{
  "generated_by": "SOC Response Atlas by Basyrix",
  "techniques": [
    {
      "technique_id": "T1001",
      "name": "Data Obfuscation",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Command and Control"
      ]
    },
    {
      "technique_id": "T1003",
      "name": "OS Credential Dumping",
      "priority": "high",
      "status": "complete",
      "tactics": [
        "Credential Access"
      ]
    },
    {
      "technique_id": "T1005",
      "name": "Data from Local System",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Collection"
      ]
    },
    {
      "technique_id": "T1006",
      "name": "Direct Volume Access",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth"
      ]
    },
    {
      "technique_id": "T1007",
      "name": "System Service Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1008",
      "name": "Fallback Channels",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Command and Control"
      ]
    },
    {
      "technique_id": "T1010",
      "name": "Application Window Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1011",
      "name": "Exfiltration Over Other Network Medium",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Exfiltration"
      ]
    },
    {
      "technique_id": "T1012",
      "name": "Query Registry",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1014",
      "name": "Rootkit",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth"
      ]
    },
    {
      "technique_id": "T1016",
      "name": "System Network Configuration Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1018",
      "name": "Remote System Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1020",
      "name": "Automated Exfiltration",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Exfiltration"
      ]
    },
    {
      "technique_id": "T1021",
      "name": "Remote Services",
      "priority": "medium",
      "status": "complete",
      "tactics": [
        "Lateral Movement"
      ]
    },
    {
      "technique_id": "T1025",
      "name": "Data from Removable Media",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Collection"
      ]
    },
    {
      "technique_id": "T1027",
      "name": "Obfuscated Files or Information",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth"
      ]
    },
    {
      "technique_id": "T1029",
      "name": "Scheduled Transfer",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Exfiltration"
      ]
    },
    {
      "technique_id": "T1030",
      "name": "Data Transfer Size Limits",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Exfiltration"
      ]
    },
    {
      "technique_id": "T1033",
      "name": "System Owner/User Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1036",
      "name": "Masquerading",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth"
      ]
    },
    {
      "technique_id": "T1037",
      "name": "Boot or Logon Initialization Scripts",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Persistence",
        "Privilege Escalation"
      ]
    },
    {
      "technique_id": "T1039",
      "name": "Data from Network Shared Drive",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Collection"
      ]
    },
    {
      "technique_id": "T1040",
      "name": "Network Sniffing",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Credential Access",
        "Discovery"
      ]
    },
    {
      "technique_id": "T1041",
      "name": "Exfiltration Over C2 Channel",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Exfiltration"
      ]
    },
    {
      "technique_id": "T1046",
      "name": "Network Service Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1047",
      "name": "Windows Management Instrumentation",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Execution"
      ]
    },
    {
      "technique_id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Exfiltration"
      ]
    },
    {
      "technique_id": "T1049",
      "name": "System Network Connections Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1052",
      "name": "Exfiltration Over Physical Medium",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Exfiltration"
      ]
    },
    {
      "technique_id": "T1053",
      "name": "Scheduled Task/Job",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Execution",
        "Persistence",
        "Privilege Escalation"
      ]
    },
    {
      "technique_id": "T1055",
      "name": "Process Injection",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth",
        "Privilege Escalation"
      ]
    },
    {
      "technique_id": "T1056",
      "name": "Input Capture",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Collection",
        "Credential Access"
      ]
    },
    {
      "technique_id": "T1057",
      "name": "Process Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1059",
      "name": "Command and Scripting Interpreter",
      "priority": "high",
      "status": "complete",
      "tactics": [
        "Execution"
      ]
    },
    {
      "technique_id": "T1068",
      "name": "Exploitation for Privilege Escalation",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Privilege Escalation"
      ]
    },
    {
      "technique_id": "T1069",
      "name": "Permission Groups Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1070",
      "name": "Indicator Removal",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth"
      ]
    },
    {
      "technique_id": "T1071",
      "name": "Application Layer Protocol",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Command and Control"
      ]
    },
    {
      "technique_id": "T1072",
      "name": "Software Deployment Tools",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Execution",
