{
  "_about": "Maps MITRE ATT&CK techniques to the SecSkills skills that cover them. Consumed by the mapping-attack-techniques skill and by scripts/sync_attack.py, which generates the '## ATT&CK Coverage' section inside each mapped SKILL.md. Edit this file, then run: python3 scripts/sync_attack.py --write",
  "_accuracy": "Technique IDs and names are curated by hand and drift as ATT&CK releases new versions. scripts/sync_attack.py checks internal consistency only, not agreement with upstream. Re-verify against the current release at https://attack.mitre.org before relying on an ID in a report.",
  "_universal": {
    "note": "Every technique in this index is detectable and huntable. Rather than repeating them on every row, treat these as applying throughout.",
    "detection": "engineering-detections",
    "hunting": "hunting-threats",
    "response": "responding-to-incidents",
    "reporting": "reporting-security-findings"
  },
  "_unmapped": {
    "note": "Skills with no ATT&CK Enterprise mapping, and the framework that fits instead.",
    "securing-ai-systems": "MITRE ATLAS (AML.T####) and the OWASP Top 10 for LLM / Agentic Applications",
    "testing-mobile-applications": "ATT&CK Mobile matrix and OWASP MASVS — the Enterprise IDs do not apply",
    "exploiting-web3-smart-contracts": "No ATT&CK equivalent; use SWC registry and DASP classifications",
    "auditing-code-for-vulnerabilities": "Pre-attack. Use CWE and OWASP ASVS",
    "reviewing-code-changes": "Pre-attack. Use CWE",
    "reviewing-cryptography": "Pre-attack. Use CWE-310 family",
    "reporting-security-findings": "Process skill, not a technique",
    "mapping-attack-techniques": "Router over this index; it points at other skills rather than covering techniques itself",
    "producing-threat-intelligence": "CTI tradecraft; consumes and produces ATT&CK mappings via mapping-attack-techniques rather than covering techniques itself",
    "analyzing-go-binaries": "Procedure skill (Go pclntab recovery + GoReSym/redress). Tool-and-artifact scoped, not a technique",
    "analyzing-dotnet-assemblies": "Procedure skill (.NET IL + dnSpyEx/de4dot). Tool-and-artifact scoped, not a technique",
    "analyzing-rust-binaries": "Procedure skill (Rust demangling + rustfilt). Tool-and-artifact scoped, not a technique",
    "unpacking-protected-binaries": "Procedure skill (packers/protectors + x64dbg/Scylla/pe-sieve). Tool-and-artifact scoped, not a technique",
    "reversing-xamarin-maui": "Procedure skill (Xamarin/MAUI + pyxamstore). Tool-and-artifact scoped, not a technique",
    "bypassing-root-jailbreak-detection": "Procedure skill (root/jailbreak/Frida detection + Magisk/objection). Tool-and-artifact scoped, not a technique",
    "analyzing-ios-binaries": "Procedure skill (Mach-O/FairPlay + frida-ios-dump, class-dump). Tool-and-artifact scoped, not a technique",
    "testing-mobile-ipc": "Procedure skill (Android IPC and iOS URL schemes + drozer/adb). Tool-and-artifact scoped, not a technique",
    "bypassing-mobile-pinning": "Procedure skill (TLS interception + objection/Frida/SSL Kill Switch). Tool-and-artifact scoped, not a technique",
    "reversing-flutter-apps": "Procedure skill (Flutter/Dart + blutter). Tool-and-artifact scoped, not a technique",
    "reversing-react-native-apps": "Procedure skill (React Native/Hermes + hbctool). Tool-and-artifact scoped, not a technique",
    "reversing-obfuscated-javascript": "Reverse-engineering craft (JS deobfuscation, unbundling, sourcemap recovery). Not an Enterprise technique",
    "reversing-unity-il2cpp": "Procedure skill (Unity IL2CPP + Il2CppDumper). Tool-and-artifact scoped, not a technique",
    "analyzing-memory-images": "Procedure skill (RAM forensics + Volatility 3). Analysis method, not a technique",
    "investigating-m365-entra": "Procedure skill (M365/Entra cloud-log DFIR + UAL/sign-in logs). Investigation method, not a technique",
    "analyzing-linux-persistence": "Procedure skill (Linux persistence sweep, forensic). Analysis method covering many T1053/T1543/T1546 sub-techniques at once",
    "writing-sigma-rules": "Procedure skill (Sigma authoring + sigma-cli/pySigma). Detection-engineering craft, not a technique",
    "testing-ics-ot-protocols": "ATT&CK for ICS matrix (T0### series) and IEC 62443 — the Enterprise IDs do not apply",
    "analyzing-firmware-images": "Procedure skill (firmware extraction + binwalk/FirmAE). Tool-and-artifact scoped, not a technique",
    "attacking-bluetooth-nfc": "Procedure skill (BLE/NFC RF + Proxmark3/gatttool). Radio-and-hardware scoped, not an Enterprise technique",
    "auditing-mcp-servers": "MITRE ATLAS and the OWASP Top 10 for LLM / Agentic Applications — pre-attack review, not a technique",
