diff --git a/app_template/lookups/mitre_enrichment.csv b/app_template/lookups/mitre_enrichment.csv
deleted file mode 100644
index f48613526a..0000000000
--- a/app_template/lookups/mitre_enrichment.csv
+++ /dev/null
@@ -1,698 +0,0 @@
-mitre_id,technique,tactics,groups
-T1055.011,Extra Window Memory Injection,Stealth|Privilege Escalation,no
-T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,APT3|Cobalt Group|Silence|Chimera|Patchwork|Daggerfly|FIN7|TA2541|GALLIUM|Sandworm Team|BlackByte|HEXANE|Mustang Panda|Magic Hound|FIN13|ToddyCat|Blue Mockingbird|Molerats|Storm-0501|APT29|APT39|FIN8|Wizard Spider|Higaisa|APT41|Rancor|Earth Lusca|Ember Bear|Machete|APT42|FIN10|Naikon|RedCurl|Moonstone Sleet|APT32|Fox Kitten|APT33|OilRig|APT38|menuPass|APT-C-36|FIN6|LuminousMoth|Lazarus Group|BRONZE BUTLER|Winter Vivern|Dragonfly|MuddyWater|Gamaredon Group|Kimsuky|Stealth Falcon|BITTER|Confucius|APT37
-T1205.002,Socket Filters,Stealth|Persistence|Command And Control,no
-T1560.001,Archive via Utility,Collection,HAFNIUM|menuPass|Wizard Spider|APT33|Fox Kitten|CopyKittens|Volt Typhoon|APT1|Mustang Panda|Play|Chimera|Gallmaker|Sea Turtle|APT39|RedCurl|APT5|Agrius|GALLIUM|APT41|MuddyWater|APT28|Turla|Sowbug|BRONZE BUTLER|UNC3886|Kimsuky|APT3|FIN8|Ke3chang|Lotus Blossom|FIN13|Earth Lusca|MirrorFace|Magic Hound|Aquatic Panda|INC Ransom|VOID MANTICORE|Akira|ToddyCat
-T1021.005,VNC,Lateral Movement,Gamaredon Group|FIN7|GCMAN|Fox Kitten
-T1047,Windows Management Instrumentation,Execution,Cinnamon Tempest|Medusa Group|menuPass|INC Ransom|Gamaredon Group|APT32|Mustang Panda|MuddyWater|Wizard Spider|VOID MANTICORE|Leviathan|Velvet Ant|APT-C-36|FIN7|GALLIUM|Volt Typhoon|Blue Mockingbird|Naikon|Lazarus Group|Lotus Blossom|Sandworm Team|Earth Lusca|Indrik Spider|TA2541|Stealth Falcon|Aquatic Panda|APT29|OilRig|Windshift|FIN6|ToddyCat|Deep Panda|Threat Group-3390|MirrorFace|APT42|Ember Bear|Chimera|BlackByte|FIN13|Magic Hound|APT41|FIN8
-T1687,Exploitation for Defense Impairment,Defense Impairment,no
-T1113,Screen Capture,Collection,VOID MANTICORE|Dragonfly|BRONZE BUTLER|Gamaredon Group|OilRig|APT28|MoustachedBouncer|GOLD SOUTHFIELD|APT42|Magic Hound|MuddyWater|Winter Vivern|Silence|Volt Typhoon|Group5|APT39|Kimsuky|Dark Caracal|FIN7
-T1027.011,Fileless Storage,Stealth,APT32|Turla
-T1037,Boot or Logon Initialization Scripts,Persistence|Privilege Escalation,APT41|APT29|Rocke|UNC3886
-T1557,Adversary-in-the-Middle,Credential Access|Collection,Mustang Panda|Kimsuky|Sea Turtle
-T1033,System Owner/User Discovery,Discovery,APT38|Moonstone Sleet|FIN8|Ke3chang|FIN7|HAFNIUM|Winter Vivern|APT19|FIN10|APT32|APT39|APT37|Lazarus Group|Tropic Trooper|Threat Group-3390|Earth Lusca|Magic Hound|ZIRCONIUM|Chimera|Patchwork|Stealth Falcon|Volt Typhoon|LuminousMoth|Aquatic Panda|Gamaredon Group|GALLIUM|Wizard Spider|APT41|OilRig|HEXANE|Windshift|MuddyWater|Kimsuky|Dragonfly|MirrorFace|Medusa Group|Sandworm Team|Storm-1811|Sidewinder|APT3
-T1583,Acquire Infrastructure,Resource Development,Kimsuky|Sea Turtle|Ember Bear|Indrik Spider|Agrius|Contagious Interview|Sandworm Team|Star Blizzard
-T1218.011,Rundll32,Stealth,Gamaredon Group|FIN7|APT19|Kimsuky|UNC3886|Carbanak|APT3|Magic Hound|TA551|Blue Mockingbird|Wizard Spider|APT32|Lazarus Group|TA505|CopyKittens|APT41|Sandworm Team|APT28|HAFNIUM|APT38|Daggerfly|RedCurl|LazyScripter|Aquatic Panda|Storm-0501|MuddyWater
-T1613,Container and Resource Discovery,Discovery,TeamTNT
-T1583.007,Serverless,Resource Development,no
-T1132.001,Standard Encoding,Command And Control,Sandworm Team|Patchwork|APT42|BRONZE BUTLER|TA551|Lazarus Group|Tropic Trooper|MuddyWater|APT19|APT33|HAFNIUM
-T1027.009,Embedded Payloads,Stealth,Lazarus Group|TA577|Moonstone Sleet
-T1556.003,Pluggable Authentication Modules,Defense Impairment|Persistence|Credential Access,no
-T1578.004,Revert Cloud Instance,Defense Impairment,no
-T1592,Gather Victim Host Information,Reconnaissance,Volt Typhoon
-T1596.003,Digital Certificates,Reconnaissance,no
-T1056.001,Keylogging,Collection|Credential Access,Magic Hound|APT39|APT38|Volt Typhoon|Ajax Security Team|APT28|Darkhotel|menuPass|APT5|Tonto Team|Threat Group-3390|Lazarus Group|Group5|PLATINUM|FIN4|Sandworm Team|Kimsuky|OilRig|APT42|Sowbug|HEXANE|APT32|APT3|FIN13|Ke3chang|APT41
-T1564.012,File/Path Exclusions,Stealth,Turla
-T1222.002,Linux and Mac Permissions,Defense Impairment,TeamTNT|Rocke|APT32
-T1110.001,Password Guessing,Credential Access,VOID MANTICORE|APT28|APT29
-T1216.001,PubPrn,Stealth,APT32
-T1597.002,Purchase Technical Data,Reconnaissance,LAPSUS$
-T1003,OS Credential Dumping,Credential Access,Ember Bear|APT39|Poseidon Group|Mustang Panda|Tonto Team|APT32|Suckfly|BlackByte|APT28|Sowbug|Storm-0501|Axiom|Leviathan
-T1129,Shared Modules,Execution,Mustang Panda
-T1602,Data from Configuration Repository,Collection,no
-T1561.002,Disk Structure Wipe,Impact,VOID MANTICORE|APT38|Sandworm Team|Lazarus Group|Ember Bear|APT37
-T1498.001,Direct Network Flood,Impact,no
-T1574.007,Path Interception by PATH Environment Variable,Stealth|Execution,no
-T1213.002,Sharepoint,Collection,Akira|HAFNIUM|LAPSUS$|Chimera|APT28|VOID MANTICORE|Ke3chang
-T1006,Direct Volume Access,Stealth,Scattered Spider|Volt Typhoon
-T1588.007,Artificial Intelligence,Resource Development,Contagious Interview|APT28
-T1666,Modify Cloud Resource Hierarchy,Defense Impairment,no
-T1564.008,Email Hiding Rules,Stealth,Scattered Spider|FIN4
-T1491.002,External Defacement,Impact,Ember Bear|Sandworm Team
-T1027.013,Encrypted/Encoded File,Stealth,Inception|Dark Caracal|Elderwood|Darkhotel|Transparent Tribe|APT28|APT18|Leviathan|Sidewinder|APT39|Lazarus Group|Saint Bear|APT33|Kimsuky|BITTER|TA505|Higaisa|APT19|APT-C-36|Fox Kitten|Threat Group-3390|TA2541|Malteiro|Magic Hound|Storm-1811|Blue Mockingbird|Tropic Trooper|Mofang|Contagious Interview|Whitefly|menuPass|Moses Staff|TeamTNT|Metador|Group5|Putter Panda|OilRig|APT32|MirrorFace|Moonstone Sleet
-T1590.005,IP Addresses,Reconnaissance,Andariel|Magic Hound|HAFNIUM
-T1499.001,OS Exhaustion Flood,Impact,no
-T1014,Rootkit,Stealth,Winnti Group|APT41|Rocke|TeamTNT|APT28|UNC3886
-T1546.013,PowerShell Profile,Privilege Escalation|Persistence,Turla
-T1059.007,JavaScript,Execution,Turla|APT32|Saint Bear|FIN6|Sidewinder|MoustachedBouncer|APT-C-36|MuddyWater|Earth Lusca|TA577|Winter Vivern|Silence|Contagious Interview|LazyScripter|TA505|FIN7|Cobalt Group|Higaisa|Kimsuky|Indrik Spider|Molerats|Leafminer|Mustang Panda|TA578|Evilnum|Star Blizzard
-T1685.003,Modify or Spoof Tool UI,Defense Impairment,no
-T1590.002,DNS,Reconnaissance,no
-T1485.001,Lifecycle-Triggered Deletion,Impact,no
-T1123,Audio Capture,Collection,VOID MANTICORE|APT37
-T1543,Create or Modify System Process,Persistence|Privilege Escalation,no
-T1133,External Remote Services,Persistence|Initial Access,TeamTNT|FIN13|Ember Bear|APT18|Sandworm Team|Volt Typhoon|Velvet Ant|Scattered Spider|APT41|LAPSUS$|OilRig|GALLIUM|Ke3chang|Wizard Spider|APT29|Kimsuky|FIN5|Threat Group-3390|Sea Turtle|VOID MANTICORE|GOLD SOUTHFIELD|APT-C-36|Chimera|Dragonfly|Akira|APT28|Play|Leviathan
-T1546.006,LC_LOAD_DYLIB Addition,Privilege Escalation|Persistence,no
-T1539,Steal Web Session Cookie,Credential Access,LuminousMoth|Kimsuky|Sandworm Team|Scattered Spider|Evilnum|Star Blizzard|Lotus Blossom|APT42
-T1053.007,Container Orchestration Job,Execution|Persistence|Privilege Escalation,no
-T1568.002,Domain Generation Algorithms,Command And Control,APT41|TA551
-T1036.007,Double File Extension,Stealth,Kimsuky|Mustang Panda
-T1548.002,Bypass User Account Control,Privilege Escalation,APT38|Evilnum|APT37|BRONZE BUTLER|MuddyWater|Cobalt Group|Earth Lusca|Threat Group-3390|Patchwork|Medusa Group|APT29
-T1496.003,SMS Pumping,Impact,no
-T1016.001,Internet Connection Discovery,Discovery,Magic Hound|HEXANE|APT29|Gamaredon Group|TA2541|Lotus Blossom|FIN13|HAFNIUM|Turla|Volt Typhoon|FIN8
-T1548.003,Sudo and Sudo Caching,Privilege Escalation,no
-T1685.001,Disable or Modify Windows Event Log,Defense Impairment,Magic Hound|Threat Group-3390
-T1682,Query Public AI Services,Reconnaissance,APT42|Kimsuky
-T1560.003,Archive via Custom Method,Collection,FIN6|CopyKittens|Mustang Panda|Kimsuky|UNC3886|Lotus Blossom|Lazarus Group
-T1578,Modify Cloud Compute Infrastructure,Defense Impairment,no
-T1584.008,Network Devices,Resource Development,Volt Typhoon|APT28|ZIRCONIUM|Leviathan
-T1583.008,Malvertising,Resource Development,Mustard Tempest
-T1069,Permission Groups Discovery,Discovery,APT41|Scattered Spider|TA505|Volt Typhoon|APT3|FIN13
-T1114,Email Collection,Collection,Ember Bear|Silent Librarian|Magic Hound|Scattered Spider
-T1003.002,Security Account Manager,Credential Access,Daggerfly|GALLIUM|APT29|FIN13|MirrorFace|Dragonfly|Ke3chang|Agrius|APT41|APT5|menuPass|Threat Group-3390|Wizard Spider|Ember Bear
-T1596.002,WHOIS,Reconnaissance,no
-T1542.001,System Firmware,Stealth|Persistence,no
-T1594,Search Victim-Owned Websites,Reconnaissance,Silent Librarian|Kimsuky|Volt Typhoon|EXOTIC LILY|Sandworm Team|TA578
-T1069.003,Cloud Groups,Discovery,no
-T1574.011,Services Registry Permissions Weakness,Stealth|Execution,no
-T1596.001,DNS/Passive DNS,Reconnaissance,no
-T1499.003,Application Exhaustion Flood,Impact,no
-T1195.001,Compromise Software Dependencies and Development Tools,Initial Access,no
-T1588.004,Digital Certificates,Resource Development,Silent Librarian|Lazarus Group|Sea Turtle|Mustang Panda|UNC3886|LuminousMoth|BlackTech
-T1583.002,DNS Server,Resource Development,Sea Turtle|Axiom|HEXANE
-T1561,Disk Wipe,Impact,no
-T1071.004,DNS,Command And Control,Chimera|LazyScripter|APT41|Cobalt Group|OilRig|Ke3chang|APT39|Ember Bear|Tropic Trooper|APT18|FIN7
-T1552.005,Cloud Instance Metadata API,Credential Access,TeamTNT
-T1555.002,Securityd Memory,Credential Access,no
-T1615,Group Policy Discovery,Discovery,Turla
-T1542.003,Bootkit,Stealth|Persistence,APT41|Lazarus Group|APT28
-T1025,Data from Removable Media,Collection,OilRig|Gamaredon Group|APT28|Turla
-T1218.013,Mavinject,Stealth,no