        "Lateral Movement"
      ]
    },
    {
      "technique_id": "T1074",
      "name": "Data Staged",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Collection"
      ]
    },
    {
      "technique_id": "T1078",
      "name": "Valid Accounts",
      "priority": "high",
      "status": "complete",
      "tactics": [
        "Initial Access",
        "Persistence",
        "Privilege Escalation",
        "Stealth"
      ]
    },
    {
      "technique_id": "T1080",
      "name": "Taint Shared Content",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Lateral Movement"
      ]
    },
    {
      "technique_id": "T1082",
      "name": "System Information Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1083",
      "name": "File and Directory Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1087",
      "name": "Account Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1090",
      "name": "Proxy",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Command and Control"
      ]
    },
    {
      "technique_id": "T1091",
      "name": "Replication Through Removable Media",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Lateral Movement",
        "Initial Access"
      ]
    },
    {
      "technique_id": "T1092",
      "name": "Communication Through Removable Media",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Command and Control"
      ]
    },
    {
      "technique_id": "T1095",
      "name": "Non-Application Layer Protocol",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Command and Control"
      ]
    },
    {
      "technique_id": "T1098",
      "name": "Account Manipulation",
      "priority": "high",
      "status": "complete",
      "tactics": [
        "Persistence",
        "Privilege Escalation"
      ]
    },
    {
      "technique_id": "T1102",
      "name": "Web Service",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Command and Control"
      ]
    },
    {
      "technique_id": "T1104",
      "name": "Multi-Stage Channels",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Command and Control"
      ]
    },
    {
      "technique_id": "T1105",
      "name": "Ingress Tool Transfer",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Command and Control"
      ]
    },
    {
      "technique_id": "T1106",
      "name": "Native API",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Execution"
      ]
    },
    {
      "technique_id": "T1110",
      "name": "Brute Force",
      "priority": "high",
      "status": "complete",
      "tactics": [
        "Credential Access"
      ]
    },
    {
      "technique_id": "T1111",
      "name": "Multi-Factor Authentication Interception",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Credential Access"
      ]
    },
    {
      "technique_id": "T1112",
      "name": "Modify Registry",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Defense Impairment",
        "Persistence"
      ]
    },
    {
      "technique_id": "T1113",
      "name": "Screen Capture",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Collection"
      ]
    },
    {
      "technique_id": "T1114",
      "name": "Email Collection",
      "priority": "medium",
      "status": "complete",
      "tactics": [
        "Collection"
      ]
    },
    {
      "technique_id": "T1115",
      "name": "Clipboard Data",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Collection"
      ]
    },
    {
      "technique_id": "T1119",
      "name": "Automated Collection",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Collection"
      ]
    },
    {
      "technique_id": "T1120",
      "name": "Peripheral Device Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1123",
      "name": "Audio Capture",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Collection"
      ]
    },
    {
      "technique_id": "T1124",
      "name": "System Time Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1125",
      "name": "Video Capture",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Collection"
      ]
    },
    {
      "technique_id": "T1127",
      "name": "Trusted Developer Utilities Proxy Execution",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth",
        "Execution"
      ]
    },
    {
      "technique_id": "T1129",
      "name": "Shared Modules",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Execution"
      ]
    },
    {
      "technique_id": "T1132",
      "name": "Data Encoding",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Command and Control"
      ]
    },
    {
      "technique_id": "T1133",
      "name": "External Remote Services",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Persistence",
        "Initial Access"
      ]
    },
    {
      "technique_id": "T1134",
      "name": "Access Token Manipulation",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth",
        "Privilege Escalation"
      ]
    },
    {
      "technique_id": "T1135",
      "name": "Network Share Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1136",
      "name": "Create Account",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Persistence"
      ]
    },
    {
      "technique_id": "T1137",
      "name": "Office Application Startup",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Persistence"
      ]
    },
    {
      "technique_id": "T1140",
      "name": "Deobfuscate/Decode Files or Information",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth"
      ]
    },
    {
      "technique_id": "T1176",
      "name": "Software Extensions",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Persistence"
      ]
    },
    {
      "technique_id": "T1185",