    "vetting-agent-extensions": "OWASP Top 10 for Agentic Applications (ASI01-ASI10) and the OWASP Top 10 for LLM Applications, plus MITRE ATLAS — a pre-adoption trust decision, not a technique",
    "writing-yara-rules": "Procedure skill (YARA authoring + yarGen/YARA-X). Detection-engineering craft, not a technique",
    "investigating-aws-incidents": "Procedure skill (AWS CloudTrail/GuardDuty cloud-log DFIR). Investigation method, not a technique",
    "investigating-azure-incidents": "Procedure skill (Azure Activity Log/Defender for Cloud DFIR). Investigation method, not a technique",
    "investigating-windows-endpoints": "Procedure skill (Windows host DFIR: EVTX/registry/prefetch/$MFT). Investigation method, not a technique",
    "analyzing-disk-images": "Procedure skill (dead-disk forensics + Sleuth Kit/Plaso). Analysis method, not a technique",
    "recognizing-deception": "MITRE Engage (deception and adversary engagement), not Enterprise ATT&CK -- ATT&CK models adversary behaviour, not the defender's decoys an adversary encounters",
    "maintaining-engagement-state": "Engagement process discipline, not an adversary technique",
    "triaging-security-alerts": "Defensive process; the techniques appear in whatever alert is being worked, not in the triage method itself",
    "investigating-gcp-incidents": "Enterprise ATT&CK techniques appear in the activity investigated, not in the investigation method; this is a cloud-IR process skill like its AWS/Azure siblings",
    "defending-kubernetes": "Defensive hardening and detection for containers/orchestration; the techniques it defends against are mapped under the offensive container skills",
    "hardening-cloud-posture": "Proactive defensive process; no adversary technique of its own",
    "managing-vulnerabilities": "Vulnerability-management process; not an ATT&CK technique",
    "hunting-web-backdoors": "Web-shell hunting maps loosely to T1505.003 (Server Software Component: Web Shell) but this is defensive discovery of planted code, not the adversary technique; kept unmapped like the other audit skills",
    "auditing-php-applications": "Source-code vulnerability audit; CWE-based, not an ATT&CK technique — same rationale as auditing-code-for-vulnerabilities",
    "orchestrating-vulnerability-research": "Pre-attack research orchestration; no ATT&CK technique. Weaknesses it discovers are classified by CWE / OWASP ASVS, and exploited paths map under the specific attack skills it dispatches.",
    "diffing-binary-patches": "Reverse-engineering craft (binary patch diffing for 1-day analysis). Not an Enterprise technique",
    "testing-thick-clients": "OWASP thick-client testing methodology; a testing method spanning many techniques (T1552 creds, T1005 local data, T1574 hijacking), not one Enterprise technique",
    "reversing-browser-extensions": "RE and security-review craft for extensions; the adversary technique it analyzes is T1176.001/002 (Browser Extensions), but this is defensive analysis of the code, kept unmapped like the other reversing skills",
    "analyzing-macos-binaries": "Procedure skill (macOS Mach-O RE + otool/class-dump/codesign, XPC/TCC/dylib review). Tool-and-artifact scoped, not a technique",
    "reversing-network-protocols": "Reverse-engineering craft (undocumented binary protocol recovery from captures + client). Not an Enterprise technique",
    "devirtualizing-vm-protected-code": "Procedure skill (VM-obfuscation lifting + Triton/miasm/VTIL). Tool-and-artifact scoped, not a technique",
    "attacking-hardware-interfaces": "Radio-and-hardware scoped (UART/JTAG/SPI + SDR feasibility). Physical/RF surface, not an Enterprise technique -- like attacking-bluetooth-nfc"
  },
  "tactics": {
    "TA0043": "Reconnaissance",
    "TA0042": "Resource Development",
    "TA0001": "Initial Access",
    "TA0002": "Execution",
    "TA0003": "Persistence",
    "TA0004": "Privilege Escalation",
    "TA0005": "Defense Evasion",
    "TA0006": "Credential Access",
    "TA0007": "Discovery",
    "TA0008": "Lateral Movement",
    "TA0009": "Collection",
    "TA0011": "Command and Control",
    "TA0010": "Exfiltration",
    "TA0040": "Impact"
  },
  "techniques": [
    {
      "id": "T1595",
      "name": "Active Scanning",
      "tactics": [
        "TA0043"
      ],
      "skills": [
        "performing-reconnaissance",
        "enumerating-network-services"
      ]
    },
    {
      "id": "T1595.002",
      "name": "Vulnerability Scanning",
      "tactics": [
        "TA0043"
      ],
      "skills": [
        "enumerating-network-services"
      ]
    },
    {
      "id": "T1590",
      "name": "Gather Victim Network Information",
      "tactics": [
        "TA0043"
      ],
      "skills": [
        "performing-reconnaissance"
      ]
    },
    {
      "id": "T1589",
      "name": "Gather Victim Identity Information",
