assets/MaesterAttackTechniques.json
|
{ "Source": "MITRE ATT&CK Enterprise", "Version": "19.2", "Modified": "2026-08-05", "Url": "https://attack.mitre.org/versions/v19/", "License": "(c) 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK is licensed under the terms at https://attack.mitre.org/resources/legal-and-branding/terms-of-use/.", "Note": "Trimmed copy: technique and tactic identifiers and names only. Regenerate with build/attack/Update-MtAttackTechniques.ps1 when the pinned version changes.", "Tactics": [ {"Id": "TA0001", "Name": "Initial Access"}, {"Id": "TA0002", "Name": "Execution"}, {"Id": "TA0003", "Name": "Persistence"}, {"Id": "TA0004", "Name": "Privilege Escalation"}, {"Id": "TA0005", "Name": "Stealth"}, {"Id": "TA0006", "Name": "Credential Access"}, {"Id": "TA0007", "Name": "Discovery"}, {"Id": "TA0008", "Name": "Lateral Movement"}, {"Id": "TA0009", "Name": "Collection"}, {"Id": "TA0010", "Name": "Exfiltration"}, {"Id": "TA0011", "Name": "Command and Control"}, {"Id": "TA0040", "Name": "Impact"}, {"Id": "TA0042", "Name": "Resource Development"}, {"Id": "TA0043", "Name": "Reconnaissance"}, {"Id": "TA0112", "Name": "Defense Impairment"} ], "Techniques": [ {"Id": "T1001", "Name": "Data Obfuscation", "Tactics": ["TA0011"]}, {"Id": "T1001.001", "Name": "Junk Data", "Tactics": ["TA0011"]}, {"Id": "T1001.002", "Name": "Steganography", "Tactics": ["TA0011"]}, {"Id": "T1001.003", "Name": "Protocol or Service Impersonation", "Tactics": ["TA0011"]}, {"Id": "T1003", "Name": "OS Credential Dumping", "Tactics": ["TA0006"]}, {"Id": "T1003.001", "Name": "LSASS Memory", "Tactics": ["TA0006"]}, {"Id": "T1003.002", "Name": "Security Account Manager", "Tactics": ["TA0006"]}, {"Id": "T1003.003", "Name": "NTDS", "Tactics": ["TA0006"]}, {"Id": "T1003.004", "Name": "LSA Secrets", "Tactics": ["TA0006"]}, {"Id": "T1003.005", "Name": "Cached Domain Credentials", "Tactics": ["TA0006"]}, {"Id": "T1003.006", "Name": "DCSync", "Tactics": ["TA0006"]}, {"Id": "T1003.007", "Name": "Proc Filesystem", "Tactics": ["TA0006"]}, {"Id": "T1003.008", "Name": "/etc/passwd and /etc/shadow", "Tactics": ["TA0006"]}, {"Id": "T1005", "Name": "Data from Local System", "Tactics": ["TA0009"]}, {"Id": "T1006", "Name": "Direct Volume Access", "Tactics": ["TA0005"]}, {"Id": "T1007", "Name": "System Service Discovery", "Tactics": ["TA0007"]}, {"Id": "T1008", "Name": "Fallback Channels", "Tactics": ["TA0011"]}, {"Id": "T1010", "Name": "Application Window Discovery", "Tactics": ["TA0007"]}, {"Id": "T1011", "Name": "Exfiltration Over Other Network Medium", "Tactics": ["TA0010"]}, {"Id": "T1011.001", "Name": "Exfiltration Over Bluetooth", "Tactics": ["TA0010"]}, {"Id": "T1012", "Name": "Query Registry", "Tactics": ["TA0007"]}, {"Id": "T1014", "Name": "Rootkit", "Tactics": ["TA0005"]}, {"Id": "T1016", "Name": "System Network Configuration Discovery", "Tactics": ["TA0007"]}, {"Id": "T1016.001", "Name": "Internet Connection Discovery", "Tactics": ["TA0007"]}, {"Id": "T1016.002", "Name": "Wi-Fi Discovery", "Tactics": ["TA0007"]}, {"Id": "T1018", "Name": "Remote System Discovery", "Tactics": ["TA0007"]}, {"Id": "T1020", "Name": "Automated Exfiltration", "Tactics": ["TA0010"]}, {"Id": "T1020.001", "Name": "Traffic Duplication", "Tactics": ["TA0010"]}, {"Id": "T1021", "Name": "Remote Services", "Tactics": ["TA0008"]}, {"Id": "T1021.001", "Name": "Remote Desktop Protocol", "Tactics": ["TA0008"]}, {"Id": "T1021.002", "Name": "SMB/Windows Admin Shares", "Tactics": ["TA0008"]}, {"Id": "T1021.003", "Name": "Distributed Component Object Model", "Tactics": ["TA0008"]}, {"Id": "T1021.004", "Name": "SSH", "Tactics": ["TA0008"]}, {"Id": "T1021.005", "Name": "VNC", "Tactics": ["TA0008"]}, {"Id": "T1021.006", "Name": "Windows Remote Management", "Tactics": ["TA0008"]}, {"Id": "T1021.007", "Name": "Cloud Services", "Tactics": ["TA0008"]}, {"Id": "T1021.008", "Name": "Direct Cloud VM Connections", "Tactics": ["TA0008"]}, {"Id": "T1025", "Name": "Data from Removable Media", "Tactics": ["TA0009"]}, {"Id": "T1027", "Name": "Obfuscated Files or Information", "Tactics": ["TA0005"]}, {"Id": "T1027.001", "Name": "Binary Padding", "Tactics": ["TA0005"]}, {"Id": "T1027.002", "Name": "Software Packing", "Tactics": ["TA0005"]}, {"Id": "T1027.003", "Name": "Steganography", "Tactics": ["TA0005"]}, {"Id": "T1027.004", "Name": "Compile After Delivery", "Tactics": ["TA0005"]}, {"Id": "T1027.005", "Name": "Indicator Removal from Tools", "Tactics": ["TA0005"]}, {"Id": "T1027.006", "Name": "HTML Smuggling", "Tactics": ["TA0005"]}, {"Id": "T1027.007", "Name": "Dynamic API Resolution", "Tactics": ["TA0005"]}, {"Id": "T1027.008", "Name": "Stripped Payloads", "Tactics": ["TA0005"]}, {"Id": "T1027.009", "Name": "Embedded Payloads", "Tactics": ["TA0005"]}, {"Id": "T1027.010", "Name": "Command Obfuscation", "Tactics": ["TA0005"]}, {"Id": "T1027.011", "Name": "Fileless Storage", "Tactics": ["TA0005"]}, {"Id": "T1027.012", "Name": "LNK Icon Smuggling", "Tactics": ["TA0005"]}, {"Id": "T1027.013", "Name": "Encrypted/Encoded File", "Tactics": ["TA0005"]}, {"Id": "T1027.014", "Name": "Polymorphic Code", "Tactics": ["TA0005"]}, {"Id": "T1027.015", "Name": "Compression", "Tactics": ["TA0005"]}, {"Id": "T1027.016", "Name": "Junk Code Insertion", "Tactics": ["TA0005"]}, {"Id": "T1027.017", "Name": "SVG Smuggling", "Tactics": ["TA0005"]}, {"Id": "T1027.018", "Name": "Invisible Unicode", "Tactics": ["TA0005"]}, {"Id": "T1029", "Name": "Scheduled Transfer", "Tactics": ["TA0010"]}, {"Id": "T1030", "Name": "Data Transfer Size Limits", "Tactics": ["TA0010"]}, {"Id": "T1033", "Name": "System Owner/User Discovery", "Tactics": ["TA0007"]}, {"Id": "T1036", "Name": "Masquerading", "Tactics": ["TA0005"]}, {"Id": "T1036.001", "Name": "Invalid Code Signature", "Tactics": ["TA0005"]}, {"Id": "T1036.002", "Name": "Right-to-Left Override", "Tactics": ["TA0005"]}, {"Id": "T1036.003", "Name": "Rename Legitimate Utilities", "Tactics": ["TA0005"]}, {"Id": "T1036.004", "Name": "Masquerade Task or Service", "Tactics": ["TA0005"]}, {"Id": "T1036.005", "Name": "Match Legitimate Resource Name or Location", "Tactics": ["TA0005"]}, {"Id": "T1036.006", "Name": "Space after Filename", "Tactics": ["TA0005"]}, {"Id": "T1036.007", "Name": "Double File Extension", "Tactics": ["TA0005"]}, {"Id": "T1036.008", "Name": "Masquerade File Type", "Tactics": ["TA0005"]}, {"Id": "T1036.009", "Name": "Break Process Trees", "Tactics": ["TA0005"]}, {"Id": "T1036.010", "Name": "Masquerade Account Name", "Tactics": ["TA0005"]}, {"Id": "T1036.011", "Name": "Overwrite Process Arguments", "Tactics": ["TA0005"]}, {"Id": "T1036.012", "Name": "Browser Fingerprint", "Tactics": ["TA0005"]}, {"Id": "T1037", "Name": "Boot or Logon Initialization Scripts", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1037.001", "Name": "Logon Script (Windows)", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1037.002", "Name": "Login Hook", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1037.003", "Name": "Network Logon Script", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1037.004", "Name": "RC