-T1074.001,Local Data Staging,Collection,Storm-1811|Threat Group-3390|Sidewinder|FIN5|Patchwork|WIRTE|UNC3886|APT5|Lotus Blossom|TeamTNT|Indrik Spider|Agrius|Lazarus Group|Chimera|MuddyWater|APT3|Wizard Spider|Kimsuky|APT39|GALLIUM|Leviathan|menuPass|BackdoorDiplomacy|Mustang Panda|Dragonfly|FIN13|APT28|Volt Typhoon
-T1036.005,Match Legitimate Resource Name or Location,Stealth,TeamTNT|Gamaredon Group|Volt Typhoon|BRONZE BUTLER|TA2541|APT41|APT42|Storm-1811|Indrik Spider|FIN7|Mustard Tempest|MuddyWater|WIRTE|Patchwork|VOID MANTICORE|Transparent Tribe|admin@338|Earth Lusca|BackdoorDiplomacy|Akira|Ferocious Kitten|RedCurl|APT29|APT28|Naikon|Chimera|Aquatic Panda|APT32|Ke3chang|Tropic Trooper|Magic Hound|APT-C-36|PROMETHIUM|INC Ransom|LuminousMoth|Whitefly|OilRig|Machete|Carbanak|Lazarus Group|Darkhotel|APT1|Blue Mockingbird|Sidewinder|menuPass|Sowbug|Ember Bear|APT39|Velvet Ant|Kimsuky|APT5|Poseidon Group|Silence|Fox Kitten|ToddyCat|SideCopy|Turla|Mustang Panda|FIN13|Sandworm Team|Rocke
-T1587.003,Digital Certificates,Resource Development,APT29|PROMETHIUM|Gamaredon Group|Storm-0501
-T1565.001,Stored Data Manipulation,Impact,APT38
-T1110.002,Password Cracking,Credential Access,APT3|Dragonfly|Salt Typhoon|FIN6
-T1114.001,Local Email Collection,Collection,WIRTE|RedCurl|Sea Turtle|APT1|Chimera|Magic Hound|MirrorFace|Winter Vivern
-T1555.001,Keychain,Credential Access,Contagious Interview
-T1547,Boot or Logon Autostart Execution,Persistence|Privilege Escalation,APT42
-T1003.004,LSA Secrets,Credential Access,MuddyWater|Threat Group-3390|OilRig|Leafminer|APT33|APT29|menuPass|Dragonfly|Ember Bear|Ke3chang
-T1600,Weaken Encryption,Defense Impairment,no
-T1606.002,SAML Tokens,Credential Access,no
-T1036.008,Masquerade File Type,Stealth,Volt Typhoon|BlackByte|MirrorFace|Mustang Panda
-T1489,Service Stop,Impact,Medusa Group|Kimsuky|Lazarus Group|Sandworm Team|LAPSUS$|Wizard Spider|Indrik Spider
-T1587.001,Malware,Resource Development,Kimsuky|FIN13|Moonstone Sleet|Indrik Spider|Lazarus Group|Contagious Interview|OilRig|UNC3886|LuminousMoth|MirrorFace|Sandworm Team|Salt Typhoon|APT29|Play|Aoqin Dragon|APT-C-36|RedCurl|Cleaver|Moses Staff|Turla|Ke3chang|VOID MANTICORE|Mustang Panda|TeamTNT|FIN7
-T1652,Device Driver Discovery,Discovery,Medusa Group
-T1087.002,Domain Account,Discovery,FIN13|FIN6|MirrorFace|APT41|Ke3chang|Scattered Spider|Mustang Panda|Lotus Blossom|MuddyWater|INC Ransom|LAPSUS$|Chimera|menuPass|VOID MANTICORE|OilRig|ToddyCat|Turla|BlackByte|Wizard Spider|Fox Kitten|FIN7|Poseidon Group|RedCurl|Storm-1811|Storm-0501|Volt Typhoon|Sandworm Team|BRONZE BUTLER|Dragonfly
-T1547.014,Active Setup,Persistence|Privilege Escalation,no
-T1564,Hide Artifacts,Stealth,no
-T1559.002,Dynamic Data Exchange,Execution,Cobalt Group|FIN7|MuddyWater|Sidewinder|APT28|APT37|Gallmaker|Leviathan|BITTER|TA505|Patchwork
-T1204.002,Malicious File,Execution,Malteiro|APT12|Kimsuky|Machete|Elderwood|Transparent Tribe|Dragonfly|WIRTE|Contagious Interview|RTM|Aoqin Dragon|APT-C-36|CURIUM|Gallmaker|Tropic Trooper|Dark Caracal|RedCurl|DarkHydrus|PLATINUM|menuPass|TA551|HEXANE|FIN8|Threat Group-3390|BITTER|Ferocious Kitten|APT37|LazyScripter|PROMETHIUM|TA505|APT39|Star Blizzard|Higaisa|Rancor|Wizard Spider|OilRig|Sandworm Team|Magic Hound|FIN4|Cobalt Group|Storm-1811|MirrorFace|Inception|EXOTIC LILY|Ajax Security Team|Saint Bear|Lazarus Group|FIN6|Patchwork|Whitefly|TA459|FIN7|Moonstone Sleet|Nomadic Octopus|APT28|Gorgon Group|APT19|TA2541|Earth Lusca|SideCopy|Mofang|VOID MANTICORE|Leviathan|Tonto Team|APT30|Andariel|BRONZE BUTLER|APT38|MuddyWater|Naikon|Mustang Panda|Molerats|admin@338|Gamaredon Group|Darkhotel|APT32|The White Company|IndigoZebra|APT33|Silence|Sidewinder|Indrik Spider|APT29|Confucius|BlackTech|Windshift
-T1591.003,Identify Business Tempo,Reconnaissance,no
-T1685.004,Disable or Modify Linux Audit System Log,Defense Impairment,no
-T1071.005,Publish/Subscribe Protocols,Command And Control,no
-T1592.001,Hardware,Reconnaissance,no
-T1080,Taint Shared Content,Lateral Movement,Darkhotel|RedCurl|Gamaredon Group|BRONZE BUTLER|Cinnamon Tempest
-T1484.002,Trust Modification,Defense Impairment|Privilege Escalation,Scattered Spider|Storm-0501
-T1213.006,Databases,Collection,Sandworm Team|FIN6|Sea Turtle|Turla
-T1573.001,Symmetric Cryptography,Command And Control,Mustang Panda|Darkhotel|Lazarus Group|ZIRCONIUM|Volt Typhoon|RedCurl|Stealth Falcon|MuddyWater|Contagious Interview|Higaisa|Inception|APT33|APT28|BRONZE BUTLER
-T1087.001,Local Account,Discovery,Ke3chang|Moses Staff|Medusa Group|OilRig|APT41|Lotus Blossom|APT32|Volt Typhoon|APT42|RedCurl|Chimera|Turla|Fox Kitten|APT3|Threat Group-3390|Poseidon Group|admin@338|APT1
-T1586.001,Social Media Accounts,Resource Development,Sandworm Team|Leviathan
-T1176.001,Browser Extensions,Persistence,Kimsuky
-T1542.005,TFTP Boot,Stealth|Persistence,no
-T1686.003,Windows Host Firewall,Defense Impairment,MirrorFace|OilRig|Moses Staff|VOID MANTICORE|Magic Hound|Lazarus Group
-T1543.003,Windows Service,Persistence|Privilege Escalation,Tropic Trooper|Medusa Group|DarkVishnya|Aquatic Panda|APT38|Lotus Blossom|APT41|Wizard Spider|Blue Mockingbird|TeamTNT|BlackByte|APT19|Threat Group-3390|Ke3chang|PROMETHIUM|OilRig|APT32|Carbanak|APT3|FIN7|Agrius|Kimsuky|Earth Lusca|Cobalt Group|Lazarus Group|Cinnamon Tempest
-T1568.001,Fast Flux DNS,Command And Control,menuPass|TA505|Gamaredon Group
-T1497.001,System Checks,Stealth|Discovery,Evilnum|Volt Typhoon|Darkhotel|WIRTE|Kimsuky|OilRig|Gamaredon Group
-T1053.003,Cron,Execution|Persistence|Privilege Escalation,Rocke|APT5|APT38
-T1069.002,Domain Groups,Discovery,LAPSUS$|ToddyCat|Volt Typhoon|OilRig|Mustang Panda|FIN7|INC Ransom|Ke3chang|Turla|Inception|Dragonfly|Medusa Group|Scattered Spider
-T1588.006,Vulnerabilities,Resource Development,Sandworm Team|Volt Typhoon|Storm-0501
-T1566.002,Spearphishing Link,Initial Access,BlackTech|MuddyWater|LuminousMoth|MirrorFace|Confucius|Mofang|Kimsuky|Sidewinder|Elderwood|Machete|FIN7|Mustard Tempest|Sandworm Team|Transparent Tribe|Evilnum|Mustang Panda|FIN8|APT32|APT3|APT1|Lazarus Group|Leviathan|APT33|ZIRCONIUM|EXOTIC LILY|Molerats|Magic Hound|OilRig|Windshift|Cobalt Group|APT29|WIRTE|FIN4|TA2541|APT-C-36|Earth Lusca|RedCurl|Storm-1811|Turla|Wizard Spider|TA577|Patchwork|TA505|LazyScripter|APT42|APT39
-T1499.004,Application or System Exploitation,Impact,no
-T1137,Office Application Startup,Persistence,APT32|Gamaredon Group
-T1218.004,InstallUtil,Stealth,Mustang Panda|menuPass
-T1598.003,Spearphishing Link,Reconnaissance,Sidewinder|Scattered Spider|Mustang Panda|Sandworm Team|Silent Librarian|ZIRCONIUM|APT32|Kimsuky|Magic Hound|APT28|Star Blizzard|Moonstone Sleet|CURIUM|Dragonfly|Patchwork
-T1021.004,SSH,Lateral Movement,FIN7|Lazarus Group|Leviathan|Scattered Spider|BlackTech|Aquatic Panda|GCMAN|Fox Kitten|TeamTNT|Storm-1811|Salt Typhoon|OilRig|APT5|UNC3886|FIN13|menuPass|Indrik Spider|Rocke|APT39
-T1098.003,Additional Cloud Roles,Persistence|Privilege Escalation,Scattered Spider|LAPSUS$|Storm-0501
-T1547.012,Print Processors,Persistence|Privilege Escalation,Earth Lusca
-T1566.001,Spearphishing Attachment,Initial Access,Cobalt Group|Lazarus Group|Saint Bear|Tropic Trooper|FIN6|APT28|admin@338|Windshift|BRONZE BUTLER|WIRTE|MuddyWater|menuPass|Threat Group-3390|Gamaredon Group|APT32|Darkhotel|BITTER|APT29|Inception|EXOTIC LILY|Ajax Security Team|Dragonfly|Sandworm Team|Elderwood|APT33|Molerats|Patchwork|TA551|RTM|RedCurl|APT41|Winter Vivern|Higaisa|Confucius|TA459|BlackTech|Gorgon Group|Leviathan|Mofang|Naikon|APT12|APT19|Star Blizzard|APT30|Ferocious Kitten|Malteiro|SideCopy|MirrorFace|FIN8|Nomadic Octopus|LazyScripter|Mustang Panda|OilRig|Moonstone Sleet|Transparent Tribe|Kimsuky|Machete|FIN4|Wizard Spider|Andariel|TA2541|Tonto Team|Sidewinder|TA505|FIN7|APT37|CURIUM|Silence|IndigoZebra|APT1|APT38|DarkHydrus|The White Company|PLATINUM|Rancor|APT-C-36|APT39|Gallmaker
-T1027.008,Stripped Payloads,Stealth,no
-T1559.001,Component Object Model,Execution,Kimsuky|MuddyWater|Gamaredon Group|Medusa Group
-T1574.001,DLL,Stealth|Execution,Chimera|Cinnamon Tempest|MuddyWater|Velvet Ant|RTM|Tonto Team|Patchwork|Whitefly|Aquatic Panda|GALLIUM|Higaisa|APT32|Storm-1811|Evilnum|Tropic Trooper|Earth Lusca|LuminousMoth|BRONZE BUTLER|WIRTE|APT3|BlackTech|FIN13|Mustang Panda|SideCopy|Daggerfly|MirrorFace|Naikon|Lazarus Group|Threat Group-3390|BackdoorDiplomacy|APT19|APT-C-36|Sidewinder|APT41|menuPass
-T1119,Automated Collection,Collection,VOID MANTICORE|Gamaredon Group|Ember Bear|RedCurl|APT1|Ke3chang|FIN5|HAFNIUM|Agrius|APT28|Winter Vivern|Confucius|OilRig|FIN6|Patchwork|Tropic Trooper|Sidewinder|Chimera|Threat Group-3390|Mustang Panda|menuPass
-T1689,Downgrade Attack,Defense Impairment,no
-T1115,Clipboard Data,Collection,APT39|Kimsuky|APT38|OilRig
-T1003.007,Proc Filesystem,Credential Access,no
-T1583.005,Botnet,Resource Development,HAFNIUM|APT5|Ke3chang
-T1555.005,Password Managers,Credential Access,Threat Group-3390|Indrik Spider|Fox Kitten|UNC3886|Storm-0501|Scattered Spider|LAPSUS$
-T1553.001,Gatekeeper Bypass,Defense Impairment,no
-T1675,ESXi Administration Command,Execution,UNC3886
-T1608.004,Drive-by Target,Resource Development,Transparent Tribe|LuminousMoth|Dragonfly|CURIUM|APT32|FIN7|Threat Group-3390|Mustard Tempest
-T1007,System Service Discovery,Discovery,BRONZE BUTLER|TeamTNT|Indrik Spider|OilRig|Turla|Aquatic Panda|Poseidon Group|Kimsuky|Chimera|Ke3chang|MirrorFace|Earth Lusca|Volt Typhoon|admin@338|APT1
-T1040,Network Sniffing,Credential Access|Discovery,Sandworm Team|Kimsuky|Velvet Ant|Salt Typhoon|APT33|UNC3886|DarkVishnya|APT28
-T1553.002,Code Signing,Defense Impairment,FIN7|Scattered Spider|Patchwork|Kimsuky|GALLIUM|Saint Bear|APT41|Molerats|OilRig|MirrorFace|Lazarus Group|Moses Staff|Silence|Wizard Spider|Leviathan|FIN6|menuPass|PROMETHIUM|Darkhotel|TA505|Mustang Panda|Medusa Group|Suckfly|Daggerfly|LuminousMoth|Winnti Group|CopyKittens
-T1530,Data from Cloud Storage,Collection,Fox Kitten|Storm-0501|APT42|HAFNIUM|Scattered Spider
-T1565.003,Runtime Data Manipulation,Impact,APT38
-T1552.002,Credentials in Registry,Credential Access,APT32|VOID MANTICORE|RedCurl