      "tactics": [
        "TA0043"
      ],
      "skills": [
        "performing-reconnaissance",
        "performing-social-engineering"
      ]
    },
    {
      "id": "T1591",
      "name": "Gather Victim Org Information",
      "tactics": [
        "TA0043"
      ],
      "skills": [
        "performing-reconnaissance",
        "performing-social-engineering"
      ]
    },
    {
      "id": "T1592",
      "name": "Gather Victim Host Information",
      "tactics": [
        "TA0043"
      ],
      "skills": [
        "performing-reconnaissance"
      ]
    },
    {
      "id": "T1593",
      "name": "Search Open Websites/Domains",
      "tactics": [
        "TA0043"
      ],
      "skills": [
        "performing-reconnaissance"
      ]
    },
    {
      "id": "T1594",
      "name": "Search Victim-Owned Websites",
      "tactics": [
        "TA0043"
      ],
      "skills": [
        "performing-reconnaissance"
      ]
    },
    {
      "id": "T1596",
      "name": "Search Open Technical Databases",
      "tactics": [
        "TA0043"
      ],
      "skills": [
        "performing-reconnaissance"
      ]
    },
    {
      "id": "T1598",
      "name": "Phishing for Information",
      "tactics": [
        "TA0043"
      ],
      "skills": [
        "performing-social-engineering",
        "analyzing-phishing-emails"
      ]
    },
    {
      "id": "T1583",
      "name": "Acquire Infrastructure",
      "tactics": [
        "TA0042"
      ],
      "skills": [
        "performing-social-engineering"
      ]
    },
    {
      "id": "T1585",
      "name": "Establish Accounts",
      "tactics": [
        "TA0042"
      ],
      "skills": [
        "performing-social-engineering"
      ]
    },
    {
      "id": "T1588",
      "name": "Obtain Capabilities",
      "tactics": [
        "TA0042"
      ],
      "skills": [
        "analyzing-malware"
      ]
    },
    {
      "id": "T1608",
      "name": "Stage Capabilities",
      "tactics": [
        "TA0042"
      ],
      "skills": [
        "performing-social-engineering",
        "transferring-files"
      ]
    },
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "tactics": [
        "TA0001"
      ],
      "skills": [
        "testing-web-applications",
        "testing-apis",
        "enumerating-network-services",
        "attacking-graphql",
        "attacking-grpc-protobuf",
        "exploiting-deserialization",
        "exploiting-ssrf",
        "exploiting-xxe"
      ]
    },
    {
      "id": "T1566",
      "name": "Phishing",
      "tactics": [
        "TA0001"
      ],
      "skills": [
        "performing-social-engineering",
        "analyzing-phishing-emails"
      ]
    },
    {
      "id": "T1566.001",
      "name": "Spearphishing Attachment",
      "tactics": [
        "TA0001"
      ],
      "skills": [
        "performing-social-engineering",
        "analyzing-malware",
        "analyzing-phishing-emails"
      ]
    },
    {
      "id": "T1566.002",
      "name": "Spearphishing Link",
      "tactics": [
        "TA0001"
      ],
      "skills": [
        "performing-social-engineering",
        "analyzing-phishing-emails"
      ]
    },
    {
      "id": "T1078",
      "name": "Valid Accounts",
      "tactics": [
        "TA0001",
        "TA0003",
        "TA0004",
        "TA0005"
      ],
      "skills": [
        "cracking-passwords",
        "attacking-active-directory",
        "exploiting-cloud-platforms"
      ]
    },
    {
      "id": "T1078.004",
      "name": "Cloud Accounts",
      "tactics": [
        "TA0001",
        "TA0003"
      ],
      "skills": [
        "exploiting-cloud-platforms",
        "attacking-entra-id"
      ]
    },
    {
      "id": "T1133",
      "name": "External Remote Services",
      "tactics": [
        "TA0001",
        "TA0003"
      ],
      "skills": [
        "enumerating-network-services"
      ]
    },
    {
      "id": "T1195",
      "name": "Supply Chain Compromise",
      "tactics": [
        "TA0001"
      ],
      "skills": [
        "auditing-supply-chain"
      ]
    },
    {
      "id": "T1195.001",
      "name": "Compromise Software Dependencies and Development Tools",
      "tactics": [
        "TA0001"
      ],
      "skills": [
        "auditing-supply-chain"
      ]
    },
    {
      "id": "T1195.002",
      "name": "Compromise Software Supply Chain",
      "tactics": [
        "TA0001"
      ],
      "skills": [
        "auditing-supply-chain"
      ]
    },
    {
      "id": "T1199",
      "name": "Trusted Relationship",
      "tactics": [
        "TA0001"
      ],
      "skills": [
        "exploiting-cloud-platforms",
        "abusing-ci-cd-oidc",
        "attacking-entra-id"
      ]
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactics": [
        "TA0001"