Scripts", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1037.005", "Name": "Startup Items", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1039", "Name": "Data from Network Shared Drive", "Tactics": ["TA0009"]}, {"Id": "T1040", "Name": "Network Sniffing", "Tactics": ["TA0006", "TA0007"]}, {"Id": "T1041", "Name": "Exfiltration Over C2 Channel", "Tactics": ["TA0010"]}, {"Id": "T1046", "Name": "Network Service Discovery", "Tactics": ["TA0007"]}, {"Id": "T1047", "Name": "Windows Management Instrumentation", "Tactics": ["TA0002"]}, {"Id": "T1048", "Name": "Exfiltration Over Alternative Protocol", "Tactics": ["TA0010"]}, {"Id": "T1048.001", "Name": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol", "Tactics": ["TA0010"]}, {"Id": "T1048.002", "Name": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol", "Tactics": ["TA0010"]}, {"Id": "T1048.003", "Name": "Exfiltration Over Unencrypted Non-C2 Protocol", "Tactics": ["TA0010"]}, {"Id": "T1049", "Name": "System Network Connections Discovery", "Tactics": ["TA0007"]}, {"Id": "T1052", "Name": "Exfiltration Over Physical Medium", "Tactics": ["TA0010"]}, {"Id": "T1052.001", "Name": "Exfiltration over USB", "Tactics": ["TA0010"]}, {"Id": "T1053", "Name": "Scheduled Task/Job", "Tactics": ["TA0002", "TA0003", "TA0004"]}, {"Id": "T1053.002", "Name": "At", "Tactics": ["TA0002", "TA0003", "TA0004"]}, {"Id": "T1053.003", "Name": "Cron", "Tactics": ["TA0002", "TA0003", "TA0004"]}, {"Id": "T1053.005", "Name": "Scheduled Task", "Tactics": ["TA0002", "TA0003", "TA0004"]}, {"Id": "T1053.006", "Name": "Systemd Timers", "Tactics": ["TA0002", "TA0003", "TA0004"]}, {"Id": "T1053.007", "Name": "Container Orchestration Job", "Tactics": ["TA0002", "TA0003", "TA0004"]}, {"Id": "T1055", "Name": "Process Injection", "Tactics": ["TA0005", "TA0004"]}, {"Id": "T1055.001", "Name": "Dynamic-link Library Injection", "Tactics": ["TA0005", "TA0004"]}, {"Id": "T1055.002", "Name": "Portable Executable Injection", "Tactics": ["TA0005", "TA0004"]}, {"Id": "T1055.003", "Name": "Thread Execution Hijacking", "Tactics": ["TA0005", "TA0004"]}, {"Id": "T1055.004", "Name": "Asynchronous Procedure Call", "Tactics": ["TA0005", "TA0004"]}, {"Id": "T1055.005", "Name": "Thread Local Storage", "Tactics": ["TA0005", "TA0004"]}, {"Id": "T1055.008", "Name": "Ptrace System Calls", "Tactics": ["TA0005", "TA0004"]}, {"Id": "T1055.009", "Name": "Proc Memory", "Tactics": ["TA0005", "TA0004"]}, {"Id": "T1055.011", "Name": "Extra Window Memory Injection", "Tactics": ["TA0005", "TA0004"]}, {"Id": "T1055.012", "Name": "Process Hollowing", "Tactics": ["TA0005", "TA0004"]}, {"Id": "T1055.013", "Name": "Process Doppelgänging", "Tactics": ["TA0005", "TA0004"]}, {"Id": "T1055.014", "Name": "VDSO Hijacking", "Tactics": ["TA0005", "TA0004"]}, {"Id": "T1055.015", "Name": "ListPlanting", "Tactics": ["TA0005", "TA0004"]}, {"Id": "T1056", "Name": "Input Capture", "Tactics": ["TA0009", "TA0006"]}, {"Id": "T1056.001", "Name": "Keylogging", "Tactics": ["TA0009", "TA0006"]}, {"Id": "T1056.002", "Name": "GUI Input Capture", "Tactics": ["TA0009", "TA0006"]}, {"Id": "T1056.003", "Name": "Web Portal Capture", "Tactics": ["TA0009", "TA0006"]}, {"Id": "T1056.004", "Name": "Credential API Hooking", "Tactics": ["TA0009", "TA0006"]}, {"Id": "T1057", "Name": "Process Discovery", "Tactics": ["TA0007"]}, {"Id": "T1059", "Name": "Command and Scripting Interpreter", "Tactics": ["TA0002"]}, {"Id": "T1059.001", "Name": "PowerShell", "Tactics": ["TA0002"]}, {"Id": "T1059.002", "Name": "AppleScript", "Tactics": ["TA0002"]}, {"Id": "T1059.003", "Name": "Windows Command Shell", "Tactics": ["TA0002"]}, {"Id": "T1059.004", "Name": "Unix Shell", "Tactics": ["TA0002"]}, {"Id": "T1059.005", "Name": "Visual Basic", "Tactics": ["TA0002"]}, {"Id": "T1059.006", "Name": "Python", "Tactics": ["TA0002"]}, {"Id": "T1059.007", "Name": "JavaScript", "Tactics": ["TA0002"]}, {"Id": "T1059.008", "Name": "Network Device CLI", "Tactics": ["TA0002"]}, {"Id": "T1059.009", "Name": "Cloud API", "Tactics": ["TA0002"]}, {"Id": "T1059.010", "Name": "AutoHotKey & AutoIT", "Tactics": ["TA0002"]}, {"Id": "T1059.011", "Name": "Lua", "Tactics": ["TA0002"]}, {"Id": "T1059.012", "Name": "Hypervisor CLI", "Tactics": ["TA0002"]}, {"Id": "T1059.013", "Name": "Container CLI/API", "Tactics": ["TA0002"]}, {"Id": "T1068", "Name": "Exploitation for Privilege Escalation", "Tactics": ["TA0004"]}, {"Id": "T1069", "Name": "Permission Groups Discovery", "Tactics": ["TA0007"]}, {"Id": "T1069.001", "Name": "Local Groups", "Tactics": ["TA0007"]}, {"Id": "T1069.002", "Name": "Domain Groups", "Tactics": ["TA0007"]}, {"Id": "T1069.003", "Name": "Cloud Groups", "Tactics": ["TA0007"]}, {"Id": "T1070", "Name": "Indicator Removal", "Tactics": ["TA0005"]}, {"Id": "T1070.003", "Name": "Clear Command History", "Tactics": ["TA0005"]}, {"Id": "T1070.004", "Name": "File Deletion", "Tactics": ["TA0005"]}, {"Id": "T1070.005", "Name": "Network Share Connection Removal", "Tactics": ["TA0005"]}, {"Id": "T1070.006", "Name": "Timestomp", "Tactics": ["TA0005"]}, {"Id": "T1070.007", "Name": "Clear Network Connection History and Configurations", "Tactics": ["TA0005"]}, {"Id": "T1070.008", "Name": "Clear Mailbox Data", "Tactics": ["TA0005"]}, {"Id": "T1070.009", "Name": "Clear Persistence", "Tactics": ["TA0005"]}, {"Id": "T1070.010", "Name": "Relocate Malware", "Tactics": ["TA0005"]}, {"Id": "T1071", "Name": "Application Layer Protocol", "Tactics": ["TA0011"]}, {"Id": "T1071.001", "Name": "Web Protocols", "Tactics": ["TA0011"]}, {"Id": "T1071.002", "Name": "File Transfer Protocols", "Tactics": ["TA0011"]}, {"Id": "T1071.003", "Name": "Mail Protocols", "Tactics": ["TA0011"]}, {"Id": "T1071.004", "Name": "DNS", "Tactics": ["TA0011"]}, {"Id": "T1071.005", "Name": "Publish/Subscribe Protocols", "Tactics": ["TA0011"]}, {"Id": "T1072", "Name": "Software Deployment Tools", "Tactics": ["TA0002", "TA0008"]}, {"Id": "T1074", "Name": "Data Staged", "Tactics": ["TA0009"]}, {"Id": "T1074.001", "Name": "Local Data Staging", "Tactics": ["TA0009"]}, {"Id": "T1074.002", "Name": "Remote Data Staging", "Tactics": ["TA0009"]}, {"Id": "T1078", "Name": "Valid Accounts", "Tactics": ["TA0005", "TA0003", "TA0004", "TA0001"]}, {"Id": "T1078.001", "Name": "Default Accounts", "Tactics": ["TA0005", "TA0003", "TA0004", "TA0001"]}, {"Id": "T1078.002", "Name": "Domain Accounts", "Tactics": ["TA0005", "TA0003", "TA0004", "TA0001"]}, {"Id": "T1078.003", "Name": "Local Accounts", "Tactics": ["TA0005", "TA0003", "TA0004", "TA0001"]}, {"Id": "T1078.004", "Name": "Cloud Accounts", "Tactics": ["TA0005", "TA0003", "TA0004", "TA0001"]}, {"Id": "T1080", "Name": "Taint Shared Content", "Tactics": ["TA0008"]}, {"Id": "T1082", "Name": "System Information Discovery", "Tactics": ["TA0007"]}, {"Id": "T1083", "Name": "File and Directory Discovery", "Tactics": ["TA0007"]}, {"Id": "T1087", "Name": "Account Discovery", "Tactics": ["TA0007"]}, {"Id": "T1087.001", "Name": "Local Account", "Tactics": ["TA0007"]}, {"Id": "T1087.002", "Name": "Domain Account", "Tactics": ["TA0007"]}, {"Id": "T1087.003", "Name": "Email Account", "Tactics": ["TA0007"]}, {"Id": "T1087.004", "Name": "Cloud