Chinese_State-Sponsored_Cyber_Operations_Observed_TTPs.json

{
	"name": "Chinese State-Sponsored Cyber Operations: Observed TTPs",
	"versions": {
		"attack": "9",
		"navigator": "4.3",
		"layer": "4.2"
	},
	"domain": "enterprise-attack",
	"description": "",
	"filters": {
		"platforms": [
			"Linux",
			"macOS",
			"Windows",
			"Azure AD",
			"Office 365",
			"SaaS",
			"IaaS",
			"Google Workspace",
			"PRE",
			"Network",
			"Containers"
		]
	},
	"sorting": 0,
	"layout": {
		"layout": "flat",
		"aggregateFunction": "average",
		"showID": false,
		"showName": true,
		"showAggregateScores": false,
		"countUnscored": false
	},
	"hideDisabled": false,
	"techniques": [
		{
			"techniqueID": "T1003",
			"tactic": "credential-access",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1003.001",
			"tactic": "credential-access",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1003.003",
			"tactic": "credential-access",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1018",
			"tactic": "discovery",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1027",
			"tactic": "defense-evasion",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1046",
			"tactic": "discovery",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1053",
			"tactic": "privilege-escalation",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1053.003",
			"tactic": "privilege-escalation",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1053.005",
			"tactic": "privilege-escalation",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1055",
			"tactic": "privilege-escalation",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1055.001",
			"tactic": "privilege-escalation",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1055.002",
			"tactic": "privilege-escalation",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1057",
			"tactic": "discovery",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1059",
			"tactic": "execution",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1059.001",
			"tactic": "execution",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1059.003",
			"tactic": "execution",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1059.004",
			"tactic": "execution",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1059.006",
			"tactic": "execution",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1059.007",
			"tactic": "execution",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1059.008",
			"tactic": "execution",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1069",
			"tactic": "discovery",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1070",
			"tactic": "defense-evasion",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1071",
			"tactic": "command-and-control",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1074",
			"tactic": "collection",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1078",
			"tactic": "initial-access",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1078.001",
			"tactic": "initial-access",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1078.002",
			"tactic": "initial-access",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1083",
			"tactic": "discovery",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1090",
			"tactic": "command-and-control",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1090.003",
			"tactic": "command-and-control",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1105",
			"tactic": "command-and-control",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1114",
			"tactic": "collection",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1115",
			"tactic": "collection",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1133",
			"tactic": "initial-access",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1140",
			"tactic": "defense-evasion",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1189",
			"tactic": "initial-access",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1190",
			"tactic": "initial-access",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1204",
			"tactic": "execution",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1204.001",
			"tactic": "execution",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1204.002",
			"tactic": "execution",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1210",
			"tactic": "lateral-movement",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1212",
			"tactic": "credential-access",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1218",
			"tactic": "defense-evasion",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1218.005",
			"tactic": "defense-evasion",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1218.011",
			"tactic": "defense-evasion",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1484",
			"tactic": "privilege-escalation",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1484.001",
			"tactic": "privilege-escalation",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1505",
			"tactic": "persistence",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1505.003",
			"tactic": "persistence",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1543",
			"tactic": "privilege-escalation",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1543.003",
			"tactic": "privilege-escalation",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1556",
			"tactic": "persistence",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1556.001",
			"tactic": "persistence",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1560",
			"tactic": "collection",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1564",
			"tactic": "defense-evasion",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1566",
			"tactic": "initial-access",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1566.001",
			"tactic": "initial-access",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1566.002",
			"tactic": "initial-access",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1571",
			"tactic": "command-and-control",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1572",
			"tactic": "command-and-control",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1574",
			"tactic": "defense-evasion",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1574.001",
			"tactic": "defense-evasion",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1583",
			"tactic": "resource-development",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1588",
			"tactic": "resource-development",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1588.002",
			"tactic": "resource-development",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1590",
			"tactic": "reconnaissance",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1595",
			"tactic": "reconnaissance",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1608",
			"tactic": "resource-development",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1543",
			"tactic": "persistence",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1543.003",
			"tactic": "persistence",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1484",
			"tactic": "defense-evasion",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1484.001",
			"tactic": "defense-evasion",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1133",
			"tactic": "persistence",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1574",
			"tactic": "persistence",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1574",
			"tactic": "privilege-escalation",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1574.001",
			"tactic": "persistence",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1574.001",
			"tactic": "privilege-escalation",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1556",
			"tactic": "credential-access",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1556",
			"tactic": "defense-evasion",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1556.001",
			"tactic": "credential-access",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1556.001",
			"tactic": "defense-evasion",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1055",
			"tactic": "defense-evasion",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1055.001",
			"tactic": "defense-evasion",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1055.002",
			"tactic": "defense-evasion",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1053",
			"tactic": "execution",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1053",
			"tactic": "persistence",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1053.005",
			"tactic": "execution",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1053.005",
			"tactic": "persistence",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1053.003",
			"tactic": "execution",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1053.003",
			"tactic": "persistence",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1078",
			"tactic": "defense-evasion",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1078",
			"tactic": "persistence",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1078",
			"tactic": "privilege-escalation",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": true
		},
		{
			"techniqueID": "T1078.001",
			"tactic": "defense-evasion",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1078.001",
			"tactic": "persistence",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1078.001",
			"tactic": "privilege-escalation",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1078.002",
			"tactic": "defense-evasion",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1078.002",
			"tactic": "persistence",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		},
		{
			"techniqueID": "T1078.002",
			"tactic": "privilege-escalation",
			"color": "#6baed6",
			"comment": "",
			"enabled": true,
			"metadata": [],
			"showSubtechniques": false
		}
	],
	"gradient": {
		"colors": [
			"#ff6666",
			"#ffe766",
			"#8ec843"
		],
		"minValue": 0,
		"maxValue": 100
	},
	"legendItems": [],
	"metadata": [],
	"showTacticRowBackground": false,
	"tacticRowBackground": "#dddddd",
	"selectTechniquesAcrossTactics": true,
	"selectSubtechniquesWithParent": false
}