      ],
      "skills": [
        "performing-social-engineering"
      ]
    },
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactics": [
        "TA0002"
      ],
      "skills": [
        "testing-web-applications",
        "enumerating-network-services"
      ]
    },
    {
      "id": "T1059.001",
      "name": "PowerShell",
      "tactics": [
        "TA0002"
      ],
      "skills": [
        "escalating-windows-privileges",
        "analyzing-malware"
      ]
    },
    {
      "id": "T1059.004",
      "name": "Unix Shell",
      "tactics": [
        "TA0002"
      ],
      "skills": [
        "escalating-linux-privileges"
      ]
    },
    {
      "id": "T1203",
      "name": "Exploitation for Client Execution",
      "tactics": [
        "TA0002"
      ],
      "skills": [
        "performing-social-engineering",
        "analyzing-malware",
        "exploiting-memory-corruption"
      ]
    },
    {
      "id": "T1204",
      "name": "User Execution",
      "tactics": [
        "TA0002"
      ],
      "skills": [
        "performing-social-engineering"
      ]
    },
    {
      "id": "T1047",
      "name": "Windows Management Instrumentation",
      "tactics": [
        "TA0002"
      ],
      "skills": [
        "attacking-active-directory",
        "escalating-windows-privileges"
      ]
    },
    {
      "id": "T1569",
      "name": "System Services",
      "tactics": [
        "TA0002"
      ],
      "skills": [
        "escalating-windows-privileges",
        "attacking-active-directory"
      ]
    },
    {
      "id": "T1609",
      "name": "Container Administration Command",
      "tactics": [
        "TA0002"
      ],
      "skills": [
        "exploiting-containers"
      ]
    },
    {
      "id": "T1610",
      "name": "Deploy Container",
      "tactics": [
        "TA0002",
        "TA0005"
      ],
      "skills": [
        "exploiting-containers",
        "attacking-eks-gke-aks"
      ]
    },
    {
      "id": "T1648",
      "name": "Serverless Execution",
      "tactics": [
        "TA0002"
      ],
      "skills": [
        "attacking-serverless"
      ]
    },
    {
      "id": "T1053",
      "name": "Scheduled Task/Job",
      "tactics": [
        "TA0002",
        "TA0003",
        "TA0004"
      ],
      "skills": [
        "establishing-persistence"
      ]
    },
    {
      "id": "T1053.003",
      "name": "Cron",
      "tactics": [
        "TA0003"
      ],
      "skills": [
        "establishing-persistence",
        "escalating-linux-privileges"
      ]
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task",
      "tactics": [
        "TA0003"
      ],
      "skills": [
        "establishing-persistence"
      ]
    },
    {
      "id": "T1543",
      "name": "Create or Modify System Process",
      "tactics": [
        "TA0003",
        "TA0004"
      ],
      "skills": [
        "establishing-persistence"
      ]
    },
    {
      "id": "T1543.002",
      "name": "Systemd Service",
      "tactics": [
        "TA0003"
      ],
      "skills": [
        "establishing-persistence",
        "escalating-linux-privileges"
      ]
    },
    {
      "id": "T1543.003",
      "name": "Windows Service",
      "tactics": [
        "TA0003"
      ],
      "skills": [
        "establishing-persistence",
        "escalating-windows-privileges"
      ]
    },
    {
      "id": "T1547",
      "name": "Boot or Logon Autostart Execution",
      "tactics": [
        "TA0003",
        "TA0004"
      ],
      "skills": [
        "establishing-persistence"
      ]
    },
    {
      "id": "T1547.001",
      "name": "Registry Run Keys / Startup Folder",
      "tactics": [
        "TA0003"
      ],
      "skills": [
        "establishing-persistence"
      ]
    },
    {
      "id": "T1546",
      "name": "Event Triggered Execution",
      "tactics": [
        "TA0003",
        "TA0004"
      ],
      "skills": [
        "establishing-persistence"
      ]
    },
    {
      "id": "T1546.003",
      "name": "Windows Management Instrumentation Event Subscription",
      "tactics": [
        "TA0003"
      ],
      "skills": [
        "establishing-persistence",
        "hunting-threats"
      ]
    },
    {
      "id": "T1136",
      "name": "Create Account",
      "tactics": [
        "TA0003"
      ],
      "skills": [
        "establishing-persistence",
        "attacking-active-directory"
      ]
    },
    {
      "id": "T1098",
      "name": "Account Manipulation",
      "tactics": [
        "TA0003",
        "TA0004"
      ],
      "skills": [
        "establishing-persistence",
        "attacking-active-directory"
      ]
    },
    {
      "id": "T1098.001",
      "name": "Additional Cloud Credentials",
      "tactics": [
        "TA0003"
      ],
      "skills": [