Account", "Tactics": ["TA0007"]}, {"Id": "T1090", "Name": "Proxy", "Tactics": ["TA0011"]}, {"Id": "T1090.001", "Name": "Internal Proxy", "Tactics": ["TA0011"]}, {"Id": "T1090.002", "Name": "External Proxy", "Tactics": ["TA0011"]}, {"Id": "T1090.003", "Name": "Multi-hop Proxy", "Tactics": ["TA0011"]}, {"Id": "T1090.004", "Name": "Domain Fronting", "Tactics": ["TA0011"]}, {"Id": "T1091", "Name": "Replication Through Removable Media", "Tactics": ["TA0008", "TA0001"]}, {"Id": "T1092", "Name": "Communication Through Removable Media", "Tactics": ["TA0011"]}, {"Id": "T1095", "Name": "Non-Application Layer Protocol", "Tactics": ["TA0011"]}, {"Id": "T1098", "Name": "Account Manipulation", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1098.001", "Name": "Additional Cloud Credentials", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1098.002", "Name": "Additional Email Delegate Permissions", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1098.003", "Name": "Additional Cloud Roles", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1098.004", "Name": "SSH Authorized Keys", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1098.005", "Name": "Device Registration", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1098.006", "Name": "Additional Container Cluster Roles", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1098.007", "Name": "Additional Local or Domain Groups", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1102", "Name": "Web Service", "Tactics": ["TA0011"]}, {"Id": "T1102.001", "Name": "Dead Drop Resolver", "Tactics": ["TA0011"]}, {"Id": "T1102.002", "Name": "Bidirectional Communication", "Tactics": ["TA0011"]}, {"Id": "T1102.003", "Name": "One-Way Communication", "Tactics": ["TA0011"]}, {"Id": "T1104", "Name": "Multi-Stage Channels", "Tactics": ["TA0011"]}, {"Id": "T1105", "Name": "Ingress Tool Transfer", "Tactics": ["TA0011"]}, {"Id": "T1106", "Name": "Native API", "Tactics": ["TA0002"]}, {"Id": "T1110", "Name": "Brute Force", "Tactics": ["TA0006"]}, {"Id": "T1110.001", "Name": "Password Guessing", "Tactics": ["TA0006"]}, {"Id": "T1110.002", "Name": "Password Cracking", "Tactics": ["TA0006"]}, {"Id": "T1110.003", "Name": "Password Spraying", "Tactics": ["TA0006"]}, {"Id": "T1110.004", "Name": "Credential Stuffing", "Tactics": ["TA0006"]}, {"Id": "T1111", "Name": "Multi-Factor Authentication Interception", "Tactics": ["TA0006"]}, {"Id": "T1112", "Name": "Modify Registry", "Tactics": ["TA0112", "TA0003"]}, {"Id": "T1113", "Name": "Screen Capture", "Tactics": ["TA0009"]}, {"Id": "T1114", "Name": "Email Collection", "Tactics": ["TA0009"]}, {"Id": "T1114.001", "Name": "Local Email Collection", "Tactics": ["TA0009"]}, {"Id": "T1114.002", "Name": "Remote Email Collection", "Tactics": ["TA0009"]}, {"Id": "T1114.003", "Name": "Email Forwarding Rule", "Tactics": ["TA0009"]}, {"Id": "T1115", "Name": "Clipboard Data", "Tactics": ["TA0009"]}, {"Id": "T1119", "Name": "Automated Collection", "Tactics": ["TA0009"]}, {"Id": "T1120", "Name": "Peripheral Device Discovery", "Tactics": ["TA0007"]}, {"Id": "T1123", "Name": "Audio Capture", "Tactics": ["TA0009"]}, {"Id": "T1124", "Name": "System Time Discovery", "Tactics": ["TA0007"]}, {"Id": "T1125", "Name": "Video Capture", "Tactics": ["TA0009"]}, {"Id": "T1127", "Name": "Trusted Developer Utilities Proxy Execution", "Tactics": ["TA0005", "TA0002"]}, {"Id": "T1127.001", "Name": "MSBuild", "Tactics": ["TA0005", "TA0002"]}, {"Id": "T1127.002", "Name": "ClickOnce", "Tactics": ["TA0005", "TA0002"]}, {"Id": "T1127.003", "Name": "JamPlus", "Tactics": ["TA0005", "TA0002"]}, {"Id": "T1129", "Name": "Shared Modules", "Tactics": ["TA0002"]}, {"Id": "T1132", "Name": "Data Encoding", "Tactics": ["TA0011"]}, {"Id": "T1132.001", "Name": "Standard Encoding", "Tactics": ["TA0011"]}, {"Id": "T1132.002", "Name": "Non-Standard Encoding", "Tactics": ["TA0011"]}, {"Id": "T1133", "Name": "External Remote Services", "Tactics": ["TA0003", "TA0001"]}, {"Id": "T1134", "Name": "Access Token Manipulation", "Tactics": ["TA0005", "TA0004"]}, {"Id": "T1134.001", "Name": "Token Impersonation/Theft", "Tactics": ["TA0005", "TA0004"]}, {"Id": "T1134.002", "Name": "Create Process with Token", "Tactics": ["TA0005", "TA0004"]}, {"Id": "T1134.003", "Name": "Make and Impersonate Token", "Tactics": ["TA0005", "TA0004"]}, {"Id": "T1134.004", "Name": "Parent PID Spoofing", "Tactics": ["TA0005", "TA0004"]}, {"Id": "T1134.005", "Name": "SID-History Injection", "Tactics": ["TA0005", "TA0004"]}, {"Id": "T1135", "Name": "Network Share Discovery", "Tactics": ["TA0007"]}, {"Id": "T1136", "Name": "Create Account", "Tactics": ["TA0003"]}, {"Id": "T1136.001", "Name": "Local Account", "Tactics": ["TA0003"]}, {"Id": "T1136.002", "Name": "Domain Account", "Tactics": ["TA0003"]}, {"Id": "T1136.003", "Name": "Cloud Account", "Tactics": ["TA0003"]}, {"Id": "T1137", "Name": "Office Application Startup", "Tactics": ["TA0003"]}, {"Id": "T1137.001", "Name": "Office Template Macros", "Tactics": ["TA0003"]}, {"Id": "T1137.002", "Name": "Office Test", "Tactics": ["TA0003"]}, {"Id": "T1137.003", "Name": "Outlook Forms", "Tactics": ["TA0003"]}, {"Id": "T1137.004", "Name": "Outlook Home Page", "Tactics": ["TA0003"]}, {"Id": "T1137.005", "Name": "Outlook Rules", "Tactics": ["TA0003"]}, {"Id": "T1137.006", "Name": "Add-ins", "Tactics": ["TA0003"]}, {"Id": "T1140", "Name": "Deobfuscate/Decode Files or Information", "Tactics": ["TA0005"]}, {"Id": "T1176", "Name": "Software Extensions", "Tactics": ["TA0003"]}, {"Id": "T1176.001", "Name": "Browser Extensions", "Tactics": ["TA0003"]}, {"Id": "T1176.002", "Name": "IDE Extensions", "Tactics": ["TA0003"]}, {"Id": "T1185", "Name": "Browser Session Hijacking", "Tactics": ["TA0009"]}, {"Id": "T1187", "Name": "Forced Authentication", "Tactics": ["TA0006"]}, {"Id": "T1189", "Name": "Drive-by Compromise", "Tactics": ["TA0001"]}, {"Id": "T1190", "Name": "Exploit Public-Facing Application", "Tactics": ["TA0001"]}, {"Id": "T1195", "Name": "Supply Chain Compromise", "Tactics": ["TA0001"]}, {"Id": "T1195.001", "Name": "Compromise Software Dependencies and Development Tools", "Tactics": ["TA0001"]}, {"Id": "T1195.002", "Name": "Compromise Software Supply Chain", "Tactics": ["TA0001"]}, {"Id": "T1195.003", "Name": "Compromise Hardware Supply Chain", "Tactics": ["TA0001"]}, {"Id": "T1197", "Name": "BITS Jobs", "Tactics": ["TA0005", "TA0003", "TA0002"]}, {"Id": "T1199", "Name": "Trusted Relationship", "Tactics": ["TA0001"]}, {"Id": "T1200", "Name": "Hardware Additions", "Tactics": ["TA0001"]}, {"Id": "T1201", "Name": "Password Policy Discovery", "Tactics": ["TA0007"]}, {"Id": "T1202", "Name": "Indirect Command Execution", "Tactics": ["TA0005"]}, {"Id": "T1203", "Name": "Exploitation for Client Execution", "Tactics": ["TA0002"]}, {"Id": "T1204", "Name": "User Execution", "Tactics": ["TA0002"]}, {"Id": "T1204.001", "Name": "Malicious Link", "Tactics": ["TA0002"]}, {"Id": "T1204.002", "Name": "Malicious File", "Tactics": ["TA0002"]}, {"Id": "T1204.003", "Name": "Malicious Image", "Tactics": ["TA0002"]}, {"Id": "T1204.004", "Name": "Malicious Copy and