T1566.001: Spearphishing Attachment - T1566.002: Spearphishing Link - T1566.003: Spearphishing via Service - - - T1204.001: Malicious Link - T1204.002: Malicious File - T1059: Command and Scripting Interpreter T1059.005: Visual Basic - T1059.005: Visual Basic - - T1053.005: Scheduled Task - T1129: Shared Modules - T1106: Native API - T1047: Windows Management Instrumentation - - T1027: Obfuscated Files or Information T1027.002: Software Packing - T1027.002: Software Packing - T1553: Subvert Trust Controls T1553.002: Code Signing - T1553.002: Code Signing - T1218: Signed Binary Proxy Execution T1218.010: Regsvr32 - T1218.010: Regsvr32 - - T1497.001: System Checks - T1497.002: User Activity Based Checks - T1497.003: Time Based Evasion - T1112: Modify Registry - T1070: Indicator Removal on Host T1070.004: File Deletion - T1070.004: File Deletion - T1140: De-obfuscate/Decode Files or Information - - - T1090.003: Multi-hop Proxy - T1105: Ingress Tool Transfer - - T1055: Process Injection T1055.012: Process Hollowing - T1055.012: Process Hollowing - - T1082: System Information Discovery - T1049: System Network Connections Discovery - T1016: System Network Configuration Discovery - T1057: Process Discovery - T1033: System Owner/User Discovery - T1518: Software Discovery T1518.001: Security Software Discovery - T1518.001: Security Software Discovery - Persistence T1546: Event Triggered Execution T1547: Boot or Logon Autostart Execution T1547.001: Registry Run Keys / Startup Folder - T1546: Event Triggered Execution - T1547: Boot or Logon Autostart Execution T1547.001: Registry Run Keys / Startup Folder - T1547.001: Registry Run Keys / Startup Folder