        "exploiting-cloud-platforms",
        "responding-to-incidents"
      ]
    },
    {
      "id": "T1098.002",
      "name": "Additional Email Delegate Permissions",
      "tactics": [
        "TA0003"
      ],
      "skills": [
        "responding-to-incidents"
      ]
    },
    {
      "id": "T1505.003",
      "name": "Web Shell",
      "tactics": [
        "TA0003"
      ],
      "skills": [
        "testing-web-applications",
        "establishing-persistence"
      ]
    },
    {
      "id": "T1556",
      "name": "Modify Authentication Process",
      "tactics": [
        "TA0003",
        "TA0006"
      ],
      "skills": [
        "establishing-persistence",
        "attacking-active-directory"
      ]
    },
    {
      "id": "T1574",
      "name": "Hijack Execution Flow",
      "tactics": [
        "TA0003",
        "TA0004",
        "TA0005"
      ],
      "skills": [
        "escalating-windows-privileges"
      ]
    },
    {
      "id": "T1574.001",
      "name": "DLL",
      "tactics": [
        "TA0004"
      ],
      "skills": [
        "escalating-windows-privileges"
      ]
    },
    {
      "id": "T1068",
      "name": "Exploitation for Privilege Escalation",
      "tactics": [
        "TA0004"
      ],
      "skills": [
        "escalating-linux-privileges",
        "escalating-windows-privileges",
        "exploiting-memory-corruption"
      ]
    },
    {
      "id": "T1548",
      "name": "Abuse Elevation Control Mechanism",
      "tactics": [
        "TA0004",
        "TA0005"
      ],
      "skills": [
        "escalating-linux-privileges",
        "escalating-windows-privileges"
      ]
    },
    {
      "id": "T1548.001",
      "name": "Setuid and Setgid",
      "tactics": [
        "TA0004"
      ],
      "skills": [
        "escalating-linux-privileges"
      ]
    },
    {
      "id": "T1548.002",
      "name": "Bypass User Account Control",
      "tactics": [
        "TA0004"
      ],
      "skills": [
        "escalating-windows-privileges"
      ]
    },
    {
      "id": "T1548.003",
      "name": "Sudo and Sudo Caching",
      "tactics": [
        "TA0004"
      ],
      "skills": [
        "escalating-linux-privileges"
      ]
    },
    {
      "id": "T1134",
      "name": "Access Token Manipulation",
      "tactics": [
        "TA0004",
        "TA0005"
      ],
      "skills": [
        "escalating-windows-privileges"
      ]
    },
    {
      "id": "T1484",
      "name": "Domain or Tenant Policy Modification",
      "tactics": [
        "TA0004",
        "TA0005"
      ],
      "skills": [
        "attacking-active-directory"
      ]
    },
    {
      "id": "T1611",
      "name": "Escape to Host",
      "tactics": [
        "TA0004"
      ],
      "skills": [
        "exploiting-containers",
        "escaping-hardened-containers"
      ]
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactics": [
        "TA0004",
        "TA0005"
      ],
      "skills": [
        "analyzing-malware",
        "escalating-windows-privileges"
      ]
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactics": [
        "TA0005"
      ],
      "skills": [
        "analyzing-malware",
        "analyzing-binaries",
        "analyzing-shellcode"
      ]
    },
    {
      "id": "T1027.002",
      "name": "Software Packing",
      "tactics": [
        "TA0005"
      ],
      "skills": [
        "analyzing-binaries",
        "analyzing-malware"
      ]
    },
    {
      "id": "T1140",
      "name": "Deobfuscate/Decode Files or Information",
      "tactics": [
        "TA0005"
      ],
      "skills": [
        "analyzing-malware",
        "analyzing-binaries",
        "analyzing-shellcode"
      ]
    },
    {
      "id": "T1070",
      "name": "Indicator Removal",
      "tactics": [
        "TA0005"
      ],
      "skills": [
        "responding-to-incidents"
      ]
    },
    {
      "id": "T1070.001",
      "name": "Clear Windows Event Logs",
      "tactics": [
        "TA0005"
      ],
      "skills": [
        "responding-to-incidents",
        "hunting-threats"
      ]
    },
    {
      "id": "T1070.006",
      "name": "Timestomp",
      "tactics": [
        "TA0005"
      ],
      "skills": [
        "responding-to-incidents"
      ]
    },
    {
      "id": "T1562",
      "name": "Impair Defenses",
      "tactics": [
        "TA0005"
      ],
      "skills": [
        "responding-to-incidents",
        "hunting-threats"
      ]
    },
    {
      "id": "T1562.001",
      "name": "Disable or Modify Tools",
      "tactics": [
        "TA0005"
      ],
      "skills": [
        "hunting-threats",
        "responding-to-incidents"
      ]
    },
    {
      "id": "T1218",
      "name": "System Binary Proxy Execution",
      "tactics": [
        "TA0005"
      ],