      "name": "Browser Session Hijacking",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Collection"
      ]
    },
    {
      "technique_id": "T1187",
      "name": "Forced Authentication",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Credential Access"
      ]
    },
    {
      "technique_id": "T1189",
      "name": "Drive-by Compromise",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Initial Access"
      ]
    },
    {
      "technique_id": "T1190",
      "name": "Exploit Public-Facing Application",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Initial Access"
      ]
    },
    {
      "technique_id": "T1195",
      "name": "Supply Chain Compromise",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Initial Access"
      ]
    },
    {
      "technique_id": "T1197",
      "name": "BITS Jobs",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth",
        "Persistence",
        "Execution"
      ]
    },
    {
      "technique_id": "T1199",
      "name": "Trusted Relationship",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Initial Access"
      ]
    },
    {
      "technique_id": "T1200",
      "name": "Hardware Additions",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Initial Access"
      ]
    },
    {
      "technique_id": "T1201",
      "name": "Password Policy Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1202",
      "name": "Indirect Command Execution",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth"
      ]
    },
    {
      "technique_id": "T1203",
      "name": "Exploitation for Client Execution",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Execution"
      ]
    },
    {
      "technique_id": "T1204",
      "name": "User Execution",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Execution"
      ]
    },
    {
      "technique_id": "T1205",
      "name": "Traffic Signaling",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth",
        "Persistence",
        "Command and Control"
      ]
    },
    {
      "technique_id": "T1207",
      "name": "Rogue Domain Controller",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Defense Impairment"
      ]
    },
    {
      "technique_id": "T1210",
      "name": "Exploitation of Remote Services",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Lateral Movement"
      ]
    },
    {
      "technique_id": "T1211",
      "name": "Exploitation for Stealth",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth"
      ]
    },
    {
      "technique_id": "T1212",
      "name": "Exploitation for Credential Access",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Credential Access"
      ]
    },
    {
      "technique_id": "T1213",
      "name": "Data from Information Repositories",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Collection"
      ]
    },
    {
      "technique_id": "T1216",
      "name": "System Script Proxy Execution",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth"
      ]
    },
    {
      "technique_id": "T1217",
      "name": "Browser Information Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1218",
      "name": "System Binary Proxy Execution",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth"
      ]
    },
    {
      "technique_id": "T1219",
      "name": "Remote Access Tools",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Command and Control"
      ]
    },
    {
      "technique_id": "T1220",
      "name": "XSL Script Processing",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth"
      ]
    },
    {
      "technique_id": "T1221",
      "name": "Template Injection",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth"
      ]
    },
    {
      "technique_id": "T1222",
      "name": "File and Directory Permissions Modification",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Defense Impairment"
      ]
    },
    {
      "technique_id": "T1480",
      "name": "Execution Guardrails",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth"
      ]
    },
    {
      "technique_id": "T1482",
      "name": "Domain Trust Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1484",
      "name": "Domain or Tenant Policy Modification",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Defense Impairment",
        "Privilege Escalation"
      ]
    },
    {
      "technique_id": "T1485",
      "name": "Data Destruction",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Impact"
      ]
    },
    {
      "technique_id": "T1486",
      "name": "Data Encrypted for Impact",
      "priority": "high",
      "status": "complete",
      "tactics": [
        "Impact"
      ]
    },
    {
      "technique_id": "T1489",
      "name": "Service Stop",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Impact"
      ]
    },
    {
      "technique_id": "T1490",
      "name": "Inhibit System Recovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Impact"
      ]
    },
    {
      "technique_id": "T1491",
      "name": "Defacement",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Impact"
      ]
    },
    {
      "technique_id": "T1495",
      "name": "Firmware Corruption",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Impact"
      ]
    },
    {
      "technique_id": "T1496",
      "name": "Resource Hijacking",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Impact"
      ]
    },
    {
      "technique_id": "T1497",
      "name": "Virtualization/Sandbox Evasion",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth",
        "Discovery"
      ]
    },
    {
      "technique_id": "T1498",
      "name": "Network Denial of Service",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Impact"
      ]
    },
    {
      "technique_id": "T1499",
