ATT&CK Techniques against Taiwan

T1595 Active Scanning1

T1588 Obtain Capabilities5 T1584 Compromise Infrastructure4 T1583 Acquire Infrastructure3 T1585 Establish Accounts2 T1608 Stage Capabilities2 T1587 Develop Capabilities1

T1566 Phishing9 T1189 Drive-by Compromise5 T1078 Valid Accounts3 T1190 Exploit Public-Facing Application3 T1133 External Remote Services2 T1195 Supply Chain Compromise2 T1091 Replication Through Removable Media1 T1199 Trusted Relationship1

T1059 Command and Scripting Interpreter8 T1204 User Execution8 T1047 Windows Management Instrumentation5 T1053 Scheduled Task/Job5 T1203 Exploitation for Client Execution5 T1574 Hijack Execution Flow4 T1106 Native API1 T1197 BITS Jobs1 T1569 System Services1

T1053 Scheduled Task/Job5 T1112 Modify Registry4 T1543 Create or Modify System Process4 T1547 Boot or Logon Autostart Execution4 T1078 Valid Accounts3 T1133 External Remote Services2 T1136 Create Account2 T1505 Server Software Component2 T1098 Account Manipulation1 T1197 BITS Jobs1

T1053 Scheduled Task/Job5 T1543 Create or Modify System Process4 T1547 Boot or Logon Autostart Execution4 T1078 Valid Accounts3 T1055 Process Injection2 T1068 Exploitation for Privilege Escalation2 T1548 Abuse Elevation Control Mechanism2 T1098 Account Manipulation1 T1134 Access Token Manipulation1

T1036 Masquerading6 T1027 Obfuscated Files or Information5 T1574 Hijack Execution Flow4 T1078 Valid Accounts3 T1140 Deobfuscate/Decode Files or Information3 T1218 System Binary Proxy Execution3 T1055 Process Injection2 T1070 Indicator Removal2 T1134 Access Token Manipulation1 T1197 BITS Jobs1 T1497 Virtualization/Sandbox Evasion1 T1564 Hide Artifacts1

T1112 Modify Registry4 T1553 Subvert Trust Controls3 T1685 Disable or Modify Tools2 T1222 File and Directory Permissions Modification1 T1686 Disable or Modify System Firewall1

T1003 OS Credential Dumping6 T1056 Input Capture3 T1555 Credentials from Password Stores2 T1539 Steal Web Session Cookie1 T1552 Unsecured Credentials1 T1557 Adversary-in-the-Middle1 T1558 Steal or Forge Kerberos Tickets1

T1016 System Network Configuration Discovery6 T1018 Remote System Discovery5 T1049 System Network Connections Discovery5 T1087 Account Discovery5 T1057 Process Discovery4 T1012 Query Registry3 T1033 System Owner/User Discovery3 T1082 System Information Discovery3 T1083 File and Directory Discovery3 T1135 Network Share Discovery3 T1518 Software Discovery3 T1007 System Service Discovery2 T1046 Network Service Discovery2 T1069 Permission Groups Discovery2 T1482 Domain Trust Discovery2 T1124 System Time Discovery1 T1497 Virtualization/Sandbox Evasion1 T1680 Local Storage Discovery1

T1021 Remote Services4 T1210 Exploitation of Remote Services4 T1550 Use Alternate Authentication Material2 T1080 Taint Shared Content1 T1091 Replication Through Removable Media1 T1570 Lateral Tool Transfer1

T1560 Archive Collected Data6 T1005 Data from Local System4 T1074 Data Staged4 T1056 Input Capture3 T1119 Automated Collection2 T1114 Email Collection1 T1557 Adversary-in-the-Middle1

T1105 Ingress Tool Transfer6 T1071 Application Layer Protocol3 T1090 Proxy3 T1095 Non-Application Layer Protocol1 T1102 Web Service1 T1568 Dynamic Resolution1 T1573 Encrypted Channel1

T1567 Exfiltration Over Web Service4 T1030 Data Transfer Size Limits1 T1041 Exfiltration Over C2 Channel1 T1048 Exfiltration Over Alternative Protocol1

T1489 Service Stop1 T1490 Inhibit System Recovery1