-T1135,Network Share Discovery,Discovery,Tonto Team|APT39|DarkVishnya|APT32|APT41|Medusa Group|Chimera|APT38|BlackByte|FIN13|Tropic Trooper|INC Ransom|Sowbug|Dragonfly|APT1|Wizard Spider
-T1120,Peripheral Device Discovery,Discovery,Equation|APT37|APT28|Turla|OilRig|TeamTNT|Volt Typhoon|Gamaredon Group|BackdoorDiplomacy
-T1036.009,Break Process Trees,Stealth,no
-T1590.004,Network Topology,Reconnaissance,Salt Typhoon|MuddyWater|FIN13|Volt Typhoon
-T1587.002,Code Signing Certificates,Resource Development,Daggerfly|PROMETHIUM|Patchwork
-T1222.001,Windows Permissions,Defense Impairment,Wizard Spider|Storm-1811
-T1137.006,Add-ins,Persistence,Naikon
-T1685.002,Disable or Modify Cloud Log,Defense Impairment,APT29
-T1505.002,Transport Agent,Persistence,no
-T1082,System Information Discovery,Discovery,Windigo|BlackByte|OilRig|ZIRCONIUM|APT41|Blue Mockingbird|HEXANE|Darkhotel|TA2541|FIN13|Rocke|Gamaredon Group|APT37|APT32|Inception|Lazarus Group|Moses Staff|Higaisa|CURIUM|Malteiro|RedCurl|APT38|Mustang Panda|VOID MANTICORE|FIN7|Kimsuky|MuddyWater|TeamTNT|Scattered Spider|APT3|Sidewinder|Magic Hound|Daggerfly|MirrorFace|Play|Storm-0501|Contagious Interview|APT42|SideCopy|APT19|APT18|FIN8|Tropic Trooper|Aquatic Panda|Winter Vivern|Mustard Tempest|Sowbug|Wizard Spider|Turla|Patchwork|Windshift|admin@338|Medusa Group|Stealth Falcon|Moonstone Sleet|Sandworm Team|Ke3chang
-T1071,Application Layer Protocol,Command And Control,Magic Hound|Rocke|INC Ransom|Velvet Ant|TeamTNT
-T1574.014,AppDomainManager,Stealth|Execution,no
-T1074.002,Remote Data Staging,Collection,Chimera|MirrorFace|Sea Turtle|menuPass|FIN8|Leviathan|APT28|MoustachedBouncer|ToddyCat|FIN6|Threat Group-3390
-T1098.006,Additional Container Cluster Roles,Persistence|Privilege Escalation,no
-T1053,Scheduled Task/Job,Execution|Persistence|Privilege Escalation,no
-T1218.007,Msiexec,Stealth,Molerats|TA505|Rancor|ZIRCONIUM|Machete|APT38
-T1590.003,Network Trust Dependencies,Reconnaissance,no
-T1498.002,Reflection Amplification,Impact,no
-T1556.002,Password Filter DLL,Defense Impairment|Persistence|Credential Access,OilRig|Strider|MirrorFace
-T1505.005,Terminal Services DLL,Persistence,no
-T1059.002,AppleScript,Execution,no
-T1176,Software Extensions,Persistence,no
-T1499.002,Service Exhaustion Flood,Impact,no
-T1195.003,Compromise Hardware Supply Chain,Initial Access,no
-T1106,Native API,Execution,Medusa Group|Higaisa|Lazarus Group|Gorgon Group|Turla|Chimera|BlackTech|Sandworm Team|SideCopy|Tropic Trooper|ToddyCat|menuPass|APT37|Kimsuky|Gamaredon Group|Mustang Panda|WIRTE|APT38|TA505|Silence
-T1558.005,Ccache Files,Credential Access,no
-T1070.007,Clear Network Connection History and Configurations,Stealth,UNC3886|Volt Typhoon
-T1558.004,AS-REP Roasting,Credential Access,no
-T1584.003,Virtual Private Server,Resource Development,Volt Typhoon|Turla
-T1059.010,AutoHotKey & AutoIT,Execution,APT39
-T1600.001,Reduce Key Space,Defense Impairment,no
-T1070.003,Clear Command History,Stealth,Aquatic Panda|Medusa Group|TeamTNT|menuPass|Magic Hound|Lazarus Group|APT5|APT41
-T1202,Indirect Command Execution,Stealth,Lazarus Group|RedCurl
-T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Gamaredon Group|LuminousMoth|Aoqin Dragon|Darkhotel|Mustang Panda|FIN7|APT28|Tropic Trooper
-T1005,Data from Local System,Collection,Kimsuky|BRONZE BUTLER|LAPSUS$|APT39|HAFNIUM|Axiom|OilRig|ToddyCat|Windigo|Fox Kitten|Andariel|RedCurl|APT1|GALLIUM|APT29|Lazarus Group|Gamaredon Group|Agrius|FIN6|Aquatic Panda|Turla|APT41|LuminousMoth|APT37|Dragonfly|CURIUM|APT28|Inception|Ke3chang|Patchwork|APT3|MirrorFace|Threat Group-3390|FIN7|VOID MANTICORE|Ember Bear|Stealth Falcon|APT38|Volt Typhoon|menuPass|Wizard Spider|Magic Hound|Dark Caracal|Sandworm Team|FIN13
-T1140,Deobfuscate/Decode Files or Information,Stealth,BRONZE BUTLER|Turla|APT39|WIRTE|Gorgon Group|Kimsuky|Moonstone Sleet|Mustang Panda|Agrius|Ke3chang|APT38|Volt Typhoon|Molerats|Darkhotel|Earth Lusca|Storm-1811|ZIRCONIUM|MuddyWater|OilRig|Gamaredon Group|TA505|Threat Group-3390|APT28|FIN7|TeamTNT|Winter Vivern|menuPass|Lazarus Group|BlackByte|Leviathan|Cinnamon Tempest|Rocke|Tropic Trooper|FIN13|Sandworm Team|Malteiro|APT19|Higaisa
-T1137.005,Outlook Rules,Persistence,no
-T1586.003,Cloud Accounts,Resource Development,APT29|APT-C-36
-T1586.002,Email Accounts,Resource Development,APT28|Magic Hound|Mustang Panda|OilRig|HEXANE|Kimsuky|WIRTE|APT-C-36|LAPSUS$|IndigoZebra|TA577|APT29|Star Blizzard|Leviathan
-T1098.007,Additional Local or Domain Groups,Persistence|Privilege Escalation,APT41|APT3|Magic Hound|APT5|Dragonfly|FIN13|Kimsuky
-T1608.001,Upload Malware,Resource Development,Sandworm Team|TA2541|Earth Lusca|Mustang Panda|LuminousMoth|WIRTE|Kimsuky|Mustard Tempest|OilRig|TeamTNT|LazyScripter|Gamaredon Group|Star Blizzard|Threat Group-3390|SideCopy|TA505|BlackByte|BITTER|APT32|HEXANE|Saint Bear|Moonstone Sleet|Contagious Interview|APT-C-36|FIN7|EXOTIC LILY|APT42
-T1195,Supply Chain Compromise,Initial Access,OilRig|Ember Bear|Sandworm Team
-T1190,Exploit Public-Facing Application,Initial Access,Rocke|Threat Group-3390|FIN7|Volt Typhoon|VOID MANTICORE|Sandworm Team|APT28|Kimsuky|Ember Bear|BackdoorDiplomacy|GOLD SOUTHFIELD|FIN13|BlackTech|Magic Hound|Medusa Group|Sea Turtle|Storm-0501|Fox Kitten|Cinnamon Tempest|BlackByte|Ke3chang|Agrius|menuPass|ToddyCat|Blue Mockingbird|GALLIUM|Winter Vivern|Earth Lusca|APT29|Leviathan|Volatile Cedar|INC Ransom|UNC3886|MirrorFace|Moses Staff|Dragonfly|Axiom|APT41|Play|HAFNIUM|APT5|MuddyWater|Salt Typhoon|APT39
-T1558,Steal or Forge Kerberos Tickets,Credential Access,Akira
-T1555,Credentials from Password Stores,Credential Access,HEXANE|Volt Typhoon|Leafminer|Stealth Falcon|APT39|Evilnum|APT41|APT33|MuddyWater|OilRig|FIN6|Malteiro
-T1567,Exfiltration Over Web Service,Exfiltration,Magic Hound|Contagious Interview|APT28|BlackByte
-T1219,Remote Access Tools,Command And Control,TeamTNT|OilRig|FIN7|GOLD SOUTHFIELD|INC Ransom|Medusa Group|DarkVishnya|Sandworm Team|Carbanak|Akira|BlackByte|Cobalt Group
-T1583.001,Domains,Resource Development,APT28|TA505|APT-C-36|Storm-1811|MuddyWater|HEXANE|VOID MANTICORE|Star Blizzard|APT42|Contagious Interview|APT1|APT32|IndigoZebra|Leviathan|Earth Lusca|Kimsuky|Scattered Spider|Dragonfly|TA2541|LazyScripter|Transparent Tribe|ZIRCONIUM|WIRTE|Threat Group-3390|RedEcho|OilRig|Mustang Panda|Lazarus Group|EXOTIC LILY|Silent Librarian|FIN7|Sea Turtle|Magic Hound|APT38|Gamaredon Group|Winter Vivern|Moonstone Sleet|BITTER|TeamTNT|Sandworm Team|Winnti Group|Ferocious Kitten|CURIUM|menuPass
-T1560.002,Archive via Library,Collection,Lazarus Group|Threat Group-3390
-T1055.003,Thread Execution Hijacking,Stealth|Privilege Escalation,no
-T1684,Social Engineering,Stealth,no
-T1036,Masquerading,Stealth,menuPass|APT32|Contagious Interview|BRONZE BUTLER|OilRig|Ember Bear|Sandworm Team|Nomadic Octopus|Agrius|Aoqin Dragon|TeamTNT|LazyScripter|APT28|ZIRCONIUM|FIN13|Windshift|Storm-1811|Winter Vivern|TA551|PLATINUM
-T1546.011,Application Shimming,Privilege Escalation|Persistence,FIN7
-T1552,Unsecured Credentials,Credential Access,Volt Typhoon
-T1547.010,Port Monitors,Persistence|Privilege Escalation,no
-T1070.008,Clear Mailbox Data,Stealth,APT42|Scattered Spider
-T1037.002,Login Hook,Persistence|Privilege Escalation,no
-T1659,Content Injection,Initial Access|Command And Control,MoustachedBouncer
-T1055,Process Injection,Stealth|Privilege Escalation,APT38|Silence|APT32|Wizard Spider|TA2541|Cobalt Group|APT37|Velvet Ant|Kimsuky|APT5|PLATINUM|Gamaredon Group|BlackByte|APT41|Turla
-T1567.004,Exfiltration Over Webhook,Exfiltration,no
-T1205,Traffic Signaling,Stealth|Persistence|Command And Control,UNC3886|Mustang Panda|Kimsuky
-T1021.008,Direct Cloud VM Connections,Lateral Movement,no
-T1218,System Binary Proxy Execution,Stealth,Lazarus Group|Volt Typhoon
-T1070.006,Timestomp,Stealth,APT28|APT5|UNC3886|APT38|APT32|Kimsuky|APT29|Chimera|Lazarus Group|Mustang Panda|Rocke
-T1557.004,Evil Twin,Credential Access|Collection,APT28
-T1620,Reflective Code Loading,Stealth,FIN7|Lazarus Group|Kimsuky|Gamaredon Group
-T1016.002,Wi-Fi Discovery,Discovery,Magic Hound
-T1480.002,Mutual Exclusion,Stealth,Kimsuky|APT38
-T1564.011,Ignore Process Interrupts,Stealth,UNC3886|Sea Turtle|Kimsuky
-T1611,Escape to Host,Privilege Escalation,TeamTNT
-T1518.002,Backup Software Discovery,Discovery,Wizard Spider
-T1547.009,Shortcut Modification,Persistence|Privilege Escalation,APT39|Leviathan|Lazarus Group|Gorgon Group
-T1010,Application Window Discovery,Discovery,Lazarus Group|Volt Typhoon|HEXANE
-T1569.003,Systemctl,Execution,TeamTNT
-T1087.003,Email Account,Discovery,TA505|Magic Hound|RedCurl|Sandworm Team
-T1497.003,Time Based Checks,Stealth|Discovery,no
-T1218.003,CMSTP,Stealth,MuddyWater|Cobalt Group
-T1563.001,SSH Hijacking,Lateral Movement,no
-T1029,Scheduled Transfer,Exfiltration,Higaisa
-T1021.002,SMB/Windows Admin Shares,Lateral Movement,Moses Staff|Threat Group-1314|Aquatic Panda|Wizard Spider|APT41|Ke3chang|Turla|FIN13|Chimera|Fox Kitten|Play|Sandworm Team|ToddyCat|APT3|FIN8|Blue Mockingbird|APT32|Cinnamon Tempest|MirrorFace|BlackByte|Velvet Ant|Orangeworm|Lazarus Group|Deep Panda|APT39|APT28|Storm-1811
-T1525,Implant Internal Image,Persistence,no
-T1572,Protocol Tunneling,Command And Control,FIN13|Magic Hound|FIN6|Salt Typhoon|FIN7|Ember Bear|Chimera|OilRig|Fox Kitten|Cobalt Group|Cinnamon Tempest|VOID MANTICORE|Mustang Panda|Scattered Spider|Leviathan
-T1218.002,Control Panel,Stealth,no
-T1599.001,Network Address Translation Traversal,Defense Impairment,no
-T1608.002,Upload Tool,Resource Development,Medusa Group|Threat Group-3390
-T1547.005,Security Support Provider,Persistence|Privilege Escalation,no
-T1036.011,Overwrite Process Arguments,Stealth,no
-T1550,Use Alternate Authentication Material,Lateral Movement,no
-T1597.001,Threat Intel Vendors,Reconnaissance,no
-T1011,Exfiltration Over Other Network Medium,Exfiltration,no
-T1602.002,Network Device Configuration Dump,Collection,Salt Typhoon
