T1003.008 - /etc/passwd and /etc/shadow, T1003 - OS Credential Dumping, T1005 - Data from Local System, T1012 - Query Registry, T1018 - Remote System Discovery, T1021.001 - Remote Desktop Protocol, T1027 - Obfuscated Files or Information, T1029 - Scheduled Transfer, T1030 - Data Transfer Size Limits, T1036 - Masquerading, T1040 - Network Sniffing, T1045 - Software Packing, T1046 - Network Service Scanning, T1047 - Windows Management Instrumentation, T1053 - Scheduled Task/Job, T1055 - Process Injection, T1056.001 - Keylogging, T1057 - Process Discovery, T1059.002 - AppleScript, T1059.007 - JavaScript, T1059 - Command and Scripting Interpreter, T1060 - Registry Run Keys / Startup Folder, T1063 - Security Software Discovery, T1068 - Exploitation for Privilege Escalation, T1070 - Indicator Removal on Host, T1071.001 - Web Protocols, T1071.002 - File Transfer Protocols, T1071.003 - Mail Protocols, T1071.004 - DNS, T1071 - Application Layer Protocol, T1081 - Credentials in Files, T1082 - System Information Discovery, T1083 - File and Directory Discovery, T1088 - Bypass User Account Control, T1095 - Non-Application Layer Protocol, T1096 - NTFS File Attributes, T1100 - Web Shell, T1105 - Ingress Tool Transfer, T1106 - Native API, T1110.002 - Password Cracking, T1110 - Brute Force, T1112 - Modify Registry, T1114 - Email Collection, T1119 - Automated Collection, T1122 - Component Object Model Hijacking, T1129 - Shared Modules, T1140 - Deobfuscate/Decode Files or Information, T1143 - Hidden Window, T1183 - Image File Execution Options Injection, T1184 - SSH Hijacking, T1192 - Spearphishing Link, T1194 - Spearphishing via Service, T1199 - Trusted Relationship, T1202 - Indirect Command Execution, T1415 - URL Scheme Hijacking, T1442 - Fake Developer Accounts, T1449 - Exploit SS7 to Redirect Phone Calls/SMS, T1454 - Malicious SMS Message, T1497 - Virtualization/Sandbox Evasion, T1518 - Software Discovery, T1539 - Steal Web Session Cookie, T1543 - Create or Modify System Process, T1546.015 - Component Object Model Hijacking, T1546 - Event Triggered Execution, T1547 - Boot or Logon Autostart Execution, T1553 - Subvert Trust Controls, T1560 - Archive Collected Data, T1562 - Impair Defenses, T1565 - Data Manipulation, T1566 - Phishing, T1568 - Dynamic Resolution, T1569 - System Services, T1571 - Non-Standard Port, T1573 - Encrypted Channel, T1574 - Hijack Execution Flow, T1583.001 - Domains, T1583.002 - DNS Server, T1583.005 - Botnet, T1583.006 - Web Services, T1583 - Acquire Infrastructure, T1585.001 - Social Media Accounts, T1586 - Compromise Accounts, T1588.004 - Digital Certificates, T1588 - Obtain Capabilities, T1591.002 - Business Relationships, TA0001 - Initial Access, TA0002 - Execution, TA0003 - Persistence, TA0004 - Privilege Escalation, TA0005 - Defense Evasion, TA0006 - Credential Access, TA0007 - Discovery, TA0008 - Lateral Movement, TA0009 - Collection, TA0010 - Exfiltration, TA0011 - Command and Control