Paste", "Tactics": ["TA0002"]}, {"Id": "T1204.005", "Name": "Malicious Library", "Tactics": ["TA0002"]}, {"Id": "T1205", "Name": "Traffic Signaling", "Tactics": ["TA0005", "TA0003", "TA0011"]}, {"Id": "T1205.001", "Name": "Port Knocking", "Tactics": ["TA0005", "TA0003", "TA0011"]}, {"Id": "T1205.002", "Name": "Socket Filters", "Tactics": ["TA0005", "TA0003", "TA0011"]}, {"Id": "T1207", "Name": "Rogue Domain Controller", "Tactics": ["TA0112"]}, {"Id": "T1210", "Name": "Exploitation of Remote Services", "Tactics": ["TA0008"]}, {"Id": "T1211", "Name": "Exploitation for Stealth", "Tactics": ["TA0005"]}, {"Id": "T1212", "Name": "Exploitation for Credential Access", "Tactics": ["TA0006"]}, {"Id": "T1213", "Name": "Data from Information Repositories", "Tactics": ["TA0009"]}, {"Id": "T1213.001", "Name": "Confluence", "Tactics": ["TA0009"]}, {"Id": "T1213.002", "Name": "Sharepoint", "Tactics": ["TA0009"]}, {"Id": "T1213.003", "Name": "Code Repositories", "Tactics": ["TA0009"]}, {"Id": "T1213.004", "Name": "Customer Relationship Management Software", "Tactics": ["TA0009"]}, {"Id": "T1213.005", "Name": "Messaging Applications", "Tactics": ["TA0009"]}, {"Id": "T1213.006", "Name": "Databases", "Tactics": ["TA0009"]}, {"Id": "T1216", "Name": "System Script Proxy Execution", "Tactics": ["TA0005"]}, {"Id": "T1216.001", "Name": "PubPrn", "Tactics": ["TA0005"]}, {"Id": "T1216.002", "Name": "SyncAppvPublishingServer", "Tactics": ["TA0005"]}, {"Id": "T1217", "Name": "Browser Information Discovery", "Tactics": ["TA0007"]}, {"Id": "T1218", "Name": "System Binary Proxy Execution", "Tactics": ["TA0005"]}, {"Id": "T1218.001", "Name": "Compiled HTML File", "Tactics": ["TA0005"]}, {"Id": "T1218.002", "Name": "Control Panel", "Tactics": ["TA0005"]}, {"Id": "T1218.003", "Name": "CMSTP", "Tactics": ["TA0005"]}, {"Id": "T1218.004", "Name": "InstallUtil", "Tactics": ["TA0005"]}, {"Id": "T1218.005", "Name": "Mshta", "Tactics": ["TA0005"]}, {"Id": "T1218.007", "Name": "Msiexec", "Tactics": ["TA0005"]}, {"Id": "T1218.008", "Name": "Odbcconf", "Tactics": ["TA0005"]}, {"Id": "T1218.009", "Name": "Regsvcs/Regasm", "Tactics": ["TA0005"]}, {"Id": "T1218.010", "Name": "Regsvr32", "Tactics": ["TA0005"]}, {"Id": "T1218.011", "Name": "Rundll32", "Tactics": ["TA0005"]}, {"Id": "T1218.012", "Name": "Verclsid", "Tactics": ["TA0005"]}, {"Id": "T1218.013", "Name": "Mavinject", "Tactics": ["TA0005"]}, {"Id": "T1218.014", "Name": "MMC", "Tactics": ["TA0005"]}, {"Id": "T1218.015", "Name": "Electron Applications", "Tactics": ["TA0005"]}, {"Id": "T1219", "Name": "Remote Access Tools", "Tactics": ["TA0011"]}, {"Id": "T1219.001", "Name": "IDE Tunneling", "Tactics": ["TA0011"]}, {"Id": "T1219.002", "Name": "Remote Desktop Software", "Tactics": ["TA0011"]}, {"Id": "T1219.003", "Name": "Remote Access Hardware", "Tactics": ["TA0011"]}, {"Id": "T1220", "Name": "XSL Script Processing", "Tactics": ["TA0005"]}, {"Id": "T1221", "Name": "Template Injection", "Tactics": ["TA0005"]}, {"Id": "T1222", "Name": "File and Directory Permissions Modification", "Tactics": ["TA0112"]}, {"Id": "T1222.001", "Name": "Windows Permissions", "Tactics": ["TA0112"]}, {"Id": "T1222.002", "Name": "Linux and Mac Permissions", "Tactics": ["TA0112"]}, {"Id": "T1480", "Name": "Execution Guardrails", "Tactics": ["TA0005"]}, {"Id": "T1480.001", "Name": "Environmental Keying", "Tactics": ["TA0005"]}, {"Id": "T1480.002", "Name": "Mutual Exclusion", "Tactics": ["TA0005"]}, {"Id": "T1482", "Name": "Domain Trust Discovery", "Tactics": ["TA0007"]}, {"Id": "T1484", "Name": "Domain or Tenant Policy Modification", "Tactics": ["TA0112", "TA0004"]}, {"Id": "T1484.001", "Name": "Group Policy Modification", "Tactics": ["TA0112", "TA0004"]}, {"Id": "T1484.002", "Name": "Trust Modification", "Tactics": ["TA0112", "TA0004"]}, {"Id": "T1485", "Name": "Data Destruction", "Tactics": ["TA0040"]}, {"Id": "T1485.001", "Name": "Lifecycle-Triggered Deletion", "Tactics": ["TA0040"]}, {"Id": "T1486", "Name": "Data Encrypted for Impact", "Tactics": ["TA0040"]}, {"Id": "T1489", "Name": "Service Stop", "Tactics": ["TA0040"]}, {"Id": "T1490", "Name": "Inhibit System Recovery", "Tactics": ["TA0040"]}, {"Id": "T1491", "Name": "Defacement", "Tactics": ["TA0040"]}, {"Id": "T1491.001", "Name": "Internal Defacement", "Tactics": ["TA0040"]}, {"Id": "T1491.002", "Name": "External Defacement", "Tactics": ["TA0040"]}, {"Id": "T1495", "Name": "Firmware Corruption", "Tactics": ["TA0040"]}, {"Id": "T1496", "Name": "Resource Hijacking", "Tactics": ["TA0040"]}, {"Id": "T1496.001", "Name": "Compute Hijacking", "Tactics": ["TA0040"]}, {"Id": "T1496.002", "Name": "Bandwidth Hijacking", "Tactics": ["TA0040"]}, {"Id": "T1496.003", "Name": "SMS Pumping", "Tactics": ["TA0040"]}, {"Id": "T1496.004", "Name": "Cloud Service Hijacking", "Tactics": ["TA0040"]}, {"Id": "T1497", "Name": "Virtualization/Sandbox Evasion", "Tactics": ["TA0005", "TA0007"]}, {"Id": "T1497.001", "Name": "System Checks", "Tactics": ["TA0005", "TA0007"]}, {"Id": "T1497.002", "Name": "User Activity Based Checks", "Tactics": ["TA0005", "TA0007"]}, {"Id": "T1497.003", "Name": "Time Based Checks", "Tactics": ["TA0005", "TA0007"]}, {"Id": "T1498", "Name": "Network Denial of Service", "Tactics": ["TA0040"]}, {"Id": "T1498.001", "Name": "Direct Network Flood", "Tactics": ["TA0040"]}, {"Id": "T1498.002", "Name": "Reflection Amplification", "Tactics": ["TA0040"]}, {"Id": "T1499", "Name": "Endpoint Denial of Service", "Tactics": ["TA0040"]}, {"Id": "T1499.001", "Name": "OS Exhaustion Flood", "Tactics": ["TA0040"]}, {"Id": "T1499.002", "Name": "Service Exhaustion Flood", "Tactics": ["TA0040"]}, {"Id": "T1499.003", "Name": "Application Exhaustion Flood", "Tactics": ["TA0040"]}, {"Id": "T1499.004", "Name": "Application or System Exploitation", "Tactics": ["TA0040"]}, {"Id": "T1505", "Name": "Server Software Component", "Tactics": ["TA0003"]}, {"Id": "T1505.001", "Name": "SQL Stored Procedures", "Tactics": ["TA0003"]}, {"Id": "T1505.002", "Name": "Transport Agent", "Tactics": ["TA0003"]}, {"Id": "T1505.003", "Name": "Web Shell", "Tactics": ["TA0003"]}, {"Id": "T1505.004", "Name": "IIS Components", "Tactics": ["TA0003"]}, {"Id": "T1505.005", "Name": "Terminal Services DLL", "Tactics": ["TA0003"]}, {"Id": "T1505.006", "Name": "vSphere Installation Bundles", "Tactics": ["TA0003"]}, {"Id": "T1518", "Name": "Software Discovery", "Tactics": ["TA0007"]}, {"Id": "T1518.001", "Name": "Security Software Discovery", "Tactics": ["TA0007"]}, {"Id": "T1518.002", "Name": "Backup Software Discovery", "Tactics": ["TA0007"]}, {"Id": "T1525", "Name": "Implant Internal Image", "Tactics": ["TA0003"]}, {"Id": "T1526", "Name": "Cloud Service Discovery", "Tactics": ["TA0007"]}, {"Id": "T1528", "Name": "Steal Application Access Token", "Tactics": ["TA0006"]}, {"Id": "T1529", "Name": "System Shutdown/Reboot", "Tactics": ["TA0040"]}, {"Id": "T1530", "Name": "Data from Cloud Storage", "Tactics": ["TA0009"]}, {"Id": "T1531", "Name": "Account Access Removal", "Tactics": ["TA0040"]}, {"Id": "T1534", "Name": "Internal Spearphishing", "Tactics": ["TA0008"]}, {"Id": "T1535", "Name": "Unused/Unsupported Cloud