-T1589,Gather Victim Identity Information,Reconnaissance,LAPSUS$|HEXANE|VOID MANTICORE|Scattered Spider|FIN13|APT32|Star Blizzard|Contagious Interview|Magic Hound|Volt Typhoon
-T1560,Archive Collected Data,Collection,Dragonfly|Patchwork|Axiom|Ember Bear|BlackByte|Lazarus Group|APT28|APT32|FIN6|LuminousMoth|Ke3chang|menuPass|Leviathan
-T1553.003,SIP and Trust Provider Hijacking,Defense Impairment,no
-T1185,Browser Session Hijacking,Collection,Kimsuky
-T1021,Remote Services,Lateral Movement,Wizard Spider|Aquatic Panda|Ember Bear
-T1071.003,Mail Protocols,Command And Control,Turla|SilverTerrier|APT32|APT28|Kimsuky|Contagious Interview
-T1556.007,Hybrid Identity,Defense Impairment|Persistence|Credential Access,APT29
-T1595.002,Vulnerability Scanning,Reconnaissance,Sandworm Team|Volatile Cedar|Leviathan|Ember Bear|APT41|TeamTNT|APT28|Magic Hound|VOID MANTICORE|APT29|Winter Vivern|Aquatic Panda|Dragonfly|Earth Lusca
-T1059.009,Cloud API,Execution,Storm-0501|TeamTNT|APT29
-T1596,Search Open Technical Databases,Reconnaissance,APT28|Kimsuky
-T1218.015,Electron Applications,Stealth,no
-T1207,Rogue Domain Controller,Defense Impairment,no
-T1553.006,Code Signing Policy Modification,Defense Impairment,APT39|Turla
-T1610,Deploy Container,Execution,TeamTNT
-T1112,Modify Registry,Defense Impairment|Persistence,Turla|APT38|Patchwork|Indrik Spider|Medusa Group|Silence|TA505|APT19|BlackByte|Lotus Blossom|Gamaredon Group|Wizard Spider|APT32|Aquatic Panda|Earth Lusca|Blue Mockingbird|OilRig|Ember Bear|Volt Typhoon|Dragonfly|Gorgon Group|LuminousMoth|Kimsuky|APT41|Magic Hound|APT42|Saint Bear|Threat Group-3390|FIN8
-T1543.004,Launch Daemon,Persistence|Privilege Escalation,no
-T1580,Cloud Infrastructure Discovery,Discovery,Scattered Spider|Storm-0501
-T1555.003,Credentials from Web Browsers,Credential Access,Patchwork|APT41|ZIRCONIUM|Malteiro|APT3|APT33|Stealth Falcon|Leafminer|APT37|Sandworm Team|MuddyWater|LAPSUS$|HEXANE|TA505|Molerats|Ajax Security Team|Inception|Volt Typhoon|Kimsuky|OilRig|RedCurl|FIN6|APT42
-T1574.008,Path Interception by Search Order Hijacking,Stealth|Execution,no
-T1491,Defacement,Impact,no
-T1535,Unused/Unsupported Cloud Regions,Stealth,no
-T1557.003,DHCP Spoofing,Credential Access|Collection,no
-T1563,Remote Service Session Hijacking,Lateral Movement,no
-T1564.013,Bind Mounts,Stealth,no
-T1027.001,Binary Padding,Stealth,Leviathan|APT29|Kimsuky|Moafee|Higaisa|Patchwork|BRONZE BUTLER|Akira
-T1505.003,Web Shell,Persistence,CURIUM|Dragonfly|APT28|OilRig|FIN13|BackdoorDiplomacy|Agrius|Deep Panda|APT39|Mustang Panda|Volatile Cedar|GALLIUM|Threat Group-3390|Tropic Trooper|Ember Bear|HAFNIUM|Moses Staff|Sandworm Team|Fox Kitten|Tonto Team|Volt Typhoon|APT38|APT29|Magic Hound|BlackByte|APT5|APT32|Medusa Group|Leviathan|Sea Turtle|Kimsuky
-T1484.001,Group Policy Modification,Defense Impairment|Privilege Escalation,VOID MANTICORE|Storm-0501|Cinnamon Tempest|APT41|Indrik Spider
-T1685.006,Clear Linux or Mac System Logs,Defense Impairment,Salt Typhoon|Rocke|Sea Turtle|TeamTNT
-T1217,Browser Information Discovery,Discovery,Kimsuky|Fox Kitten|Volt Typhoon|APT38|Scattered Spider|Moonstone Sleet|Chimera
-T1552.004,Private Keys,Credential Access,Scattered Spider|Kimsuky|TeamTNT|Storm-0501|Rocke|Volt Typhoon
-T1583.004,Server,Resource Development,GALLIUM|Kimsuky|Sandworm Team|VOID MANTICORE|Earth Lusca|Mustard Tempest|CURIUM
-T1021.006,Windows Remote Management,Lateral Movement,FIN13|Chimera|Storm-0501|Threat Group-3390|Wizard Spider
-T1011.001,Exfiltration Over Bluetooth,Exfiltration,no
-T1078.001,Default Accounts,Stealth|Persistence|Privilege Escalation|Initial Access,FIN13|UNC3886|Magic Hound|Ember Bear
-T1547.003,Time Providers,Persistence|Privilege Escalation,no
-T1546.005,Trap,Privilege Escalation|Persistence,no
-T1574.006,Dynamic Linker Hijacking,Stealth|Execution,Aquatic Panda|Rocke|APT41
-T1136.001,Local Account,Persistence,Wizard Spider|APT5|Dragonfly|TeamTNT|Fox Kitten|APT41|FIN13|Kimsuky|Magic Hound|Indrik Spider|Leafminer|APT39|Daggerfly|APT3
-T1681,Search Threat Vendor Data,Reconnaissance,UNC3886|Contagious Interview
-T1674,Input Injection,Execution,FIN7
-T1092,Communication Through Removable Media,Command And Control,APT28
-T1585.002,Email Accounts,Resource Development,Kimsuky|Moonstone Sleet|Magic Hound|Mustang Panda|Leviathan|Medusa Group|Star Blizzard|APT42|CURIUM|Silent Librarian|EXOTIC LILY|APT1|Wizard Spider|HEXANE|Indrik Spider|Sandworm Team|VOID MANTICORE|Contagious Interview|Lazarus Group
-T1557.001,Name Resolution Poisoning and SMB Relay,Credential Access|Collection,Lazarus Group|Wizard Spider
-T1222,File and Directory Permissions Modification,Defense Impairment,no
-T1003.001,LSASS Memory,Credential Access,Indrik Spider|OilRig|Cleaver|Leafminer|Threat Group-3390|APT1|Leviathan|FIN8|HAFNIUM|Blue Mockingbird|Volt Typhoon|Whitefly|APT33|FIN13|APT32|MirrorFace|VOID MANTICORE|Mustang Panda|Agrius|GALLIUM|APT5|Medusa Group|BRONZE BUTLER|APT39|Magic Hound|Earth Lusca|UNC3886|PLATINUM|Fox Kitten|Silence|Sandworm Team|Moonstone Sleet|MuddyWater|Wizard Spider|Aquatic Panda|Ke3chang|APT3|APT41|FIN6|Ember Bear|APT28|Kimsuky|Play|RedCurl
-T1176.002,IDE Extensions,Persistence,Mustang Panda
-T1595,Active Scanning,Reconnaissance,no
-T1027.016,Junk Code Insertion,Stealth,FIN7|APT-C-36|Gamaredon Group|Kimsuky|APT32|Mustang Panda
-T1548,Abuse Elevation Control Mechanism,Privilege Escalation,UNC3886
-T1134.002,Create Process with Token,Stealth|Privilege Escalation,Turla|Lazarus Group
-T1548.001,Setuid and Setgid,Privilege Escalation,no
-T1547.004,Winlogon Helper DLL,Persistence|Privilege Escalation,Wizard Spider|Tropic Trooper|Turla
-T1021.003,Distributed Component Object Model,Lateral Movement,no
-T1110.003,Password Spraying,Credential Access,HAFNIUM|Agrius|Ember Bear|APT29|HEXANE|Lazarus Group|APT33|Silent Librarian|Chimera|Leafminer|APT28
-T1090.002,External Proxy,Command And Control,APT39|APT28|FIN5|Tonto Team|Lazarus Group|menuPass|APT3|Silence|GALLIUM|APT29|MuddyWater
-T1056.003,Web Portal Capture,Collection|Credential Access,Kimsuky|Winter Vivern
-T1589.002,Email Addresses,Reconnaissance,Saint Bear|Moonstone Sleet|TA551|Volt Typhoon|Lazarus Group|HAFNIUM|Magic Hound|Silent Librarian|Kimsuky|HEXANE|LAPSUS$|EXOTIC LILY|APT32|Sandworm Team
-T1598.004,Spearphishing Voice,Reconnaissance,LAPSUS$|Scattered Spider
-T1683.001,Written Content,Resource Development,APT-C-36|Contagious Interview
-T1003.005,Cached Domain Credentials,Credential Access,APT33|Leafminer|OilRig|MuddyWater
-T1098.004,SSH Authorized Keys,Persistence|Privilege Escalation,Earth Lusca|Salt Typhoon|TeamTNT
-T1673,Virtual Machine Discovery,Discovery,UNC3886
-T1590.006,Network Security Appliances,Reconnaissance,Volt Typhoon
-T1546.012,Image File Execution Options Injection,Privilege Escalation|Persistence,no
-T1218.008,Odbcconf,Stealth,Cobalt Group
-T1593.002,Search Engines,Reconnaissance,Kimsuky
-T1591.002,Business Relationships,Reconnaissance,Dragonfly|LAPSUS$|Sandworm Team
-T1548.005,Temporary Elevated Cloud Access,Privilege Escalation,no
-T1125,Video Capture,Collection,Ember Bear|Silence|FIN7|VOID MANTICORE
-T1055.013,Process Doppelgänging,Stealth|Privilege Escalation,Leafminer
-T1016,System Network Configuration Discovery,Discovery,HEXANE|Mustang Panda|Play|BlackByte|Dragonfly|admin@338|Lotus Blossom|Moses Staff|APT19|FIN13|Volt Typhoon|Lazarus Group|APT3|MuddyWater|menuPass|SideCopy|Stealth Falcon|APT1|Tropic Trooper|Threat Group-3390|Ke3chang|Scattered Spider|Naikon|APT42|MirrorFace|Chimera|Magic Hound|Sidewinder|Turla|Wizard Spider|TeamTNT|APT41|GALLIUM|Moonstone Sleet|Kimsuky|Darkhotel|HAFNIUM|APT32|Higaisa|OilRig|Earth Lusca|Medusa Group|ZIRCONIUM
-T1578.003,Delete Cloud Instance,Defense Impairment,LAPSUS$|Storm-0501
-T1593.003,Code Repositories,Reconnaissance,Contagious Interview|LAPSUS$|HAFNIUM
-T1574.005,Executable Installer File Permissions Weakness,Stealth|Execution,Mustang Panda
-T1546.008,Accessibility Features,Privilege Escalation|Persistence,APT41|APT3|Deep Panda|Axiom|Fox Kitten|APT29
-T1496.002,Bandwidth Hijacking,Impact,no
-T1087,Account Discovery,Discovery,Aquatic Panda|Scattered Spider|FIN13
-T1090,Proxy,Command And Control,Volt Typhoon|Sandworm Team|Turla|CopyKittens|MirrorFace|LAPSUS$|Blue Mockingbird|Cinnamon Tempest|MoustachedBouncer|Windigo|POLONIUM|Fox Kitten|Contagious Interview|MuddyWater|Earth Lusca|Scattered Spider|Magic Hound|APT41|Gamaredon Group
-T1059,Command and Scripting Interpreter,Execution,Fox Kitten|Stealth Falcon|Winter Vivern|FIN7|FIN6|FIN5|APT19|APT32|Dragonfly|Saint Bear|Whitefly|APT39|Ke3chang|APT37|Mustang Panda|Windigo|OilRig
-T1204.005,Malicious Library,Execution,Contagious Interview
-T1685.005,Clear Windows Event Logs,Defense Impairment,MirrorFace|APT41|Volt Typhoon|APT38|Play|FIN5|Chimera|Dragonfly|FIN8|Indrik Spider|APT32|APT28|Aquatic Panda|HAFNIUM
-T1136.002,Domain Account,Persistence,GALLIUM|BlackByte|Wizard Spider|Medusa Group|HAFNIUM
-T1564.014,Extended Attributes,Stealth,no
-T1589.003,Employee Names,Reconnaissance,Kimsuky|Sandworm Team|Silent Librarian
-T1677,Poisoned Pipeline Execution,Execution,no
-T1482,Domain Trust Discovery,Discovery,BlackByte|Akira|Chimera|MirrorFace|Lotus Blossom|Earth Lusca|Storm-0501|Storm-1811|Magic Hound|FIN8
-T1558.001,Golden Ticket,Credential Access,Ke3chang
-T1020,Automated Exfiltration,Exfiltration,Kimsuky|Sidewinder|Ke3chang|RedCurl|Winter Vivern|Tropic Trooper|Gamaredon Group
-T1592.004,Client Configurations,Reconnaissance,HAFNIUM
-T1219.001,IDE Tunneling,Command And Control,Mustang Panda
-T1036.002,Right-to-Left Override,Stealth,Ferocious Kitten|BlackTech|Ke3chang|Scarlet Mimic|BRONZE BUTLER
-T1588.001,Malware,Resource Development,LuminousMoth|MuddyWater|TA2541|APT-C-36|Ember Bear|LAPSUS$|VOID MANTICORE|Metador|APT1|Aquatic Panda|LazyScripter|UNC3886|Andariel|TA505|Turla|Earth Lusca|BackdoorDiplomacy|Scattered Spider
-T1027.017,SVG Smuggling,Stealth,no
-T1542.002,Component Firmware,Stealth|Persistence,Equation
-T1070,Indicator Removal,Stealth,APT42|Mustang Panda|APT5|Lazarus Group
-T1048.001,Exfiltration Over Symmetric Encrypted Non-C2 Protocol,Exfiltration,no
-T1137.001,Office Template Macros,Persistence,MuddyWater
