style="white-space:nowrap">T1558.005<a name="MITRE-ATTCK-Techniques-T1558.46005"> </a></td><td>Ccache Files</td><td>TA0006</td><td>T1558</td><td>true</td></tr><tr><td style="white-space:nowrap">T1558.004<a name="MITRE-ATTCK-Techniques-T1558.46004"> </a></td><td>AS-REP Roasting</td><td>TA0006</td><td>T1558</td><td>true</td></tr><tr><td style="white-space:nowrap">T1558.001<a name="MITRE-ATTCK-Techniques-T1558.46001"> </a></td><td>Golden Ticket</td><td>TA0006</td><td>T1558</td><td>true</td></tr><tr><td style="white-space:nowrap">T1555<a name="MITRE-ATTCK-Techniques-T1555"> </a></td><td>Credentials from Password Stores</td><td>TA0006</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1555.004<a name="MITRE-ATTCK-Techniques-T1555.46004"> </a></td><td>Windows Credential Manager</td><td>TA0006</td><td>T1555</td><td>true</td></tr><tr><td style="white-space:nowrap">T1555.001<a name="MITRE-ATTCK-Techniques-T1555.46001"> </a></td><td>Keychain</td><td>TA0006</td><td>T1555</td><td>true</td></tr><tr><td style="white-space:nowrap">T1555.005<a name="MITRE-ATTCK-Techniques-T1555.46005"> </a></td><td>Password Managers</td><td>TA0006</td><td>T1555</td><td>true</td></tr><tr><td style="white-space:nowrap">T1555.006<a name="MITRE-ATTCK-Techniques-T1555.46006"> </a></td><td>Cloud Secrets Management Stores</td><td>TA0006</td><td>T1555</td><td>true</td></tr><tr><td style="white-space:nowrap">T1555.003<a name="MITRE-ATTCK-Techniques-T1555.46003"> </a></td><td>Credentials from Web Browsers</td><td>TA0006</td><td>T1555</td><td>true</td></tr><tr><td style="white-space:nowrap">T1555.002<a name="MITRE-ATTCK-Techniques-T1555.46002"> </a></td><td>Securityd Memory</td><td>TA0006</td><td>T1555</td><td>true</td></tr><tr><td style="white-space:nowrap">T1567<a name="MITRE-ATTCK-Techniques-T1567"> </a></td><td>Exfiltration Over Web Service</td><td>TA0010</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1567.001<a name="MITRE-ATTCK-Techniques-T1567.46001"> </a></td><td>Exfiltration to Code Repository</td><td>TA0010</td><td>T1567</td><td>true</td></tr><tr><td style="white-space:nowrap">T1567.003<a name="MITRE-ATTCK-Techniques-T1567.46003"> </a></td><td>Exfiltration to Text Storage Sites</td><td>TA0010</td><td>T1567</td><td>true</td></tr><tr><td style="white-space:nowrap">T1567.002<a name="MITRE-ATTCK-Techniques-T1567.46002"> </a></td><td>Exfiltration to Cloud Storage</td><td>TA0010</td><td>T1567</td><td>true</td></tr><tr><td style="white-space:nowrap">T1567.004<a name="MITRE-ATTCK-Techniques-T1567.46004"> </a></td><td>Exfiltration Over Webhook</td><td>TA0010</td><td>T1567</td><td>true</td></tr><tr><td style="white-space:nowrap">T1219<a name="MITRE-ATTCK-Techniques-T1219"> </a></td><td>Remote Access Tools</td><td>TA0011</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1219.003<a name="MITRE-ATTCK-Techniques-T1219.46003"> </a></td><td>Remote Access Hardware</td><td>TA0011</td><td>T1219</td><td>true</td></tr><tr><td style="white-space:nowrap">T1219.001<a name="MITRE-ATTCK-Techniques-T1219.46001"> </a></td><td>IDE Tunneling</td><td>TA0011</td><td>T1219</td><td>true</td></tr><tr><td style="white-space:nowrap">T1219.002<a name="MITRE-ATTCK-Techniques-T1219.46002"> </a></td><td>Remote Desktop Software</td><td>TA0011</td><td>T1219</td><td>true</td></tr><tr><td style="white-space:nowrap">T1036<a name="MITRE-ATTCK-Techniques-T1036"> </a></td><td>Masquerading</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1036.008<a name="MITRE-ATTCK-Techniques-T1036.46008"> </a></td><td>Masquerade File Type</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style="white-space:nowrap">T1036.003<a name="MITRE-ATTCK-Techniques-T1036.46003"> </a></td><td>Rename Legitimate Utilities</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style="white-space:nowrap">T1036.006<a name="MITRE-ATTCK-Techniques-T1036.46006"> </a></td><td>Space after Filename</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style="white-space:nowrap">T1036.004<a name="MITRE-ATTCK-Techniques-T1036.46004"> </a></td><td>Masquerade Task or Service</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style="white-space:nowrap">T1036.002<a name="MITRE-ATTCK-Techniques-T1036.46002"> </a></td><td>Right-to-Left Override</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style="white-space:nowrap">T1036.005<a name="MITRE-ATTCK-Techniques-T1036.46005"> </a></td><td>Match Legitimate Resource Name or Location</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style="white-space:nowrap">T1036.011<a name="MITRE-ATTCK-Techniques-T1036.46011"> </a></td><td>Overwrite Process Arguments</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style="white-space:nowrap">T1036.007<a name="MITRE-ATTCK-Techniques-T1036.46007"> </a></td><td>Double File Extension</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style="white-space:nowrap">T1036.010<a name="MITRE-ATTCK-Techniques-T1036.46010"> </a></td><td>Masquerade Account Name</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style="white-space:nowrap">T1036.001<a name="MITRE-ATTCK-Techniques-T1036.46001"> </a></td><td>Invalid Code Signature</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style="white-space:nowrap">T1036.012<a name="MITRE-ATTCK-Techniques-T1036.46012"> </a></td><td>Browser Fingerprint</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style="white-space:nowrap">T1036.009<a name="MITRE-ATTCK-Techniques-T1036.46009"> </a></td><td>Break Process Trees</td><td>TA0005</td><td>T1036</td><td>true</td></tr><tr><td style="white-space:nowrap">T1552<a name="MITRE-ATTCK-Techniques-T1552"> </a></td><td>Unsecured Credentials</td><td>TA0006</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1552.006<a name="MITRE-ATTCK-Techniques-T1552.46006"> </a></td><td>Group Policy Preferences</td><td>TA0006</td><td>T1552</td><td>true</td></tr><tr><td style="white-space:nowrap">T1552.004<a name="MITRE-ATTCK-Techniques-T1552.46004"> </a></td><td>Private Keys</td><td>TA0006</td><td>T1552</td><td>true</td></tr><tr><td style="white-space:nowrap">T1552.007<a name="MITRE-ATTCK-Techniques-T1552.46007"> </a></td><td>Container API</td><td>TA0006</td><td>T1552</td><td>true</td></tr><tr><td style="white-space:nowrap">T1552.001<a name="MITRE-ATTCK-Techniques-T1552.46001"> </a></td><td>Credentials In Files</td><td>TA0006</td><td>T1552</td><td>true</td></tr><tr><td style="white-space:nowrap">T1552.002<a name="MITRE-ATTCK-Techniques-T1552.46002"> </a></td><td>Credentials in Registry</td><td>TA0006</td><td>T1552</td><td>true</td></tr><tr><td style="white-space:nowrap">T1552.003<a name="MITRE-ATTCK-Techniques-T1552.46003"> </a></td><td>Shell History</td><td>TA0006</td><td>T1552</td><td>true</td></tr><tr><td style="white-space:nowrap">T1552.008<a name="MITRE-ATTCK-Techniques-T1552.46008"> </a></td><td>Chat Messages</td><td>TA0006</td><td>T1552</td><td>true</td></tr><tr><td style="white-space:nowrap">T1552.005<a name="MITRE-ATTCK-Techniques-T1552.46005"> </a></td><td>Cloud Instance Metadata API</td><td>TA0006</td><td>T1552</td><td>true</td></tr><tr><td style="white-space:nowrap">T1659<a name="MITRE-ATTCK-Techniques-T1659"> </a></td><td>Content Injection</td><td>TA0001, TA0011</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1055<a name="MITRE-ATTCK-Techniques-T1055"> </a></td><td>Process Injection</td><td>TA0005, TA0004</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1055.013<a name="MITRE-ATTCK-Techniques-T1055.46013"> </a></td><td>Process Doppelgänging</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style="white-space:nowrap">T1055.012<a name="MITRE-ATTCK-Techniques-T1055.46012"> </a></td><td>Process Hollowing</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style="white-space:nowrap">T1055.009<a name="MITRE-ATTCK-Techniques-T1055.46009"> </a></td><td>Proc Memory</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style="white-space:nowrap">T1055.015<a name="MITRE-ATTCK-Techniques-T1055.46015"> </a></td><td>ListPlanting</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style="white-space:nowrap">T1055.014<a name="MITRE-ATTCK-Techniques-T1055.46014"> </a></td><td>VDSO Hijacking</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style="white-space:nowrap">T1055.005<a name="MITRE-ATTCK-Techniques-T1055.46005"> </a></td><td>Thread Local Storage</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style="white-space:nowrap">T1055.011<a name="MITRE-ATTCK-Techniques-T1055.46011"> </a></td><td>Extra Window Memory Injection</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style="white-space:nowrap">T1055.001<a name="MITRE-ATTCK-Techniques-T1055.46001"> </a></td><td>Dynamic-link Library Injection</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style="white-space:nowrap">T1055.003<a name="MITRE-ATTCK-Techniques-T1055.46003"> </a></td><td>Thread Execution Hijacking</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style="white-space:nowrap">T1055.008<a name="MITRE-ATTCK-Techniques-T1055.46008"> </a></td><td>Ptrace System Calls</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style="white-space:nowrap">T1055.004<a name="MITRE-ATTCK-Techniques-T1055.46004"> </a></td><td>Asynchronous Procedure Call</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style="white-space:nowrap">T1055.002<a name="MITRE-ATTCK-Techniques-T1055.46002"> </a></td><td>Portable Executable Injection</td><td>TA0005, TA0004</td><td>T1055</td><td>true</td></tr><tr><td style="white-space:nowrap">T1205<a name="MITRE-ATTCK-Techniques-T1205"> </a></td><td>Traffic Signaling</td><td>TA0005, TA0003, TA0011</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1205.001<a name="MITRE-ATTCK-Techniques-T1205.46001"> </a></td><td>Port Knocking</td><td>TA0005, TA0003, TA0011</td><td>T1205</td><td>true</td></tr><tr><td style="white-space:nowrap">T1205.002<a name="MITRE-ATTCK-Techniques-T1205.46002"> </a></td><td>Socket Filters</td><td>TA0005, TA0003, TA0011</td><td>T1205</td><td>true</td></tr><tr><td style="white-space:nowrap">T1218<a name="MITRE-ATTCK-Techniques-T1218"> </a></td><td>System Binary Proxy Execution</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1218.005<a name="MITRE-ATTCK-Techniques-T1218.46005"> </a></td><td>Mshta</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style="white-space:nowrap">T1218.014<a name="MITRE-ATTCK-Techniques-T1218.46014"> </a></td><td>MMC</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style="white-space:nowrap">T1218.008<a name="MITRE-ATTCK-Techniques-T1218.46008"> </a></td><td>Odbcconf</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style="white-space:nowrap">T1218.015<a name="MITRE-ATTCK-Techniques-T1218.46015"> </a></td><td>Electron Applications</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style="white-space:nowrap">T1218.012<a name="MITRE-ATTCK-Techniques-T1218.46012"> </a></td><td>Verclsid</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style="white-space:nowrap">T1218.013<a name="MITRE-ATTCK-Techniques-T1218.46013"> </a></td><td>Mavinject</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style="white-space:nowrap">T1218.002<a name="MITRE-ATTCK-Techniques-T1218.46002"> </a></td><td>Control Panel</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style="white-space:nowrap">T1218.001<a name="MITRE-ATTCK-Techniques-T1218.46001"> </a></td><td>Compiled HTML File</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style="white-space:nowrap">T1218.010<a name="MITRE-ATTCK-Techniques-T1218.46010"> </a></td><td>Regsvr32</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style="white-space:nowrap">T1218.004<a name="MITRE-ATTCK-Techniques-T1218.46004"> </a></td><td>InstallUtil</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style="white-space:nowrap">T1218.011<a name="MITRE-ATTCK-Techniques-T1218.46011"> </a></td><td>Rundll32</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style="white-space:nowrap">T1218.009<a name="MITRE-ATTCK-Techniques-T1218.46009"> </a></td><td>Regsvcs/Regasm</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style="white-space:nowrap">T1218.003<a name="MITRE-ATTCK-Techniques-T1218.46003"> </a></td><td>CMSTP</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style="white-space:nowrap">T1218.007<a name="MITRE-ATTCK-Techniques-T1218.46007"> </a></td><td>Msiexec</td><td>TA0005</td><td>T1218</td><td>true</td></tr><tr><td style="white-space:nowrap">T1620<a name="MITRE-ATTCK-Techniques-T1620"> </a></td><td>Reflective Code Loading</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1611<a name="MITRE-ATTCK-Techniques-T1611"> </a></td><td>Escape to Host</td><td>TA0004</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1010<a name="MITRE-ATTCK-Techniques-T1010"> </a></td><td>Application Window Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1029<a name="MITRE-ATTCK-Techniques-T1029"> </a></td><td>Scheduled Transfer</td><td>TA0010</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1525<a name="MITRE-ATTCK-Techniques-T1525"> </a></td><td>Implant Internal Image</td><td>TA0003</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1572<a name="MITRE-ATTCK-Techniques-T1572"> </a></td><td>Protocol Tunneling</td><td>TA0011</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1550<a name="MITRE-ATTCK-Techniques-T1550"> </a></td><td>Use Alternate Authentication Material</td><td>TA0005, TA0008</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1550.004<a name="MITRE-ATTCK-Techniques-T1550.46004"> </a></td><td>Web Session Cookie</td><td>TA0005, TA0008</td><td>T1550</td><td>true</td></tr><tr><td style="white-space:nowrap">T1550.001<a name="MITRE-ATTCK-Techniques-T1550.46001"> </a></td><td>Application Access Token</td><td>TA0005, TA0008</td><td>T1550</td><td>true</td></tr><tr><td style="white-space:nowrap">T1550.003<a name="MITRE-ATTCK-Techniques-T1550.46003"> </a></td><td>Pass the Ticket</td><td>TA0005, TA0008</td><td>T1550</td><td>true</td></tr><tr><td style="white-space:nowrap">T1550.002<a name="MITRE-ATTCK-Techniques-T1550.46002"> </a></td><td>Pass the Hash</td><td>TA0005, TA0008</td><td>T1550</td><td>true</td></tr><tr><td style="white-space:nowrap">T1011<a name="MITRE-ATTCK-Techniques-T1011"> </a></td><td>Exfiltration Over Other Network Medium</td><td>TA0010</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1011.001<a name="MITRE-ATTCK-Techniques-T1011.46001"> </a></td><td>Exfiltration Over Bluetooth</td><td>TA0010</td><td>T1011</td><td>true</td></tr><tr><td style="white-space:nowrap">T1589<a name="MITRE-ATTCK-Techniques-T1589"> </a></td><td>Gather Victim Identity Information</td><td>TA0043</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1589.003<a name="MITRE-ATTCK-Techniques-T1589.46003"> </a></td><td>Employee Names</td><td>TA0043</td><td>T1589</td><td>true</td></tr><tr><td style="white-space:nowrap">T1589.002<a name="MITRE-ATTCK-Techniques-T1589.46002"> </a></td><td>Email Addresses</td><td>TA0043</td><td>T1589</td><td>true</td></tr><tr><td style="white-space:nowrap">T1589.001<a name="MITRE-ATTCK-Techniques-T1589.46001"> </a></td><td>Credentials</td><td>TA0043</td><td>T1589</td><td>true</td></tr><tr><td style="white-space:nowrap">T1560<a name="MITRE-ATTCK-Techniques-T1560"> </a></td><td>Archive Collected Data</td><td>TA0009</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1560.002<a name="MITRE-ATTCK-Techniques-T1560.46002"> </a></td><td>Archive via Library</td><td>TA0009</td><td>T1560</td><td>true</td></tr><tr><td style="white-space:nowrap">T1560.001<a name="MITRE-ATTCK-Techniques-T1560.46001"> </a></td><td>Archive via Utility</td><td>TA0009</td><td>T1560</td><td>true</td></tr><tr><td style="white-space:nowrap">T1560.003<a name="MITRE-ATTCK-Techniques-T1560.46003"> </a></td><td>Archive via Custom Method</td><td>TA0009</td><td>T1560</td><td>true</td></tr><tr><td style="white-space:nowrap">T1185<a name="MITRE-ATTCK-Techniques-T1185"> </a></td><td>Browser Session Hijacking</td><td>TA0009</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1021<a name="MITRE-ATTCK-Techniques-T1021"> </a></td><td>Remote Services</td><td>TA0008</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1021.006<a name="MITRE-ATTCK-Techniques-T1021.46006"> </a></td><td>Windows Remote Management</td><td>TA0008</td><td>T1021</td><td>true</td></tr><tr><td style="white-space:nowrap">T1021.005<a name="MITRE-ATTCK-Techniques-T1021.46005"> </a></td><td>VNC</td><td>TA0008</td><td>T1021</td><td>true</td></tr><tr><td style="white-space:nowrap">T1021.002<a name="MITRE-ATTCK-Techniques-T1021.46002"> </a></td><td>SMB/Windows Admin Shares</td><td>TA0008</td><td>T1021</td><td>true</td></tr><tr><td style="white-space:nowrap">T1021.007<a name="MITRE-ATTCK-Techniques-T1021.46007"> </a></td><td>Cloud Services</td><td>TA0008</td><td>T1021</td><td>true</td></tr><tr><td style="white-space:nowrap">T1021.001<a name="MITRE-ATTCK-Techniques-T1021.46001"> </a></td><td>Remote Desktop Protocol</td><td>TA0008</td><td>T1021</td><td>true</td></tr><tr><td style="white-space:nowrap">T1021.003<a name="MITRE-ATTCK-Techniques-T1021.46003"> </a></td><td>Distributed Component Object Model</td><td>TA0008</td><td>T1021</td><td>true</td></tr><tr><td style="white-space:nowrap">T1021.008<a name="MITRE-ATTCK-Techniques-T1021.46008"> </a></td><td>Direct Cloud VM Connections</td><td>TA0008</td><td>T1021</td><td>true</td></tr><tr><td style="white-space:nowrap">T1021.004<a name="MITRE-ATTCK-Techniques-T1021.46004"> </a></td><td>SSH</td><td>TA0008</td><td>T1021</td><td>true</td></tr><tr><td style="white-space:nowrap">T1596<a name="MITRE-ATTCK-Techniques-T1596"> </a></td><td>Search Open Technical Databases</td><td>TA0043</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1596.003<a name="MITRE-ATTCK-Techniques-T1596.46003"> </a></td><td>Digital Certificates</td><td>TA0043</td><td>T1596</td><td>true</td></tr><tr><td style="white-space:nowrap">T1596.005<a name="MITRE-ATTCK-Techniques-T1596.46005"> </a></td><td>Scan Databases</td><td>TA0043</td><td>T1596</td><td>true</td></tr><tr><td style="white-space:nowrap">T1596.001<a name="MITRE-ATTCK-Techniques-T1596.46001"> </a></td><td>DNS/Passive DNS</td><td>TA0043</td><td>T1596</td><td>true</td></tr><tr><td style="white-space:nowrap">T1596.004<a name="MITRE-ATTCK-Techniques-T1596.46004"> </a></td><td>CDNs</td><td>TA0043</td><td>T1596</td><td>true</td></tr><tr><td style="white-space:nowrap">T1596.002<a name="MITRE-ATTCK-Techniques-T1596.46002"> </a></td><td>WHOIS</td><td>TA0043</td><td>T1596</td><td>true</td></tr><tr><td style="white-space:nowrap">T1207<a name="MITRE-ATTCK-Techniques-T1207"> </a></td><td>Rogue Domain Controller</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1610<a name="MITRE-ATTCK-Techniques-T1610"> </a></td><td>Deploy Container</td><td>TA0005, TA0002</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1112<a name="MITRE-ATTCK-Techniques-T1112"> </a></td><td>Modify Registry</td><td>TA0005, TA0003</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1580<a name="MITRE-ATTCK-Techniques-T1580"> </a></td><td>Cloud Infrastructure Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1491<a name="MITRE-ATTCK-Techniques-T1491"> </a></td><td>Defacement</td><td>TA0040</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1491.002<a name="MITRE-ATTCK-Techniques-T1491.46002"> </a></td><td>External Defacement</td><td>TA0040</td><td>T1491</td><td>true</td></tr><tr><td style="white-space:nowrap">T1491.001<a name="MITRE-ATTCK-Techniques-T1491.46001"> </a></td><td>Internal Defacement</td><td>TA0040</td><td>T1491</td><td>true</td></tr><tr><td style="white-space:nowrap">T1535<a name="MITRE-ATTCK-Techniques-T1535"> </a></td><td>Unused/Unsupported Cloud Regions</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1563<a name="MITRE-ATTCK-Techniques-T1563"> </a></td><td>Remote Service Session Hijacking</td><td>TA0008</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1563.002<a name="MITRE-ATTCK-Techniques-T1563.46002"> </a></td><td>RDP Hijacking</td><td>TA0008</td><td>T1563</td><td>true</td></tr><tr><td style="white-space:nowrap">T1563.001<a name="MITRE-ATTCK-Techniques-T1563.46001"> </a></td><td>SSH Hijacking</td><td>TA0008</td><td>T1563</td><td>true</td></tr><tr><td style="white-space:nowrap">T1217<a name="MITRE-ATTCK-Techniques-T1217"> </a></td><td>Browser Information Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1681<a name="MITRE-ATTCK-Techniques-T1681"> </a></td><td>Search Threat Vendor Data</td><td>TA0043</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1674<a name="MITRE-ATTCK-Techniques-T1674"> </a></td><td>Input Injection</td><td>TA0002</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1092<a name="MITRE-ATTCK-Techniques-T1092"> </a></td><td>Communication Through Removable Media</td><td>TA0011</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1222<a name="MITRE-ATTCK-Techniques-T1222"> </a></td><td>File and Directory Permissions Modification</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1222.002<a name="MITRE-ATTCK-Techniques-T1222.46002"> </a></td><td>Linux and Mac File and Directory Permissions Modification</td><td>TA0005</td><td>T1222</td><td>true</td></tr><tr><td style="white-space:nowrap">T1222.001<a name="MITRE-ATTCK-Techniques-T1222.46001"> </a></td><td>Windows File and Directory Permissions Modification</td><td>TA0005</td><td>T1222</td><td>true</td></tr><tr><td style="white-space:nowrap">T1595<a name="MITRE-ATTCK-Techniques-T1595"> </a></td><td>Active Scanning</td><td>TA0043</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1595.003<a name="MITRE-ATTCK-Techniques-T1595.46003"> </a></td><td>Wordlist Scanning</td><td>TA0043</td><td>T1595</td><td>true</td></tr><tr><td style="white-space:nowrap">T1595.001<a name="MITRE-ATTCK-Techniques-T1595.46001"> </a></td><td>Scanning IP Blocks</td><td>TA0043</td><td>T1595</td><td>true</td></tr><tr><td style="white-space:nowrap">T1595.002<a name="MITRE-ATTCK-Techniques-T1595.46002"> </a></td><td>Vulnerability Scanning</td><td>TA0043</td><td>T1595</td><td>true</td></tr><tr><td style="white-space:nowrap">T1548<a name="MITRE-ATTCK-Techniques-T1548"> </a></td><td>Abuse Elevation Control Mechanism</td><td>TA0004, TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1548.001<a name="MITRE-ATTCK-Techniques-T1548.46001"> </a></td><td>Setuid and Setgid</td><td>TA0004, TA0005</td><td>T1548</td><td>true</td></tr><tr><td style="white-space:nowrap">T1548.005<a name="MITRE-ATTCK-Techniques-T1548.46005"> </a></td><td>Temporary Elevated Cloud Access</td><td>TA0004, TA0005</td><td>T1548</td><td>true</td></tr><tr><td style="white-space:nowrap">T1548.002<a name="MITRE-ATTCK-Techniques-T1548.46002"> </a></td><td>Bypass User Account Control</td><td>TA0004, TA0005</td><td>T1548</td><td>true</td></tr><tr><td style="white-space:nowrap">T1548.004<a name="MITRE-ATTCK-Techniques-T1548.46004"> </a></td><td>Elevated Execution with Prompt</td><td>TA0004, TA0005</td><td>T1548</td><td>true</td></tr><tr><td style="white-space:nowrap">T1548.003<a name="MITRE-ATTCK-Techniques-T1548.46003"> </a></td><td>Sudo and Sudo Caching</td><td>TA0004, TA0005</td><td>T1548</td><td>true</td></tr><tr><td style="white-space:nowrap">T1548.006<a name="MITRE-ATTCK-Techniques-T1548.46006"> </a></td><td>TCC Manipulation</td><td>TA0004, TA0005</td><td>T1548</td><td>true</td></tr><tr><td style="white-space:nowrap">T1673<a name="MITRE-ATTCK-Techniques-T1673"> </a></td><td>Virtual Machine Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1125<a name="MITRE-ATTCK-Techniques-T1125"> </a></td><td>Video Capture</td><td>TA0009</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1016<a name="MITRE-ATTCK-Techniques-T1016"> </a></td><td>System Network Configuration Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1016.002<a name="MITRE-ATTCK-Techniques-T1016.46002"> </a></td><td>Wi-Fi Discovery</td><td>TA0007</td><td>T1016</td><td>true</td></tr><tr><td style="white-space:nowrap">T1016.001<a name="MITRE-ATTCK-Techniques-T1016.46001"> </a></td><td>Internet Connection Discovery</td><td>TA0007</td><td>T1016</td><td>true</td></tr><tr><td style="white-space:nowrap">T1087<a