Regions", "Tactics": ["TA0005"]}, {"Id": "T1537", "Name": "Transfer Data to Cloud Account", "Tactics": ["TA0010"]}, {"Id": "T1538", "Name": "Cloud Service Dashboard", "Tactics": ["TA0007"]}, {"Id": "T1539", "Name": "Steal Web Session Cookie", "Tactics": ["TA0006"]}, {"Id": "T1542", "Name": "Pre-OS Boot", "Tactics": ["TA0005", "TA0003"]}, {"Id": "T1542.001", "Name": "System Firmware", "Tactics": ["TA0005", "TA0003"]}, {"Id": "T1542.002", "Name": "Component Firmware", "Tactics": ["TA0005", "TA0003"]}, {"Id": "T1542.003", "Name": "Bootkit", "Tactics": ["TA0005", "TA0003"]}, {"Id": "T1542.004", "Name": "ROMMONkit", "Tactics": ["TA0005", "TA0003"]}, {"Id": "T1542.005", "Name": "TFTP Boot", "Tactics": ["TA0005", "TA0003"]}, {"Id": "T1543", "Name": "Create or Modify System Process", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1543.001", "Name": "Launch Agent", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1543.002", "Name": "Systemd Service", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1543.003", "Name": "Windows Service", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1543.004", "Name": "Launch Daemon", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1543.005", "Name": "Container Service", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1546", "Name": "Event Triggered Execution", "Tactics": ["TA0004", "TA0003"]}, {"Id": "T1546.001", "Name": "Change Default File Association", "Tactics": ["TA0004", "TA0003"]}, {"Id": "T1546.002", "Name": "Screensaver", "Tactics": ["TA0004", "TA0003"]}, {"Id": "T1546.003", "Name": "Windows Management Instrumentation Event Subscription", "Tactics": ["TA0004", "TA0003"]}, {"Id": "T1546.004", "Name": "Unix Shell Configuration Modification", "Tactics": ["TA0004", "TA0003"]}, {"Id": "T1546.005", "Name": "Trap", "Tactics": ["TA0004", "TA0003"]}, {"Id": "T1546.006", "Name": "LC_LOAD_DYLIB Addition", "Tactics": ["TA0004", "TA0003"]}, {"Id": "T1546.007", "Name": "Netsh Helper DLL", "Tactics": ["TA0004", "TA0003"]}, {"Id": "T1546.008", "Name": "Accessibility Features", "Tactics": ["TA0004", "TA0003"]}, {"Id": "T1546.009", "Name": "AppCert DLLs", "Tactics": ["TA0004", "TA0003"]}, {"Id": "T1546.010", "Name": "AppInit DLLs", "Tactics": ["TA0004", "TA0003"]}, {"Id": "T1546.011", "Name": "Application Shimming", "Tactics": ["TA0004", "TA0003"]}, {"Id": "T1546.012", "Name": "Image File Execution Options Injection", "Tactics": ["TA0004", "TA0003"]}, {"Id": "T1546.013", "Name": "PowerShell Profile", "Tactics": ["TA0004", "TA0003"]}, {"Id": "T1546.014", "Name": "Emond", "Tactics": ["TA0004", "TA0003"]}, {"Id": "T1546.015", "Name": "Component Object Model Hijacking", "Tactics": ["TA0004", "TA0003"]}, {"Id": "T1546.016", "Name": "Installer Packages", "Tactics": ["TA0004", "TA0003"]}, {"Id": "T1546.017", "Name": "Udev Rules", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1546.018", "Name": "Python Startup Hooks", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1547", "Name": "Boot or Logon Autostart Execution", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1547.001", "Name": "Registry Run Keys / Startup Folder", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1547.002", "Name": "Authentication Package", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1547.003", "Name": "Time Providers", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1547.004", "Name": "Winlogon Helper DLL", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1547.005", "Name": "Security Support Provider", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1547.006", "Name": "Kernel Modules and Extensions", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1547.007", "Name": "Re-opened Applications", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1547.008", "Name": "LSASS Driver", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1547.009", "Name": "Shortcut Modification", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1547.010", "Name": "Port Monitors", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1547.012", "Name": "Print Processors", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1547.013", "Name": "XDG Autostart Entries", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1547.014", "Name": "Active Setup", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1547.015", "Name": "Login Items", "Tactics": ["TA0003", "TA0004"]}, {"Id": "T1548", "Name": "Abuse Elevation Control Mechanism", "Tactics": ["TA0004"]}, {"Id": "T1548.001", "Name": "Setuid and Setgid", "Tactics": ["TA0004"]}, {"Id": "T1548.002", "Name": "Bypass User Account Control", "Tactics": ["TA0004"]}, {"Id": "T1548.003", "Name": "Sudo and Sudo Caching", "Tactics": ["TA0004"]}, {"Id": "T1548.004", "Name": "Elevated Execution with Prompt", "Tactics": ["TA0004"]}, {"Id": "T1548.005", "Name": "Temporary Elevated Cloud Access", "Tactics": ["TA0004"]}, {"Id": "T1548.006", "Name": "TCC Manipulation", "Tactics": ["TA0004"]}, {"Id": "T1550", "Name": "Use Alternate Authentication Material", "Tactics": ["TA0008"]}, {"Id": "T1550.001", "Name": "Application Access Token", "Tactics": ["TA0008"]}, {"Id": "T1550.002", "Name": "Pass the Hash", "Tactics": ["TA0008"]}, {"Id": "T1550.003", "Name": "Pass the Ticket", "Tactics": ["TA0008"]}, {"Id": "T1550.004", "Name": "Web Session Cookie", "Tactics": ["TA0008"]}, {"Id": "T1552", "Name": "Unsecured Credentials", "Tactics": ["TA0006"]}, {"Id": "T1552.001", "Name": "Credentials In Files", "Tactics": ["TA0006"]}, {"Id": "T1552.002", "Name": "Credentials in Registry", "Tactics": ["TA0006"]}, {"Id": "T1552.003", "Name": "Shell History", "Tactics": ["TA0006"]}, {"Id": "T1552.004", "Name": "Private Keys", "Tactics": ["TA0006"]}, {"Id": "T1552.005", "Name": "Cloud Instance Metadata API", "Tactics": ["TA0006"]}, {"Id": "T1552.006", "Name": "Group Policy Preferences", "Tactics": ["TA0006"]}, {"Id": "T1552.007", "Name": "Container API", "Tactics": ["TA0006"]}, {"Id": "T1552.008", "Name": "Chat Messages", "Tactics": ["TA0006"]}, {"Id": "T1553", "Name": "Subvert Trust Controls", "Tactics": ["TA0112"]}, {"Id": "T1553.001", "Name": "Gatekeeper Bypass", "Tactics": ["TA0112"]}, {"Id": "T1553.002", "Name": "Code Signing", "Tactics": ["TA0112"]}, {"Id": "T1553.003", "Name": "SIP and Trust Provider Hijacking", "Tactics": ["TA0112"]}, {"Id": "T1553.004", "Name": "Install Root Certificate", "Tactics": ["TA0112"]}, {"Id": "T1553.005", "Name": "Mark-of-the-Web Bypass", "Tactics": ["TA0112"]}, {"Id": "T1553.006", "Name": "Code Signing Policy Modification", "Tactics": ["TA0112"]}, {"Id": "T1554", "Name": "Compromise Host Software Binary", "Tactics": ["TA0003"]}, {"Id": "T1555", "Name": "Credentials from Password Stores", "Tactics": ["TA0006"]}, {"Id": "T1555.001", "Name": "Keychain", "Tactics": ["TA0006"]}, {"Id": "T1555.002", "Name": "Securityd Memory", "Tactics": ["TA0006"]}, {"Id": "T1555.003", "Name": "Credentials from Web Browsers", "Tactics": ["TA0006"]}, {"Id": "T1555.004", "Name": "Windows Credential Manager", "Tactics": ["TA0006"]}, {"Id": "T1555.005", "Name": "Password Managers", "Tactics": ["TA0006"]}, {"Id": "T1555.006", "Name": "Cloud Secrets Management