      "skills": [
        "hunting-threats",
        "escalating-windows-privileges"
      ]
    },
    {
      "id": "T1218.011",
      "name": "Rundll32",
      "tactics": [
        "TA0005"
      ],
      "skills": [
        "hunting-threats",
        "analyzing-malware"
      ]
    },
    {
      "id": "T1497",
      "name": "Virtualization/Sandbox Evasion",
      "tactics": [
        "TA0005"
      ],
      "skills": [
        "analyzing-malware",
        "analyzing-binaries"
      ]
    },
    {
      "id": "T1622",
      "name": "Debugger Evasion",
      "tactics": [
        "TA0005"
      ],
      "skills": [
        "analyzing-binaries",
        "analyzing-malware"
      ]
    },
    {
      "id": "T1036",
      "name": "Masquerading",
      "tactics": [
        "TA0005"
      ],
      "skills": [
        "establishing-persistence",
        "hunting-threats"
      ]
    },
    {
      "id": "T1620",
      "name": "Reflective Code Loading",
      "tactics": [
        "TA0005"
      ],
      "skills": [
        "analyzing-malware",
        "analyzing-shellcode"
      ]
    },
    {
      "id": "T1553",
      "name": "Subvert Trust Controls",
      "tactics": [
        "TA0005"
      ],
      "skills": [
        "analyzing-malware",
        "auditing-supply-chain"
      ]
    },
    {
      "id": "T1003",
      "name": "OS Credential Dumping",
      "tactics": [
        "TA0006"
      ],
      "skills": [
        "attacking-active-directory",
        "cracking-passwords"
      ]
    },
    {
      "id": "T1003.001",
      "name": "LSASS Memory",
      "tactics": [
        "TA0006"
      ],
      "skills": [
        "attacking-active-directory",
        "engineering-detections"
      ]
    },
    {
      "id": "T1003.002",
      "name": "Security Account Manager",
      "tactics": [
        "TA0006"
      ],
      "skills": [
        "escalating-windows-privileges",
        "cracking-passwords"
      ]
    },
    {
      "id": "T1003.003",
      "name": "NTDS",
      "tactics": [
        "TA0006"
      ],
      "skills": [
        "attacking-active-directory"
      ]
    },
    {
      "id": "T1003.006",
      "name": "DCSync",
      "tactics": [
        "TA0006"
      ],
      "skills": [
        "attacking-active-directory"
      ]
    },
    {
      "id": "T1003.008",
      "name": "/etc/passwd and /etc/shadow",
      "tactics": [
        "TA0006"
      ],
      "skills": [
        "escalating-linux-privileges",
        "cracking-passwords"
      ]
    },
    {
      "id": "T1110",
      "name": "Brute Force",
      "tactics": [
        "TA0006"
      ],
      "skills": [
        "cracking-passwords"
      ]
    },
    {
      "id": "T1110.002",
      "name": "Password Cracking",
      "tactics": [
        "TA0006"
      ],
      "skills": [
        "cracking-passwords"
      ]
    },
    {
      "id": "T1110.003",
      "name": "Password Spraying",
      "tactics": [
        "TA0006"
      ],
      "skills": [
        "cracking-passwords",
        "attacking-active-directory"
      ]
    },
    {
      "id": "T1558",
      "name": "Steal or Forge Kerberos Tickets",
      "tactics": [
        "TA0006"
      ],
      "skills": [
        "attacking-active-directory",
        "attacking-kerberos-delegation"
      ]
    },
    {
      "id": "T1558.003",
      "name": "Kerberoasting",
      "tactics": [
        "TA0006"
      ],
      "skills": [
        "attacking-active-directory",
        "cracking-passwords"
      ]
    },
    {
      "id": "T1558.004",
      "name": "AS-REP Roasting",
      "tactics": [
        "TA0006"
      ],
      "skills": [
        "attacking-active-directory"
      ]
    },
    {
      "id": "T1552",
      "name": "Unsecured Credentials",
      "tactics": [
        "TA0006"
      ],
      "skills": [
        "escalating-linux-privileges",
        "exploiting-cloud-platforms",
        "auditing-supply-chain",
        "abusing-ci-cd-oidc"
      ]
    },
    {
      "id": "T1552.005",
      "name": "Cloud Instance Metadata API",
      "tactics": [
        "TA0006"
      ],
      "skills": [
        "exploiting-ssrf",
        "exploiting-cloud-platforms",
        "attacking-eks-gke-aks"
      ]
    },
    {
      "id": "T1555",
      "name": "Credentials from Password Stores",
      "tactics": [
        "TA0006"
      ],
      "skills": [
        "escalating-windows-privileges"
      ]
    },
    {
      "id": "T1040",
      "name": "Network Sniffing",
      "tactics": [
        "TA0006",
        "TA0007"
      ],
      "skills": [
        "attacking-wireless-networks",
        "enumerating-network-services"
      ]
    },
    {
      "id": "T1557",
      "name": "Adversary-in-the-Middle",
      "tactics": [
        "TA0006",
        "TA0009"
      ],
      "skills": [