name="MITRE-ATTCK-Techniques-T1087"> </a></td><td>Account Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1087.003<a name="MITRE-ATTCK-Techniques-T1087.46003"> </a></td><td>Email Account</td><td>TA0007</td><td>T1087</td><td>true</td></tr><tr><td style="white-space:nowrap">T1087.004<a name="MITRE-ATTCK-Techniques-T1087.46004"> </a></td><td>Cloud Account</td><td>TA0007</td><td>T1087</td><td>true</td></tr><tr><td style="white-space:nowrap">T1087.002<a name="MITRE-ATTCK-Techniques-T1087.46002"> </a></td><td>Domain Account</td><td>TA0007</td><td>T1087</td><td>true</td></tr><tr><td style="white-space:nowrap">T1087.001<a name="MITRE-ATTCK-Techniques-T1087.46001"> </a></td><td>Local Account</td><td>TA0007</td><td>T1087</td><td>true</td></tr><tr><td style="white-space:nowrap">T1090<a name="MITRE-ATTCK-Techniques-T1090"> </a></td><td>Proxy</td><td>TA0011</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1090.001<a name="MITRE-ATTCK-Techniques-T1090.46001"> </a></td><td>Internal Proxy</td><td>TA0011</td><td>T1090</td><td>true</td></tr><tr><td style="white-space:nowrap">T1090.003<a name="MITRE-ATTCK-Techniques-T1090.46003"> </a></td><td>Multi-hop Proxy</td><td>TA0011</td><td>T1090</td><td>true</td></tr><tr><td style="white-space:nowrap">T1090.004<a name="MITRE-ATTCK-Techniques-T1090.46004"> </a></td><td>Domain Fronting</td><td>TA0011</td><td>T1090</td><td>true</td></tr><tr><td style="white-space:nowrap">T1090.002<a name="MITRE-ATTCK-Techniques-T1090.46002"> </a></td><td>External Proxy</td><td>TA0011</td><td>T1090</td><td>true</td></tr><tr><td style="white-space:nowrap">T1059<a name="MITRE-ATTCK-Techniques-T1059"> </a></td><td>Command and Scripting Interpreter</td><td>TA0002</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1059.005<a name="MITRE-ATTCK-Techniques-T1059.46005"> </a></td><td>Visual Basic</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style="white-space:nowrap">T1059.002<a name="MITRE-ATTCK-Techniques-T1059.46002"> </a></td><td>AppleScript</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style="white-space:nowrap">T1059.003<a name="MITRE-ATTCK-Techniques-T1059.46003"> </a></td><td>Windows Command Shell</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style="white-space:nowrap">T1059.013<a name="MITRE-ATTCK-Techniques-T1059.46013"> </a></td><td>Container CLI/API</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style="white-space:nowrap">T1059.004<a name="MITRE-ATTCK-Techniques-T1059.46004"> </a></td><td>Unix Shell</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style="white-space:nowrap">T1059.010<a name="MITRE-ATTCK-Techniques-T1059.46010"> </a></td><td>AutoHotKey &amp; AutoIT</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style="white-space:nowrap">T1059.008<a name="MITRE-ATTCK-Techniques-T1059.46008"> </a></td><td>Network Device CLI</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style="white-space:nowrap">T1059.012<a name="MITRE-ATTCK-Techniques-T1059.46012"> </a></td><td>Hypervisor CLI</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style="white-space:nowrap">T1059.006<a name="MITRE-ATTCK-Techniques-T1059.46006"> </a></td><td>Python</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style="white-space:nowrap">T1059.001<a name="MITRE-ATTCK-Techniques-T1059.46001"> </a></td><td>PowerShell</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style="white-space:nowrap">T1059.009<a name="MITRE-ATTCK-Techniques-T1059.46009"> </a></td><td>Cloud API</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style="white-space:nowrap">T1059.011<a name="MITRE-ATTCK-Techniques-T1059.46011"> </a></td><td>Lua</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style="white-space:nowrap">T1059.007<a name="MITRE-ATTCK-Techniques-T1059.46007"> </a></td><td>JavaScript</td><td>TA0002</td><td>T1059</td><td>true</td></tr><tr><td style="white-space:nowrap">T1677<a name="MITRE-ATTCK-Techniques-T1677"> </a></td><td>Poisoned Pipeline Execution</td><td>TA0002</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1482<a name="MITRE-ATTCK-Techniques-T1482"> </a></td><td>Domain Trust Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1020<a name="MITRE-ATTCK-Techniques-T1020"> </a></td><td>Automated Exfiltration</td><td>TA0010</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1020.001<a name="MITRE-ATTCK-Techniques-T1020.46001"> </a></td><td>Traffic Duplication</td><td>TA0010</td><td>T1020</td><td>true</td></tr><tr><td style="white-space:nowrap">T1070<a name="MITRE-ATTCK-Techniques-T1070"> </a></td><td>Indicator Removal</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1070.004<a name="MITRE-ATTCK-Techniques-T1070.46004"> </a></td><td>File Deletion</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style="white-space:nowrap">T1070.006<a name="MITRE-ATTCK-Techniques-T1070.46006"> </a></td><td>Timestomp</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style="white-space:nowrap">T1070.008<a name="MITRE-ATTCK-Techniques-T1070.46008"> </a></td><td>Clear Mailbox Data</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style="white-space:nowrap">T1070.002<a name="MITRE-ATTCK-Techniques-T1070.46002"> </a></td><td>Clear Linux or Mac System Logs</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style="white-space:nowrap">T1070.001<a name="MITRE-ATTCK-Techniques-T1070.46001"> </a></td><td>Clear Windows Event Logs</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style="white-space:nowrap">T1070.009<a name="MITRE-ATTCK-Techniques-T1070.46009"> </a></td><td>Clear Persistence</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style="white-space:nowrap">T1070.003<a name="MITRE-ATTCK-Techniques-T1070.46003"> </a></td><td>Clear Command History</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style="white-space:nowrap">T1070.010<a name="MITRE-ATTCK-Techniques-T1070.46010"> </a></td><td>Relocate Malware</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style="white-space:nowrap">T1070.007<a name="MITRE-ATTCK-Techniques-T1070.46007"> </a></td><td>Clear Network Connection History and Configurations</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style="white-space:nowrap">T1070.005<a name="MITRE-ATTCK-Techniques-T1070.46005"> </a></td><td>Network Share Connection Removal</td><td>TA0005</td><td>T1070</td><td>true</td></tr><tr><td style="white-space:nowrap">T1609<a name="MITRE-ATTCK-Techniques-T1609"> </a></td><td>Container Administration Command</td><td>TA0002</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1083<a name="MITRE-ATTCK-Techniques-T1083"> </a></td><td>File and Directory Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1568<a name="MITRE-ATTCK-Techniques-T1568"> </a></td><td>Dynamic Resolution</td><td>TA0011</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1568.001<a name="MITRE-ATTCK-Techniques-T1568.46001"> </a></td><td>Fast Flux DNS</td><td>TA0011</td><td>T1568</td><td>true</td></tr><tr><td style="white-space:nowrap">T1568.002<a name="MITRE-ATTCK-Techniques-T1568.46002"> </a></td><td>Domain Generation Algorithms</td><td>TA0011</td><td>T1568</td><td>true</td></tr><tr><td style="white-space:nowrap">T1568.003<a name="MITRE-ATTCK-Techniques-T1568.46003"> </a></td><td>DNS Calculation</td><td>TA0011</td><td>T1568</td><td>true</td></tr><tr><td style="white-space:nowrap">T1647<a name="MITRE-ATTCK-Techniques-T1647"> </a></td><td>Plist File Modification</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1074<a name="MITRE-ATTCK-Techniques-T1074"> </a></td><td>Data Staged</td><td>TA0009</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1074.001<a name="MITRE-ATTCK-Techniques-T1074.46001"> </a></td><td>Local Data Staging</td><td>TA0009</td><td>T1074</td><td>true</td></tr><tr><td style="white-space:nowrap">T1074.002<a name="MITRE-ATTCK-Techniques-T1074.46002"> </a></td><td>Remote Data Staging</td><td>TA0009</td><td>T1074</td><td>true</td></tr><tr><td style="white-space:nowrap">T1649<a name="MITRE-ATTCK-Techniques-T1649"> </a></td><td>Steal or Forge Authentication Certificates</td><td>TA0006</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1049<a name="MITRE-ATTCK-Techniques-T1049"> </a></td><td>System Network Connections Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1584<a name="MITRE-ATTCK-Techniques-T1584"> </a></td><td>Compromise Infrastructure</td><td>TA0042</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1584.003<a name="MITRE-ATTCK-Techniques-T1584.46003"> </a></td><td>Virtual Private Server</td><td>TA0042</td><td>T1584</td><td>true</td></tr><tr><td style="white-space:nowrap">T1584.002<a name="MITRE-ATTCK-Techniques-T1584.46002"> </a></td><td>DNS Server</td><td>TA0042</td><td>T1584</td><td>true</td></tr><tr><td style="white-space:nowrap">T1584.006<a name="MITRE-ATTCK-Techniques-T1584.46006"> </a></td><td>Web Services</td><td>TA0042</td><td>T1584</td><td>true</td></tr><tr><td style="white-space:nowrap">T1584.007<a name="MITRE-ATTCK-Techniques-T1584.46007"> </a></td><td>Serverless</td><td>TA0042</td><td>T1584</td><td>true</td></tr><tr><td style="white-space:nowrap">T1584.005<a name="MITRE-ATTCK-Techniques-T1584.46005"> </a></td><td>Botnet</td><td>TA0042</td><td>T1584</td><td>true</td></tr><tr><td style="white-space:nowrap">T1584.004<a name="MITRE-ATTCK-Techniques-T1584.46004"> </a></td><td>Server</td><td>TA0042</td><td>T1584</td><td>true</td></tr><tr><td style="white-space:nowrap">T1584.008<a name="MITRE-ATTCK-Techniques-T1584.46008"> </a></td><td>Network Devices</td><td>TA0042</td><td>T1584</td><td>true</td></tr><tr><td style="white-space:nowrap">T1584.001<a name="MITRE-ATTCK-Techniques-T1584.46001"> </a></td><td>Domains</td><td>TA0042</td><td>T1584</td><td>true</td></tr><tr><td style="white-space:nowrap">T1542<a name="MITRE-ATTCK-Techniques-T1542"> </a></td><td>Pre-OS Boot</td><td>TA0005, TA0003</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1542.003<a name="MITRE-ATTCK-Techniques-T1542.46003"> </a></td><td>Bootkit</td><td>TA0005, TA0003</td><td>T1542</td><td>true</td></tr><tr><td style="white-space:nowrap">T1542.005<a name="MITRE-ATTCK-Techniques-T1542.46005"> </a></td><td>TFTP Boot</td><td>TA0005, TA0003</td><td>T1542</td><td>true</td></tr><tr><td style="white-space:nowrap">T1542.002<a name="MITRE-ATTCK-Techniques-T1542.46002"> </a></td><td>Component Firmware</td><td>TA0005, TA0003</td><td>T1542</td><td>true</td></tr><tr><td style="white-space:nowrap">T1542.004<a name="MITRE-ATTCK-Techniques-T1542.46004"> </a></td><td>ROMMONkit</td><td>TA0005, TA0003</td><td>T1542</td><td>true</td></tr><tr><td style="white-space:nowrap">T1542.001<a name="MITRE-ATTCK-Techniques-T1542.46001"> </a></td><td>System Firmware</td><td>TA0005, TA0003</td><td>T1542</td><td>true</td></tr><tr><td style="white-space:nowrap">T1612<a name="MITRE-ATTCK-Techniques-T1612"> </a></td><td>Build Image on Host</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1586<a name="MITRE-ATTCK-Techniques-T1586"> </a></td><td>Compromise Accounts</td><td>TA0042</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1586.003<a name="MITRE-ATTCK-Techniques-T1586.46003"> </a></td><td>Cloud Accounts</td><td>TA0042</td><td>T1586</td><td>true</td></tr><tr><td style="white-space:nowrap">T1586.002<a name="MITRE-ATTCK-Techniques-T1586.46002"> </a></td><td>Email Accounts</td><td>TA0042</td><td>T1586</td><td>true</td></tr><tr><td style="white-space:nowrap">T1586.001<a name="MITRE-ATTCK-Techniques-T1586.46001"> </a></td><td>Social Media Accounts</td><td>TA0042</td><td>T1586</td><td>true</td></tr><tr><td style="white-space:nowrap">T1497<a name="MITRE-ATTCK-Techniques-T1497"> </a></td><td>Virtualization/Sandbox Evasion</td><td>TA0005, TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1497.002<a name="MITRE-ATTCK-Techniques-T1497.46002"> </a></td><td>User Activity Based Checks</td><td>TA0005, TA0007</td><td>T1497</td><td>true</td></tr><tr><td style="white-space:nowrap">T1497.001<a name="MITRE-ATTCK-Techniques-T1497.46001"> </a></td><td>System Checks</td><td>TA0005, TA0007</td><td>T1497</td><td>true</td></tr><tr><td style="white-space:nowrap">T1497.003<a name="MITRE-ATTCK-Techniques-T1497.46003"> </a></td><td>Time Based Checks</td><td>TA0005, TA0007</td><td>T1497</td><td>true</td></tr><tr><td style="white-space:nowrap">T1102<a name="MITRE-ATTCK-Techniques-T1102"> </a></td><td>Web Service</td><td>TA0011</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1102.003<a name="MITRE-ATTCK-Techniques-T1102.46003"> </a></td><td>One-Way Communication</td><td>TA0011</td><td>T1102</td><td>true</td></tr><tr><td style="white-space:nowrap">T1102.001<a name="MITRE-ATTCK-Techniques-T1102.46001"> </a></td><td>Dead Drop Resolver</td><td>TA0011</td><td>T1102</td><td>true</td></tr><tr><td style="white-space:nowrap">T1102.002<a name="MITRE-ATTCK-Techniques-T1102.46002"> </a></td><td>Bidirectional Communication</td><td>TA0011</td><td>T1102</td><td>true</td></tr><tr><td style="white-space:nowrap">T1608<a name="MITRE-ATTCK-Techniques-T1608"> </a></td><td>Stage Capabilities</td><td>TA0042</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1608.004<a name="MITRE-ATTCK-Techniques-T1608.46004"> </a></td><td>Drive-by Target</td><td>TA0042</td><td>T1608</td><td>true</td></tr><tr><td style="white-space:nowrap">T1608.005<a name="MITRE-ATTCK-Techniques-T1608.46005"> </a></td><td>Link Target</td><td>TA0042</td><td>T1608</td><td>true</td></tr><tr><td style="white-space:nowrap">T1608.006<a name="MITRE-ATTCK-Techniques-T1608.46006"> </a></td><td>SEO Poisoning</td><td>TA0042</td><td>T1608</td><td>true</td></tr><tr><td style="white-space:nowrap">T1608.003<a name="MITRE-ATTCK-Techniques-T1608.46003"> </a></td><td>Install Digital Certificate</td><td>TA0042</td><td>T1608</td><td>true</td></tr><tr><td style="white-space:nowrap">T1608.002<a name="MITRE-ATTCK-Techniques-T1608.46002"> </a></td><td>Upload Tool</td><td>TA0042</td><td>T1608</td><td>true</td></tr><tr><td style="white-space:nowrap">T1608.001<a name="MITRE-ATTCK-Techniques-T1608.46001"> </a></td><td>Upload Malware</td><td>TA0042</td><td>T1608</td><td>true</td></tr><tr><td style="white-space:nowrap">T1104<a name="MITRE-ATTCK-Techniques-T1104"> </a></td><td>Multi-Stage Channels</td><td>TA0011</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1657<a name="MITRE-ATTCK-Techniques-T1657"> </a></td><td>Financial Theft</td><td>TA0040</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1480<a name="MITRE-ATTCK-Techniques-T1480"> </a></td><td>Execution Guardrails</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1480.001<a name="MITRE-ATTCK-Techniques-T1480.46001"> </a></td><td>Environmental Keying</td><td>TA0005</td><td>T1480</td><td>true</td></tr><tr><td style="white-space:nowrap">T1480.002<a name="MITRE-ATTCK-Techniques-T1480.46002"> </a></td><td>Mutual Exclusion</td><td>TA0005</td><td>T1480</td><td>true</td></tr><tr><td style="white-space:nowrap">T1619<a name="MITRE-ATTCK-Techniques-T1619"> </a></td><td>Cloud Storage Object Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1654<a name="MITRE-ATTCK-Techniques-T1654"> </a></td><td>Log Enumeration</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1528<a name="MITRE-ATTCK-Techniques-T1528"> </a></td><td>Steal Application Access Token</td><td>TA0006</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1204<a name="MITRE-ATTCK-Techniques-T1204"> </a></td><td>User Execution</td><td>TA0002</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1204.005<a name="MITRE-ATTCK-Techniques-T1204.46005"> </a></td><td>Malicious Library</td><td>TA0002</td><td>T1204</td><td>true</td></tr><tr><td style="white-space:nowrap">T1204.002<a name="MITRE-ATTCK-Techniques-T1204.46002"> </a></td><td>Malicious File</td><td>TA0002</td><td>T1204</td><td>true</td></tr><tr><td style="white-space:nowrap">T1204.003<a name="MITRE-ATTCK-Techniques-T1204.46003"> </a></td><td>Malicious Image</td><td>TA0002</td><td>T1204</td><td>true</td></tr><tr><td style="white-space:nowrap">T1204.001<a name="MITRE-ATTCK-Techniques-T1204.46001"> </a></td><td>Malicious Link</td><td>TA0002</td><td>T1204</td><td>true</td></tr><tr><td style="white-space:nowrap">T1204.004<a name="MITRE-ATTCK-Techniques-T1204.46004"> </a></td><td>Malicious Copy and Paste</td><td>TA0002</td><td>T1204</td><td>true</td></tr><tr><td style="white-space:nowrap">T1057<a name="MITRE-ATTCK-Techniques-T1057"> </a></td><td>Process Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1072<a name="MITRE-ATTCK-Techniques-T1072"> </a></td><td>Software Deployment Tools</td><td>TA0002, TA0008</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1041<a name="MITRE-ATTCK-Techniques-T1041"> </a></td><td>Exfiltration Over C2 Channel</td><td>TA0010</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1591<a name="MITRE-ATTCK-Techniques-T1591"> </a></td><td>Gather Victim Org Information</td><td>TA0043</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1591.002<a name="MITRE-ATTCK-Techniques-T1591.46002"> </a></td><td>Business Relationships</td><td>TA0043</td><td>T1591</td><td>true</td></tr><tr><td style="white-space:nowrap">T1591.001<a name="MITRE-ATTCK-Techniques-T1591.46001"> </a></td><td>Determine Physical Locations</td><td>TA0043</td><td>T1591</td><td>true</td></tr><tr><td style="white-space:nowrap">T1591.004<a name="MITRE-ATTCK-Techniques-T1591.46004"> </a></td><td>Identify Roles</td><td>TA0043</td><td>T1591</td><td>true</td></tr><tr><td style="white-space:nowrap">T1591.003<a name="MITRE-ATTCK-Techniques-T1591.46003"> </a></td><td>Identify Business Tempo</td><td>TA0043</td><td>T1591</td><td>true</td></tr><tr><td style="white-space:nowrap">T1606<a name="MITRE-ATTCK-Techniques-T1606"> </a></td><td>Forge Web Credentials</td><td>TA0006</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1606.001<a name="MITRE-ATTCK-Techniques-T1606.46001"> </a></td><td>Web Cookies</td><td>TA0006</td><td>T1606</td><td>true</td></tr><tr><td style="white-space:nowrap">T1606.002<a name="MITRE-ATTCK-Techniques-T1606.46002"> </a></td><td>SAML Tokens</td><td>TA0006</td><td>T1606</td><td>true</td></tr><tr><td style="white-space:nowrap">T1621<a name="MITRE-ATTCK-Techniques-T1621"> </a></td><td>Multi-Factor Authentication Request Generation</td><td>TA0006</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1554<a name="MITRE-ATTCK-Techniques-T1554"> </a></td><td>Compromise Host Software Binary</td><td>TA0003</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1679<a name="MITRE-ATTCK-Techniques-T1679"> </a></td><td>Selective Exclusion</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1212<a name="MITRE-ATTCK-Techniques-T1212"> </a></td><td>Exploitation for Credential Access</td><td>TA0006</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1590<a name="MITRE-ATTCK-Techniques-T1590"> </a></td><td>Gather Victim Network Information</td><td>TA0043</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1590.001<a name="MITRE-ATTCK-Techniques-T1590.46001"> </a></td><td>Domain Properties</td><td>TA0043</td><td>T1590</td><td>true</td></tr><tr><td style="white-space:nowrap">T1590.002<a name="MITRE-ATTCK-Techniques-T1590.46002"> </a></td><td>DNS</td><td>TA0043</td><td>T1590</td><td>true</td></tr><tr><td style="white-space:nowrap">T1590.005<a name="MITRE-ATTCK-Techniques-T1590.46005"> </a></td><td>IP Addresses</td><td>TA0043</td><td>T1590</td><td>true</td></tr><tr><td style="white-space:nowrap">T1590.003<a name="MITRE-ATTCK-Techniques-T1590.46003"> </a></td><td>Network Trust Dependencies</td><td>TA0043</td><td>T1590</td><td>true</td></tr><tr><td style="white-space:nowrap">T1590.004<a name="MITRE-ATTCK-Techniques-T1590.46004"> </a></td><td>Network Topology</td><td>TA0043</td><td>T1590</td><td>true</td></tr><tr><td style="white-space:nowrap">T1590.006<a name="MITRE-ATTCK-Techniques-T1590.46006"> </a></td><td>Network Security Appliances</td><td>TA0043</td><td>T1590</td><td>true</td></tr><tr><td style="white-space:nowrap">T1210<a name="MITRE-ATTCK-Techniques-T1210"> </a></td><td>Exploitation of Remote Services</td><td>TA0008</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1534<a name="MITRE-ATTCK-Techniques-T1534"> </a></td><td>Internal Spearphishing</td><td>TA0008</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1199<a name="MITRE-ATTCK-Techniques-T1199"> </a></td><td>Trusted Relationship</td><td>TA0001</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1593<a name="MITRE-ATTCK-Techniques-T1593"> </a></td><td>Search Open Websites/Domains</td><td>TA0043</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1593.002<a name="MITRE-ATTCK-Techniques-T1593.46002"> </a></td><td>Search Engines</td><td>TA0043</td><td>T1593</td><td>true</td></tr><tr><td style="white-space:nowrap">T1593.003<a name="MITRE-ATTCK-Techniques-T1593.46003"> </a></td><td>Code Repositories</td><td>TA0043</td><td>T1593</td><td>true</td></tr><tr><td style="white-space:nowrap">T1593.001<a name="MITRE-ATTCK-Techniques-T1593.46001"> </a></td><td>Social Media</td><td>TA0043</td><td>T1593</td><td>true</td></tr><tr><td style="white-space:nowrap">T1098<a name="MITRE-ATTCK-Techniques-T1098"> </a></td><td>Account Manipulation</td><td>TA0003, TA0004</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1098.001<a name="MITRE-ATTCK-Techniques-T1098.46001"> </a></td><td>Additional Cloud Credentials</td><td>TA0003, TA0004</td><td>T1098</td><td>true</td></tr><tr><td style="white-space:nowrap">T1098.002<a name="MITRE-ATTCK-Techniques-T1098.46002"> </a></td><td>Additional Email Delegate Permissions</td><td>TA0003, TA0004</td><td>T1098</td><td>true</td></tr><tr><td style="white-space:nowrap">T1098.003<a name="MITRE-ATTCK-Techniques-T1098.46003"> </a></td><td>Additional Cloud Roles</td><td>TA0003, TA0004</td><td>T1098</td><td>true</td></tr><tr><td style="white-space:nowrap">T1098.005<a name="MITRE-ATTCK-Techniques-T1098.46005"> </a></td><td>Device Registration</td><td>TA0003, TA0004</td><td>T1098</td><td>true</td></tr><tr><td style="white-space:nowrap">T1098.006<a name="MITRE-ATTCK-Techniques-T1098.46006"> </a></td><td>Additional Container Cluster Roles</td><td>TA0003, TA0004</td><td>T1098</td><td>true</td></tr><tr><td style="white-space:nowrap">T1098.004<a name="MITRE-ATTCK-Techniques-T1098.46004"> </a></td><td>SSH Authorized Keys</td><td>TA0003, TA0004</td><td>T1098</td><td>true</td></tr><tr><td style="white-space:nowrap">T1098.007<a name="MITRE-ATTCK-Techniques-T1098.46007"> </a></td><td>Additional Local or Domain Groups</td><td>TA0003, TA0004</td><td>T1098</td><td>true</td></tr><tr><td style="white-space:nowrap">T1048<a name="MITRE-ATTCK-Techniques-T1048"> </a></td><td>Exfiltration Over Alternative Protocol</td><td>TA0010</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1048.002<a name="MITRE-ATTCK-Techniques-T1048.46002"> </a></td><td>Exfiltration Over Asymmetric Encrypted Non-C2 Protocol</td><td>TA0010</td><td>T1048</td><td>true</td></tr><tr><td style="white-space:nowrap">T1048.003<a name="MITRE-ATTCK-Techniques-T1048.46003"> </a></td><td>Exfiltration Over Unencrypted Non-C2 Protocol</td><td>TA0010</td><td>T1048</td><td>true</td></tr><tr><td style="white-space:nowrap">T1048.001<a name="MITRE-ATTCK-Techniques-T1048.46001"> </a></td><td>Exfiltration Over Symmetric Encrypted Non-C2 Protocol</td><td>TA0010</td><td>T1048</td><td>true</td></tr><tr><td style="white-space:nowrap">T1678<a name="MITRE-ATTCK-Techniques-T1678"> </a></td><td>Delay Execution</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1597<a name="MITRE-ATTCK-Techniques-T1597"> </a></td><td>Search Closed Sources</td><td>TA0043</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1597.001<a name="MITRE-ATTCK-Techniques-T1597.46001"> </a></td><td>Threat Intel Vendors</td><td>TA0043</td><td>T1597</td><td>true</td></tr><tr><td style="white-space:nowrap">T1597.002<a name="MITRE-ATTCK-Techniques-T1597.46002"> </a></td><td>Purchase Technical Data</td><td>TA0043</td><td>T1597</td><td>true</td></tr><tr><td style="white-space:nowrap">T1566<a name="MITRE-ATTCK-Techniques-T1566"> </a></td><td>Phishing</td><td>TA0001</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1566.002<a name="MITRE-ATTCK-Techniques-T1566.46002"> </a></td><td>Spearphishing