-T1583.003,Virtual Private Server,Resource Development,Gamaredon Group|APT28|Ember Bear|LAPSUS$|Sea Turtle|Winter Vivern|CURIUM|VOID MANTICORE|BlackByte|Axiom|Moonstone Sleet|Contagious Interview|Dragonfly|APT-C-36|APT42|HAFNIUM
-T1213.001,Confluence,Collection,LAPSUS$
-T1550.003,Pass the Ticket,Lateral Movement,APT29|APT32|BRONZE BUTLER
-T1609,Container Administration Command,Execution,TeamTNT
-T1083,File and Directory Discovery,Discovery,Volt Typhoon|Contagious Interview|UNC3886|Patchwork|Sowbug|Gamaredon Group|Medusa Group|Dragonfly|APT38|APT28|Inception|MirrorFace|RedCurl|Velvet Ant|Chimera|admin@338|Ke3chang|Sandworm Team|Sidewinder|Scattered Spider|Aoqin Dragon|Tropic Trooper|Dark Caracal|MuddyWater|Magic Hound|TeamTNT|Lotus Blossom|LuminousMoth|APT3|APT32|Mustang Panda|APT39|ToddyCat|Lazarus Group|Darkhotel|Play|menuPass|Kimsuky|HAFNIUM|Confucius|APT41|Winnti Group|Winter Vivern|Windigo|APT18|APT5|Fox Kitten|Leafminer|FIN13|Turla|BRONZE BUTLER
-T1568,Dynamic Resolution,Command And Control,RedEcho|TA2541|Transparent Tribe|BITTER|APT29|Kimsuky|APT-C-36|Gamaredon Group
-T1036.004,Masquerade Task or Service,Stealth,Aquatic Panda|Kimsuky|Carbanak|FIN7|FIN13|APT-C-36|APT32|Winter Vivern|Wizard Spider|BITTER|FIN6|Naikon|Fox Kitten|PROMETHIUM|UNC3886|ZIRCONIUM|Magic Hound|Higaisa|Lazarus Group|Storm-0501|VOID MANTICORE|BackdoorDiplomacy|APT41
-T1055.004,Asynchronous Procedure Call,Stealth|Privilege Escalation,FIN8
-T1020.001,Traffic Duplication,Exfiltration,no
-T1647,Plist File Modification,Defense Impairment,no
-T1127.003,JamPlus,Stealth|Execution,no
-T1546.009,AppCert DLLs,Privilege Escalation|Persistence,no
-T1114.003,Email Forwarding Rule,Collection,Scattered Spider|Silent Librarian|LAPSUS$|Star Blizzard|Kimsuky
-T1074,Data Staged,Collection,Wizard Spider|Volt Typhoon|VOID MANTICORE|INC Ransom|Scattered Spider
-T1649,Steal or Forge Authentication Certificates,Credential Access,APT29
-T1098.005,Device Registration,Persistence|Privilege Escalation,APT29
-T1049,System Network Connections Discovery,Discovery,APT38|menuPass|Poseidon Group|TeamTNT|Andariel|Mustang Panda|Turla|APT3|Lotus Blossom|Volt Typhoon|Sandworm Team|Velvet Ant|APT1|OilRig|ToddyCat|Magic Hound|Chimera|MuddyWater|admin@338|GALLIUM|APT41|HEXANE|APT5|BackdoorDiplomacy|APT32|Earth Lusca|Tropic Trooper|Ke3chang|Lazarus Group|FIN13|INC Ransom|Threat Group-3390
-T1584,Compromise Infrastructure,Resource Development,no
-T1553.005,Mark-of-the-Web Bypass,Defense Impairment,TA505|APT38|APT29
-T1600.002,Disable Crypto Hardware,Defense Impairment,no
-T1542,Pre-OS Boot,Stealth|Persistence,no
-T1612,Build Image on Host,Stealth,no
-T1055.002,Portable Executable Injection,Stealth|Privilege Escalation,Rocke|Gorgon Group
-T1218.012,Verclsid,Stealth,no
-T1586,Compromise Accounts,Resource Development,no
-T1569.001,Launchctl,Execution,no
-T1584.005,Botnet,Resource Development,HAFNIUM|Axiom|Sandworm Team|APT-C-36|Volt Typhoon
-T1059.008,Network Device CLI,Execution,no
-T1552.003,Shell History,Credential Access,no
-T1559.003,XPC Services,Execution,no
-T1497,Virtualization/Sandbox Evasion,Stealth|Discovery,Contagious Interview|Saint Bear|Darkhotel
-T1102,Web Service,Command And Control,RedCurl|Inception|VOID MANTICORE|Rocke|FIN6|LazyScripter|FIN8|EXOTIC LILY|APT42|Fox Kitten|Turla|Mustang Panda|Gamaredon Group|APT32|TeamTNT
-T1552.001,Credentials In Files,Credential Access,APT33|Fox Kitten|TA505|FIN13|Indrik Spider|APT3|Leafminer|Kimsuky|RedCurl|OilRig|Ember Bear|TeamTNT|MuddyWater|Scattered Spider
-T1568.003,DNS Calculation,Command And Control,APT12
-T1218.005,Mshta,Stealth,Sidewinder|Lazarus Group|MuddyWater|Mustang Panda|LazyScripter|TA2541|APT38|Inception|Kimsuky|FIN7|Earth Lusca|APT32|APT29|Confucius|TA551|SideCopy|Gamaredon Group
-T1547.015,Login Items,Persistence|Privilege Escalation,no
-T1608,Stage Capabilities,Resource Development,Mustang Panda
-T1608.005,Link Target,Resource Development,FIN7|LuminousMoth|Silent Librarian
-T1104,Multi-Stage Channels,Command And Control,APT3|Lazarus Group|MuddyWater|APT41
-T1657,Financial Theft,Impact,INC Ransom|VOID MANTICORE|Contagious Interview|Cinnamon Tempest|Malteiro|Kimsuky|FIN13|Storm-0501|AppleJeus|Akira|Scattered Spider|Medusa Group|Water Galura|SilverTerrier|Play
-T1480,Execution Guardrails,Stealth,APT-C-36|Contagious Interview|BlackByte|Gamaredon Group
-T1619,Cloud Storage Object Discovery,Discovery,no
-T1606.001,Web Cookies,Credential Access,no
-T1654,Log Enumeration,Discovery,APT5|Ember Bear|Volt Typhoon|Aquatic Panda|Mustang Panda
-T1134.001,Token Impersonation/Theft,Stealth|Privilege Escalation,APT28|FIN8
-T1567.001,Exfiltration to Code Repository,Exfiltration,no
-T1021.007,Cloud Services,Lateral Movement,Storm-0501|APT29|Scattered Spider
-T1205.001,Port Knocking,Stealth|Persistence|Command And Control,PROMETHIUM|UNC3886
-T1027.012,LNK Icon Smuggling,Stealth,Kimsuky|Gamaredon Group|Mustang Panda
-T1583.006,Web Services,Resource Development,Earth Lusca|HAFNIUM|Contagious Interview|Medusa Group|Mustang Panda|Turla|ZIRCONIUM|APT17|MuddyWater|APT28|APT29|APT-C-36|FIN7|VOID MANTICORE|Lazarus Group|Confucius|Gamaredon Group|IndigoZebra|Saint Bear|POLONIUM|APT32|Kimsuky|TA578|TA2541|Magic Hound|LazyScripter
-T1528,Steal Application Access Token,Credential Access,APT29|APT28
-T1598.002,Spearphishing Attachment,Reconnaissance,Dragonfly|Star Blizzard|Sidewinder|SideCopy
-T1098.001,Additional Cloud Credentials,Persistence|Privilege Escalation,Storm-0501
-T1204,User Execution,Execution,Scattered Spider|LAPSUS$
-T1491.001,Internal Defacement,Impact,Gamaredon Group|BlackByte|Lazarus Group
-T1564.002,Hidden Users,Stealth,Dragonfly|Kimsuky
-T1134.003,Make and Impersonate Token,Stealth|Privilege Escalation,BlackByte|FIN13
-T1552.006,Group Policy Preferences,Credential Access,APT33|Wizard Spider
-T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,APT28|CURIUM|MirrorFace|Storm-1811
-T1087.004,Cloud Account,Discovery,Storm-0501|APT29
-T1683.002,Audio-Visual Content,Resource Development,APT-C-36|Contagious Interview
-T1057,Process Discovery,Discovery,MirrorFace|Windshift|Volt Typhoon|Tropic Trooper|Sidewinder|Deep Panda|APT1|HAFNIUM|Darkhotel|Play|Stealth Falcon|TeamTNT|APT28|Chimera|Andariel|Lazarus Group|Storm-0501|Molerats|Earth Lusca|Medusa Group|Mustang Panda|ToddyCat|APT5|FIN7|Turla|MuddyWater|UNC3886|Rocke|Magic Hound|APT37|Kimsuky|Higaisa|Poseidon Group|Ke3chang|HEXANE|Inception|OilRig|APT3|Gamaredon Group|Winnti Group|APT38
-T1556.008,Network Provider DLL,Defense Impairment|Persistence|Credential Access,no
-T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,Blue Mockingbird|APT29|HEXANE|FIN8|Leviathan|Turla|Metador|APT33|Mustang Panda|Rancor
-T1596.004,CDNs,Reconnaissance,no
-T1497.002,User Activity Based Checks,Stealth|Discovery,Darkhotel|FIN7
-T1496.004,Cloud Service Hijacking,Impact,no
-T1585.003,Cloud Accounts,Resource Development,Storm-1811
-T1072,Software Deployment Tools,Execution|Lateral Movement,APT32|Sandworm Team|Mustang Panda|VOID MANTICORE|Silence|Threat Group-1314|Medusa Group
-T1041,Exfiltration Over C2 Channel,Exfiltration,Scattered Spider|LuminousMoth|Sandworm Team|Chimera|GALLIUM|Higaisa|Ke3chang|APT39|Lazarus Group|Mustang Panda|APT3|APT32|Contagious Interview|WIRTE|Kimsuky|ZIRCONIUM|BlackByte|Confucius|Winter Vivern|Wizard Spider|Agrius|Leviathan|Gamaredon Group|MuddyWater|Stealth Falcon|CURIUM|VOID MANTICORE
-T1134.004,Parent PID Spoofing,Stealth|Privilege Escalation,no
-T1591,Gather Victim Org Information,Reconnaissance,APT28|MirrorFace|Lazarus Group|Moonstone Sleet|FIN7|Kimsuky|Volt Typhoon
-T1606,Forge Web Credentials,Credential Access,no
-T1621,Multi-Factor Authentication Request Generation,Credential Access,APT29|Scattered Spider|LAPSUS$
-T1554,Compromise Host Software Binary,Persistence,UNC3886|APT5
-T1552.008,Chat Messages,Credential Access,LAPSUS$
-T1059.001,PowerShell,Execution,WIRTE|APT42|APT5|Blue Mockingbird|APT39|Magic Hound|APT19|APT28|APT41|Sandworm Team|VOID MANTICORE|MoustachedBouncer|CopyKittens|Thrip|Storm-0501|Storm-1811|FIN13|Gorgon Group|Play|FIN7|RedCurl|TeamTNT|OilRig|Inception|Lazarus Group|APT32|Chimera|Volt Typhoon|Saint Bear|Earth Lusca|Threat Group-3390|TA2541|Deep Panda|Indrik Spider|Cobalt Group|Leviathan|Wizard Spider|Akira|APT29|GALLIUM|Ember Bear|Daggerfly|FIN6|Medusa Group|HEXANE|LazyScripter|BlackByte|HAFNIUM|Sidewinder|FIN10|Gallmaker|Turla|Silence|Molerats|ToddyCat|UNC3886|APT3|DarkVishnya|TA459|Gamaredon Group|Kimsuky|TA505|FIN8|APT33|Scattered Spider|BRONZE BUTLER|Mustang Panda|Patchwork|Tonto Team|APT38|DarkHydrus|CURIUM|GOLD SOUTHFIELD|menuPass|Poseidon Group|Stealth Falcon|MuddyWater|Fox Kitten|Cinnamon Tempest|Dragonfly|Winter Vivern|Aquatic Panda|Confucius|Nomadic Octopus|APT-C-36
-T1546.001,Change Default File Association,Privilege Escalation|Persistence,Kimsuky
-T1055.014,VDSO Hijacking,Stealth|Privilege Escalation,no
-T1071.002,File Transfer Protocols,Command And Control,APT41|Dragonfly|MirrorFace|SilverTerrier|Kimsuky
-T1679,Selective Exclusion,Stealth,VOID MANTICORE
-T1212,Exploitation for Credential Access,Credential Access,UNC3886
-T1546.014,Emond,Privilege Escalation|Persistence,no
-T1102.003,One-Way Communication,Command And Control,Leviathan|Gamaredon Group
-T1590,Gather Victim Network Information,Reconnaissance,Volt Typhoon|Indrik Spider|HAFNIUM
-T1210,Exploitation of Remote Services,Lateral Movement,Wizard Spider|Fox Kitten|Earth Lusca|Ember Bear|APT28|Tonto Team|menuPass|Dragonfly|MuddyWater|Threat Group-3390|FIN7
-T1534,Internal Spearphishing,Lateral Movement,Gamaredon Group|MuddyWater|Kimsuky|APT-C-36|Leviathan|HEXANE
-T1574.010,Services File Permissions Weakness,Stealth|Execution,no
-T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,APT19|APT37|APT39|TA2541|RTM|Magic Hound|Storm-1811|Inception|APT28|TeamTNT|Leviathan|Naikon|Silence|Gorgon Group|APT29|ZIRCONIUM|Patchwork|FIN6|Turla|Putter Panda|MuddyWater|Sidewinder|Threat Group-3390|Tropic Trooper|Lazarus Group|APT41|Windshift|FIN7|Dark Caracal|FIN10|PROMETHIUM|LuminousMoth|FIN13|Moonstone Sleet|Rocke|Molerats|VOID MANTICORE|Cobalt Group|Mustang Panda|Higaisa|Kimsuky|Dragonfly|LazyScripter|APT3|Darkhotel|APT33|BRONZE BUTLER|BlackByte|RedCurl|Ke3chang|Confucius|APT18|Contagious Interview|Gamaredon Group|Wizard Spider|APT32