Stores", "Tactics": ["TA0006"]}, {"Id": "T1556", "Name": "Modify Authentication Process", "Tactics": ["TA0112", "TA0003", "TA0006"]}, {"Id": "T1556.001", "Name": "Domain Controller Authentication", "Tactics": ["TA0112", "TA0003", "TA0006"]}, {"Id": "T1556.002", "Name": "Password Filter DLL", "Tactics": ["TA0112", "TA0003", "TA0006"]}, {"Id": "T1556.003", "Name": "Pluggable Authentication Modules", "Tactics": ["TA0112", "TA0003", "TA0006"]}, {"Id": "T1556.004", "Name": "Network Device Authentication", "Tactics": ["TA0112", "TA0003", "TA0006"]}, {"Id": "T1556.005", "Name": "Reversible Encryption", "Tactics": ["TA0112", "TA0003", "TA0006"]}, {"Id": "T1556.006", "Name": "Multi-Factor Authentication", "Tactics": ["TA0112", "TA0003", "TA0006"]}, {"Id": "T1556.007", "Name": "Hybrid Identity", "Tactics": ["TA0112", "TA0003", "TA0006"]}, {"Id": "T1556.008", "Name": "Network Provider DLL", "Tactics": ["TA0112", "TA0003", "TA0006"]}, {"Id": "T1556.009", "Name": "Conditional Access Policies", "Tactics": ["TA0112", "TA0003", "TA0006"]}, {"Id": "T1557", "Name": "Adversary-in-the-Middle", "Tactics": ["TA0006", "TA0009"]}, {"Id": "T1557.001", "Name": "Name Resolution Poisoning and SMB Relay", "Tactics": ["TA0006", "TA0009"]}, {"Id": "T1557.002", "Name": "ARP Cache Poisoning", "Tactics": ["TA0006", "TA0009"]}, {"Id": "T1557.003", "Name": "DHCP Spoofing", "Tactics": ["TA0006", "TA0009"]}, {"Id": "T1557.004", "Name": "Evil Twin", "Tactics": ["TA0006", "TA0009"]}, {"Id": "T1558", "Name": "Steal or Forge Kerberos Tickets", "Tactics": ["TA0006"]}, {"Id": "T1558.001", "Name": "Golden Ticket", "Tactics": ["TA0006"]}, {"Id": "T1558.002", "Name": "Silver Ticket", "Tactics": ["TA0006"]}, {"Id": "T1558.003", "Name": "Kerberoasting", "Tactics": ["TA0006"]}, {"Id": "T1558.004", "Name": "AS-REP Roasting", "Tactics": ["TA0006"]}, {"Id": "T1558.005", "Name": "Ccache Files", "Tactics": ["TA0006"]}, {"Id": "T1559", "Name": "Inter-Process Communication", "Tactics": ["TA0002"]}, {"Id": "T1559.001", "Name": "Component Object Model", "Tactics": ["TA0002"]}, {"Id": "T1559.002", "Name": "Dynamic Data Exchange", "Tactics": ["TA0002"]}, {"Id": "T1559.003", "Name": "XPC Services", "Tactics": ["TA0002"]}, {"Id": "T1560", "Name": "Archive Collected Data", "Tactics": ["TA0009"]}, {"Id": "T1560.001", "Name": "Archive via Utility", "Tactics": ["TA0009"]}, {"Id": "T1560.002", "Name": "Archive via Library", "Tactics": ["TA0009"]}, {"Id": "T1560.003", "Name": "Archive via Custom Method", "Tactics": ["TA0009"]}, {"Id": "T1561", "Name": "Disk Wipe", "Tactics": ["TA0040"]}, {"Id": "T1561.001", "Name": "Disk Content Wipe", "Tactics": ["TA0040"]}, {"Id": "T1561.002", "Name": "Disk Structure Wipe", "Tactics": ["TA0040"]}, {"Id": "T1563", "Name": "Remote Service Session Hijacking", "Tactics": ["TA0008"]}, {"Id": "T1563.001", "Name": "SSH Hijacking", "Tactics": ["TA0008"]}, {"Id": "T1563.002", "Name": "RDP Hijacking", "Tactics": ["TA0008"]}, {"Id": "T1564", "Name": "Hide Artifacts", "Tactics": ["TA0005"]}, {"Id": "T1564.001", "Name": "Hidden Files and Directories", "Tactics": ["TA0005"]}, {"Id": "T1564.002", "Name": "Hidden Users", "Tactics": ["TA0005"]}, {"Id": "T1564.003", "Name": "Hidden Window", "Tactics": ["TA0005"]}, {"Id": "T1564.004", "Name": "NTFS File Attributes", "Tactics": ["TA0005"]}, {"Id": "T1564.005", "Name": "Hidden File System", "Tactics": ["TA0005"]}, {"Id": "T1564.006", "Name": "Run Virtual Instance", "Tactics": ["TA0005"]}, {"Id": "T1564.007", "Name": "VBA Stomping", "Tactics": ["TA0005"]}, {"Id": "T1564.008", "Name": "Email Hiding Rules", "Tactics": ["TA0005"]}, {"Id": "T1564.009", "Name": "Resource Forking", "Tactics": ["TA0005"]}, {"Id": "T1564.010", "Name": "Process Argument Spoofing", "Tactics": ["TA0005"]}, {"Id": "T1564.011", "Name": "Ignore Process Interrupts", "Tactics": ["TA0005"]}, {"Id": "T1564.012", "Name": "File/Path Exclusions", "Tactics": ["TA0005"]}, {"Id": "T1564.013", "Name": "Bind Mounts", "Tactics": ["TA0005"]}, {"Id": "T1564.014", "Name": "Extended Attributes", "Tactics": ["TA0005"]}, {"Id": "T1565", "Name": "Data Manipulation", "Tactics": ["TA0040"]}, {"Id": "T1565.001", "Name": "Stored Data Manipulation", "Tactics": ["TA0040"]}, {"Id": "T1565.002", "Name": "Transmitted Data Manipulation", "Tactics": ["TA0040"]}, {"Id": "T1565.003", "Name": "Runtime Data Manipulation", "Tactics": ["TA0040"]}, {"Id": "T1566", "Name": "Phishing", "Tactics": ["TA0001"]}, {"Id": "T1566.001", "Name": "Spearphishing Attachment", "Tactics": ["TA0001"]}, {"Id": "T1566.002", "Name": "Spearphishing Link", "Tactics": ["TA0001"]}, {"Id": "T1566.003", "Name": "Spearphishing via Service", "Tactics": ["TA0001"]}, {"Id": "T1566.004", "Name": "Spearphishing Voice", "Tactics": ["TA0001"]}, {"Id": "T1567", "Name": "Exfiltration Over Web Service", "Tactics": ["TA0010"]}, {"Id": "T1567.001", "Name": "Exfiltration to Code Repository", "Tactics": ["TA0010"]}, {"Id": "T1567.002", "Name": "Exfiltration to Cloud Storage", "Tactics": ["TA0010"]}, {"Id": "T1567.003", "Name": "Exfiltration to Text Storage Sites", "Tactics": ["TA0010"]}, {"Id": "T1567.004", "Name": "Exfiltration Over Webhook", "Tactics": ["TA0010"]}, {"Id": "T1568", "Name": "Dynamic Resolution", "Tactics": ["TA0011"]}, {"Id": "T1568.001", "Name": "Fast Flux DNS", "Tactics": ["TA0011"]}, {"Id": "T1568.002", "Name": "Domain Generation Algorithms", "Tactics": ["TA0011"]}, {"Id": "T1568.003", "Name": "DNS Calculation", "Tactics": ["TA0011"]}, {"Id": "T1569", "Name": "System Services", "Tactics": ["TA0002"]}, {"Id": "T1569.001", "Name": "Launchctl", "Tactics": ["TA0002"]}, {"Id": "T1569.002", "Name": "Service Execution", "Tactics": ["TA0002"]}, {"Id": "T1569.003", "Name": "Systemctl", "Tactics": ["TA0002"]}, {"Id": "T1570", "Name": "Lateral Tool Transfer", "Tactics": ["TA0008"]}, {"Id": "T1571", "Name": "Non-Standard Port", "Tactics": ["TA0011"]}, {"Id": "T1572", "Name": "Protocol Tunneling", "Tactics": ["TA0011"]}, {"Id": "T1573", "Name": "Encrypted Channel", "Tactics": ["TA0011"]}, {"Id": "T1573.001", "Name": "Symmetric Cryptography", "Tactics": ["TA0011"]}, {"Id": "T1573.002", "Name": "Asymmetric Cryptography", "Tactics": ["TA0011"]}, {"Id": "T1574", "Name": "Hijack Execution Flow", "Tactics": ["TA0005", "TA0002"]}, {"Id": "T1574.001", "Name": "DLL", "Tactics": ["TA0005", "TA0002"]}, {"Id": "T1574.004", "Name": "Dylib Hijacking", "Tactics": ["TA0005", "TA0002"]}, {"Id": "T1574.005", "Name": "Executable Installer File Permissions Weakness", "Tactics": ["TA0005", "TA0002"]}, {"Id": "T1574.006", "Name": "Dynamic Linker Hijacking", "Tactics": ["TA0005", "TA0002"]}, {"Id": "T1574.007", "Name": "Path Interception by PATH Environment Variable", "Tactics": ["TA0005", "TA0002"]}, {"Id": "T1574.008", "Name": "Path Interception by Search Order Hijacking", "Tactics": ["TA0005", "TA0002"]}, {"Id": "T1574.009", "Name": "Path Interception by Unquoted Path", "Tactics": ["TA0005", "TA0002"]}, {"Id": "T1574.010", "Name": "Services File Permissions Weakness", "Tactics": ["TA0005", "TA0002"]}, {"Id": "T1574.011", "Name": "Services Registry Permissions