Link</td><td>TA0001</td><td>T1566</td><td>true</td></tr><tr><td style="white-space:nowrap">T1566.001<a name="MITRE-ATTCK-Techniques-T1566.46001"> </a></td><td>Spearphishing Attachment</td><td>TA0001</td><td>T1566</td><td>true</td></tr><tr><td style="white-space:nowrap">T1566.004<a name="MITRE-ATTCK-Techniques-T1566.46004"> </a></td><td>Spearphishing Voice</td><td>TA0001</td><td>T1566</td><td>true</td></tr><tr><td style="white-space:nowrap">T1566.003<a name="MITRE-ATTCK-Techniques-T1566.46003"> </a></td><td>Spearphishing via Service</td><td>TA0001</td><td>T1566</td><td>true</td></tr><tr><td style="white-space:nowrap">T1110<a name="MITRE-ATTCK-Techniques-T1110"> </a></td><td>Brute Force</td><td>TA0006</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1110.004<a name="MITRE-ATTCK-Techniques-T1110.46004"> </a></td><td>Credential Stuffing</td><td>TA0006</td><td>T1110</td><td>true</td></tr><tr><td style="white-space:nowrap">T1110.002<a name="MITRE-ATTCK-Techniques-T1110.46002"> </a></td><td>Password Cracking</td><td>TA0006</td><td>T1110</td><td>true</td></tr><tr><td style="white-space:nowrap">T1110.001<a name="MITRE-ATTCK-Techniques-T1110.46001"> </a></td><td>Password Guessing</td><td>TA0006</td><td>T1110</td><td>true</td></tr><tr><td style="white-space:nowrap">T1110.003<a name="MITRE-ATTCK-Techniques-T1110.46003"> </a></td><td>Password Spraying</td><td>TA0006</td><td>T1110</td><td>true</td></tr><tr><td style="white-space:nowrap">T1565<a name="MITRE-ATTCK-Techniques-T1565"> </a></td><td>Data Manipulation</td><td>TA0040</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1565.002<a name="MITRE-ATTCK-Techniques-T1565.46002"> </a></td><td>Transmitted Data Manipulation</td><td>TA0040</td><td>T1565</td><td>true</td></tr><tr><td style="white-space:nowrap">T1565.003<a name="MITRE-ATTCK-Techniques-T1565.46003"> </a></td><td>Runtime Data Manipulation</td><td>TA0040</td><td>T1565</td><td>true</td></tr><tr><td style="white-space:nowrap">T1565.001<a name="MITRE-ATTCK-Techniques-T1565.46001"> </a></td><td>Stored Data Manipulation</td><td>TA0040</td><td>T1565</td><td>true</td></tr><tr><td style="white-space:nowrap">T1559<a name="MITRE-ATTCK-Techniques-T1559"> </a></td><td>Inter-Process Communication</td><td>TA0002</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1559.003<a name="MITRE-ATTCK-Techniques-T1559.46003"> </a></td><td>XPC Services</td><td>TA0002</td><td>T1559</td><td>true</td></tr><tr><td style="white-space:nowrap">T1559.002<a name="MITRE-ATTCK-Techniques-T1559.46002"> </a></td><td>Dynamic Data Exchange</td><td>TA0002</td><td>T1559</td><td>true</td></tr><tr><td style="white-space:nowrap">T1559.001<a name="MITRE-ATTCK-Techniques-T1559.46001"> </a></td><td>Component Object Model</td><td>TA0002</td><td>T1559</td><td>true</td></tr><tr><td style="white-space:nowrap">T1001<a name="MITRE-ATTCK-Techniques-T1001"> </a></td><td>Data Obfuscation</td><td>TA0011</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1001.001<a name="MITRE-ATTCK-Techniques-T1001.46001"> </a></td><td>Junk Data</td><td>TA0011</td><td>T1001</td><td>true</td></tr><tr><td style="white-space:nowrap">T1001.003<a name="MITRE-ATTCK-Techniques-T1001.46003"> </a></td><td>Protocol or Service Impersonation</td><td>TA0011</td><td>T1001</td><td>true</td></tr><tr><td style="white-space:nowrap">T1001.002<a name="MITRE-ATTCK-Techniques-T1001.46002"> </a></td><td>Steganography</td><td>TA0011</td><td>T1001</td><td>true</td></tr><tr><td style="white-space:nowrap">T1039<a name="MITRE-ATTCK-Techniques-T1039"> </a></td><td>Data from Network Shared Drive</td><td>TA0009</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1601<a name="MITRE-ATTCK-Techniques-T1601"> </a></td><td>Modify System Image</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1601.002<a name="MITRE-ATTCK-Techniques-T1601.46002"> </a></td><td>Downgrade System Image</td><td>TA0005</td><td>T1601</td><td>true</td></tr><tr><td style="white-space:nowrap">T1601.001<a name="MITRE-ATTCK-Techniques-T1601.46001"> </a></td><td>Patch System Image</td><td>TA0005</td><td>T1601</td><td>true</td></tr><tr><td style="white-space:nowrap">T1574<a name="MITRE-ATTCK-Techniques-T1574"> </a></td><td>Hijack Execution Flow</td><td>TA0003, TA0004, TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1574.010<a name="MITRE-ATTCK-Techniques-T1574.46010"> </a></td><td>Services File Permissions Weakness</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style="white-space:nowrap">T1574.013<a name="MITRE-ATTCK-Techniques-T1574.46013"> </a></td><td>KernelCallbackTable</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style="white-space:nowrap">T1574.007<a name="MITRE-ATTCK-Techniques-T1574.46007"> </a></td><td>Path Interception by PATH Environment Variable</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style="white-space:nowrap">T1574.005<a name="MITRE-ATTCK-Techniques-T1574.46005"> </a></td><td>Executable Installer File Permissions Weakness</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style="white-space:nowrap">T1574.009<a name="MITRE-ATTCK-Techniques-T1574.46009"> </a></td><td>Path Interception by Unquoted Path</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style="white-space:nowrap">T1574.004<a name="MITRE-ATTCK-Techniques-T1574.46004"> </a></td><td>Dylib Hijacking</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style="white-space:nowrap">T1574.006<a name="MITRE-ATTCK-Techniques-T1574.46006"> </a></td><td>Dynamic Linker Hijacking</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style="white-space:nowrap">T1574.014<a name="MITRE-ATTCK-Techniques-T1574.46014"> </a></td><td>AppDomainManager</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style="white-space:nowrap">T1574.001<a name="MITRE-ATTCK-Techniques-T1574.46001"> </a></td><td>DLL</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style="white-space:nowrap">T1574.008<a name="MITRE-ATTCK-Techniques-T1574.46008"> </a></td><td>Path Interception by Search Order Hijacking</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style="white-space:nowrap">T1574.011<a name="MITRE-ATTCK-Techniques-T1574.46011"> </a></td><td>Services Registry Permissions Weakness</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style="white-space:nowrap">T1574.012<a name="MITRE-ATTCK-Techniques-T1574.46012"> </a></td><td>COR_PROFILER</td><td>TA0003, TA0004, TA0005</td><td>T1574</td><td>true</td></tr><tr><td style="white-space:nowrap">T1078<a name="MITRE-ATTCK-Techniques-T1078"> </a></td><td>Valid Accounts</td><td>TA0005, TA0003, TA0004, TA0001</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1078.004<a name="MITRE-ATTCK-Techniques-T1078.46004"> </a></td><td>Cloud Accounts</td><td>TA0005, TA0003, TA0004, TA0001</td><td>T1078</td><td>true</td></tr><tr><td style="white-space:nowrap">T1078.002<a name="MITRE-ATTCK-Techniques-T1078.46002"> </a></td><td>Domain Accounts</td><td>TA0005, TA0003, TA0004, TA0001</td><td>T1078</td><td>true</td></tr><tr><td style="white-space:nowrap">T1078.003<a name="MITRE-ATTCK-Techniques-T1078.46003"> </a></td><td>Local Accounts</td><td>TA0005, TA0003, TA0004, TA0001</td><td>T1078</td><td>true</td></tr><tr><td style="white-space:nowrap">T1078.001<a name="MITRE-ATTCK-Techniques-T1078.46001"> </a></td><td>Default Accounts</td><td>TA0005, TA0003, TA0004, TA0001</td><td>T1078</td><td>true</td></tr><tr><td style="white-space:nowrap">T1571<a name="MITRE-ATTCK-Techniques-T1571"> </a></td><td>Non-Standard Port</td><td>TA0011</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1068<a name="MITRE-ATTCK-Techniques-T1068"> </a></td><td>Exploitation for Privilege Escalation</td><td>TA0004</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1531<a name="MITRE-ATTCK-Techniques-T1531"> </a></td><td>Account Access Removal</td><td>TA0040</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1027<a name="MITRE-ATTCK-Techniques-T1027"> </a></td><td>Obfuscated Files or Information</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1027.005<a name="MITRE-ATTCK-Techniques-T1027.46005"> </a></td><td>Indicator Removal from Tools</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style="white-space:nowrap">T1027.009<a name="MITRE-ATTCK-Techniques-T1027.46009"> </a></td><td>Embedded Payloads</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style="white-space:nowrap">T1027.013<a name="MITRE-ATTCK-Techniques-T1027.46013"> </a></td><td>Encrypted/Encoded File</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style="white-space:nowrap">T1027.012<a name="MITRE-ATTCK-Techniques-T1027.46012"> </a></td><td>LNK Icon Smuggling</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style="white-space:nowrap">T1027.017<a name="MITRE-ATTCK-Techniques-T1027.46017"> </a></td><td>SVG Smuggling</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style="white-space:nowrap">T1027.006<a name="MITRE-ATTCK-Techniques-T1027.46006"> </a></td><td>HTML Smuggling</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style="white-space:nowrap">T1027.011<a name="MITRE-ATTCK-Techniques-T1027.46011"> </a></td><td>Fileless Storage</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style="white-space:nowrap">T1027.014<a name="MITRE-ATTCK-Techniques-T1027.46014"> </a></td><td>Polymorphic Code</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style="white-space:nowrap">T1027.010<a name="MITRE-ATTCK-Techniques-T1027.46010"> </a></td><td>Command Obfuscation</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style="white-space:nowrap">T1027.004<a name="MITRE-ATTCK-Techniques-T1027.46004"> </a></td><td>Compile After Delivery</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style="white-space:nowrap">T1027.007<a name="MITRE-ATTCK-Techniques-T1027.46007"> </a></td><td>Dynamic API Resolution</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style="white-space:nowrap">T1027.003<a name="MITRE-ATTCK-Techniques-T1027.46003"> </a></td><td>Steganography</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style="white-space:nowrap">T1027.015<a name="MITRE-ATTCK-Techniques-T1027.46015"> </a></td><td>Compression</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style="white-space:nowrap">T1027.016<a name="MITRE-ATTCK-Techniques-T1027.46016"> </a></td><td>Junk Code Insertion</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style="white-space:nowrap">T1027.008<a name="MITRE-ATTCK-Techniques-T1027.46008"> </a></td><td>Stripped Payloads</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style="white-space:nowrap">T1027.002<a name="MITRE-ATTCK-Techniques-T1027.46002"> </a></td><td>Software Packing</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style="white-space:nowrap">T1027.001<a name="MITRE-ATTCK-Techniques-T1027.46001"> </a></td><td>Binary Padding</td><td>TA0005</td><td>T1027</td><td>true</td></tr><tr><td style="white-space:nowrap">T1201<a name="MITRE-ATTCK-Techniques-T1201"> </a></td><td>Password Policy Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1546<a name="MITRE-ATTCK-Techniques-T1546"> </a></td><td>Event Triggered Execution</td><td>TA0004, TA0003</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1546.002<a name="MITRE-ATTCK-Techniques-T1546.46002"> </a></td><td>Screensaver</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style="white-space:nowrap">T1546.013<a name="MITRE-ATTCK-Techniques-T1546.46013"> </a></td><td>PowerShell Profile</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style="white-space:nowrap">T1546.016<a name="MITRE-ATTCK-Techniques-T1546.46016"> </a></td><td>Installer Packages</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style="white-space:nowrap">T1546.003<a name="MITRE-ATTCK-Techniques-T1546.46003"> </a></td><td>Windows Management Instrumentation Event Subscription</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style="white-space:nowrap">T1546.006<a name="MITRE-ATTCK-Techniques-T1546.46006"> </a></td><td>LC_LOAD_DYLIB Addition</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style="white-space:nowrap">T1546.018<a name="MITRE-ATTCK-Techniques-T1546.46018"> </a></td><td>Python Startup Hooks</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style="white-space:nowrap">T1546.011<a name="MITRE-ATTCK-Techniques-T1546.46011"> </a></td><td>Application Shimming</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style="white-space:nowrap">T1546.015<a name="MITRE-ATTCK-Techniques-T1546.46015"> </a></td><td>Component Object Model Hijacking</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style="white-space:nowrap">T1546.004<a name="MITRE-ATTCK-Techniques-T1546.46004"> </a></td><td>Unix Shell Configuration Modification</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style="white-space:nowrap">T1546.010<a name="MITRE-ATTCK-Techniques-T1546.46010"> </a></td><td>AppInit DLLs</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style="white-space:nowrap">T1546.005<a name="MITRE-ATTCK-Techniques-T1546.46005"> </a></td><td>Trap</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style="white-space:nowrap">T1546.007<a name="MITRE-ATTCK-Techniques-T1546.46007"> </a></td><td>Netsh Helper DLL</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style="white-space:nowrap">T1546.012<a name="MITRE-ATTCK-Techniques-T1546.46012"> </a></td><td>Image File Execution Options Injection</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style="white-space:nowrap">T1546.001<a name="MITRE-ATTCK-Techniques-T1546.46001"> </a></td><td>Change Default File Association</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style="white-space:nowrap">T1546.009<a name="MITRE-ATTCK-Techniques-T1546.46009"> </a></td><td>AppCert DLLs</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style="white-space:nowrap">T1546.017<a name="MITRE-ATTCK-Techniques-T1546.46017"> </a></td><td>Udev Rules</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style="white-space:nowrap">T1546.014<a name="MITRE-ATTCK-Techniques-T1546.46014"> </a></td><td>Emond</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style="white-space:nowrap">T1546.008<a name="MITRE-ATTCK-Techniques-T1546.46008"> </a></td><td>Accessibility Features</td><td>TA0004, TA0003</td><td>T1546</td><td>true</td></tr><tr><td style="white-space:nowrap">T1187<a name="MITRE-ATTCK-Techniques-T1187"> </a></td><td>Forced Authentication</td><td>TA0006</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1599<a name="MITRE-ATTCK-Techniques-T1599"> </a></td><td>Network Boundary Bridging</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1599.001<a name="MITRE-ATTCK-Techniques-T1599.46001"> </a></td><td>Network Address Translation Traversal</td><td>TA0005</td><td>T1599</td><td>true</td></tr><tr><td style="white-space:nowrap">T1486<a name="MITRE-ATTCK-Techniques-T1486"> </a></td><td>Data Encrypted for Impact</td><td>TA0040</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1553<a name="MITRE-ATTCK-Techniques-T1553"> </a></td><td>Subvert Trust Controls</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1553.005<a name="MITRE-ATTCK-Techniques-T1553.46005"> </a></td><td>Mark-of-the-Web Bypass</td><td>TA0005</td><td>T1553</td><td>true</td></tr><tr><td style="white-space:nowrap">T1553.002<a name="MITRE-ATTCK-Techniques-T1553.46002"> </a></td><td>Code Signing</td><td>TA0005</td><td>T1553</td><td>true</td></tr><tr><td style="white-space:nowrap">T1553.004<a name="MITRE-ATTCK-Techniques-T1553.46004"> </a></td><td>Install Root Certificate</td><td>TA0005</td><td>T1553</td><td>true</td></tr><tr><td style="white-space:nowrap">T1553.003<a name="MITRE-ATTCK-Techniques-T1553.46003"> </a></td><td>SIP and Trust Provider Hijacking</td><td>TA0005</td><td>T1553</td><td>true</td></tr><tr><td style="white-space:nowrap">T1553.006<a name="MITRE-ATTCK-Techniques-T1553.46006"> </a></td><td>Code Signing Policy Modification</td><td>TA0005</td><td>T1553</td><td>true</td></tr><tr><td style="white-space:nowrap">T1553.001<a name="MITRE-ATTCK-Techniques-T1553.46001"> </a></td><td>Gatekeeper Bypass</td><td>TA0005</td><td>T1553</td><td>true</td></tr><tr><td style="white-space:nowrap">T1573<a name="MITRE-ATTCK-Techniques-T1573"> </a></td><td>Encrypted Channel</td><td>TA0011</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1573.002<a name="MITRE-ATTCK-Techniques-T1573.46002"> </a></td><td>Asymmetric Cryptography</td><td>TA0011</td><td>T1573</td><td>true</td></tr><tr><td style="white-space:nowrap">T1573.001<a name="MITRE-ATTCK-Techniques-T1573.46001"> </a></td><td>Symmetric Cryptography</td><td>TA0011</td><td>T1573</td><td>true</td></tr><tr><td style="white-space:nowrap">T1056<a name="MITRE-ATTCK-Techniques-T1056"> </a></td><td>Input Capture</td><td>TA0009, TA0006</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1056.001<a name="MITRE-ATTCK-Techniques-T1056.46001"> </a></td><td>Keylogging</td><td>TA0009, TA0006</td><td>T1056</td><td>true</td></tr><tr><td style="white-space:nowrap">T1056.002<a name="MITRE-ATTCK-Techniques-T1056.46002"> </a></td><td>GUI Input Capture</td><td>TA0009, TA0006</td><td>T1056</td><td>true</td></tr><tr><td style="white-space:nowrap">T1056.004<a name="MITRE-ATTCK-Techniques-T1056.46004"> </a></td><td>Credential API Hooking</td><td>TA0009, TA0006</td><td>T1056</td><td>true</td></tr><tr><td style="white-space:nowrap">T1056.003<a name="MITRE-ATTCK-Techniques-T1056.46003"> </a></td><td>Web Portal Capture</td><td>TA0009, TA0006</td><td>T1056</td><td>true</td></tr><tr><td style="white-space:nowrap">T1203<a name="MITRE-ATTCK-Techniques-T1203"> </a></td><td>Exploitation for Client Execution</td><td>TA0002</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1667<a name="MITRE-ATTCK-Techniques-T1667"> </a></td><td>Email Bombing</td><td>TA0040</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1570<a name="MITRE-ATTCK-Techniques-T1570"> </a></td><td>Lateral Tool Transfer</td><td>TA0008</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1095<a name="MITRE-ATTCK-Techniques-T1095"> </a></td><td>Non-Application Layer Protocol</td><td>TA0011</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1671<a name="MITRE-ATTCK-Techniques-T1671"> </a></td><td>Cloud Application Integration</td><td>TA0003</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1012<a name="MITRE-ATTCK-Techniques-T1012"> </a></td><td>Query Registry</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1030<a name="MITRE-ATTCK-Techniques-T1030"> </a></td><td>Data Transfer Size Limits</td><td>TA0010</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1499<a name="MITRE-ATTCK-Techniques-T1499"> </a></td><td>Endpoint Denial of Service</td><td>TA0040</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1499.003<a name="MITRE-ATTCK-Techniques-T1499.46003"> </a></td><td>Application Exhaustion Flood</td><td>TA0040</td><td>T1499</td><td>true</td></tr><tr><td style="white-space:nowrap">T1499.002<a name="MITRE-ATTCK-Techniques-T1499.46002"> </a></td><td>Service Exhaustion Flood</td><td>TA0040</td><td>T1499</td><td>true</td></tr><tr><td style="white-space:nowrap">T1499.004<a name="MITRE-ATTCK-Techniques-T1499.46004"> </a></td><td>Application or System Exploitation</td><td>TA0040</td><td>T1499</td><td>true</td></tr><tr><td style="white-space:nowrap">T1499.001<a name="MITRE-ATTCK-Techniques-T1499.46001"> </a></td><td>OS Exhaustion Flood</td><td>TA0040</td><td>T1499</td><td>true</td></tr><tr><td style="white-space:nowrap">T1614<a name="MITRE-ATTCK-Techniques-T1614"> </a></td><td>System Location Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1614.001<a name="MITRE-ATTCK-Techniques-T1614.46001"> </a></td><td>System Language Discovery</td><td>TA0007</td><td>T1614</td><td>true</td></tr><tr><td style="white-space:nowrap">T1197<a name="MITRE-ATTCK-Techniques-T1197"> </a></td><td>BITS Jobs</td><td>TA0005, TA0003</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1656<a name="MITRE-ATTCK-Techniques-T1656"> </a></td><td>Impersonation</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1132<a name="MITRE-ATTCK-Techniques-T1132"> </a></td><td>Data Encoding</td><td>TA0011</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1132.001<a name="MITRE-ATTCK-Techniques-T1132.46001"> </a></td><td>Standard Encoding</td><td>TA0011</td><td>T1132</td><td>true</td></tr><tr><td style="white-space:nowrap">T1132.002<a name="MITRE-ATTCK-Techniques-T1132.46002"> </a></td><td>Non-Standard Encoding</td><td>TA0011</td><td>T1132</td><td>true</td></tr><tr><td style="white-space:nowrap">T1598<a name="MITRE-ATTCK-Techniques-T1598"> </a></td><td>Phishing for Information</td><td>TA0043</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1598.004<a name="MITRE-ATTCK-Techniques-T1598.46004"> </a></td><td>Spearphishing Voice</td><td>TA0043</td><td>T1598</td><td>true</td></tr><tr><td style="white-space:nowrap">T1598.001<a name="MITRE-ATTCK-Techniques-T1598.46001"> </a></td><td>Spearphishing Service</td><td>TA0043</td><td>T1598</td><td>true</td></tr><tr><td style="white-space:nowrap">T1598.002<a name="MITRE-ATTCK-Techniques-T1598.46002"> </a></td><td>Spearphishing Attachment</td><td>TA0043</td><td>T1598</td><td>true</td></tr><tr><td style="white-space:nowrap">T1598.003<a name="MITRE-ATTCK-Techniques-T1598.46003"> </a></td><td>Spearphishing Link</td><td>TA0043</td><td>T1598</td><td>true</td></tr><tr><td style="white-space:nowrap">T1496<a name="MITRE-ATTCK-Techniques-T1496"> </a></td><td>Resource Hijacking</td><td>TA0040</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1496.001<a name="MITRE-ATTCK-Techniques-T1496.46001"> </a></td><td>Compute Hijacking</td><td>TA0040</td><td>T1496</td><td>true</td></tr><tr><td style="white-space:nowrap">T1496.002<a name="MITRE-ATTCK-Techniques-T1496.46002"> </a></td><td>Bandwidth Hijacking</td><td>TA0040</td><td>T1496</td><td>true</td></tr><tr><td style="white-space:nowrap">T1496.004<a name="MITRE-ATTCK-Techniques-T1496.46004"> </a></td><td>Cloud Service Hijacking</td><td>TA0040</td><td>T1496</td><td>true</td></tr><tr><td style="white-space:nowrap">T1496.003<a name="MITRE-ATTCK-Techniques-T1496.46003"> </a></td><td>SMS Pumping</td><td>TA0040</td><td>T1496</td><td>true</td></tr><tr><td style="white-space:nowrap">T1585<a name="MITRE-ATTCK-Techniques-T1585"> </a></td><td>Establish Accounts</td><td>TA0042</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1585.003<a name="MITRE-ATTCK-Techniques-T1585.46003"> </a></td><td>Cloud Accounts</td><td>TA0042</td><td>T1585</td><td>true</td></tr><tr><td style="white-space:nowrap">T1585.002<a name="MITRE-ATTCK-Techniques-T1585.46002"> </a></td><td>Email Accounts</td><td>TA0042</td><td>T1585</td><td>true</td></tr><tr><td style="white-space:nowrap">T1585.001<a name="MITRE-ATTCK-Techniques-T1585.46001"> </a></td><td>Social Media Accounts</td><td>TA0042</td><td>T1585</td><td>true</td></tr><tr><td style="white-space:nowrap">T1588<a name="MITRE-ATTCK-Techniques-T1588"> </a></td><td>Obtain Capabilities</td><td>TA0042</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1588.006<a name="MITRE-ATTCK-Techniques-T1588.46006"> </a></td><td>Vulnerabilities</td><td>TA0042</td><td>T1588</td><td>true</td></tr><tr><td style="white-space:nowrap">T1588.005<a name="MITRE-ATTCK-Techniques-T1588.46005"> </a></td><td>Exploits</td><td>TA0042</td><td>T1588</td><td>true</td></tr><tr><td style="white-space:nowrap">T1588.007<a name="MITRE-ATTCK-Techniques-T1588.46007"> </a></td><td>Artificial Intelligence</td><td>TA0042</td><td>T1588</td><td>true</td></tr><tr><td style="white-space:nowrap">T1588.004<a name="MITRE-ATTCK-Techniques-T1588.46004"> </a></td><td>Digital Certificates</td><td>TA0042</td><td>T1588</td><td>true</td></tr><tr><td style="white-space:nowrap">T1588.002<a name="MITRE-ATTCK-Techniques-T1588.46002"> </a></td><td>Tool</td><td>TA0042</td><td>T1588</td><td>true</td></tr><tr><td style="white-space:nowrap">T1588.003<a name="MITRE-ATTCK-Techniques-T1588.46003"> </a></td><td>Code Signing Certificates</td><td>TA0042</td><td>T1588</td><td>true</td></tr><tr><td style="white-space:nowrap">T1588.001<a name="MITRE-ATTCK-Techniques-T1588.46001"> </a></td><td>Malware</td><td>TA0042</td><td>T1588</td><td>true</td></tr><tr><td