ATT&CK Techniques against China

T1598 Phishing for Information5 T1595 Active Scanning4 T1589 Gather Victim Identity Information3 T1591 Gather Victim Org Information3 T1596 Search Open Technical Databases1

T1583 Acquire Infrastructure9 T1588 Obtain Capabilities8 T1608 Stage Capabilities5 T1584 Compromise Infrastructure4 T1585 Establish Accounts3 T1587 Develop Capabilities3 T1586 Compromise Accounts2

T1566 Phishing15 T1189 Drive-by Compromise10 T1078 Valid Accounts7 T1190 Exploit Public-Facing Application6 T1133 External Remote Services4 T1195 Supply Chain Compromise3 T1199 Trusted Relationship3 T1091 Replication Through Removable Media2 T1669 Wi-Fi Networks1

T1204 User Execution14 T1059 Command and Scripting Interpreter11 T1203 Exploitation for Client Execution11 T1053 Scheduled Task/Job10 T1574 Hijack Execution Flow7 T1047 Windows Management Instrumentation5 T1559 Inter-Process Communication2 T1569 System Services2 T1072 Software Deployment Tools1 T1106 Native API1 T1651 Cloud Administration Command1

T1547 Boot or Logon Autostart Execution12 T1053 Scheduled Task/Job10 T1078 Valid Accounts7 T1505 Server Software Component5 T1098 Account Manipulation4 T1112 Modify Registry4 T1133 External Remote Services4 T1137 Office Application Startup3 T1543 Create or Modify System Process3 T1546 Event Triggered Execution3 T1037 Boot or Logon Initialization Scripts2 T1136 Create Account2 T1542 Pre-OS Boot2 T1556 Modify Authentication Process2

T1547 Boot or Logon Autostart Execution12 T1053 Scheduled Task/Job10 T1078 Valid Accounts7 T1068 Exploitation for Privilege Escalation4 T1098 Account Manipulation4 T1548 Abuse Elevation Control Mechanism4 T1543 Create or Modify System Process3 T1546 Event Triggered Execution3 T1037 Boot or Logon Initialization Scripts2 T1055 Process Injection2 T1134 Access Token Manipulation1

T1027 Obfuscated Files or Information11 T1036 Masquerading11 T1078 Valid Accounts7 T1140 Deobfuscate/Decode Files or Information7 T1574 Hijack Execution Flow7 T1070 Indicator Removal6 T1218 System Binary Proxy Execution6 T1564 Hide Artifacts6 T1014 Rootkit2 T1055 Process Injection2 T1221 Template Injection2 T1542 Pre-OS Boot2 T1134 Access Token Manipulation1 T1211 Exploitation for Stealth1 T1216 System Script Proxy Execution1 T1220 XSL Script Processing1 T1480 Execution Guardrails1 T1497 Virtualization/Sandbox Evasion1

T1685 Disable or Modify Tools6 T1112 Modify Registry4 T1553 Subvert Trust Controls4 T1556 Modify Authentication Process2 T1222 File and Directory Permissions Modification1 T1686 Disable or Modify System Firewall1

T1003 OS Credential Dumping10 T1056 Input Capture4 T1110 Brute Force3 T1528 Steal Application Access Token2 T1556 Modify Authentication Process2 T1557 Adversary-in-the-Middle2 T1040 Network Sniffing1 T1187 Forced Authentication1 T1552 Unsecured Credentials1 T1555 Credentials from Password Stores1 T1621 Multi-Factor Authentication Request Generation1 T1649 Steal or Forge Authentication Certificates1

T1016 System Network Configuration Discovery10 T1083 File and Directory Discovery7 T1018 Remote System Discovery6 T1033 System Owner/User Discovery6 T1057 Process Discovery6 T1082 System Information Discovery5 T1087 Account Discovery5 T1124 System Time Discovery4 T1518 Software Discovery4 T1012 Query Registry3 T1046 Network Service Discovery3 T1049 System Network Connections Discovery3 T1007 System Service Discovery2 T1120 Peripheral Device Discovery2 T1135 Network Share Discovery2 T1040 Network Sniffing1 T1069 Permission Groups Discovery1 T1217 Browser Information Discovery1

T1021 Remote Services6 T1210 Exploitation of Remote Services4 T1550 Use Alternate Authentication Material4 T1080 Taint Shared Content2 T1091 Replication Through Removable Media2 T1072 Software Deployment Tools1 T1563 Remote Service Session Hijacking1 T1570 Lateral Tool Transfer1

T1560 Archive Collected Data7 T1005 Data from Local System6 T1056 Input Capture4 T1074 Data Staged4 T1113 Screen Capture3 T1114 Email Collection3 T1119 Automated Collection3 T1039 Data from Network Shared Drive2 T1557 Adversary-in-the-Middle2 T1025 Data from Removable Media1 T1213 Data from Information Repositories1

T1105 Ingress Tool Transfer11 T1071 Application Layer Protocol8 T1090 Proxy5 T1573 Encrypted Channel5 T1001 Data Obfuscation3 T1102 Web Service3 T1092 Communication Through Removable Media1 T1132 Data Encoding1 T1568 Dynamic Resolution1 T1571 Non-Standard Port1 T1665 Hide Infrastructure1

T1567 Exfiltration Over Web Service3 T1030 Data Transfer Size Limits2 T1041 Exfiltration Over C2 Channel2 T1048 Exfiltration Over Alternative Protocol2 T1020 Automated Exfiltration1 T1029 Scheduled Transfer1

T1486 Data Encrypted for Impact1 T1498 Network Denial of Service1