      "name": "Endpoint Denial of Service",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Impact"
      ]
    },
    {
      "technique_id": "T1505",
      "name": "Server Software Component",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Persistence"
      ]
    },
    {
      "technique_id": "T1518",
      "name": "Software Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1525",
      "name": "Implant Internal Image",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Persistence"
      ]
    },
    {
      "technique_id": "T1526",
      "name": "Cloud Service Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1528",
      "name": "Steal Application Access Token",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Credential Access"
      ]
    },
    {
      "technique_id": "T1529",
      "name": "System Shutdown/Reboot",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Impact"
      ]
    },
    {
      "technique_id": "T1530",
      "name": "Data from Cloud Storage",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Collection"
      ]
    },
    {
      "technique_id": "T1531",
      "name": "Account Access Removal",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Impact"
      ]
    },
    {
      "technique_id": "T1534",
      "name": "Internal Spearphishing",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Lateral Movement"
      ]
    },
    {
      "technique_id": "T1535",
      "name": "Unused/Unsupported Cloud Regions",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth"
      ]
    },
    {
      "technique_id": "T1537",
      "name": "Transfer Data to Cloud Account",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Exfiltration"
      ]
    },
    {
      "technique_id": "T1538",
      "name": "Cloud Service Dashboard",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1539",
      "name": "Steal Web Session Cookie",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Credential Access"
      ]
    },
    {
      "technique_id": "T1542",
      "name": "Pre-OS Boot",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth",
        "Persistence"
      ]
    },
    {
      "technique_id": "T1543",
      "name": "Create or Modify System Process",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Persistence",
        "Privilege Escalation"
      ]
    },
    {
      "technique_id": "T1546",
      "name": "Event Triggered Execution",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Privilege Escalation",
        "Persistence"
      ]
    },
    {
      "technique_id": "T1547",
      "name": "Boot or Logon Autostart Execution",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Persistence",
        "Privilege Escalation"
      ]
    },
    {
      "technique_id": "T1548",
      "name": "Abuse Elevation Control Mechanism",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Privilege Escalation"
      ]
    },
    {
      "technique_id": "T1550",
      "name": "Use Alternate Authentication Material",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Lateral Movement"
      ]
    },
    {
      "technique_id": "T1552",
      "name": "Unsecured Credentials",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Credential Access"
      ]
    },
    {
      "technique_id": "T1553",
      "name": "Subvert Trust Controls",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Defense Impairment"
      ]
    },
    {
      "technique_id": "T1554",
      "name": "Compromise Host Software Binary",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Persistence"
      ]
    },
    {
      "technique_id": "T1555",
      "name": "Credentials from Password Stores",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Credential Access"
      ]
    },
    {
      "technique_id": "T1556",
      "name": "Modify Authentication Process",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Defense Impairment",
        "Persistence",
        "Credential Access"
      ]
    },
    {
      "technique_id": "T1557",
      "name": "Adversary-in-the-Middle",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Credential Access",
        "Collection"
      ]
    },
    {
      "technique_id": "T1558",
      "name": "Steal or Forge Kerberos Tickets",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Credential Access"
      ]
    },
    {
      "technique_id": "T1559",
      "name": "Inter-Process Communication",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Execution"
      ]
    },
    {
      "technique_id": "T1560",
      "name": "Archive Collected Data",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Collection"
      ]
    },
    {
      "technique_id": "T1561",
      "name": "Disk Wipe",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Impact"
      ]
    },
    {
      "technique_id": "T1563",
      "name": "Remote Service Session Hijacking",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Lateral Movement"
      ]
    },
    {
      "technique_id": "T1564",
      "name": "Hide Artifacts",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth"
      ]
    },
    {
      "technique_id": "T1565",
      "name": "Data Manipulation",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Impact"
      ]
    },
    {
      "technique_id": "T1566",
      "name": "Phishing",
      "priority": "high",
      "status": "complete",
      "tactics": [
        "Initial Access"
      ]
    },
    {
      "technique_id": "T1567",
      "name": "Exfiltration Over Web Service",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Exfiltration"
      ]
    },
    {
      "technique_id": "T1568",
      "name": "Dynamic Resolution",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Command and Control"