style="white-space:nowrap">T1569<a name="MITRE-ATTCK-Techniques-T1569"> </a></td><td>System Services</td><td>TA0002</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1569.003<a name="MITRE-ATTCK-Techniques-T1569.46003"> </a></td><td>Systemctl</td><td>TA0002</td><td>T1569</td><td>true</td></tr><tr><td style="white-space:nowrap">T1569.002<a name="MITRE-ATTCK-Techniques-T1569.46002"> </a></td><td>Service Execution</td><td>TA0002</td><td>T1569</td><td>true</td></tr><tr><td style="white-space:nowrap">T1569.001<a name="MITRE-ATTCK-Techniques-T1569.46001"> </a></td><td>Launchctl</td><td>TA0002</td><td>T1569</td><td>true</td></tr><tr><td style="white-space:nowrap">T1650<a name="MITRE-ATTCK-Techniques-T1650"> </a></td><td>Acquire Access</td><td>TA0042</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1213<a name="MITRE-ATTCK-Techniques-T1213"> </a></td><td>Data from Information Repositories</td><td>TA0009</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1213.003<a name="MITRE-ATTCK-Techniques-T1213.46003"> </a></td><td>Code Repositories</td><td>TA0009</td><td>T1213</td><td>true</td></tr><tr><td style="white-space:nowrap">T1213.006<a name="MITRE-ATTCK-Techniques-T1213.46006"> </a></td><td>Databases</td><td>TA0009</td><td>T1213</td><td>true</td></tr><tr><td style="white-space:nowrap">T1213.005<a name="MITRE-ATTCK-Techniques-T1213.46005"> </a></td><td>Messaging Applications</td><td>TA0009</td><td>T1213</td><td>true</td></tr><tr><td style="white-space:nowrap">T1213.004<a name="MITRE-ATTCK-Techniques-T1213.46004"> </a></td><td>Customer Relationship Management Software</td><td>TA0009</td><td>T1213</td><td>true</td></tr><tr><td style="white-space:nowrap">T1213.002<a name="MITRE-ATTCK-Techniques-T1213.46002"> </a></td><td>Sharepoint</td><td>TA0009</td><td>T1213</td><td>true</td></tr><tr><td style="white-space:nowrap">T1213.001<a name="MITRE-ATTCK-Techniques-T1213.46001"> </a></td><td>Confluence</td><td>TA0009</td><td>T1213</td><td>true</td></tr><tr><td style="white-space:nowrap">T1200<a name="MITRE-ATTCK-Techniques-T1200"> </a></td><td>Hardware Additions</td><td>TA0001</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1505<a name="MITRE-ATTCK-Techniques-T1505"> </a></td><td>Server Software Component</td><td>TA0003</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1505.002<a name="MITRE-ATTCK-Techniques-T1505.46002"> </a></td><td>Transport Agent</td><td>TA0003</td><td>T1505</td><td>true</td></tr><tr><td style="white-space:nowrap">T1505.004<a name="MITRE-ATTCK-Techniques-T1505.46004"> </a></td><td>IIS Components</td><td>TA0003</td><td>T1505</td><td>true</td></tr><tr><td style="white-space:nowrap">T1505.003<a name="MITRE-ATTCK-Techniques-T1505.46003"> </a></td><td>Web Shell</td><td>TA0003</td><td>T1505</td><td>true</td></tr><tr><td style="white-space:nowrap">T1505.005<a name="MITRE-ATTCK-Techniques-T1505.46005"> </a></td><td>Terminal Services DLL</td><td>TA0003</td><td>T1505</td><td>true</td></tr><tr><td style="white-space:nowrap">T1505.006<a name="MITRE-ATTCK-Techniques-T1505.46006"> </a></td><td>vSphere Installation Bundles</td><td>TA0003</td><td>T1505</td><td>true</td></tr><tr><td style="white-space:nowrap">T1505.001<a name="MITRE-ATTCK-Techniques-T1505.46001"> </a></td><td>SQL Stored Procedures</td><td>TA0003</td><td>T1505</td><td>true</td></tr><tr><td style="white-space:nowrap">T1485<a name="MITRE-ATTCK-Techniques-T1485"> </a></td><td>Data Destruction</td><td>TA0040</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1485.001<a name="MITRE-ATTCK-Techniques-T1485.46001"> </a></td><td>Lifecycle-Triggered Deletion</td><td>TA0040</td><td>T1485</td><td>true</td></tr><tr><td style="white-space:nowrap">T1537<a name="MITRE-ATTCK-Techniques-T1537"> </a></td><td>Transfer Data to Cloud Account</td><td>TA0010</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1189<a name="MITRE-ATTCK-Techniques-T1189"> </a></td><td>Drive-by Compromise</td><td>TA0001</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1498<a name="MITRE-ATTCK-Techniques-T1498"> </a></td><td>Network Denial of Service</td><td>TA0040</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1498.002<a name="MITRE-ATTCK-Techniques-T1498.46002"> </a></td><td>Reflection Amplification</td><td>TA0040</td><td>T1498</td><td>true</td></tr><tr><td style="white-space:nowrap">T1498.001<a name="MITRE-ATTCK-Techniques-T1498.46001"> </a></td><td>Direct Network Flood</td><td>TA0040</td><td>T1498</td><td>true</td></tr><tr><td style="white-space:nowrap">T1651<a name="MITRE-ATTCK-Techniques-T1651"> </a></td><td>Cloud Administration Command</td><td>TA0002</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1221<a name="MITRE-ATTCK-Techniques-T1221"> </a></td><td>Template Injection</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1134<a name="MITRE-ATTCK-Techniques-T1134"> </a></td><td>Access Token Manipulation</td><td>TA0005, TA0004</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1134.001<a name="MITRE-ATTCK-Techniques-T1134.46001"> </a></td><td>Token Impersonation/Theft</td><td>TA0005, TA0004</td><td>T1134</td><td>true</td></tr><tr><td style="white-space:nowrap">T1134.004<a name="MITRE-ATTCK-Techniques-T1134.46004"> </a></td><td>Parent PID Spoofing</td><td>TA0005, TA0004</td><td>T1134</td><td>true</td></tr><tr><td style="white-space:nowrap">T1134.005<a name="MITRE-ATTCK-Techniques-T1134.46005"> </a></td><td>SID-History Injection</td><td>TA0005, TA0004</td><td>T1134</td><td>true</td></tr><tr><td style="white-space:nowrap">T1134.002<a name="MITRE-ATTCK-Techniques-T1134.46002"> </a></td><td>Create Process with Token</td><td>TA0005, TA0004</td><td>T1134</td><td>true</td></tr><tr><td style="white-space:nowrap">T1134.003<a name="MITRE-ATTCK-Techniques-T1134.46003"> </a></td><td>Make and Impersonate Token</td><td>TA0005, TA0004</td><td>T1134</td><td>true</td></tr><tr><td style="white-space:nowrap">T1111<a name="MITRE-ATTCK-Techniques-T1111"> </a></td><td>Multi-Factor Authentication Interception</td><td>TA0006</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1668<a name="MITRE-ATTCK-Techniques-T1668"> </a></td><td>Exclusive Control</td><td>TA0003</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1136<a name="MITRE-ATTCK-Techniques-T1136"> </a></td><td>Create Account</td><td>TA0003</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1136.003<a name="MITRE-ATTCK-Techniques-T1136.46003"> </a></td><td>Cloud Account</td><td>TA0003</td><td>T1136</td><td>true</td></tr><tr><td style="white-space:nowrap">T1136.001<a name="MITRE-ATTCK-Techniques-T1136.46001"> </a></td><td>Local Account</td><td>TA0003</td><td>T1136</td><td>true</td></tr><tr><td style="white-space:nowrap">T1136.002<a name="MITRE-ATTCK-Techniques-T1136.46002"> </a></td><td>Domain Account</td><td>TA0003</td><td>T1136</td><td>true</td></tr><tr><td style="white-space:nowrap">T1672<a name="MITRE-ATTCK-Techniques-T1672"> </a></td><td>Email Spoofing</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1526<a name="MITRE-ATTCK-Techniques-T1526"> </a></td><td>Cloud Service Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1018<a name="MITRE-ATTCK-Techniques-T1018"> </a></td><td>Remote System Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1046<a name="MITRE-ATTCK-Techniques-T1046"> </a></td><td>Network Service Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1518<a name="MITRE-ATTCK-Techniques-T1518"> </a></td><td>Software Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1518.001<a name="MITRE-ATTCK-Techniques-T1518.46001"> </a></td><td>Security Software Discovery</td><td>TA0007</td><td>T1518</td><td>true</td></tr><tr><td style="white-space:nowrap">T1518.002<a name="MITRE-ATTCK-Techniques-T1518.46002"> </a></td><td>Backup Software Discovery</td><td>TA0007</td><td>T1518</td><td>true</td></tr><tr><td style="white-space:nowrap">T1538<a name="MITRE-ATTCK-Techniques-T1538"> </a></td><td>Cloud Service Dashboard</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1622<a name="MITRE-ATTCK-Techniques-T1622"> </a></td><td>Debugger Evasion</td><td>TA0005, TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1052<a name="MITRE-ATTCK-Techniques-T1052"> </a></td><td>Exfiltration Over Physical Medium</td><td>TA0010</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1052.001<a name="MITRE-ATTCK-Techniques-T1052.46001"> </a></td><td>Exfiltration over USB</td><td>TA0010</td><td>T1052</td><td>true</td></tr><tr><td style="white-space:nowrap">T1105<a name="MITRE-ATTCK-Techniques-T1105"> </a></td><td>Ingress Tool Transfer</td><td>TA0011</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1648<a name="MITRE-ATTCK-Techniques-T1648"> </a></td><td>Serverless Execution</td><td>TA0002</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1653<a name="MITRE-ATTCK-Techniques-T1653"> </a></td><td>Power Settings</td><td>TA0003</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1665<a name="MITRE-ATTCK-Techniques-T1665"> </a></td><td>Hide Infrastructure</td><td>TA0011</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1484<a name="MITRE-ATTCK-Techniques-T1484"> </a></td><td>Domain or Tenant Policy Modification</td><td>TA0005, TA0004</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1484.002<a name="MITRE-ATTCK-Techniques-T1484.46002"> </a></td><td>Trust Modification</td><td>TA0005, TA0004</td><td>T1484</td><td>true</td></tr><tr><td style="white-space:nowrap">T1484.001<a name="MITRE-ATTCK-Techniques-T1484.46001"> </a></td><td>Group Policy Modification</td><td>TA0005, TA0004</td><td>T1484</td><td>true</td></tr><tr><td style="white-space:nowrap">T1220<a name="MITRE-ATTCK-Techniques-T1220"> </a></td><td>XSL Script Processing</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1587<a name="MITRE-ATTCK-Techniques-T1587"> </a></td><td>Develop Capabilities</td><td>TA0042</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1587.002<a name="MITRE-ATTCK-Techniques-T1587.46002"> </a></td><td>Code Signing Certificates</td><td>TA0042</td><td>T1587</td><td>true</td></tr><tr><td style="white-space:nowrap">T1587.003<a name="MITRE-ATTCK-Techniques-T1587.46003"> </a></td><td>Digital Certificates</td><td>TA0042</td><td>T1587</td><td>true</td></tr><tr><td style="white-space:nowrap">T1587.004<a name="MITRE-ATTCK-Techniques-T1587.46004"> </a></td><td>Exploits</td><td>TA0042</td><td>T1587</td><td>true</td></tr><tr><td style="white-space:nowrap">T1587.001<a name="MITRE-ATTCK-Techniques-T1587.46001"> </a></td><td>Malware</td><td>TA0042</td><td>T1587</td><td>true</td></tr><tr><td style="white-space:nowrap">T1008<a name="MITRE-ATTCK-Techniques-T1008"> </a></td><td>Fallback Channels</td><td>TA0011</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1680<a name="MITRE-ATTCK-Techniques-T1680"> </a></td><td>Local Storage Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1124<a name="MITRE-ATTCK-Techniques-T1124"> </a></td><td>System Time Discovery</td><td>TA0007</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1556<a name="MITRE-ATTCK-Techniques-T1556"> </a></td><td>Modify Authentication Process</td><td>TA0006, TA0005, TA0003</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1556.004<a name="MITRE-ATTCK-Techniques-T1556.46004"> </a></td><td>Network Device Authentication</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style="white-space:nowrap">T1556.001<a name="MITRE-ATTCK-Techniques-T1556.46001"> </a></td><td>Domain Controller Authentication</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style="white-space:nowrap">T1556.009<a name="MITRE-ATTCK-Techniques-T1556.46009"> </a></td><td>Conditional Access Policies</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style="white-space:nowrap">T1556.008<a name="MITRE-ATTCK-Techniques-T1556.46008"> </a></td><td>Network Provider DLL</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style="white-space:nowrap">T1556.002<a name="MITRE-ATTCK-Techniques-T1556.46002"> </a></td><td>Password Filter DLL</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style="white-space:nowrap">T1556.006<a name="MITRE-ATTCK-Techniques-T1556.46006"> </a></td><td>Multi-Factor Authentication</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style="white-space:nowrap">T1556.007<a name="MITRE-ATTCK-Techniques-T1556.46007"> </a></td><td>Hybrid Identity</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style="white-space:nowrap">T1556.005<a name="MITRE-ATTCK-Techniques-T1556.46005"> </a></td><td>Reversible Encryption</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style="white-space:nowrap">T1556.003<a name="MITRE-ATTCK-Techniques-T1556.46003"> </a></td><td>Pluggable Authentication Modules</td><td>TA0006, TA0005, TA0003</td><td>T1556</td><td>true</td></tr><tr><td style="white-space:nowrap">T1495<a name="MITRE-ATTCK-Techniques-T1495"> </a></td><td>Firmware Corruption</td><td>TA0040</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1490<a name="MITRE-ATTCK-Techniques-T1490"> </a></td><td>Inhibit System Recovery</td><td>TA0040</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1216<a name="MITRE-ATTCK-Techniques-T1216"> </a></td><td>System Script Proxy Execution</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1216.001<a name="MITRE-ATTCK-Techniques-T1216.46001"> </a></td><td>PubPrn</td><td>TA0005</td><td>T1216</td><td>true</td></tr><tr><td style="white-space:nowrap">T1216.002<a name="MITRE-ATTCK-Techniques-T1216.46002"> </a></td><td>SyncAppvPublishingServer</td><td>TA0005</td><td>T1216</td><td>true</td></tr><tr><td style="white-space:nowrap">T1669<a name="MITRE-ATTCK-Techniques-T1669"> </a></td><td>Wi-Fi Networks</td><td>TA0001</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1211<a name="MITRE-ATTCK-Techniques-T1211"> </a></td><td>Exploitation for Defense Evasion</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1127<a name="MITRE-ATTCK-Techniques-T1127"> </a></td><td>Trusted Developer Utilities Proxy Execution</td><td>TA0005</td><td/><td>false</td></tr><tr><td style="white-space:nowrap">T1127.001<a name="MITRE-ATTCK-Techniques-T1127.46001"> </a></td><td>MSBuild</td><td>TA0005</td><td>T1127</td><td>true</td></tr><tr><td style="white-space:nowrap">T1127.002<a name="MITRE-ATTCK-Techniques-T1127.46002"> </a></td><td>ClickOnce</td><td>TA0005</td><td>T1127</td><td>true</td></tr><tr><td style="white-space:nowrap">T1127.003<a name="MITRE-ATTCK-Techniques-T1127.46003"> </a></td><td>JamPlus</td><td>TA0005</td><td>T1127</td><td>true</td></tr><tr><td style="white-space:nowrap">T1529<a name="MITRE-ATTCK-Techniques-T1529"> </a></td><td>System Shutdown/Reboot</td><td>TA0040</td><td/><td>false</td></tr></table></div>
  </text>
  <url
       value="https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Techniques"/>
  <version value="0.0.5"/>
  <name value="MITRE-ATTCK-Techniques"/>
  <title value="CS MITRE ATT&amp;CK Techniques and Subtechniques"/>
  <status value="draft"/>
  <experimental value="false"/>
  <date value="2026-04-26T20:36:59+00:00"/>
  <publisher value="ATTCK2FHIR IG"/>
  <contact>
    <name value="ATTCK2FHIR IG"/>
    <telecom>
      <system value="url"/>
      <value value="https://constir1.github.io/ATTCK2FHIR"/>
    </telecom>
  </contact>
  <description
               value="This Code System contains all MITRE ATT&amp;CK Enterprise Techniques and Subtechniques with their tactic and parent-technique relationships expressed as properties."/>
  <caseSensitive value="true"/>
  <content value="complete"/>
  <count value="691"/>
  <property>
    <code value="tactic"/>
    <uri
         value="https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Tactics"/>
    <description
                 value="The tactic(s) this technique or subtechnique contributes to, referenced by tactic ID"/>
    <type value="code"/>
  </property>
  <property>
    <code value="parentTechnique"/>
    <uri
         value="https://constir1.github.io/ATTCK2FHIR/CodeSystem/MITRE-ATTCK-Techniques"/>
    <description
                 value="The parent technique of this subtechnique, referenced by ATT&amp;CK ID"/>
    <type value="code"/>
  </property>
  <property>
    <code value="isSubtechnique"/>
    <description value="Whether this concept is a subtechnique"/>
    <type value="boolean"/>
  </property>
  <concept>
    <code value="T1047"/>
    <display value="Windows Management Instrumentation"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1113"/>
    <display value="Screen Capture"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1037"/>
    <display value="Boot or Logon Initialization Scripts"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1037.004"/>
    <display value="RC Scripts"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1037"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1037.001"/>
    <display value="Logon Script (Windows)"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1037"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1037.003"/>
    <display value="Network Logon Script"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1037"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1037.005"/>
    <display value="Startup Items"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1037"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1037.002"/>
    <display value="Login Hook"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1037"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1557"/>
    <display value="Adversary-in-the-Middle"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1557.003"/>
    <display value="DHCP Spoofing"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1557"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1557.002"/>
    <display value="ARP Cache Poisoning"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1557"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1557.001"/>
    <display value="LLMNR/NBT-NS Poisoning and SMB Relay"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1557"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1557.004"/>
    <display value="Evil Twin"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1557"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1033"/>
    <display value="System Owner/User Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1583"/>
    <display value="Acquire Infrastructure"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1583.008"/>
    <display value="Malvertising"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1583"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1583.001"/>
    <display value="Domains"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1583"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1583.005"/>
    <display value="Botnet"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1583"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1583.004"/>
    <display value="Server"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1583"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1583.002"/>
    <display value="DNS Server"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1583"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1583.003"/>
    <display value="Virtual Private Server"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1583"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1583.007"/>
    <display value="Serverless"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1583"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1583.006"/>
    <display value="Web Services"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1583"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1613"/>
    <display value="Container and Resource Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1592"/>
    <display value="Gather Victim Host Information"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1592.001"/>
    <display value="Hardware"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1592"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1592.003"/>
    <display value="Firmware"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1592"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1592.002"/>
    <display value="Software"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1592"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1592.004"/>
    <display value="Client Configurations"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1592"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1003"/>
    <display value="OS Credential Dumping"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1003.002"/>
    <display value="Security Account Manager"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1003.004"/>
    <display value="LSA Secrets"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1003.006"/>
    <display value="DCSync"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1003.007"/>
    <display value="Proc Filesystem"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1003.003"/>
    <display value="NTDS"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1003.005"/>
    <display value="Cached Domain Credentials"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1003.001"/>
    <display value="LSASS Memory"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1003.008"/>
    <display value="/etc/passwd and /etc/shadow"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1129"/>
    <display value="Shared Modules"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1602"/>
    <display value="Data from Configuration Repository"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1602.002"/>
    <display value="Network Device Configuration Dump"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1602"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1602.001"/>
    <display value="SNMP (MIB Dump)"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1602"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1006"/>
    <display value="Direct Volume Access"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1666"/>
    <display value="Modify Cloud Resource Hierarchy"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1014"/>
    <display value="Rootkit"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1123"/>
    <display value="Audio Capture"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1543"/>
    <display value="Create or Modify System Process"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1543.004"/>
    <display value="Launch Daemon"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1543"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1543.005"/>
    <display value="Container Service"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1543"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1543.001"/>
    <display value="Launch Agent"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1543"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1543.002"/>
    <display value="Systemd Service"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1543"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1543.003"/>
    <display value="Windows Service"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1543"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1133"/>
    <display value="External Remote Services"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0001"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1539"/>
    <display value="Steal Web Session Cookie"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1578"/>
    <display value="Modify Cloud Compute Infrastructure"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1578.001"/>
    <display value="Create Snapshot"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1578"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1578.003"/>
    <display value="Delete Cloud Instance"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1578"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1578.004"/>
    <display value="Revert Cloud Instance"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1578"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1578.002"/>
