attack_map.json

{
  "T1566": {"name": "Phishing", "tactics": ["initial-access"]},
  "T1190": {"name": "Exploit Public-Facing Application", "tactics": ["initial-access"]},
  "T1133": {"name": "External Remote Services", "tactics": ["initial-access", "persistence"]},
  "T1078": {"name": "Valid Accounts", "tactics": ["initial-access", "persistence", "privilege-escalation", "defense-evasion"]},
  "T1059": {"name": "Command and Scripting Interpreter", "tactics": ["execution"]},
  "T1204": {"name": "User Execution", "tactics": ["execution"]},
  "T1053": {"name": "Scheduled Task/Job", "tactics": ["execution", "persistence", "privilege-escalation"]},
  "T1547": {"name": "Boot or Logon Autostart Execution", "tactics": ["persistence", "privilege-escalation"]},
  "T1136": {"name": "Create Account", "tactics": ["persistence"]},
  "T1543": {"name": "Create or Modify System Process", "tactics": ["persistence", "privilege-escalation"]},
  "T1548": {"name": "Abuse Elevation Control Mechanism", "tactics": ["privilege-escalation", "defense-evasion"]},
  "T1068": {"name": "Exploitation for Privilege Escalation", "tactics": ["privilege-escalation"]},
  "T1055": {"name": "Process Injection", "tactics": ["privilege-escalation", "defense-evasion"]},
  "T1070": {"name": "Indicator Removal", "tactics": ["defense-evasion"]},
  "T1027": {"name": "Obfuscated Files or Information", "tactics": ["defense-evasion"]},
  "T1562": {"name": "Impair Defenses", "tactics": ["defense-evasion"]},
  "T1110": {"name": "Brute Force", "tactics": ["credential-access"]},
  "T1003": {"name": "OS Credential Dumping", "tactics": ["credential-access"]},
  "T1555": {"name": "Credentials from Password Stores", "tactics": ["credential-access"]},
  "T1552": {"name": "Unsecured Credentials", "tactics": ["credential-access"]},
  "T1087": {"name": "Account Discovery", "tactics": ["discovery"]},
  "T1046": {"name": "Network Service Discovery", "tactics": ["discovery"]},
  "T1082": {"name": "System Information Discovery", "tactics": ["discovery"]},
  "T1021": {"name": "Remote Services", "tactics": ["lateral-movement"]},
  "T1570": {"name": "Lateral Tool Transfer", "tactics": ["lateral-movement"]},
  "T1560": {"name": "Archive Collected Data", "tactics": ["collection"]},
  "T1114": {"name": "Email Collection", "tactics": ["collection"]},
  "T1071": {"name": "Application Layer Protocol", "tactics": ["command-and-control"]},
  "T1105": {"name": "Ingress Tool Transfer", "tactics": ["command-and-control"]},
  "T1572": {"name": "Protocol Tunneling", "tactics": ["command-and-control"]},
  "T1041": {"name": "Exfiltration Over C2 Channel", "tactics": ["exfiltration"]},
  "T1048": {"name": "Exfiltration Over Alternative Protocol", "tactics": ["exfiltration"]},
  "T1486": {"name": "Data Encrypted for Impact", "tactics": ["impact"]},
  "T1490": {"name": "Inhibit System Recovery", "tactics": ["impact"]}
}