      ]
    },
    {
      "technique_id": "T1569",
      "name": "System Services",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Execution"
      ]
    },
    {
      "technique_id": "T1570",
      "name": "Lateral Tool Transfer",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Lateral Movement"
      ]
    },
    {
      "technique_id": "T1571",
      "name": "Non-Standard Port",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Command and Control"
      ]
    },
    {
      "technique_id": "T1572",
      "name": "Protocol Tunneling",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Command and Control"
      ]
    },
    {
      "technique_id": "T1573",
      "name": "Encrypted Channel",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Command and Control"
      ]
    },
    {
      "technique_id": "T1574",
      "name": "Hijack Execution Flow",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth",
        "Execution"
      ]
    },
    {
      "technique_id": "T1578",
      "name": "Modify Cloud Compute Infrastructure",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Defense Impairment"
      ]
    },
    {
      "technique_id": "T1580",
      "name": "Cloud Infrastructure Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1583",
      "name": "Acquire Infrastructure",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Resource Development"
      ]
    },
    {
      "technique_id": "T1584",
      "name": "Compromise Infrastructure",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Resource Development"
      ]
    },
    {
      "technique_id": "T1585",
      "name": "Establish Accounts",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Resource Development"
      ]
    },
    {
      "technique_id": "T1586",
      "name": "Compromise Accounts",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Resource Development"
      ]
    },
    {
      "technique_id": "T1587",
      "name": "Develop Capabilities",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Resource Development"
      ]
    },
    {
      "technique_id": "T1588",
      "name": "Obtain Capabilities",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Resource Development"
      ]
    },
    {
      "technique_id": "T1589",
      "name": "Gather Victim Identity Information",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Reconnaissance"
      ]
    },
    {
      "technique_id": "T1590",
      "name": "Gather Victim Network Information",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Reconnaissance"
      ]
    },
    {
      "technique_id": "T1591",
      "name": "Gather Victim Org Information",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Reconnaissance"
      ]
    },
    {
      "technique_id": "T1592",
      "name": "Gather Victim Host Information",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Reconnaissance"
      ]
    },
    {
      "technique_id": "T1593",
      "name": "Search Open Websites/Domains",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Reconnaissance"
      ]
    },
    {
      "technique_id": "T1594",
      "name": "Search Victim-Owned Websites",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Reconnaissance"
      ]
    },
    {
      "technique_id": "T1595",
      "name": "Active Scanning",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Reconnaissance"
      ]
    },
    {
      "technique_id": "T1596",
      "name": "Search Open Technical Databases",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Reconnaissance"
      ]
    },
    {
      "technique_id": "T1597",
      "name": "Search Closed Sources",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Reconnaissance"
      ]
    },
    {
      "technique_id": "T1598",
      "name": "Phishing for Information",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Reconnaissance"
      ]
    },
    {
      "technique_id": "T1599",
      "name": "Network Boundary Bridging",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Defense Impairment"
      ]
    },
    {
      "technique_id": "T1600",
      "name": "Weaken Encryption",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Defense Impairment"
      ]
    },
    {
      "technique_id": "T1601",
      "name": "Modify System Image",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Defense Impairment"
      ]
    },
    {
      "technique_id": "T1602",
      "name": "Data from Configuration Repository",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Collection"
      ]
    },
    {
      "technique_id": "T1606",
      "name": "Forge Web Credentials",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Credential Access"
      ]
    },
    {
      "technique_id": "T1608",
      "name": "Stage Capabilities",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Resource Development"
      ]
    },
    {
      "technique_id": "T1609",
      "name": "Container Administration Command",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Execution"
      ]
    },
    {
      "technique_id": "T1610",
      "name": "Deploy Container",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Execution"
      ]
    },
    {
      "technique_id": "T1611",
      "name": "Escape to Host",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Privilege Escalation"
      ]
    },
    {
      "technique_id": "T1612",
      "name": "Build Image on Host",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth"
      ]
    },
    {
      "technique_id": "T1613",
      "name": "Container and Resource Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1614",
      "name": "System Location Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1615",