    <display value="Create Cloud Instance"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1578"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1578.005"/>
    <display value="Modify Cloud Compute Configurations"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1578"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1069"/>
    <display value="Permission Groups Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1069.003"/>
    <display value="Cloud Groups"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1069"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1069.002"/>
    <display value="Domain Groups"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1069"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1069.001"/>
    <display value="Local Groups"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1069"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1114"/>
    <display value="Email Collection"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1114.002"/>
    <display value="Remote Email Collection"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1114"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1114.003"/>
    <display value="Email Forwarding Rule"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1114"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1114.001"/>
    <display value="Local Email Collection"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1114"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1594"/>
    <display value="Search Victim-Owned Websites"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1561"/>
    <display value="Disk Wipe"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1561.002"/>
    <display value="Disk Structure Wipe"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1561"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1561.001"/>
    <display value="Disk Content Wipe"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1561"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1615"/>
    <display value="Group Policy Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1025"/>
    <display value="Data from Removable Media"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1547"/>
    <display value="Boot or Logon Autostart Execution"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1547.009"/>
    <display value="Shortcut Modification"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1547"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1547.006"/>
    <display value="Kernel Modules and Extensions"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1547"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1547.007"/>
    <display value="Re-opened Applications"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1547"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1547.004"/>
    <display value="Winlogon Helper DLL"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1547"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1547.005"/>
    <display value="Security Support Provider"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1547"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1547.001"/>
    <display value="Registry Run Keys / Startup Folder"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1547"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1547.008"/>
    <display value="LSASS Driver"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1547"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1547.012"/>
    <display value="Print Processors"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1547"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1547.014"/>
    <display value="Active Setup"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1547"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1547.015"/>
    <display value="Login Items"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1547"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1547.013"/>
    <display value="XDG Autostart Entries"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1547"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1547.003"/>
    <display value="Time Providers"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1547"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1547.002"/>
    <display value="Authentication Package"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1547"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1547.010"/>
    <display value="Port Monitors"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1547"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1600"/>
    <display value="Weaken Encryption"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1600.001"/>
    <display value="Reduce Key Space"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1600"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1600.002"/>
    <display value="Disable Crypto Hardware"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1600"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1489"/>
    <display value="Service Stop"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1652"/>
    <display value="Device Driver Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1564"/>
    <display value="Hide Artifacts"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1564.003"/>
    <display value="Hidden Window"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1564"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1564.011"/>
    <display value="Ignore Process Interrupts"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1564"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1564.002"/>
    <display value="Hidden Users"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1564"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1564.012"/>
    <display value="File/Path Exclusions"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1564"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1564.014"/>
    <display value="Extended Attributes"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1564"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1564.008"/>
    <display value="Email Hiding Rules"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1564"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1564.009"/>
    <display value="Resource Forking"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1564"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1564.013"/>
    <display value="Bind Mounts"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1564"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1564.006"/>
    <display value="Run Virtual Instance"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1564"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1564.010"/>
    <display value="Process Argument Spoofing"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1564"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1564.001"/>
    <display value="Hidden Files and Directories"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1564"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1564.004"/>
    <display value="NTFS File Attributes"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1564"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1564.007"/>
    <display value="VBA Stomping"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1564"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1564.005"/>
    <display value="Hidden File System"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1564"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1080"/>
    <display value="Taint Shared Content"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0008"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1137"/>
    <display value="Office Application Startup"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1137.002"/>
    <display value="Office Test"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1137"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1137.001"/>
    <display value="Office Template Macros"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1137"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1137.004"/>
    <display value="Outlook Home Page"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1137"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1137.003"/>
    <display value="Outlook Forms"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1137"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1137.006"/>
    <display value="Add-ins"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1137"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1137.005"/>
    <display value="Outlook Rules"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1137"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1119"/>
    <display value="Automated Collection"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1115"/>
    <display value="Clipboard Data"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1675"/>
    <display value="ESXi Administration Command"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1007"/>
    <display value="System Service Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1040"/>
    <display value="Network Sniffing"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1530"/>
    <display value="Data from Cloud Storage"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1135"/>
    <display value="Network Share Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1120"/>
    <display value="Peripheral Device Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1082"/>
    <display value="System Information Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1071"/>
    <display value="Application Layer Protocol"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1071.002"/>
    <display value="File Transfer Protocols"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1071"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1071.004"/>
    <display value="DNS"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1071"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1071.005"/>
    <display value="Publish/Subscribe Protocols"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1071"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1071.003"/>
    <display value="Mail Protocols"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1071"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1071.001"/>
    <display value="Web Protocols"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1071"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1053"/>
    <display value="Scheduled Task/Job"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1053.003"/>
    <display value="Cron"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1053"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1053.005"/>
    <display value="Scheduled Task"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1053"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1053.006"/>
    <display value="Systemd Timers"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1053"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1053.007"/>
    <display value="Container Orchestration Job"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1053"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1053.002"/>
    <display value="At"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1053"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1176"/>
    <display value="Software Extensions"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1176.002"/>
    <display value="IDE Extensions"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1176"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1176.001"/>
    <display value="Browser Extensions"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1176"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1106"/>
    <display value="Native API"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1202"/>
    <display value="Indirect Command Execution"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1091"/>
    <display value="Replication Through Removable Media"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0008"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0001"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1005"/>
    <display value="Data from Local System"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1140"/>
    <display value="Deobfuscate/Decode Files or Information"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1562"/>
    <display value="Impair Defenses"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1562.003"/>
    <display value="Impair Command History Logging"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1562"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1562.013"/>
    <display value="Disable or Modify Network Device Firewall"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1562"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1562.004"/>
    <display value="Disable or Modify System Firewall"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1562"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1562.002"/>
    <display value="Disable Windows Event Logging"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1562"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1562.001"/>
    <display value="Disable or Modify Tools"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1562"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1562.006"/>
    <display value="Indicator Blocking"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1562"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1562.012"/>
    <display value="Disable or Modify Linux Audit System"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1562"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1562.011"/>
    <display value="Spoof Security Alerting"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1562"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1562.008"/>
    <display value="Disable or Modify Cloud Logs"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1562"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1562.010"/>
    <display value="Downgrade Attack"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1562"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1562.007"/>
    <display value="Disable or Modify Cloud Firewall"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1562"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1562.009"/>
    <display value="Safe Mode Boot"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1562"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1195"/>
    <display value="Supply Chain Compromise"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0001"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1195.001"/>
    <display value="Compromise Software Dependencies and Development Tools"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1195"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0001"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1195.002"/>
    <display value="Compromise Software Supply Chain"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1195"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0001"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1195.003"/>
    <display value="Compromise Hardware Supply Chain"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1195"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0001"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1190"/>
    <display value="Exploit Public-Facing Application"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0001"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1558"/>
    <display value="Steal or Forge Kerberos Tickets"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1558.003"/>
    <display value="Kerberoasting"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1558"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1558.002"/>
    <display value="Silver Ticket"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1558"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1558.005"/>
    <display value="Ccache Files"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1558"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1558.004"/>
    <display value="AS-REP Roasting"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1558"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1558.001"/>
    <display value="Golden Ticket"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1558"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1555"/>
    <display value="Credentials from Password Stores"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1555.004"/>
    <display value="Windows Credential Manager"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1555"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1555.001"/>
    <display value="Keychain"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1555"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1555.005"/>
    <display value="Password Managers"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1555"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1555.006"/>
    <display value="Cloud Secrets Management Stores"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1555"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1555.003"/>
    <display value="Credentials from Web Browsers"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1555"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1555.002"/>
    <display value="Securityd Memory"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1555"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1567"/>
    <display value="Exfiltration Over Web Service"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0010"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1567.001"/>
    <display value="Exfiltration to Code Repository"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1567"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0010"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1567.003"/>
    <display value="Exfiltration to Text Storage Sites"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1567"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0010"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1567.002"/>
    <display value="Exfiltration to Cloud Storage"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1567"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0010"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1567.004"/>
    <display value="Exfiltration Over Webhook"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1567"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0010"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1219"/>
    <display value="Remote Access Tools"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1219.003"/>
    <display value="Remote Access Hardware"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1219"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1219.001"/>
    <display value="IDE Tunneling"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1219"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1219.002"/>
    <display value="Remote Desktop Software"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1219"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1036"/>
    <display value="Masquerading"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1036.008"/>
    <display value="Masquerade File Type"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1036"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1036.003"/>
    <display value="Rename Legitimate Utilities"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1036"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1036.006"/>
    <display value="Space after Filename"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1036"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1036.004"/>
    <display value="Masquerade Task or Service"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1036"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1036.002"/>
    <display value="Right-to-Left Override"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1036"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1036.005"/>
    <display value="Match Legitimate Resource Name or Location"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1036"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1036.011"/>
    <display value="Overwrite Process Arguments"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1036"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1036.007"/>
    <display value="Double File Extension"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1036"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1036.010"/>
    <display value="Masquerade Account Name"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1036"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1036.001"/>
    <display value="Invalid Code Signature"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1036"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1036.012"/>
    <display value="Browser Fingerprint"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1036"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1036.009"/>
    <display value="Break Process Trees"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1036"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1552"/>
    <display value="Unsecured Credentials"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1552.006"/>
    <display value="Group Policy Preferences"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1552"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1552.004"/>
    <display value="Private Keys"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1552"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1552.007"/>
    <display value="Container API"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1552"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1552.001"/>
    <display value="Credentials In Files"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1552"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1552.002"/>
    <display value="Credentials in Registry"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1552"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1552.003"/>
    <display value="Shell History"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1552"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1552.008"/>
    <display value="Chat Messages"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1552"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1552.005"/>
    <display value="Cloud Instance Metadata API"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1552"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1659"/>
    <display value="Content Injection"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0001"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1055"/>
    <display value="Process Injection"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1055.013"/>
    <display value="Process Doppelgänging"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1055"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1055.012"/>
    <display value="Process Hollowing"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1055"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1055.009"/>
    <display value="Proc Memory"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1055"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1055.015"/>
    <display value="ListPlanting"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1055"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1055.014"/>
    <display value="VDSO Hijacking"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1055"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1055.005"/>
