ATT&CK Techniques against Australia

T1589 Gather Victim Identity Information1 T1591 Gather Victim Org Information1 T1595 Active Scanning1 T1598 Phishing for Information1 T1682 Query Public AI Services1

T1588 Obtain Capabilities7 T1583 Acquire Infrastructure6 T1608 Stage Capabilities5 T1585 Establish Accounts3 T1587 Develop Capabilities2 T1584 Compromise Infrastructure1

T1566 Phishing8 T1078 Valid Accounts4 T1189 Drive-by Compromise3 T1190 Exploit Public-Facing Application3 T1133 External Remote Services2 T1195 Supply Chain Compromise2 T1199 Trusted Relationship2 T1091 Replication Through Removable Media1

T1204 User Execution8 T1053 Scheduled Task/Job6 T1059 Command and Scripting Interpreter6 T1047 Windows Management Instrumentation5 T1203 Exploitation for Client Execution3 T1574 Hijack Execution Flow3 T1106 Native API2 T1569 System Services2 T1197 BITS Jobs1 T1559 Inter-Process Communication1

T1053 Scheduled Task/Job6 T1112 Modify Registry5 T1547 Boot or Logon Autostart Execution5 T1078 Valid Accounts4 T1543 Create or Modify System Process3 T1133 External Remote Services2 T1098 Account Manipulation1 T1136 Create Account1 T1197 BITS Jobs1 T1505 Server Software Component1

T1053 Scheduled Task/Job6 T1547 Boot or Logon Autostart Execution5 T1055 Process Injection4 T1078 Valid Accounts4 T1543 Create or Modify System Process3 T1548 Abuse Elevation Control Mechanism2 T1068 Exploitation for Privilege Escalation1 T1098 Account Manipulation1

T1027 Obfuscated Files or Information8 T1036 Masquerading5 T1140 Deobfuscate/Decode Files or Information5 T1055 Process Injection4 T1070 Indicator Removal4 T1078 Valid Accounts4 T1218 System Binary Proxy Execution4 T1574 Hijack Execution Flow3 T1197 BITS Jobs1 T1684 Social Engineering1

T1112 Modify Registry5 T1553 Subvert Trust Controls3 T1685 Disable or Modify Tools3 T1222 File and Directory Permissions Modification1

T1003 OS Credential Dumping5 T1555 Credentials from Password Stores4 T1056 Input Capture3 T1552 Unsecured Credentials2 T1111 Multi-Factor Authentication Interception1 T1539 Steal Web Session Cookie1 T1557 Adversary-in-the-Middle1 T1558 Steal or Forge Kerberos Tickets1 T1697 Steal Application Specific Passwords1

T1016 System Network Configuration Discovery6 T1087 Account Discovery5 T1018 Remote System Discovery4 T1033 System Owner/User Discovery4 T1049 System Network Connections Discovery3 T1082 System Information Discovery3 T1046 Network Service Discovery2 T1083 File and Directory Discovery2 T1518 Software Discovery2 T1007 System Service Discovery1 T1012 Query Registry1 T1057 Process Discovery1 T1069 Permission Groups Discovery1 T1135 Network Share Discovery1 T1217 Browser Information Discovery1 T1482 Domain Trust Discovery1

T1210 Exploitation of Remote Services4 T1021 Remote Services3 T1570 Lateral Tool Transfer2 T1091 Replication Through Removable Media1 T1550 Use Alternate Authentication Material1

T1560 Archive Collected Data4 T1005 Data from Local System3 T1056 Input Capture3 T1074 Data Staged3 T1119 Automated Collection2 T1039 Data from Network Shared Drive1 T1113 Screen Capture1 T1530 Data from Cloud Storage1 T1557 Adversary-in-the-Middle1

T1105 Ingress Tool Transfer6 T1071 Application Layer Protocol5 T1090 Proxy2 T1568 Dynamic Resolution2 T1102 Web Service1 T1132 Data Encoding1 T1573 Encrypted Channel1

T1567 Exfiltration Over Web Service3 T1030 Data Transfer Size Limits1 T1041 Exfiltration Over C2 Channel1 T1048 Exfiltration Over Alternative Protocol1

T1486 Data Encrypted for Impact2 T1489 Service Stop1 T1490 Inhibit System Recovery1