      "name": "Group Policy Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1619",
      "name": "Cloud Storage Object Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1620",
      "name": "Reflective Code Loading",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth"
      ]
    },
    {
      "technique_id": "T1621",
      "name": "Multi-Factor Authentication Request Generation",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Credential Access"
      ]
    },
    {
      "technique_id": "T1622",
      "name": "Debugger Evasion",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth",
        "Discovery"
      ]
    },
    {
      "technique_id": "T1647",
      "name": "Plist File Modification",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Defense Impairment"
      ]
    },
    {
      "technique_id": "T1648",
      "name": "Serverless Execution",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Execution"
      ]
    },
    {
      "technique_id": "T1649",
      "name": "Steal or Forge Authentication Certificates",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Credential Access"
      ]
    },
    {
      "technique_id": "T1650",
      "name": "Acquire Access",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Resource Development"
      ]
    },
    {
      "technique_id": "T1651",
      "name": "Cloud Administration Command",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Execution"
      ]
    },
    {
      "technique_id": "T1652",
      "name": "Device Driver Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1653",
      "name": "Power Settings",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Persistence"
      ]
    },
    {
      "technique_id": "T1654",
      "name": "Log Enumeration",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1657",
      "name": "Financial Theft",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Impact"
      ]
    },
    {
      "technique_id": "T1659",
      "name": "Content Injection",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Initial Access",
        "Command and Control"
      ]
    },
    {
      "technique_id": "T1665",
      "name": "Hide Infrastructure",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Command and Control"
      ]
    },
    {
      "technique_id": "T1666",
      "name": "Modify Cloud Resource Hierarchy",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Defense Impairment"
      ]
    },
    {
      "technique_id": "T1667",
      "name": "Email Bombing",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Impact"
      ]
    },
    {
      "technique_id": "T1668",
      "name": "Exclusive Control",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Persistence"
      ]
    },
    {
      "technique_id": "T1669",
      "name": "Wi-Fi Networks",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Initial Access"
      ]
    },
    {
      "technique_id": "T1671",
      "name": "Cloud Application Integration",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Persistence"
      ]
    },
    {
      "technique_id": "T1673",
      "name": "Virtual Machine Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1674",
      "name": "Input Injection",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Execution"
      ]
    },
    {
      "technique_id": "T1675",
      "name": "ESXi Administration Command",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Execution"
      ]
    },
    {
      "technique_id": "T1677",
      "name": "Poisoned Pipeline Execution",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Execution"
      ]
    },
    {
      "technique_id": "T1678",
      "name": "Delay Execution",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth"
      ]
    },
    {
      "technique_id": "T1679",
      "name": "Selective Exclusion",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth"
      ]
    },
    {
      "technique_id": "T1680",
      "name": "Local Storage Discovery",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Discovery"
      ]
    },
    {
      "technique_id": "T1681",
      "name": "Search Threat Vendor Data",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Reconnaissance"
      ]
    },
    {
      "technique_id": "T1682",
      "name": "Query Public AI Services",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Reconnaissance"
      ]
    },
    {
      "technique_id": "T1683",
      "name": "Generate Content",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Resource Development"
      ]
    },
    {
      "technique_id": "T1684",
      "name": "Social Engineering",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Stealth"
      ]
    },
    {
      "technique_id": "T1685",
      "name": "Disable or Modify Tools",
      "priority": "high",
      "status": "complete",
      "tactics": [
        "Defense Impairment"
      ]
    },
    {
      "technique_id": "T1686",
      "name": "Disable or Modify System Firewall",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Defense Impairment"
      ]
    },
    {
      "technique_id": "T1687",
      "name": "Exploitation for Defense Impairment",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Defense Impairment"
      ]
    },
    {
      "technique_id": "T1688",
      "name": "Safe Mode Boot",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Defense Impairment"
      ]
    },
    {
      "technique_id": "T1689",
      "name": "Downgrade Attack",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Defense Impairment"
      ]
    },
    {
      "technique_id": "T1690",
      "name": "Prevent Command History Logging",
      "priority": "medium",
      "status": "draft",
      "tactics": [
        "Defense Impairment"
      ]
    }
  ]
}