Weakness", "Tactics": ["TA0005", "TA0002"]}, {"Id": "T1574.012", "Name": "COR_PROFILER", "Tactics": ["TA0005", "TA0002"]}, {"Id": "T1574.013", "Name": "KernelCallbackTable", "Tactics": ["TA0005", "TA0002"]}, {"Id": "T1574.014", "Name": "AppDomainManager", "Tactics": ["TA0005", "TA0002"]}, {"Id": "T1578", "Name": "Modify Cloud Compute Infrastructure", "Tactics": ["TA0112"]}, {"Id": "T1578.001", "Name": "Create Snapshot", "Tactics": ["TA0112"]}, {"Id": "T1578.002", "Name": "Create Cloud Instance", "Tactics": ["TA0112"]}, {"Id": "T1578.003", "Name": "Delete Cloud Instance", "Tactics": ["TA0112"]}, {"Id": "T1578.004", "Name": "Revert Cloud Instance", "Tactics": ["TA0112"]}, {"Id": "T1578.005", "Name": "Modify Cloud Compute Configurations", "Tactics": ["TA0112"]}, {"Id": "T1580", "Name": "Cloud Infrastructure Discovery", "Tactics": ["TA0007"]}, {"Id": "T1583", "Name": "Acquire Infrastructure", "Tactics": ["TA0042"]}, {"Id": "T1583.001", "Name": "Domains", "Tactics": ["TA0042"]}, {"Id": "T1583.002", "Name": "DNS Server", "Tactics": ["TA0042"]}, {"Id": "T1583.003", "Name": "Virtual Private Server", "Tactics": ["TA0042"]}, {"Id": "T1583.004", "Name": "Server", "Tactics": ["TA0042"]}, {"Id": "T1583.005", "Name": "Botnet", "Tactics": ["TA0042"]}, {"Id": "T1583.006", "Name": "Web Services", "Tactics": ["TA0042"]}, {"Id": "T1583.007", "Name": "Serverless", "Tactics": ["TA0042"]}, {"Id": "T1583.008", "Name": "Malvertising", "Tactics": ["TA0042"]}, {"Id": "T1584", "Name": "Compromise Infrastructure", "Tactics": ["TA0042"]}, {"Id": "T1584.001", "Name": "Domains", "Tactics": ["TA0042"]}, {"Id": "T1584.002", "Name": "DNS Server", "Tactics": ["TA0042"]}, {"Id": "T1584.003", "Name": "Virtual Private Server", "Tactics": ["TA0042"]}, {"Id": "T1584.004", "Name": "Server", "Tactics": ["TA0042"]}, {"Id": "T1584.005", "Name": "Botnet", "Tactics": ["TA0042"]}, {"Id": "T1584.006", "Name": "Web Services", "Tactics": ["TA0042"]}, {"Id": "T1584.007", "Name": "Serverless", "Tactics": ["TA0042"]}, {"Id": "T1584.008", "Name": "Network Devices", "Tactics": ["TA0042"]}, {"Id": "T1585", "Name": "Establish Accounts", "Tactics": ["TA0042"]}, {"Id": "T1585.001", "Name": "Social Media Accounts", "Tactics": ["TA0042"]}, {"Id": "T1585.002", "Name": "Email Accounts", "Tactics": ["TA0042"]}, {"Id": "T1585.003", "Name": "Cloud Accounts", "Tactics": ["TA0042"]}, {"Id": "T1586", "Name": "Compromise Accounts", "Tactics": ["TA0042"]}, {"Id": "T1586.001", "Name": "Social Media Accounts", "Tactics": ["TA0042"]}, {"Id": "T1586.002", "Name": "Email Accounts", "Tactics": ["TA0042"]}, {"Id": "T1586.003", "Name": "Cloud Accounts", "Tactics": ["TA0042"]}, {"Id": "T1587", "Name": "Develop Capabilities", "Tactics": ["TA0042"]}, {"Id": "T1587.001", "Name": "Malware", "Tactics": ["TA0042"]}, {"Id": "T1587.002", "Name": "Code Signing Certificates", "Tactics": ["TA0042"]}, {"Id": "T1587.003", "Name": "Digital Certificates", "Tactics": ["TA0042"]}, {"Id": "T1587.004", "Name": "Exploits", "Tactics": ["TA0042"]}, {"Id": "T1588", "Name": "Obtain Capabilities", "Tactics": ["TA0042"]}, {"Id": "T1588.001", "Name": "Malware", "Tactics": ["TA0042"]}, {"Id": "T1588.002", "Name": "Tool", "Tactics": ["TA0042"]}, {"Id": "T1588.003", "Name": "Code Signing Certificates", "Tactics": ["TA0042"]}, {"Id": "T1588.004", "Name": "Digital Certificates", "Tactics": ["TA0042"]}, {"Id": "T1588.005", "Name": "Exploits", "Tactics": ["TA0042"]}, {"Id": "T1588.006", "Name": "Vulnerabilities", "Tactics": ["TA0042"]}, {"Id": "T1588.007", "Name": "Artificial Intelligence", "Tactics": ["TA0042"]}, {"Id": "T1589", "Name": "Gather Victim Identity Information", "Tactics": ["TA0043"]}, {"Id": "T1589.001", "Name": "Credentials", "Tactics": ["TA0043"]}, {"Id": "T1589.002", "Name": "Email Addresses", "Tactics": ["TA0043"]}, {"Id": "T1589.003", "Name": "Employee Names", "Tactics": ["TA0043"]}, {"Id": "T1590", "Name": "Gather Victim Network Information", "Tactics": ["TA0043"]}, {"Id": "T1590.001", "Name": "Domain Properties", "Tactics": ["TA0043"]}, {"Id": "T1590.002", "Name": "DNS", "Tactics": ["TA0043"]}, {"Id": "T1590.003", "Name": "Network Trust Dependencies", "Tactics": ["TA0043"]}, {"Id": "T1590.004", "Name": "Network Topology", "Tactics": ["TA0043"]}, {"Id": "T1590.005", "Name": "IP Addresses", "Tactics": ["TA0043"]}, {"Id": "T1590.006", "Name": "Network Security Appliances", "Tactics": ["TA0043"]}, {"Id": "T1591", "Name": "Gather Victim Org Information", "Tactics": ["TA0043"]}, {"Id": "T1591.001", "Name": "Determine Physical Locations", "Tactics": ["TA0043"]}, {"Id": "T1591.002", "Name": "Business Relationships", "Tactics": ["TA0043"]}, {"Id": "T1591.003", "Name": "Identify Business Tempo", "Tactics": ["TA0043"]}, {"Id": "T1591.004", "Name": "Identify Roles", "Tactics": ["TA0043"]}, {"Id": "T1592", "Name": "Gather Victim Host Information", "Tactics": ["TA0043"]}, {"Id": "T1592.001", "Name": "Hardware", "Tactics": ["TA0043"]}, {"Id": "T1592.002", "Name": "Software", "Tactics": ["TA0043"]}, {"Id": "T1592.003", "Name": "Firmware", "Tactics": ["TA0043"]}, {"Id": "T1592.004", "Name": "Client Configurations", "Tactics": ["TA0043"]}, {"Id": "T1593", "Name": "Search Open Websites/Domains", "Tactics": ["TA0043"]}, {"Id": "T1593.001", "Name": "Social Media", "Tactics": ["TA0043"]}, {"Id": "T1593.002", "Name": "Search Engines", "Tactics": ["TA0043"]}, {"Id": "T1593.003", "Name": "Code Repositories", "Tactics": ["TA0043"]}, {"Id": "T1594", "Name": "Search Victim-Owned Websites", "Tactics": ["TA0043"]}, {"Id": "T1595", "Name": "Active Scanning", "Tactics": ["TA0043"]}, {"Id": "T1595.001", "Name": "Scanning IP Blocks", "Tactics": ["TA0043"]}, {"Id": "T1595.002", "Name": "Vulnerability Scanning", "Tactics": ["TA0043"]}, {"Id": "T1595.003", "Name": "Wordlist Scanning", "Tactics": ["TA0043"]}, {"Id": "T1596", "Name": "Search Open Technical Databases", "Tactics": ["TA0043"]}, {"Id": "T1596.001", "Name": "DNS/Passive DNS", "Tactics": ["TA0043"]}, {"Id": "T1596.002", "Name": "WHOIS", "Tactics": ["TA0043"]}, {"Id": "T1596.003", "Name": "Digital Certificates", "Tactics": ["TA0043"]}, {"Id": "T1596.004", "Name": "CDNs", "Tactics": ["TA0043"]}, {"Id": "T1596.005", "Name": "Scan Databases", "Tactics": ["TA0043"]}, {"Id": "T1597", "Name": "Search Closed Sources", "Tactics": ["TA0043"]}, {"Id": "T1597.001", "Name": "Threat Intel Vendors", "Tactics": ["TA0043"]}, {"Id": "T1597.002", "Name": "Purchase Technical Data", "Tactics": ["TA0043"]}, {"Id": "T1598", "Name": "Phishing for Information", "Tactics": ["TA0043"]}, {"Id": "T1598.001", "Name": "Spearphishing Service", "Tactics": ["TA0043"]}, {"Id": "T1598.002", "Name": "Spearphishing Attachment", "Tactics": ["TA0043"]}, {"Id": "T1598.003", "Name": "Spearphishing Link", "Tactics": ["TA0043"]}, {"Id": "T1598.004", "Name": "Spearphishing Voice", "Tactics": ["TA0043"]}, {"Id": "T1599", "Name": "Network Boundary Bridging", "Tactics": ["TA0112"]}, {"Id": "T1599.001", "Name": "Network Address Translation Traversal", "Tactics": ["TA0112"]}, {"Id": "T1600", "Name": "Weaken Encryption", "Tactics": ["TA0112"]}, {"Id": "T1600.001", "Name": "Reduce Key Space", "Tactics": ["TA0112"]}, {"Id": "T1600.002", "Name": "Disable Crypto Hardware", "Tactics": ["TA0112"]}, {"Id": "T1601", "Name": "Modify