        "attacking-wireless-networks",
        "attacking-active-directory"
      ]
    },
    {
      "id": "T1528",
      "name": "Steal Application Access Token",
      "tactics": [
        "TA0006"
      ],
      "skills": [
        "testing-apis",
        "exploiting-cloud-platforms",
        "attacking-entra-id",
        "attacking-oauth-oidc"
      ]
    },
    {
      "id": "T1539",
      "name": "Steal Web Session Cookie",
      "tactics": [
        "TA0006"
      ],
      "skills": [
        "testing-web-applications"
      ]
    },
    {
      "id": "T1649",
      "name": "Steal or Forge Authentication Certificates",
      "tactics": [
        "TA0006"
      ],
      "skills": [
        "attacking-active-directory",
        "abusing-adcs"
      ]
    },
    {
      "id": "T1606",
      "name": "Forge Web Credentials",
      "tactics": [
        "TA0006"
      ],
      "skills": [
        "attacking-jwt",
        "attacking-oauth-oidc"
      ]
    },
    {
      "id": "T1606.002",
      "name": "SAML Tokens",
      "tactics": [
        "TA0006"
      ],
      "skills": [
        "attacking-saml",
        "attacking-entra-id"
      ]
    },
    {
      "id": "T1087",
      "name": "Account Discovery",
      "tactics": [
        "TA0007"
      ],
      "skills": [
        "attacking-active-directory",
        "exploiting-cloud-platforms"
      ]
    },
    {
      "id": "T1046",
      "name": "Network Service Discovery",
      "tactics": [
        "TA0007"
      ],
      "skills": [
        "enumerating-network-services"
      ]
    },
    {
      "id": "T1018",
      "name": "Remote System Discovery",
      "tactics": [
        "TA0007"
      ],
      "skills": [
        "enumerating-network-services",
        "attacking-active-directory"
      ]
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "tactics": [
        "TA0007"
      ],
      "skills": [
        "escalating-linux-privileges",
        "escalating-windows-privileges"
      ]
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactics": [
        "TA0007"
      ],
      "skills": [
        "escalating-linux-privileges",
        "escalating-windows-privileges"
      ]
    },
    {
      "id": "T1069",
      "name": "Permission Groups Discovery",
      "tactics": [
        "TA0007"
      ],
      "skills": [
        "attacking-active-directory",
        "exploiting-cloud-platforms"
      ]
    },
    {
      "id": "T1518",
      "name": "Software Discovery",
      "tactics": [
        "TA0007"
      ],
      "skills": [
        "escalating-windows-privileges"
      ]
    },
    {
      "id": "T1613",
      "name": "Container and Resource Discovery",
      "tactics": [
        "TA0007"
      ],
      "skills": [
        "exploiting-containers"
      ]
    },
    {
      "id": "T1526",
      "name": "Cloud Service Discovery",
      "tactics": [
        "TA0007"
      ],
      "skills": [
        "exploiting-cloud-platforms"
      ]
    },
    {
      "id": "T1021",
      "name": "Remote Services",
      "tactics": [
        "TA0008"
      ],
      "skills": [
        "attacking-active-directory",
        "enumerating-network-services"
      ]
    },
    {
      "id": "T1021.001",
      "name": "Remote Desktop Protocol",
      "tactics": [
        "TA0008"
      ],
      "skills": [
        "attacking-active-directory"
      ]
    },
    {
      "id": "T1021.002",
      "name": "SMB/Windows Admin Shares",
      "tactics": [
        "TA0008"
      ],
      "skills": [
        "attacking-active-directory",
        "enumerating-network-services"
      ]
    },
    {
      "id": "T1021.004",
      "name": "SSH",
      "tactics": [
        "TA0008"
      ],
      "skills": [
        "enumerating-network-services",
        "escalating-linux-privileges"
      ]
    },
    {
      "id": "T1021.006",
      "name": "Windows Remote Management",
      "tactics": [
        "TA0008"
      ],
      "skills": [
        "attacking-active-directory"
      ]
    },
    {
      "id": "T1550",
      "name": "Use Alternate Authentication Material",
      "tactics": [
        "TA0008",
        "TA0005"
      ],
      "skills": [
        "attacking-active-directory"
      ]
    },
    {
      "id": "T1550.002",
      "name": "Pass the Hash",
      "tactics": [
        "TA0008"
      ],
      "skills": [
        "attacking-active-directory",
        "cracking-passwords"
      ]
    },
    {
      "id": "T1550.003",
      "name": "Pass the Ticket",
      "tactics": [
        "TA0008"
      ],
      "skills": [
        "attacking-active-directory"
      ]
    },
    {
      "id": "T1570",
      "name": "Lateral Tool Transfer",
      "tactics": [
        "TA0008"
      ],
      "skills": [
        "transferring-files"
      ]
    },
    {
      "id": "T1210",