-T1199,Trusted Relationship,Initial Access,GOLD SOUTHFIELD|APT28|Threat Group-3390|Sandworm Team|menuPass|RedCurl|APT29|POLONIUM|HAFNIUM|LAPSUS$|VOID MANTICORE|Sea Turtle
-T1136.003,Cloud Account,Persistence,APT29|LAPSUS$
-T1069.001,Local Groups,Discovery,Turla|Tonto Team|HEXANE|admin@338|Chimera|Volt Typhoon|OilRig
-T1593,Search Open Websites/Domains,Reconnaissance,Mustang Panda|Volt Typhoon|Contagious Interview|APT-C-36|Sandworm Team|Star Blizzard
-T1098,Account Manipulation,Persistence|Privilege Escalation,Lazarus Group|Scattered Spider|VOID MANTICORE|HAFNIUM
-T1048,Exfiltration Over Alternative Protocol,Exfiltration,Play|TeamTNT
-T1547.006,Kernel Modules and Extensions,Persistence|Privilege Escalation,no
-T1678,Delay Execution,Stealth,Kimsuky|Mustang Panda
-T1056.002,GUI Input Capture,Collection|Credential Access,RedCurl|FIN4
-T1686.002,Network Device Firewall,Defense Impairment,APT38
-T1588.002,Tool,Resource Development,DarkVishnya|Turla|Inception|Magic Hound|BITTER|Kimsuky|BlackTech|MuddyWater|LAPSUS$|Leafminer|APT29|Medusa Group|APT28|Wizard Spider|Storm-1811|BRONZE BUTLER|menuPass|APT41|Scattered Spider|FIN8|TA505|APT39|GALLIUM|Cleaver|BackdoorDiplomacy|Cinnamon Tempest|OilRig|TA2541|FIN6|Sandworm Team|Patchwork|FIN7|LuminousMoth|Sea Turtle|MirrorFace|APT-C-36|WIRTE|Contagious Interview|FIN13|Mustang Panda|Cobalt Group|Ke3chang|Threat Group-3390|Lazarus Group|FIN5|Thrip|Moses Staff|POLONIUM|PittyTiger|HEXANE|Whitefly|Lotus Blossom|FIN10|INC Ransom|Dragonfly|IndigoZebra|Aquatic Panda|Aoqin Dragon|APT38|Earth Lusca|APT33|VOID MANTICORE|Ferocious Kitten|APT32|Star Blizzard|Gorgon Group|Silence|Gamaredon Group|Chimera|Metador|CopyKittens|Silent Librarian|Play|Salt Typhoon|Volt Typhoon|APT19|APT42|Blue Mockingbird|APT1|Carbanak|DarkHydrus
-T1052.001,Exfiltration over USB,Exfiltration,Tropic Trooper|Mustang Panda
-T1574.013,KernelCallbackTable,Stealth|Execution,Lazarus Group
-T1597,Search Closed Sources,Reconnaissance,EXOTIC LILY
-T1053.006,Systemd Timers,Execution|Persistence|Privilege Escalation,no
-T1566,Phishing,Initial Access,Kimsuky|VOID MANTICORE|INC Ransom|MuddyWater|Sea Turtle|Axiom|AppleJeus|GOLD SOUTHFIELD
-T1542.004,ROMMONkit,Stealth|Persistence,no
-T1218.001,Compiled HTML File,Stealth,OilRig|Dark Caracal|Silence|APT41|APT38
-T1496.001,Compute Hijacking,Impact,Rocke|Blue Mockingbird|TeamTNT|APT41
-T1070.005,Network Share Connection Removal,Stealth,Threat Group-3390
-T1090.003,Multi-hop Proxy,Command And Control,Ember Bear|APT28|Inception|Leviathan|FIN4|APT29|Medusa Group|Lotus Blossom|ZIRCONIUM|Volt Typhoon|Gamaredon Group
-T1110,Brute Force,Credential Access,Fox Kitten|HEXANE|Ember Bear|Turla|DarkVishnya|FIN5|APT41|APT38|OilRig|Agrius|APT39|Dragonfly|VOID MANTICORE|Storm-0501|APT28
-T1059.004,Unix Shell,Execution,Aquatic Panda|TeamTNT|Contagious Interview|Rocke|Velvet Ant|Scattered Spider|Volt Typhoon|APT41|UNC3886|Sea Turtle
-T1137.003,Outlook Forms,Persistence,no
-T1219.003,Remote Access Hardware,Command And Control,no
-T1565,Data Manipulation,Impact,FIN13
-T1559,Inter-Process Communication,Execution,no
-T1001,Data Obfuscation,Command And Control,Gamaredon Group
-T1039,Data from Network Shared Drive,Collection,RedCurl|APT28|Gamaredon Group|BRONZE BUTLER|Sowbug|Chimera|menuPass|Fox Kitten
-T1584.006,Web Services,Resource Development,Turla|Earth Lusca|CURIUM|Winter Vivern
-T1601,Modify System Image,Defense Impairment,no
-T1574,Hijack Execution Flow,Stealth|Execution,no
-T1036.012,Browser Fingerprint,Stealth,no
-T1059.011,Lua,Execution,no
-T1027.005,Indicator Removal from Tools,Stealth,UNC3886|Patchwork|Deep Panda|GALLIUM|OilRig|Turla|APT3
-T1204.003,Malicious Image,Execution,TeamTNT
-T1543.005,Container Service,Persistence|Privilege Escalation,no
-T1078,Valid Accounts,Stealth|Persistence|Privilege Escalation|Initial Access,APT41|FIN8|FIN4|FIN7|Scattered Spider|Dragonfly|GALLIUM|APT18|Volt Typhoon|Lazarus Group|Chimera|menuPass|Sandworm Team|Cinnamon Tempest|Akira|LAPSUS$|Carbanak|APT28|Threat Group-3390|Medusa Group|Suckfly|Play|Axiom|Indrik Spider|Leviathan|PittyTiger|Silence|OilRig|Wizard Spider|APT29|UNC3886|BlackByte|Ke3chang|FIN10|APT33|INC Ransom|FIN6|Fox Kitten|POLONIUM|FIN5|Silent Librarian|Sea Turtle|Star Blizzard|APT39|VOID MANTICORE
-T1571,Non-Standard Port,Command And Control,WIRTE|Silence|Contagious Interview|RedEcho|MuddyWater|Ember Bear|APT32|Velvet Ant|Sandworm Team|Lazarus Group|FIN7|Magic Hound|Gamaredon Group|DarkVishnya|APT-C-36|APT33|Rocke
-T1585.001,Social Media Accounts,Resource Development,Sandworm Team|Scattered Spider|Medusa Group|EXOTIC LILY|HEXANE|Water Galura|Kimsuky|Leviathan|CURIUM|Cleaver|Lazarus Group|APT32|Contagious Interview|Fox Kitten|Magic Hound|Star Blizzard|VOID MANTICORE|Moonstone Sleet
-T1055.012,Process Hollowing,Stealth|Privilege Escalation,Gorgon Group|Threat Group-3390|Patchwork|BlackByte|TA2541|menuPass|Kimsuky|APT-C-36
-T1068,Exploitation for Privilege Escalation,Privilege Escalation,Threat Group-3390|HAFNIUM|UNC3886|APT29|Turla|PLATINUM|FIN8|Cobalt Group|MoustachedBouncer|Volt Typhoon|FIN6|Whitefly|BITTER|LAPSUS$|BlackByte|Scattered Spider|APT28|ZIRCONIUM|Tonto Team|APT32|APT33|OilRig
-T1564.009,Resource Forking,Stealth,no
-T1531,Account Access Removal,Impact,Akira|LAPSUS$
-T1110.004,Credential Stuffing,Credential Access,Chimera|VOID MANTICORE
-T1027,Obfuscated Files or Information,Stealth,BackdoorDiplomacy|RedCurl|Rocke|GALLIUM|Gallmaker|BlackOasis|APT3|APT-C-36|Windshift|Ke3chang|APT37|Kimsuky|Moonstone Sleet|Mustang Panda|Sandworm Team|Earth Lusca|Gamaredon Group|APT41
-T1556.006,Multi-Factor Authentication,Defense Impairment|Persistence|Credential Access,Scattered Spider
-T1114.002,Remote Email Collection,Collection,Ke3chang|APT28|VOID MANTICORE|Star Blizzard|APT1|APT29|HAFNIUM|Magic Hound|Chimera|Dragonfly|FIN4|Leafminer|Kimsuky
-T1505.004,IIS Components,Persistence,no
-T1036.001,Invalid Code Signature,Stealth,APT37|Windshift
-T1683,Generate Content,Resource Development,no
-T1564.006,Run Virtual Instance,Stealth,no
-T1027.014,Polymorphic Code,Stealth,no
-T1201,Password Policy Discovery,Discovery,OilRig|Chimera|Turla
-T1546,Event Triggered Execution,Privilege Escalation|Persistence,no
-T1546.004,Unix Shell Configuration Modification,Privilege Escalation|Persistence,Contagious Interview
-T1187,Forced Authentication,Credential Access,DarkHydrus|Dragonfly
-T1134.005,SID-History Injection,Stealth|Privilege Escalation,no
-T1599,Network Boundary Bridging,Defense Impairment,APT41
-T1486,Data Encrypted for Impact,Impact,APT38|INC Ransom|VOID MANTICORE|Magic Hound|Scattered Spider|FIN7|Storm-0501|Medusa Group|Sandworm Team|Akira|Storm-1811|Indrik Spider|APT41|Water Galura|TA505|BlackByte|FIN8|Moonstone Sleet
-T1690,Prevent Command History Logging,Defense Impairment,Sea Turtle|UNC3886|APT38|Medusa Group
-T1553,Subvert Trust Controls,Defense Impairment,Axiom
-T1548.004,Elevated Execution with Prompt,Privilege Escalation,no
-T1592.003,Firmware,Reconnaissance,no
-T1573,Encrypted Channel,Command And Control,Tropic Trooper|Magic Hound|BITTER|APT29
-T1547.002,Authentication Package,Persistence|Privilege Escalation,no
-T1218.010,Regsvr32,Stealth,TA551|Deep Panda|Cobalt Group|Storm-0501|Blue Mockingbird|Leviathan|Kimsuky|Inception|WIRTE|APT32|APT19
-T1567.003,Exfiltration to Text Storage Sites,Exfiltration,no
-T1592.002,Software,Reconnaissance,Magic Hound|Sandworm Team|Andariel
-T1056,Input Capture,Collection|Credential Access,APT42|Storm-1811|APT39
-T1566.004,Spearphishing Voice,Initial Access,Storm-1811
-T1587.004,Exploits,Resource Development,Volt Typhoon|UNC3886|Leviathan
-T1685,Disable or Modify Tools,Defense Impairment,Scattered Spider|Kimsuky|Gorgon Group|FIN6|MirrorFace|Agrius|APT5|TA2541|BlackByte|Indrik Spider|Contagious Interview|APT38|Saint Bear|Putter Panda|Wizard Spider|APT41|BRONZE BUTLER|Turla|Lazarus Group|MuddyWater|Gamaredon Group|INC Ransom|UNC3886|Aquatic Panda|Velvet Ant|TeamTNT|Akira|Medusa Group|TA505|Rocke|Magic Hound|Play
-T1593.001,Social Media,Reconnaissance,Kimsuky|Contagious Interview|EXOTIC LILY
-T1213.004,Customer Relationship Management Software,Collection,no
-T1546.015,Component Object Model Hijacking,Privilege Escalation|Persistence,APT28
-T1589.001,Credentials,Reconnaissance,APT28|Magic Hound|Leviathan|LAPSUS$|Chimera
-T1195.002,Compromise Software Supply Chain,Initial Access,APT41|Cobalt Group|GOLD SOUTHFIELD|Sandworm Team|Dragonfly|Threat Group-3390|Daggerfly|Moonstone Sleet|FIN7
-T1036.003,Rename Legitimate Utilities,Stealth,menuPass|Lazarus Group|Daggerfly|APT32|APT38|GALLIUM
-T1102.002,Bidirectional Communication,Command And Control,Kimsuky|POLONIUM|APT37|Lazarus Group|APT12|APT39|Magic Hound|Turla|HEXANE|Carbanak|FIN7|Sandworm Team|APT28|MuddyWater|ZIRCONIUM|Gamaredon Group
-T1203,Exploitation for Client Execution,Execution,Sidewinder|Saint Bear|APT28|Threat Group-3390|Sandworm Team|Dragonfly|Andariel|The White Company|EXOTIC LILY|Lazarus Group|APT29|BlackTech|Confucius|Patchwork|APT12|Axiom|Higaisa|Cobalt Group|Leviathan|APT37|TA459|Mustang Panda|UNC3886|APT3|BRONZE BUTLER|Sea Turtle|Transparent Tribe|Tropic Trooper|Tonto Team|Aoqin Dragon|Inception|APT41|Ember Bear|BITTER|Elderwood|Darkhotel|APT32|OilRig|admin@338|APT33|MuddyWater
-T1595.003,Wordlist Scanning,Reconnaissance,APT41|Volatile Cedar
-T1667,Email Bombing,Impact,Storm-1811
-T1137.004,Outlook Home Page,Persistence,OilRig
-T1573.002,Asymmetric Cryptography,Command And Control,TA2541|Velvet Ant|Tropic Trooper|RedCurl|Medusa Group|RedEcho|OilRig|Cobalt Group|APT42|FIN6|FIN8
-T1567.002,Exfiltration to Cloud Storage,Exfiltration,Leviathan|Akira|LuminousMoth|Kimsuky|Threat Group-3390|Mustang Panda|Confucius|POLONIUM|HEXANE|Medusa Group|Cinnamon Tempest|Storm-0501|Wizard Spider|Indrik Spider|Turla|HAFNIUM|MuddyWater|Contagious Interview|Earth Lusca|Ember Bear|ToddyCat|ZIRCONIUM|Chimera|Scattered Spider|FIN7