System Image", "Tactics": ["TA0112"]}, {"Id": "T1601.001", "Name": "Patch System Image", "Tactics": ["TA0112"]}, {"Id": "T1601.002", "Name": "Downgrade System Image", "Tactics": ["TA0112"]}, {"Id": "T1602", "Name": "Data from Configuration Repository", "Tactics": ["TA0009"]}, {"Id": "T1602.001", "Name": "SNMP (MIB Dump)", "Tactics": ["TA0009"]}, {"Id": "T1602.002", "Name": "Network Device Configuration Dump", "Tactics": ["TA0009"]}, {"Id": "T1606", "Name": "Forge Web Credentials", "Tactics": ["TA0006"]}, {"Id": "T1606.001", "Name": "Web Cookies", "Tactics": ["TA0006"]}, {"Id": "T1606.002", "Name": "SAML Tokens", "Tactics": ["TA0006"]}, {"Id": "T1608", "Name": "Stage Capabilities", "Tactics": ["TA0042"]}, {"Id": "T1608.001", "Name": "Upload Malware", "Tactics": ["TA0042"]}, {"Id": "T1608.002", "Name": "Upload Tool", "Tactics": ["TA0042"]}, {"Id": "T1608.003", "Name": "Install Digital Certificate", "Tactics": ["TA0042"]}, {"Id": "T1608.004", "Name": "Drive-by Target", "Tactics": ["TA0042"]}, {"Id": "T1608.005", "Name": "Link Target", "Tactics": ["TA0042"]}, {"Id": "T1608.006", "Name": "SEO Poisoning", "Tactics": ["TA0042"]}, {"Id": "T1609", "Name": "Container Administration Command", "Tactics": ["TA0002"]}, {"Id": "T1610", "Name": "Deploy Container", "Tactics": ["TA0002"]}, {"Id": "T1611", "Name": "Escape to Host", "Tactics": ["TA0004"]}, {"Id": "T1612", "Name": "Build Image on Host", "Tactics": ["TA0005"]}, {"Id": "T1613", "Name": "Container and Resource Discovery", "Tactics": ["TA0007"]}, {"Id": "T1614", "Name": "System Location Discovery", "Tactics": ["TA0007"]}, {"Id": "T1614.001", "Name": "System Language Discovery", "Tactics": ["TA0007"]}, {"Id": "T1615", "Name": "Group Policy Discovery", "Tactics": ["TA0007"]}, {"Id": "T1619", "Name": "Cloud Storage Object Discovery", "Tactics": ["TA0007"]}, {"Id": "T1620", "Name": "Reflective Code Loading", "Tactics": ["TA0005"]}, {"Id": "T1621", "Name": "Multi-Factor Authentication Request Generation", "Tactics": ["TA0006"]}, {"Id": "T1622", "Name": "Debugger Evasion", "Tactics": ["TA0005", "TA0007"]}, {"Id": "T1647", "Name": "Plist File Modification", "Tactics": ["TA0112"]}, {"Id": "T1648", "Name": "Serverless Execution", "Tactics": ["TA0002"]}, {"Id": "T1649", "Name": "Steal or Forge Authentication Certificates", "Tactics": ["TA0006"]}, {"Id": "T1650", "Name": "Acquire Access", "Tactics": ["TA0042"]}, {"Id": "T1651", "Name": "Cloud Administration Command", "Tactics": ["TA0002"]}, {"Id": "T1652", "Name": "Device Driver Discovery", "Tactics": ["TA0007"]}, {"Id": "T1653", "Name": "Power Settings", "Tactics": ["TA0003"]}, {"Id": "T1654", "Name": "Log Enumeration", "Tactics": ["TA0007"]}, {"Id": "T1657", "Name": "Financial Theft", "Tactics": ["TA0040"]}, {"Id": "T1659", "Name": "Content Injection", "Tactics": ["TA0001", "TA0011"]}, {"Id": "T1665", "Name": "Hide Infrastructure", "Tactics": ["TA0011"]}, {"Id": "T1666", "Name": "Modify Cloud Resource Hierarchy", "Tactics": ["TA0112"]}, {"Id": "T1667", "Name": "Email Bombing", "Tactics": ["TA0040"]}, {"Id": "T1668", "Name": "Exclusive Control", "Tactics": ["TA0003"]}, {"Id": "T1669", "Name": "Wi-Fi Networks", "Tactics": ["TA0001"]}, {"Id": "T1671", "Name": "Cloud Application Integration", "Tactics": ["TA0003"]}, {"Id": "T1673", "Name": "Virtual Machine Discovery", "Tactics": ["TA0007"]}, {"Id": "T1674", "Name": "Input Injection", "Tactics": ["TA0002"]}, {"Id": "T1675", "Name": "ESXi Administration Command", "Tactics": ["TA0002"]}, {"Id": "T1677", "Name": "Poisoned Pipeline Execution", "Tactics": ["TA0002"]}, {"Id": "T1678", "Name": "Delay Execution", "Tactics": ["TA0005"]}, {"Id": "T1679", "Name": "Selective Exclusion", "Tactics": ["TA0005"]}, {"Id": "T1680", "Name": "Local Storage Discovery", "Tactics": ["TA0007"]}, {"Id": "T1681", "Name": "Search Threat Vendor Data", "Tactics": ["TA0043"]}, {"Id": "T1682", "Name": "Query Public AI Services", "Tactics": ["TA0043"]}, {"Id": "T1683", "Name": "Generate Content", "Tactics": ["TA0042"]}, {"Id": "T1683.001", "Name": "Written Content", "Tactics": ["TA0042"]}, {"Id": "T1683.002", "Name": "Audio-Visual Content", "Tactics": ["TA0042"]}, {"Id": "T1684", "Name": "Social Engineering", "Tactics": ["TA0005"]}, {"Id": "T1684.001", "Name": "Impersonation", "Tactics": ["TA0005"]}, {"Id": "T1684.002", "Name": "Email Spoofing", "Tactics": ["TA0005"]}, {"Id": "T1685", "Name": "Disable or Modify Tools", "Tactics": ["TA0112"]}, {"Id": "T1685.001", "Name": "Disable or Modify Windows Event Log", "Tactics": ["TA0112"]}, {"Id": "T1685.002", "Name": "Disable or Modify Cloud Log", "Tactics": ["TA0112"]}, {"Id": "T1685.003", "Name": "Modify or Spoof Tool UI", "Tactics": ["TA0112"]}, {"Id": "T1685.004", "Name": "Disable or Modify Linux Audit System Log", "Tactics": ["TA0112"]}, {"Id": "T1685.005", "Name": "Clear Windows Event Logs", "Tactics": ["TA0112"]}, {"Id": "T1685.006", "Name": "Clear Linux or Mac System Logs", "Tactics": ["TA0112"]}, {"Id": "T1686", "Name": "Disable or Modify System Firewall", "Tactics": ["TA0112"]}, {"Id": "T1686.001", "Name": "Cloud Firewall", "Tactics": ["TA0112"]}, {"Id": "T1686.002", "Name": "Network Device Firewall", "Tactics": ["TA0112"]}, {"Id": "T1686.003", "Name": "Windows Host Firewall", "Tactics": ["TA0112"]}, {"Id": "T1687", "Name": "Exploitation for Defense Impairment", "Tactics": ["TA0112"]}, {"Id": "T1688", "Name": "Safe Mode Boot", "Tactics": ["TA0112"]}, {"Id": "T1689", "Name": "Downgrade Attack", "Tactics": ["TA0112"]}, {"Id": "T1690", "Name": "Prevent Command History Logging", "Tactics": ["TA0112"]} ], "Retired": [ "T1002", "T1004", "T1009", "T1013", "T1015", "T1017", "T1019", "T1022", "T1023", "T1024", "T1026", "T1028", "T1031", "T1032", "T1034", "T1035", "T1038", "T1042", "T1043", "T1044", "T1045", "T1050", "T1051", "T1053.001", "T1053.004", "T1054", "T1058", "T1060", "T1061", "T1062", "T1063", "T1064", "T1065", "T1066", "T1067", "T1070.001", "T1070.002", "T1073", "T1075", "T1076", "T1077", "T1079", "T1081", "T1084", "T1085", "T1086", "T1088", "T1089", "T1093", "T1094", "T1096", "T1097", "T1099", "T1100", "T1101", "T1103", "T1107", "T1108", "T1109", "T1116", "T1117", "T1118", "T1121", "T1122", "T1126", "T1128", "T1130", "T1131", "T1138", "T1139", "T1141", "T1142", "T1143", "T1144", "T1145", "T1146", "T1147", "T1148", "T1149", "T1150", "T1151", "T1152", "T1153", "T1154", "T1155", "T1156", "T1157", "T1158", "T1159", "T1160", "T1161", "T1162", "T1163", "T1164", "T1165", "T1166", "T1167", "T1168", "T1169", "T1170", "T1171", "T1172", "T1173", "T1174", "T1175", "T1177", "T1178", "T1179", "T1180", "T1181", "T1182", "T1183", "T1184", "T1186", "T1188", "T1191", "T1192", "T1193", "T1194", "T1196", "T1198", "T1206", "T1208", "T1209", "T1214", "T1215", "T1223", "T1483", "T1487", "T1488", "T1492", "T1493", "T1494", "T1500", "T1501", "T1502", "T1503", "T1504", "T1506", "T1514", "T1519", "T1522", "T1527", "T1536", "T1547.011", "T1562", "T1562.001", "T1562.002", "T1562.003", "T1562.004", "T1562.006", "T1562.007", "T1562.008", "T1562.009", "T1562.010", "T1562.011", "T1562.012", "T1562.013", "T1574.002", "T1656", "T1672" ] } |