    <display value="Thread Local Storage"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1055"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1055.011"/>
    <display value="Extra Window Memory Injection"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1055"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1055.001"/>
    <display value="Dynamic-link Library Injection"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1055"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1055.003"/>
    <display value="Thread Execution Hijacking"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1055"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1055.008"/>
    <display value="Ptrace System Calls"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1055"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1055.004"/>
    <display value="Asynchronous Procedure Call"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1055"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1055.002"/>
    <display value="Portable Executable Injection"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1055"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1205"/>
    <display value="Traffic Signaling"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1205.001"/>
    <display value="Port Knocking"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1205"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1205.002"/>
    <display value="Socket Filters"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1205"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1218"/>
    <display value="System Binary Proxy Execution"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1218.005"/>
    <display value="Mshta"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1218"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1218.014"/>
    <display value="MMC"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1218"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1218.008"/>
    <display value="Odbcconf"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1218"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1218.015"/>
    <display value="Electron Applications"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1218"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1218.012"/>
    <display value="Verclsid"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1218"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1218.013"/>
    <display value="Mavinject"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1218"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1218.002"/>
    <display value="Control Panel"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1218"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1218.001"/>
    <display value="Compiled HTML File"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1218"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1218.010"/>
    <display value="Regsvr32"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1218"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1218.004"/>
    <display value="InstallUtil"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1218"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1218.011"/>
    <display value="Rundll32"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1218"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1218.009"/>
    <display value="Regsvcs/Regasm"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1218"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1218.003"/>
    <display value="CMSTP"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1218"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1218.007"/>
    <display value="Msiexec"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1218"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1620"/>
    <display value="Reflective Code Loading"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1611"/>
    <display value="Escape to Host"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1010"/>
    <display value="Application Window Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1029"/>
    <display value="Scheduled Transfer"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0010"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1525"/>
    <display value="Implant Internal Image"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1572"/>
    <display value="Protocol Tunneling"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1550"/>
    <display value="Use Alternate Authentication Material"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0008"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1550.004"/>
    <display value="Web Session Cookie"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1550"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0008"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1550.001"/>
    <display value="Application Access Token"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1550"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0008"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1550.003"/>
    <display value="Pass the Ticket"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1550"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0008"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1550.002"/>
    <display value="Pass the Hash"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1550"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0008"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1011"/>
    <display value="Exfiltration Over Other Network Medium"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0010"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1011.001"/>
    <display value="Exfiltration Over Bluetooth"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1011"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0010"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1589"/>
    <display value="Gather Victim Identity Information"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1589.003"/>
    <display value="Employee Names"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1589"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1589.002"/>
    <display value="Email Addresses"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1589"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1589.001"/>
    <display value="Credentials"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1589"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1560"/>
    <display value="Archive Collected Data"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1560.002"/>
    <display value="Archive via Library"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1560"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1560.001"/>
    <display value="Archive via Utility"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1560"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1560.003"/>
    <display value="Archive via Custom Method"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1560"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1185"/>
    <display value="Browser Session Hijacking"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1021"/>
    <display value="Remote Services"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0008"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1021.006"/>
    <display value="Windows Remote Management"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1021"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0008"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1021.005"/>
    <display value="VNC"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1021"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0008"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1021.002"/>
    <display value="SMB/Windows Admin Shares"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1021"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0008"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1021.007"/>
    <display value="Cloud Services"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1021"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0008"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1021.001"/>
    <display value="Remote Desktop Protocol"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1021"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0008"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1021.003"/>
    <display value="Distributed Component Object Model"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1021"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0008"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1021.008"/>
    <display value="Direct Cloud VM Connections"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1021"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0008"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1021.004"/>
    <display value="SSH"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1021"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0008"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1596"/>
    <display value="Search Open Technical Databases"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1596.003"/>
    <display value="Digital Certificates"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1596"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1596.005"/>
    <display value="Scan Databases"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1596"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1596.001"/>
    <display value="DNS/Passive DNS"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1596"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1596.004"/>
    <display value="CDNs"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1596"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1596.002"/>
    <display value="WHOIS"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1596"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1207"/>
    <display value="Rogue Domain Controller"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1610"/>
    <display value="Deploy Container"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1112"/>
    <display value="Modify Registry"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1580"/>
    <display value="Cloud Infrastructure Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1491"/>
    <display value="Defacement"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1491.002"/>
    <display value="External Defacement"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1491"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1491.001"/>
    <display value="Internal Defacement"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1491"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1535"/>
    <display value="Unused/Unsupported Cloud Regions"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1563"/>
    <display value="Remote Service Session Hijacking"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0008"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1563.002"/>
    <display value="RDP Hijacking"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1563"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0008"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1563.001"/>
    <display value="SSH Hijacking"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1563"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0008"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1217"/>
    <display value="Browser Information Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1681"/>
    <display value="Search Threat Vendor Data"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1674"/>
    <display value="Input Injection"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1092"/>
    <display value="Communication Through Removable Media"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1222"/>
    <display value="File and Directory Permissions Modification"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1222.002"/>
    <display
             value="Linux and Mac File and Directory Permissions Modification"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1222"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1222.001"/>
    <display value="Windows File and Directory Permissions Modification"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1222"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1595"/>
    <display value="Active Scanning"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1595.003"/>
    <display value="Wordlist Scanning"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1595"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1595.001"/>
    <display value="Scanning IP Blocks"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1595"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1595.002"/>
    <display value="Vulnerability Scanning"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1595"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1548"/>
    <display value="Abuse Elevation Control Mechanism"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1548.001"/>
    <display value="Setuid and Setgid"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1548"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1548.005"/>
    <display value="Temporary Elevated Cloud Access"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1548"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1548.002"/>
    <display value="Bypass User Account Control"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1548"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1548.004"/>
    <display value="Elevated Execution with Prompt"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1548"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1548.003"/>
    <display value="Sudo and Sudo Caching"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1548"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1548.006"/>
    <display value="TCC Manipulation"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1548"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1673"/>
    <display value="Virtual Machine Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1125"/>
    <display value="Video Capture"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1016"/>
    <display value="System Network Configuration Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1016.002"/>
    <display value="Wi-Fi Discovery"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1016"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1016.001"/>
    <display value="Internet Connection Discovery"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1016"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1087"/>
    <display value="Account Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1087.003"/>
    <display value="Email Account"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1087"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1087.004"/>
    <display value="Cloud Account"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1087"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1087.002"/>
    <display value="Domain Account"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1087"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1087.001"/>
    <display value="Local Account"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1087"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1090"/>
    <display value="Proxy"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1090.001"/>
    <display value="Internal Proxy"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1090"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1090.003"/>
    <display value="Multi-hop Proxy"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1090"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1090.004"/>
    <display value="Domain Fronting"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1090"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1090.002"/>
    <display value="External Proxy"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1090"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1059"/>
    <display value="Command and Scripting Interpreter"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1059.005"/>
    <display value="Visual Basic"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1059"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1059.002"/>
    <display value="AppleScript"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1059"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1059.003"/>
    <display value="Windows Command Shell"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1059"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1059.013"/>
    <display value="Container CLI/API"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1059"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1059.004"/>
    <display value="Unix Shell"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1059"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1059.010"/>
    <display value="AutoHotKey &amp; AutoIT"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1059"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1059.008"/>
    <display value="Network Device CLI"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1059"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1059.012"/>
    <display value="Hypervisor CLI"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1059"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1059.006"/>
    <display value="Python"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1059"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1059.001"/>
    <display value="PowerShell"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1059"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1059.009"/>
    <display value="Cloud API"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1059"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1059.011"/>
    <display value="Lua"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1059"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1059.007"/>
    <display value="JavaScript"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1059"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1677"/>
    <display value="Poisoned Pipeline Execution"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1482"/>
    <display value="Domain Trust Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1020"/>
    <display value="Automated Exfiltration"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0010"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1020.001"/>
    <display value="Traffic Duplication"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1020"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0010"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1070"/>
    <display value="Indicator Removal"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1070.004"/>
    <display value="File Deletion"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1070"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1070.006"/>
    <display value="Timestomp"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1070"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1070.008"/>
    <display value="Clear Mailbox Data"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1070"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1070.002"/>
    <display value="Clear Linux or Mac System Logs"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1070"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1070.001"/>
    <display value="Clear Windows Event Logs"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1070"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1070.009"/>
    <display value="Clear Persistence"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1070"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1070.003"/>
    <display value="Clear Command History"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1070"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1070.010"/>
    <display value="Relocate Malware"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1070"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1070.007"/>
    <display value="Clear Network Connection History and Configurations"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1070"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1070.005"/>
    <display value="Network Share Connection Removal"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1070"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1609"/>
    <display value="Container Administration Command"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1083"/>
    <display value="File and Directory Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1568"/>
    <display value="Dynamic Resolution"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1568.001"/>
    <display value="Fast Flux DNS"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1568"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1568.002"/>
    <display value="Domain Generation Algorithms"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1568"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1568.003"/>
    <display value="DNS Calculation"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1568"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1647"/>
    <display value="Plist File Modification"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1074"/>
    <display value="Data Staged"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1074.001"/>
    <display value="Local Data Staging"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1074"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1074.002"/>
    <display value="Remote Data Staging"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1074"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1649"/>
    <display value="Steal or Forge Authentication Certificates"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1049"/>
    <display value="System Network Connections Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1584"/>
    <display value="Compromise Infrastructure"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1584.003"/>
    <display value="Virtual Private Server"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1584"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1584.002"/>
    <display value="DNS Server"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1584"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1584.006"/>
    <display value="Web Services"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1584"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1584.007"/>
    <display value="Serverless"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1584"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1584.005"/>
    <display value="Botnet"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1584"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1584.004"/>
    <display value="Server"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1584"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1584.008"/>
    <display value="Network Devices"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1584"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1584.001"/>
    <display value="Domains"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1584"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1542"/>
    <display value="Pre-OS Boot"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1542.003"/>
    <display value="Bootkit"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1542"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1542.005"/>