      "name": "Exploitation of Remote Services",
      "tactics": [
        "TA0008"
      ],
      "skills": [
        "enumerating-network-services",
        "exploiting-memory-corruption"
      ]
    },
    {
      "id": "T1560",
      "name": "Archive Collected Data",
      "tactics": [
        "TA0009"
      ],
      "skills": [
        "transferring-files",
        "hunting-threats"
      ]
    },
    {
      "id": "T1005",
      "name": "Data from Local System",
      "tactics": [
        "TA0009"
      ],
      "skills": [
        "transferring-files"
      ]
    },
    {
      "id": "T1530",
      "name": "Data from Cloud Storage",
      "tactics": [
        "TA0009"
      ],
      "skills": [
        "exploiting-cloud-platforms"
      ]
    },
    {
      "id": "T1074",
      "name": "Data Staged",
      "tactics": [
        "TA0009"
      ],
      "skills": [
        "transferring-files",
        "hunting-threats"
      ]
    },
    {
      "id": "T1114",
      "name": "Email Collection",
      "tactics": [
        "TA0009"
      ],
      "skills": [
        "responding-to-incidents"
      ]
    },
    {
      "id": "T1056.001",
      "name": "Keylogging",
      "tactics": [
        "TA0009",
        "TA0006"
      ],
      "skills": [
        "analyzing-malware"
      ]
    },
    {
      "id": "T1071",
      "name": "Application Layer Protocol",
      "tactics": [
        "TA0011"
      ],
      "skills": [
        "analyzing-malware",
        "engineering-detections",
        "analyzing-network-traffic"
      ]
    },
    {
      "id": "T1071.004",
      "name": "DNS",
      "tactics": [
        "TA0011"
      ],
      "skills": [
        "engineering-detections",
        "hunting-threats",
        "analyzing-network-traffic"
      ]
    },
    {
      "id": "T1573",
      "name": "Encrypted Channel",
      "tactics": [
        "TA0011"
      ],
      "skills": [
        "analyzing-malware",
        "engineering-detections",
        "analyzing-network-traffic"
      ]
    },
    {
      "id": "T1090",
      "name": "Proxy",
      "tactics": [
        "TA0011"
      ],
      "skills": [
        "transferring-files"
      ]
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactics": [
        "TA0011"
      ],
      "skills": [
        "transferring-files"
      ]
    },
    {
      "id": "T1219",
      "name": "Remote Access Software",
      "tactics": [
        "TA0011"
      ],
      "skills": [
        "hunting-threats"
      ]
    },
    {
      "id": "T1568",
      "name": "Dynamic Resolution",
      "tactics": [
        "TA0011"
      ],
      "skills": [
        "analyzing-malware",
        "hunting-threats",
        "analyzing-network-traffic"
      ]
    },
    {
      "id": "T1572",
      "name": "Protocol Tunneling",
      "tactics": [
        "TA0011"
      ],
      "skills": [
        "transferring-files",
        "hunting-threats"
      ]
    },
    {
      "id": "T1132",
      "name": "Data Encoding",
      "tactics": [
        "TA0011"
      ],
      "skills": [
        "transferring-files",
        "analyzing-malware",
        "analyzing-network-traffic"
      ]
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel",
      "tactics": [
        "TA0010"
      ],
      "skills": [
        "transferring-files"
      ]
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactics": [
        "TA0010"
      ],
      "skills": [
        "transferring-files",
        "hunting-threats",
        "analyzing-network-traffic"
      ]
    },
    {
      "id": "T1567",
      "name": "Exfiltration Over Web Service",
      "tactics": [
        "TA0010"
      ],
      "skills": [
        "transferring-files",
        "hunting-threats"
      ]
    },
    {
      "id": "T1030",
      "name": "Data Transfer Size Limits",
      "tactics": [
        "TA0010"
      ],
      "skills": [
        "hunting-threats"
      ]
    },
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactics": [
        "TA0040"
      ],
      "skills": [
        "analyzing-malware",
        "responding-to-incidents"
      ]
    },
    {
      "id": "T1485",
      "name": "Data Destruction",
      "tactics": [
        "TA0040"
      ],
      "skills": [
        "responding-to-incidents"
      ]
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactics": [
        "TA0040"
      ],
      "skills": [
        "responding-to-incidents",
        "hunting-threats"
      ]
    },
    {
      "id": "T1496",
      "name": "Resource Hijacking",
      "tactics": [
        "TA0040"
      ],
      "skills": [
        "hunting-threats",
        "exploiting-cloud-platforms"
      ]
    },
    {
      "id": "T1489",
      "name": "Service Stop",
      "tactics": [
        "TA0040"
      ],
      "skills": [
        "responding-to-incidents"
      ]
    }
  ]
}