| { |
| "Activate Firmware Update Mode": "inhibit response function", |
| "Alarm Suppression": "inhibit response function", |
| "Automated Collection": "collection", |
| "Block Command Message": "inhibit response function", |
| "Block Reporting Message": "inhibit response function", |
| "Block Serial COM": "inhibit response function", |
| "Brute Force I/O": "impair process control", |
| "Change Operating Mode": "execution", |
| "Command-Line Interface": "execution", |
| "Commonly Used Port": "command and control", |
| "Connection Proxy": "command and control", |
| "Damage to Property": "impact", |
| "Data Destruction": "inhibit response function", |
| "Data from Information Repositories": "collection", |
| "Default Credentials": "lateral movement", |
| "Denial of Control": "impact", |
| "Denial of Service": "inhibit response function", |
| "Denial of View": "impact", |
| "Detect Operating Mode": "collection", |
| "Device Restart/Shutdown": "inhibit response function", |
| "Drive-by Compromise": "initial access", |
| "Execution through API": "execution", |
| "Exploit Public-Facing Application": "initial access", |
| "Exploitation for Evasion": "evasion", |
| "Exploitation for Privilege Escalation": "privilege escalation", |
| "Exploitation of Remote Services": "initial access", |
| "External Remote Services": "initial access", |
| "Graphical User Interface": "execution", |
| "Hooking": "execution", |
| "I/O Image": "collection", |
| "Indicator Removal on Host": "evasion", |
| "Internet Accessible Device": "initial access", |
| "Lateral Tool Transfer": "lateral movement", |
| "Loss of Availability": "impact", |
| "Loss of Control": "impact", |
| "Loss of Productivity and Revenue": "impact", |
| "Loss of Protection": "impact", |
| "Loss of Safety": "impact", |
| "Loss of View": "impact", |
| "Man in the Middle": "collection", |
| "Manipulate I/O Image": "inhibit response function", |
| "Manipulation of Control": "impact", |
| "Manipulation of View": "impact", |
| "Masquerading": "evasion", |
| "Modify Alarm Settings": "inhibit response function", |
| "Modify Controller Tasking": "execution", |
| "Modify Parameter": "impair process control", |
| "Modify Program": "persistence", |
| "Module Firmware": "persistence", |
| "Monitor Process State": "collection", |
| "Native API": "execution", |
| "Network Connection Enumeration": "discovery", |
| "Network Sniffing": "discovery", |
| "Point & Tag Identification": "collection", |
| "Program Download": "lateral movement", |
| "Program Upload": "collection", |
| "Project File Infection": "persistence", |
| "Remote Services": "initial access", |
| "Remote System Discovery": "discovery", |
| "Remote System Information Discovery": "discovery", |
| "Replication Through Removable Media": "initial access", |
| "Rogue Master": "initial access", |
| "Rootkit": "evasion", |
| "Screen Capture": "collection", |
| "Scripting": "execution", |
| "Service Stop": "inhibit response function", |
| "Spearphishing Attachment": "initial access", |
| "Spoof Reporting Message": "evasion", |
| "Standard Application Layer Protocol": "command and control", |
| "Supply Chain Compromise": "initial access", |
| "System Firmware": "persistence", |
| "Theft of Operational Information": "impact", |
| "Transient Cyber Asset": "initial access", |
| "Unauthorized Command Message": "impair process control", |
| "User Execution": "execution", |
| "Valid Accounts": "persistence", |
| "Wireless Compromise": "initial access", |
| "Wireless Sniffing": "discovery" |
| } |