    <display value="TFTP Boot"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1542"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1542.002"/>
    <display value="Component Firmware"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1542"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1542.004"/>
    <display value="ROMMONkit"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1542"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1542.001"/>
    <display value="System Firmware"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1542"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1612"/>
    <display value="Build Image on Host"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1586"/>
    <display value="Compromise Accounts"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1586.003"/>
    <display value="Cloud Accounts"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1586"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1586.002"/>
    <display value="Email Accounts"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1586"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1586.001"/>
    <display value="Social Media Accounts"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1586"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1497"/>
    <display value="Virtualization/Sandbox Evasion"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1497.002"/>
    <display value="User Activity Based Checks"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1497"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1497.001"/>
    <display value="System Checks"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1497"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1497.003"/>
    <display value="Time Based Checks"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1497"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1102"/>
    <display value="Web Service"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1102.003"/>
    <display value="One-Way Communication"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1102"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1102.001"/>
    <display value="Dead Drop Resolver"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1102"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1102.002"/>
    <display value="Bidirectional Communication"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1102"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1608"/>
    <display value="Stage Capabilities"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1608.004"/>
    <display value="Drive-by Target"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1608"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1608.005"/>
    <display value="Link Target"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1608"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1608.006"/>
    <display value="SEO Poisoning"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1608"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1608.003"/>
    <display value="Install Digital Certificate"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1608"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1608.002"/>
    <display value="Upload Tool"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1608"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1608.001"/>
    <display value="Upload Malware"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1608"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1104"/>
    <display value="Multi-Stage Channels"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1657"/>
    <display value="Financial Theft"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1480"/>
    <display value="Execution Guardrails"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1480.001"/>
    <display value="Environmental Keying"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1480"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1480.002"/>
    <display value="Mutual Exclusion"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1480"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1619"/>
    <display value="Cloud Storage Object Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1654"/>
    <display value="Log Enumeration"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1528"/>
    <display value="Steal Application Access Token"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1204"/>
    <display value="User Execution"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1204.005"/>
    <display value="Malicious Library"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1204"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1204.002"/>
    <display value="Malicious File"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1204"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1204.003"/>
    <display value="Malicious Image"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1204"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1204.001"/>
    <display value="Malicious Link"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1204"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1204.004"/>
    <display value="Malicious Copy and Paste"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1204"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1057"/>
    <display value="Process Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1072"/>
    <display value="Software Deployment Tools"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0008"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1041"/>
    <display value="Exfiltration Over C2 Channel"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0010"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1591"/>
    <display value="Gather Victim Org Information"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1591.002"/>
    <display value="Business Relationships"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1591"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1591.001"/>
    <display value="Determine Physical Locations"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1591"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1591.004"/>
    <display value="Identify Roles"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1591"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1591.003"/>
    <display value="Identify Business Tempo"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1591"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1606"/>
    <display value="Forge Web Credentials"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1606.001"/>
    <display value="Web Cookies"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1606"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1606.002"/>
    <display value="SAML Tokens"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1606"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1621"/>
    <display value="Multi-Factor Authentication Request Generation"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1554"/>
    <display value="Compromise Host Software Binary"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1679"/>
    <display value="Selective Exclusion"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1212"/>
    <display value="Exploitation for Credential Access"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1590"/>
    <display value="Gather Victim Network Information"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1590.001"/>
    <display value="Domain Properties"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1590"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1590.002"/>
    <display value="DNS"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1590"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1590.005"/>
    <display value="IP Addresses"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1590"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1590.003"/>
    <display value="Network Trust Dependencies"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1590"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1590.004"/>
    <display value="Network Topology"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1590"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1590.006"/>
    <display value="Network Security Appliances"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1590"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1210"/>
    <display value="Exploitation of Remote Services"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0008"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1534"/>
    <display value="Internal Spearphishing"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0008"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1199"/>
    <display value="Trusted Relationship"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0001"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1593"/>
    <display value="Search Open Websites/Domains"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1593.002"/>
    <display value="Search Engines"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1593"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1593.003"/>
    <display value="Code Repositories"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1593"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1593.001"/>
    <display value="Social Media"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1593"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1098"/>
    <display value="Account Manipulation"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1098.001"/>
    <display value="Additional Cloud Credentials"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1098"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1098.002"/>
    <display value="Additional Email Delegate Permissions"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1098"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1098.003"/>
    <display value="Additional Cloud Roles"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1098"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1098.005"/>
    <display value="Device Registration"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1098"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1098.006"/>
    <display value="Additional Container Cluster Roles"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1098"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1098.004"/>
    <display value="SSH Authorized Keys"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1098"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1098.007"/>
    <display value="Additional Local or Domain Groups"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1098"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1048"/>
    <display value="Exfiltration Over Alternative Protocol"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0010"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1048.002"/>
    <display value="Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1048"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0010"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1048.003"/>
    <display value="Exfiltration Over Unencrypted Non-C2 Protocol"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1048"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0010"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1048.001"/>
    <display value="Exfiltration Over Symmetric Encrypted Non-C2 Protocol"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1048"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0010"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1678"/>
    <display value="Delay Execution"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1597"/>
    <display value="Search Closed Sources"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1597.001"/>
    <display value="Threat Intel Vendors"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1597"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1597.002"/>
    <display value="Purchase Technical Data"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1597"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1566"/>
    <display value="Phishing"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0001"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1566.002"/>
    <display value="Spearphishing Link"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1566"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0001"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1566.001"/>
    <display value="Spearphishing Attachment"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1566"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0001"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1566.004"/>
    <display value="Spearphishing Voice"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1566"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0001"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1566.003"/>
    <display value="Spearphishing via Service"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1566"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0001"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1110"/>
    <display value="Brute Force"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1110.004"/>
    <display value="Credential Stuffing"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1110"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1110.002"/>
    <display value="Password Cracking"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1110"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1110.001"/>
    <display value="Password Guessing"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1110"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1110.003"/>
    <display value="Password Spraying"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1110"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1565"/>
    <display value="Data Manipulation"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1565.002"/>
    <display value="Transmitted Data Manipulation"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1565"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1565.003"/>
    <display value="Runtime Data Manipulation"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1565"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1565.001"/>
    <display value="Stored Data Manipulation"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1565"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1559"/>
    <display value="Inter-Process Communication"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1559.003"/>
    <display value="XPC Services"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1559"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1559.002"/>
    <display value="Dynamic Data Exchange"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1559"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1559.001"/>
    <display value="Component Object Model"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1559"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1001"/>
    <display value="Data Obfuscation"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1001.001"/>
    <display value="Junk Data"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1001"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1001.003"/>
    <display value="Protocol or Service Impersonation"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1001"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1001.002"/>
    <display value="Steganography"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1001"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1039"/>
    <display value="Data from Network Shared Drive"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1601"/>
    <display value="Modify System Image"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1601.002"/>
    <display value="Downgrade System Image"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1601"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1601.001"/>
    <display value="Patch System Image"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1601"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1574"/>
    <display value="Hijack Execution Flow"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1574.010"/>
    <display value="Services File Permissions Weakness"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1574"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1574.013"/>
    <display value="KernelCallbackTable"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1574"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1574.007"/>
    <display value="Path Interception by PATH Environment Variable"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1574"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1574.005"/>
    <display value="Executable Installer File Permissions Weakness"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1574"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1574.009"/>
    <display value="Path Interception by Unquoted Path"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1574"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1574.004"/>
    <display value="Dylib Hijacking"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1574"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1574.006"/>
    <display value="Dynamic Linker Hijacking"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1574"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1574.014"/>
    <display value="AppDomainManager"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1574"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1574.001"/>
    <display value="DLL"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1574"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1574.008"/>
    <display value="Path Interception by Search Order Hijacking"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1574"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1574.011"/>
    <display value="Services Registry Permissions Weakness"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1574"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1574.012"/>
    <display value="COR_PROFILER"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1574"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1078"/>
    <display value="Valid Accounts"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0001"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1078.004"/>
    <display value="Cloud Accounts"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1078"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0001"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1078.002"/>
    <display value="Domain Accounts"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1078"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0001"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1078.003"/>
    <display value="Local Accounts"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1078"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0001"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1078.001"/>
    <display value="Default Accounts"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1078"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0001"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1571"/>
    <display value="Non-Standard Port"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1068"/>
    <display value="Exploitation for Privilege Escalation"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1531"/>
    <display value="Account Access Removal"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1027"/>
    <display value="Obfuscated Files or Information"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1027.005"/>
    <display value="Indicator Removal from Tools"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1027"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1027.009"/>
    <display value="Embedded Payloads"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1027"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1027.013"/>
    <display value="Encrypted/Encoded File"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1027"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1027.012"/>
    <display value="LNK Icon Smuggling"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1027"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1027.017"/>
    <display value="SVG Smuggling"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1027"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1027.006"/>
    <display value="HTML Smuggling"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1027"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1027.011"/>
    <display value="Fileless Storage"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1027"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1027.014"/>
    <display value="Polymorphic Code"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1027"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1027.010"/>
    <display value="Command Obfuscation"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1027"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1027.004"/>
    <display value="Compile After Delivery"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1027"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1027.007"/>
    <display value="Dynamic API Resolution"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1027"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1027.003"/>
    <display value="Steganography"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1027"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1027.015"/>
    <display value="Compression"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1027"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1027.016"/>
    <display value="Junk Code Insertion"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1027"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1027.008"/>
    <display value="Stripped Payloads"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1027"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1027.002"/>
    <display value="Software Packing"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1027"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1027.001"/>
    <display value="Binary Padding"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1027"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1201"/>
    <display value="Password Policy Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1546"/>
    <display value="Event Triggered Execution"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1546.002"/>
    <display value="Screensaver"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1546"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1546.013"/>
    <display value="PowerShell Profile"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1546"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1546.016"/>
    <display value="Installer Packages"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1546"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1546.003"/>
    <display value="Windows Management Instrumentation Event Subscription"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1546"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1546.006"/>
    <display value="LC_LOAD_DYLIB Addition"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1546"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1546.018"/>
    <display value="Python Startup Hooks"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1546"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1546.011"/>