-T1570,Lateral Tool Transfer,Lateral Movement,Medusa Group|APT32|Aoqin Dragon|FIN10|Ember Bear|Volt Typhoon|Velvet Ant|Wizard Spider|Turla|BlackByte|Chimera|GALLIUM|Storm-1811|Magic Hound|INC Ransom|UNC3886|Sandworm Team|Agrius|APT41
-T1574.009,Path Interception by Unquoted Path,Stealth|Execution,no
-T1608.003,Install Digital Certificate,Resource Development,Sea Turtle
-T1037.005,Startup Items,Persistence|Privilege Escalation,no
-T1614.001,System Language Discovery,Discovery,Ke3chang|MirrorFace|BlackByte|Storm-0501|Malteiro
-T1095,Non-Application Layer Protocol,Command And Control,Gamaredon Group|Ember Bear|ToddyCat|Mustang Panda|Metador|PLATINUM|UNC3886|FIN6|BackdoorDiplomacy|APT3|BITTER|HAFNIUM
-T1059.013,Container CLI/API,Execution,TeamTNT
-T1027.003,Steganography,Stealth,Earth Lusca|APT37|TA551|Leviathan|MuddyWater|APT-C-36|Andariel|Tropic Trooper|BRONZE BUTLER
-T1584.002,DNS Server,Resource Development,Sea Turtle|LAPSUS$
-T1671,Cloud Application Integration,Persistence,no
-T1001.003,Protocol or Service Impersonation,Command And Control,Lazarus Group|Mustang Panda|Higaisa
-T1012,Query Registry,Discovery,ZIRCONIUM|Threat Group-3390|Lazarus Group|APT32|Dragonfly|Turla|Kimsuky|Stealth Falcon|Gamaredon Group|BlackByte|Fox Kitten|APT39|Chimera|APT41|Daggerfly|Volt Typhoon|OilRig|Indrik Spider|Lotus Blossom
-T1030,Data Transfer Size Limits,Exfiltration,Play|LuminousMoth|Threat Group-3390|APT28|APT41
-T1550.004,Web Session Cookie,Lateral Movement,Star Blizzard
-T1078.002,Domain Accounts,Stealth|Persistence|Privilege Escalation|Initial Access,Naikon|Agrius|Wizard Spider|Sandworm Team|VOID MANTICORE|OilRig|Cinnamon Tempest|ToddyCat|Indrik Spider|APT3|Chimera|Play|TA505|Threat Group-1314|APT5|Magic Hound|Volt Typhoon|BlackByte|Aquatic Panda
-T1218.009,Regsvcs/Regasm,Stealth,no
-T1546.018,Python Startup Hooks,Persistence|Privilege Escalation,no
-T1553.004,Install Root Certificate,Defense Impairment,no
-T1037.003,Network Logon Script,Persistence|Privilege Escalation,no
-T1499,Endpoint Denial of Service,Impact,Sandworm Team
-T1027.004,Compile After Delivery,Stealth,Gamaredon Group|Rocke|MuddyWater|Sea Turtle
-T1688,Safe Mode Boot,Defense Impairment,no
-T1614,System Location Discovery,Discovery,SideCopy|Volt Typhoon
-T1564.007,VBA Stomping,Stealth,no
-T1197,BITS Jobs,Stealth|Persistence|Execution,Patchwork|Leviathan|APT39|APT41|Wizard Spider
-T1127.001,MSBuild,Stealth|Execution,no
-T1578.005,Modify Cloud Compute Configurations,Defense Impairment,no
-T1090.004,Domain Fronting,Command And Control,APT29
-T1557.002,ARP Cache Poisoning,Credential Access|Collection,Cleaver|LuminousMoth
-T1518.001,Security Software Discovery,Discovery,Darkhotel|Sidewinder|SideCopy|Windshift|APT38|FIN8|APT42|TA2541|The White Company|Naikon|Cobalt Group|Gamaredon Group|Wizard Spider|Patchwork|MuddyWater|Storm-0501|Aquatic Panda|Kimsuky|TeamTNT|Malteiro|Turla|ToddyCat|Play|Tropic Trooper|Medusa Group|BlackByte|Rocke
-T1564.003,Hidden Window,Stealth,APT3|VOID MANTICORE|APT28|APT19|FIN7|Medusa Group|Deep Panda|Gorgon Group|CopyKittens|Higaisa|Gamaredon Group|DarkHydrus|ToddyCat|Nomadic Octopus|Kimsuky|APT-C-36|APT32|Magic Hound
-T1127.002,ClickOnce,Stealth|Execution,no
-T1059.006,Python,Execution,APT37|BRONZE BUTLER|Tonto Team|ZIRCONIUM|Rocke|Machete|UNC3886|Earth Lusca|MuddyWater|Contagious Interview|Cinnamon Tempest|Turla|APT29|APT39|RedCurl|VOID MANTICORE|Dragonfly|Kimsuky
-T1070.010,Relocate Malware,Stealth,no
-T1591.004,Identify Roles,Reconnaissance,Volt Typhoon|LAPSUS$|FIN7|HEXANE
-T1132,Data Encoding,Command And Control,Velvet Ant
-T1546.010,AppInit DLLs,Privilege Escalation|Persistence,APT39
-T1598,Phishing for Information,Reconnaissance,Scattered Spider|ZIRCONIUM|Kimsuky|APT28|Moonstone Sleet
-T1496,Resource Hijacking,Impact,no
-T1684.001,Impersonation,Stealth,Star Blizzard|Kimsuky|APT-C-36|VOID MANTICORE|MirrorFace|Scattered Spider|Saint Bear|APT42|Storm-1811|MuddyWater|Contagious Interview|WIRTE|LAPSUS$|APT41|APT28
-T1585,Establish Accounts,Resource Development,Contagious Interview|Fox Kitten|Kimsuky|Ember Bear|APT17
-T1588,Obtain Capabilities,Resource Development,no
-T1546.002,Screensaver,Privilege Escalation|Persistence,no
-T1556.009,Conditional Access Policies,Defense Impairment|Persistence|Credential Access,Scattered Spider|Storm-0501
-T1578.002,Create Cloud Instance,Defense Impairment,LAPSUS$|Scattered Spider
-T1555.006,Cloud Secrets Management Stores,Credential Access,HAFNIUM|Storm-0501
-T1213.003,Code Repositories,Collection,LAPSUS$|Scattered Spider|APT41
-T1565.002,Transmitted Data Manipulation,Impact,APT38
-T1003.008,/etc/passwd and /etc/shadow,Credential Access,no
-T1543.001,Launch Agent,Persistence|Privilege Escalation,Contagious Interview
-T1569,System Services,Execution,no
-T1059.003,Windows Command Shell,Execution,Lazarus Group|Suckfly|GALLIUM|Magic Hound|ZIRCONIUM|Dark Caracal|Wizard Spider|Volt Typhoon|OilRig|Threat Group-3390|Threat Group-1314|Saint Bear|Play|Nomadic Octopus|TeamTNT|INC Ransom|Machete|WIRTE|APT38|MuddyWater|HAFNIUM|APT3|Storm-1811|APT32|RedCurl|BlackByte|FIN10|Gorgon Group|FIN6|Contagious Interview|Fox Kitten|Blue Mockingbird|APT28|Kimsuky|Metador|Mustang Panda|Tropic Trooper|APT41|Indrik Spider|Aquatic Panda|FIN13|MirrorFace|Turla|Agrius|Chimera|Sowbug|Cobalt Group|TA577|ToddyCat|UNC3886|Dragonfly|LazyScripter|APT5|Medusa Group|Darkhotel|Patchwork|APT37|FIN7|Ke3chang|Winter Vivern|BRONZE BUTLER|Higaisa|menuPass|FIN8|APT18|TA551|Rancor|APT1|Silence|Gamaredon Group|Cinnamon Tempest|admin@338|TA505
-T1055.009,Proc Memory,Stealth|Privilege Escalation,no
-T1650,Acquire Access,Resource Development,Medusa Group
-T1601.001,Patch System Image,Defense Impairment,no
-T1558.002,Silver Ticket,Credential Access,no
-T1213,Data from Information Repositories,Collection,APT28
-T1070.009,Clear Persistence,Stealth,no
-T1059.012,Hypervisor CLI,Execution,UNC3886
-T1555.004,Windows Credential Manager,Credential Access,OilRig|Stealth Falcon|Turla|Wizard Spider
-T1036.010,Masquerade Account Name,Stealth,Storm-1811|Magic Hound|Dragonfly|APT3
-T1200,Hardware Additions,Initial Access,DarkVishnya
-T1219.002,Remote Desktop Software,Command And Control,Storm-0501|Contagious Interview|Evilnum|Storm-1811|Mustang Panda|Kimsuky|Thrip|RTM|VOID MANTICORE|Scattered Spider|MuddyWater
-T1505,Server Software Component,Persistence,no
-T1485,Data Destruction,Impact,LAPSUS$|Lazarus Group|Storm-0501|APT38|Sandworm Team|VOID MANTICORE
-T1132.002,Non-Standard Encoding,Command And Control,Kimsuky
-T1556.001,Domain Controller Authentication,Defense Impairment|Persistence|Credential Access,Chimera
-T1537,Transfer Data to Cloud Account,Exfiltration,Storm-0501|INC Ransom|RedCurl
-T1027.006,HTML Smuggling,Stealth,APT29
-T1556.005,Reversible Encryption,Defense Impairment|Persistence|Credential Access,no
-T1027.010,Command Obfuscation,Stealth,Aquatic Panda|Sandworm Team|HEXANE|Leafminer|Cobalt Group|Kimsuky|Medusa Group|Fox Kitten|FIN6|APT32|Play|Magic Hound|Wizard Spider|MuddyWater|Patchwork|Chimera|Silence|FIN8|FIN7|TA551|Sidewinder|TA505|Turla|GOLD SOUTHFIELD|LazyScripter|Contagious Interview|Gamaredon Group|WIRTE|APT19
-T1070.004,File Deletion,Stealth,Aquatic Panda|FIN10|menuPass|BRONZE BUTLER|Tropic Trooper|TeamTNT|APT38|FIN5|Play|BlackByte|Ember Bear|MirrorFace|Kimsuky|OilRig|FIN6|APT41|APT39|APT29|Wizard Spider|APT28|APT18|Evilnum|Contagious Interview|Dragonfly|Mustang Panda|Sandworm Team|Magic Hound|APT32|Cobalt Group|FIN8|APT5|UNC3886|Lazarus Group|APT3|The White Company|Chimera|Patchwork|Group5|Medusa Group|Metador|Gamaredon Group|Volt Typhoon|INC Ransom|Silence|RedCurl|Rocke|Threat Group-3390
-T1189,Drive-by Compromise,Initial Access,Transparent Tribe|RTM|PLATINUM|Windshift|Earth Lusca|APT38|Axiom|APT19|Darkhotel|Andariel|APT28|Dragonfly|Dark Caracal|Turla|Patchwork|Leviathan|APT32|BRONZE BUTLER|Lazarus Group|Threat Group-3390|Winter Vivern|Elderwood|Mustard Tempest|APT37|Leafminer|Machete|CURIUM|Daggerfly|PROMETHIUM|Windigo|Magic Hound
-T1498,Network Denial of Service,Impact,APT28
-T1651,Cloud Administration Command,Execution,APT29|VOID MANTICORE
-T1546.016,Installer Packages,Privilege Escalation|Persistence,no
-T1595.001,Scanning IP Blocks,Reconnaissance,Ember Bear|TeamTNT
-T1221,Template Injection,Stealth,Dragonfly|Confucius|Tropic Trooper|APT28|Gamaredon Group|Inception|MirrorFace|DarkHydrus
-T1037.004,RC Scripts,Persistence|Privilege Escalation,Velvet Ant|UNC3886|APT29
-T1134,Access Token Manipulation,Stealth|Privilege Escalation,Lotus Blossom|FIN6|Blue Mockingbird
-T1111,Multi-Factor Authentication Interception,Credential Access,Kimsuky|Chimera|APT42|LAPSUS$
-T1027.002,Software Packing,Stealth,The White Company|TA2541|APT41|Dark Caracal|Aoqin Dragon|MoustachedBouncer|APT39|TA505|Volt Typhoon|GALLIUM|TeamTNT|APT38|Rocke|Patchwork|Kimsuky|ZIRCONIUM|Medusa Group|Storm-0501|Threat Group-3390|Saint Bear|APT3|Elderwood|APT29
-T1584.007,Serverless,Resource Development,no
-T1071.001,Web Protocols,Command And Control,Rancor|Metador|RedEcho|BITTER|Moonstone Sleet|OilRig|Orangeworm|APT37|Winter Vivern|Dark Caracal|Daggerfly|Magic Hound|Tropic Trooper|Chimera|LuminousMoth|APT19|APT41|Mustang Panda|Medusa Group|APT38|BRONZE BUTLER|Sidewinder|Kimsuky|Lazarus Group|BlackByte|Higaisa|RedCurl|MuddyWater|Stealth Falcon|APT32|Inception|WIRTE|Turla|FIN13|SilverTerrier|APT28|Wizard Spider|FIN8|Confucius|Windshift|Cobalt Group|APT33|TA551|APT42|Gamaredon Group|Ke3chang|FIN4|APT18|APT39|Threat Group-3390|HAFNIUM|VOID MANTICORE|TeamTNT|Rocke|Sea Turtle|Sandworm Team|TA505
-T1059.005,Visual Basic,Execution,Patchwork|Higaisa|FIN4|WIRTE|Windshift|Turla|Earth Lusca|Rancor|Mustang Panda|Transparent Tribe|Silence|Gamaredon Group|FIN7|APT38|Machete|MuddyWater|APT42|BRONZE BUTLER|Confucius|TA505|Magic Hound|RedCurl|LazyScripter|Malteiro|Lazarus Group|Cobalt Group|OilRig|SideCopy|Leviathan|TA459|MirrorFace|FIN13|Sidewinder|APT32|Molerats|TA2541|Inception|Contagious Interview|APT-C-36|HEXANE|APT33|APT37|Sandworm Team|Kimsuky|Gorgon Group|APT39
-T1564.005,Hidden File System,Stealth,Equation|Strider