    <display value="Application Shimming"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1546"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1546.015"/>
    <display value="Component Object Model Hijacking"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1546"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1546.004"/>
    <display value="Unix Shell Configuration Modification"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1546"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1546.010"/>
    <display value="AppInit DLLs"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1546"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1546.005"/>
    <display value="Trap"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1546"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1546.007"/>
    <display value="Netsh Helper DLL"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1546"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1546.012"/>
    <display value="Image File Execution Options Injection"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1546"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1546.001"/>
    <display value="Change Default File Association"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1546"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1546.009"/>
    <display value="AppCert DLLs"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1546"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1546.017"/>
    <display value="Udev Rules"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1546"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1546.014"/>
    <display value="Emond"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1546"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1546.008"/>
    <display value="Accessibility Features"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1546"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1187"/>
    <display value="Forced Authentication"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1599"/>
    <display value="Network Boundary Bridging"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1599.001"/>
    <display value="Network Address Translation Traversal"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1599"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1486"/>
    <display value="Data Encrypted for Impact"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1553"/>
    <display value="Subvert Trust Controls"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1553.005"/>
    <display value="Mark-of-the-Web Bypass"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1553"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1553.002"/>
    <display value="Code Signing"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1553"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1553.004"/>
    <display value="Install Root Certificate"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1553"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1553.003"/>
    <display value="SIP and Trust Provider Hijacking"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1553"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1553.006"/>
    <display value="Code Signing Policy Modification"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1553"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1553.001"/>
    <display value="Gatekeeper Bypass"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1553"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1573"/>
    <display value="Encrypted Channel"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1573.002"/>
    <display value="Asymmetric Cryptography"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1573"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1573.001"/>
    <display value="Symmetric Cryptography"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1573"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1056"/>
    <display value="Input Capture"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1056.001"/>
    <display value="Keylogging"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1056"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1056.002"/>
    <display value="GUI Input Capture"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1056"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1056.004"/>
    <display value="Credential API Hooking"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1056"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1056.003"/>
    <display value="Web Portal Capture"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1056"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1203"/>
    <display value="Exploitation for Client Execution"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1667"/>
    <display value="Email Bombing"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1570"/>
    <display value="Lateral Tool Transfer"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0008"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1095"/>
    <display value="Non-Application Layer Protocol"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1671"/>
    <display value="Cloud Application Integration"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1012"/>
    <display value="Query Registry"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1030"/>
    <display value="Data Transfer Size Limits"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0010"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1499"/>
    <display value="Endpoint Denial of Service"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1499.003"/>
    <display value="Application Exhaustion Flood"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1499"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1499.002"/>
    <display value="Service Exhaustion Flood"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1499"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1499.004"/>
    <display value="Application or System Exploitation"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1499"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1499.001"/>
    <display value="OS Exhaustion Flood"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1499"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1614"/>
    <display value="System Location Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1614.001"/>
    <display value="System Language Discovery"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1614"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1197"/>
    <display value="BITS Jobs"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1656"/>
    <display value="Impersonation"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1132"/>
    <display value="Data Encoding"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1132.001"/>
    <display value="Standard Encoding"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1132"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1132.002"/>
    <display value="Non-Standard Encoding"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1132"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1598"/>
    <display value="Phishing for Information"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1598.004"/>
    <display value="Spearphishing Voice"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1598"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1598.001"/>
    <display value="Spearphishing Service"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1598"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1598.002"/>
    <display value="Spearphishing Attachment"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1598"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1598.003"/>
    <display value="Spearphishing Link"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1598"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0043"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1496"/>
    <display value="Resource Hijacking"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1496.001"/>
    <display value="Compute Hijacking"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1496"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1496.002"/>
    <display value="Bandwidth Hijacking"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1496"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1496.004"/>
    <display value="Cloud Service Hijacking"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1496"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1496.003"/>
    <display value="SMS Pumping"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1496"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1585"/>
    <display value="Establish Accounts"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1585.003"/>
    <display value="Cloud Accounts"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1585"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1585.002"/>
    <display value="Email Accounts"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1585"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1585.001"/>
    <display value="Social Media Accounts"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1585"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1588"/>
    <display value="Obtain Capabilities"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1588.006"/>
    <display value="Vulnerabilities"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1588"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1588.005"/>
    <display value="Exploits"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1588"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1588.007"/>
    <display value="Artificial Intelligence"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1588"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1588.004"/>
    <display value="Digital Certificates"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1588"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1588.002"/>
    <display value="Tool"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1588"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1588.003"/>
    <display value="Code Signing Certificates"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1588"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1588.001"/>
    <display value="Malware"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1588"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1569"/>
    <display value="System Services"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1569.003"/>
    <display value="Systemctl"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1569"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1569.002"/>
    <display value="Service Execution"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1569"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1569.001"/>
    <display value="Launchctl"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1569"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1650"/>
    <display value="Acquire Access"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1213"/>
    <display value="Data from Information Repositories"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1213.003"/>
    <display value="Code Repositories"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1213"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1213.006"/>
    <display value="Databases"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1213"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1213.005"/>
    <display value="Messaging Applications"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1213"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1213.004"/>
    <display value="Customer Relationship Management Software"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1213"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1213.002"/>
    <display value="Sharepoint"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1213"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1213.001"/>
    <display value="Confluence"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1213"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0009"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1200"/>
    <display value="Hardware Additions"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0001"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1505"/>
    <display value="Server Software Component"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1505.002"/>
    <display value="Transport Agent"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1505"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1505.004"/>
    <display value="IIS Components"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1505"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1505.003"/>
    <display value="Web Shell"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1505"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1505.005"/>
    <display value="Terminal Services DLL"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1505"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1505.006"/>
    <display value="vSphere Installation Bundles"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1505"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1505.001"/>
    <display value="SQL Stored Procedures"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1505"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1485"/>
    <display value="Data Destruction"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1485.001"/>
    <display value="Lifecycle-Triggered Deletion"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1485"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1537"/>
    <display value="Transfer Data to Cloud Account"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0010"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1189"/>
    <display value="Drive-by Compromise"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0001"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1498"/>
    <display value="Network Denial of Service"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1498.002"/>
    <display value="Reflection Amplification"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1498"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1498.001"/>
    <display value="Direct Network Flood"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1498"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1651"/>
    <display value="Cloud Administration Command"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1221"/>
    <display value="Template Injection"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1134"/>
    <display value="Access Token Manipulation"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1134.001"/>
    <display value="Token Impersonation/Theft"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1134"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1134.004"/>
    <display value="Parent PID Spoofing"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1134"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1134.005"/>
    <display value="SID-History Injection"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1134"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1134.002"/>
    <display value="Create Process with Token"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1134"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1134.003"/>
    <display value="Make and Impersonate Token"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1134"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1111"/>
    <display value="Multi-Factor Authentication Interception"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1668"/>
    <display value="Exclusive Control"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1136"/>
    <display value="Create Account"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1136.003"/>
    <display value="Cloud Account"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1136"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1136.001"/>
    <display value="Local Account"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1136"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1136.002"/>
    <display value="Domain Account"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1136"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1672"/>
    <display value="Email Spoofing"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1526"/>
    <display value="Cloud Service Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1018"/>
    <display value="Remote System Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1046"/>
    <display value="Network Service Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1518"/>
    <display value="Software Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1518.001"/>
    <display value="Security Software Discovery"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1518"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1518.002"/>
    <display value="Backup Software Discovery"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1518"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1538"/>
    <display value="Cloud Service Dashboard"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1622"/>
    <display value="Debugger Evasion"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1052"/>
    <display value="Exfiltration Over Physical Medium"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0010"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1052.001"/>
    <display value="Exfiltration over USB"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1052"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0010"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1105"/>
    <display value="Ingress Tool Transfer"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1648"/>
    <display value="Serverless Execution"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0002"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1653"/>
    <display value="Power Settings"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1665"/>
    <display value="Hide Infrastructure"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1484"/>
    <display value="Domain or Tenant Policy Modification"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1484.002"/>
    <display value="Trust Modification"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1484"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1484.001"/>
    <display value="Group Policy Modification"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1484"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0004"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1220"/>
    <display value="XSL Script Processing"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1587"/>
    <display value="Develop Capabilities"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1587.002"/>
    <display value="Code Signing Certificates"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1587"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1587.003"/>
    <display value="Digital Certificates"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1587"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1587.004"/>
    <display value="Exploits"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1587"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1587.001"/>
    <display value="Malware"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1587"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0042"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1008"/>
    <display value="Fallback Channels"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0011"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1680"/>
    <display value="Local Storage Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1124"/>
    <display value="System Time Discovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0007"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1556"/>
    <display value="Modify Authentication Process"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1556.004"/>
    <display value="Network Device Authentication"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1556"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1556.001"/>
    <display value="Domain Controller Authentication"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1556"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1556.009"/>
    <display value="Conditional Access Policies"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1556"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1556.008"/>
    <display value="Network Provider DLL"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1556"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1556.002"/>
    <display value="Password Filter DLL"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1556"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1556.006"/>
    <display value="Multi-Factor Authentication"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1556"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1556.007"/>
    <display value="Hybrid Identity"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1556"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1556.005"/>
    <display value="Reversible Encryption"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1556"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1556.003"/>
    <display value="Pluggable Authentication Modules"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1556"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0006"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0003"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1495"/>
    <display value="Firmware Corruption"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1490"/>
    <display value="Inhibit System Recovery"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1216"/>
    <display value="System Script Proxy Execution"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1216.001"/>
    <display value="PubPrn"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1216"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1216.002"/>
    <display value="SyncAppvPublishingServer"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1216"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1669"/>
    <display value="Wi-Fi Networks"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0001"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1211"/>
    <display value="Exploitation for Defense Evasion"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1127"/>
    <display value="Trusted Developer Utilities Proxy Execution"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
  <concept>
    <code value="T1127.001"/>
    <display value="MSBuild"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1127"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1127.002"/>
    <display value="ClickOnce"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1127"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1127.003"/>
    <display value="JamPlus"/>
    <property>
      <code value="parentTechnique"/>
      <valueCode value="T1127"/>
    </property>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0005"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="true"/>
    </property>
  </concept>
  <concept>
    <code value="T1529"/>
    <display value="System Shutdown/Reboot"/>
    <property>
      <code value="tactic"/>
      <valueCode value="TA0040"/>
    </property>
    <property>
      <code value="isSubtechnique"/>
      <valueBoolean value="false"/>
    </property>
  </concept>
</CodeSystem>