-T1543.002,Systemd Service,Persistence|Privilege Escalation,TeamTNT|Scattered Spider|Rocke
-T1668,Exclusive Control,Persistence,no
-T1563.002,RDP Hijacking,Lateral Movement,Axiom
-T1136,Create Account,Persistence,Indrik Spider|Scattered Spider|Salt Typhoon
-T1547.013,XDG Autostart Entries,Persistence|Privilege Escalation,Contagious Interview
-T1584.004,Server,Resource Development,Lazarus Group|Volt Typhoon|Dragonfly|Turla|Leviathan|APT16|Sandworm Team|Daggerfly|Indrik Spider|Earth Lusca
-T1526,Cloud Service Discovery,Discovery,Storm-0501
-T1204.004,Malicious Copy and Paste,Execution,MuddyWater|Kimsuky|Contagious Interview
-T1018,Remote System Discovery,Discovery,Ember Bear|menuPass|Fox Kitten|Agrius|Naikon|Deep Panda|Earth Lusca|APT41|FIN5|Volt Typhoon|Sandworm Team|Play|Mustang Panda|Akira|Ke3chang|HEXANE|MirrorFace|Threat Group-3390|Medusa Group|ToddyCat|Lotus Blossom|BRONZE BUTLER|APT39|APT32|Silence|FIN6|Indrik Spider|Turla|Rocke|Leafminer|Magic Hound|Scattered Spider|Chimera|HAFNIUM|Wizard Spider|APT3|GALLIUM|BlackByte|FIN8|Dragonfly
-T1046,Network Service Discovery,Discovery,Volt Typhoon|APT39|BlackTech|BlackByte|menuPass|Threat Group-3390|Mustang Panda|Agrius|FIN13|DarkVishnya|OilRig|Lazarus Group|Leafminer|Tropic Trooper|Naikon|Magic Hound|Rocke|APT32|INC Ransom|Chimera|APT41|Suckfly|FIN6|TeamTNT|BackdoorDiplomacy|Lotus Blossom|Fox Kitten|Medusa Group|Cobalt Group|RedCurl|Ember Bear
-T1590.001,Domain Properties,Reconnaissance,Sandworm Team
-T1518,Software Discovery,Discovery,Volt Typhoon|Windigo|Inception|BRONZE BUTLER|Windshift|MuddyWater|SideCopy|Sidewinder|Mustang Panda|HEXANE|Tropic Trooper
-T1538,Cloud Service Dashboard,Discovery,Scattered Spider
-T1055.005,Thread Local Storage,Stealth|Privilege Escalation,no
-T1622,Debugger Evasion,Stealth|Discovery,Mustang Panda
-T1036.006,Space after Filename,Stealth,APT38
-T1547.007,Re-opened Applications,Persistence|Privilege Escalation,no
-T1608.006,SEO Poisoning,Resource Development,Mustard Tempest
-T1550.002,Pass the Hash,Lateral Movement,APT32|APT28|Aquatic Panda|Chimera|APT1|Wizard Spider|APT41|Kimsuky|FIN13|Ember Bear|GALLIUM
-T1052,Exfiltration Over Physical Medium,Exfiltration,no
-T1105,Ingress Tool Transfer,Command And Control,Fox Kitten|BITTER|HAFNIUM|Cobalt Group|Cinnamon Tempest|BlackByte|Tropic Trooper|Scattered Spider|Lazarus Group|PLATINUM|Ke3chang|Whitefly|APT37|SideCopy|TA2541|Kimsuky|Turla|Gamaredon Group|Leviathan|menuPass|Molerats|APT29|Rocke|Sidewinder|Magic Hound|Aquatic Panda|APT38|LuminousMoth|Gorgon Group|APT39|APT28|Threat Group-3390|Rancor|FIN13|Medusa Group|MuddyWater|APT18|TeamTNT|VOID MANTICORE|OilRig|Storm-1811|Daggerfly|Play|LazyScripter|APT32|Silence|Confucius|APT33|Wizard Spider|Volatile Cedar|Evilnum|Moonstone Sleet|FIN7|Winter Vivern|TA505|APT41|Nomadic Octopus|BackdoorDiplomacy|HEXANE|Winnti Group|APT-C-36|FIN8|Windshift|TA551|Mustang Panda|Dragonfly|Moses Staff|Darkhotel|Volt Typhoon|WIRTE|BRONZE BUTLER|Indrik Spider|Patchwork|ZIRCONIUM|INC Ransom|GALLIUM|Metador|Sandworm Team|Mustard Tempest|Andariel|Ajax Security Team|Elderwood|APT3|Chimera|Tonto Team|IndigoZebra
-T1216.002,SyncAppvPublishingServer,Stealth,no
-T1098.002,Additional Email Delegate Permissions,Persistence|Privilege Escalation,Magic Hound|APT28|APT29
-T1588.003,Code Signing Certificates,Resource Development,Wizard Spider|OilRig|BlackTech|FIN8|Mustang Panda|Threat Group-3390|Kimsuky
-T1648,Serverless Execution,Execution,no
-T1548.006,TCC Manipulation,Privilege Escalation,no
-T1027.018,Invisible Unicode,Stealth,no
-T1055.008,Ptrace System Calls,Stealth|Privilege Escalation,no
-T1653,Power Settings,Persistence,no
-T1027.007,Dynamic API Resolution,Stealth,Mustang Panda|Kimsuky|Lazarus Group
-T1021.001,Remote Desktop Protocol,Lateral Movement,Kimsuky|INC Ransom|Volt Typhoon|APT5|OilRig|Patchwork|FIN8|MirrorFace|BlackByte|APT39|Magic Hound|Wizard Spider|Aquatic Panda|FIN7|Indrik Spider|Silence|HEXANE|Axiom|Cobalt Group|Akira|Agrius|FIN6|FIN10|FIN13|Blue Mockingbird|Scattered Spider|menuPass|Lazarus Group|APT3|Fox Kitten|Leviathan|Dragonfly|APT41|Chimera|Medusa Group|APT1|VOID MANTICORE
-T1037.001,Logon Script (Windows),Persistence|Privilege Escalation,APT28|Cobalt Group
-T1055.015,ListPlanting,Stealth|Privilege Escalation,no
-T1665,Hide Infrastructure,Command And Control,ZIRCONIUM|APT29
-T1484,Domain or Tenant Policy Modification,Defense Impairment|Privilege Escalation,no
-T1220,XSL Script Processing,Stealth,Cobalt Group|Higaisa
-T1596.005,Scan Databases,Reconnaissance,APT41|Volt Typhoon
-T1564.001,Hidden Files and Directories,Stealth,APT28|RedCurl|LuminousMoth|Lazarus Group|Mustang Panda|Tropic Trooper|FIN7|Rocke|FIN13|Transparent Tribe|HAFNIUM|APT32
-T1578.001,Create Snapshot,Defense Impairment,no
-T1591.001,Determine Physical Locations,Reconnaissance,Magic Hound
-T1137.002,Office Test,Persistence,APT28
-T1587,Develop Capabilities,Resource Development,Kimsuky|Contagious Interview|Moonstone Sleet
-T1003.003,NTDS,Credential Access,APT28|Scattered Spider|Sandworm Team|FIN13|FIN6|Volt Typhoon|menuPass|Chimera|Fox Kitten|Medusa Group|Wizard Spider|Dragonfly|APT41|Mustang Panda|Ke3chang|HAFNIUM|LAPSUS$|MirrorFace
-T1686.001,Cloud Firewall,Defense Impairment,no
-T1602.001,SNMP (MIB Dump),Collection,no
-T1686,Disable or Modify System Firewall,Defense Impairment,TeamTNT|ToddyCat|BlackByte|Velvet Ant|Medusa Group|APT38|FIN7|Dragonfly|Kimsuky|Rocke|Salt Typhoon|Carbanak|UNC3886
-T1001.002,Steganography,Command And Control,Axiom
-T1204.001,Malicious Link,Execution,FIN7|BlackTech|Mustang Panda|Molerats|Windshift|Kimsuky|LazyScripter|Confucius|Saint Bear|WIRTE|APT38|FIN8|TA2541|APT29|Patchwork|APT3|Evilnum|TA505|LuminousMoth|Magic Hound|APT39|APT32|Mofang|FIN4|RedCurl|Sandworm Team|Elderwood|Turla|TA578|Daggerfly|OilRig|Gamaredon Group|EXOTIC LILY|APT-C-36|Cobalt Group|ZIRCONIUM|Transparent Tribe|MuddyWater|Contagious Interview|Wizard Spider|Machete|Mustard Tempest|Sidewinder|APT28|TA577|Winter Vivern|APT33|Leviathan|Earth Lusca
-T1550.001,Application Access Token,Lateral Movement,APT28|HAFNIUM
-T1547.008,LSASS Driver,Persistence|Privilege Escalation,no
-T1569.002,Service Execution,Execution,Chimera|APT39|FIN7|INC Ransom|Velvet Ant|APT41|Silence|Ke3chang|Medusa Group|Blue Mockingbird|APT32|BlackByte|FIN6|Moonstone Sleet|APT38|Wizard Spider
-T1078.004,Cloud Accounts,Stealth|Persistence|Privilege Escalation|Initial Access,APT29|APT5|APT28|Storm-0501|VOID MANTICORE|HAFNIUM|Scattered Spider|APT33|LAPSUS$|Ke3chang
-T1480.001,Environmental Keying,Stealth,Equation|APT41
-T1008,Fallback Channels,Command And Control,OilRig|APT41|Lazarus Group|FIN7|UNC3886
-T1680,Local Storage Discovery,Discovery,TeamTNT|Volt Typhoon|Confucius|Tropic Trooper|Lazarus Group|Higaisa|Patchwork|Chimera|ToddyCat|Kimsuky
-T1564.004,NTFS File Attributes,Stealth,APT32
-T1558.003,Kerberoasting,Credential Access,Wizard Spider|FIN7|Indrik Spider
-T1003.006,DCSync,Credential Access,Earth Lusca|Mustang Panda|Storm-0501|LAPSUS$
-T1124,System Time Discovery,Discovery,Sidewinder|Volt Typhoon|Higaisa|ZIRCONIUM|BRONZE BUTLER|CURIUM|Turla|Darkhotel|Chimera|FIN7|UNC3886|Lazarus Group|The White Company|Kimsuky
-T1053.002,At,Execution|Persistence|Privilege Escalation,Threat Group-3390|APT18|BRONZE BUTLER
-T1055.001,Dynamic-link Library Injection,Stealth|Privilege Escalation,Turla|Malteiro|BackdoorDiplomacy|Leviathan|Putter Panda|Kimsuky|Lazarus Group|Tropic Trooper|TA505|Wizard Spider
-T1588.005,Exploits,Resource Development,Ember Bear|Kimsuky
-T1556,Modify Authentication Process,Defense Impairment|Persistence|Credential Access,FIN13
-T1546.017,Udev Rules,Persistence|Privilege Escalation,no
-T1056.004,Credential API Hooking,Collection|Credential Access,PLATINUM
-T1495,Firmware Corruption,Impact,no
-T1490,Inhibit System Recovery,Impact,Medusa Group|Storm-0501|VOID MANTICORE|Wizard Spider|BlackByte|Scattered Spider|Sandworm Team
-T1546.007,Netsh Helper DLL,Privilege Escalation|Persistence,no
-T1566.003,Spearphishing via Service,Initial Access,CURIUM|Windshift|Ajax Security Team|EXOTIC LILY|Contagious Interview|ToddyCat|FIN6|APT29|OilRig|Dark Caracal|Lazarus Group|Storm-1811|Magic Hound|Moonstone Sleet
-T1090.001,Internal Proxy,Command And Control,Velvet Ant|FIN13|Higaisa|Lotus Blossom|Strider|Volt Typhoon|Turla|Lazarus Group|APT39
-T1216,System Script Proxy Execution,Stealth,no
-T1102.001,Dead Drop Resolver,Command And Control,Rocke|APT41|RTM|BRONZE BUTLER|Kimsuky|Patchwork
-T1001.001,Junk Data,Command And Control,APT28
-T1598.001,Spearphishing Service,Reconnaissance,no
-T1505.006,vSphere Installation Bundles,Persistence,UNC3886
-T1552.007,Container API,Credential Access,no
-T1584.001,Domains,Resource Development,Magic Hound|SideCopy|Transparent Tribe|Mustard Tempest|Kimsuky|APT1
-T1505.001,SQL Stored Procedures,Persistence,no
-T1556.004,Network Device Authentication,Defense Impairment|Persistence|Credential Access,no
-T1561.001,Disk Content Wipe,Impact,VOID MANTICORE|Lazarus Group|Gamaredon Group
-T1213.005,Messaging Applications,Collection,Fox Kitten|Scattered Spider|LAPSUS$
-T1048.003,Exfiltration Over Unencrypted Non-C2 Protocol,Exfiltration,Lazarus Group|FIN8|Thrip|APT32|Salt Typhoon|Mustang Panda|Contagious Interview|Wizard Spider|OilRig|APT33|FIN6
-T1027.015,Compression,Stealth,Molerats|Threat Group-3390|VOID MANTICORE|Gamaredon Group|Higaisa|TA2541|Mofang|Kimsuky|WIRTE|Leviathan
-T1574.004,Dylib Hijacking,Stealth|Execution,no
-T1601.002,Downgrade System Image,Defense Impairment,no
-T1684.002,Email Spoofing,Stealth,no
-T1078.003,Local Accounts,Stealth|Persistence|Privilege Escalation|Initial Access,Kimsuky|PROMETHIUM|FIN10|Play|APT32|Sea Turtle|Tropic Trooper|HAFNIUM|FIN7|Velvet Ant|APT29|Turla
-T1669,Wi-Fi Networks,Initial Access,APT28
-T1211,Exploitation for Stealth,Stealth,Velvet Ant|APT28
-T1127,Trusted Developer Utilities Proxy Execution,Stealth|Execution,no
-T1529,System Shutdown/Reboot,Impact,APT38|APT37|Lazarus Group|Medusa Group
-T1218.014,MMC,Stealth,Medusa Group
-T1564.010,Process Argument Spoofing,Stealth,no
-T1574.012,COR_PROFILER,Stealth|Execution,Blue Mockingbird