| T0888 | Remote System Information Discovery | | Discovery | MITRE ATT&CK |
| T0846_ICS | Remote System Discovery | OT | Discovery | MITRE ATT&CK |
| T0814_ICS | Denial of Service | OT | Inhibit Response Function | MITRE ATT&CK |
| T0840 | Network Connection Enumeration | | Discovery | MITRE ATT&CK |
| T0846 | Remote System Discovery | | Discovery | MITRE ATT&CK |
| T0855 | Unauthorized Command Message | | Impair Process Control | MITRE ATT&CK |
| T0812_ICS | Default Credentials | OT | Lateral Movement | MITRE ATT&CK |
| T0820_ICS | Exploitation for Evasion | OT | Evasion | MITRE ATT&CK |
| T0891_ICS | Hardcoded Credentials | OT | Lateral Movement, Persistence | MITRE ATT&CK |
| T0801 | Monitor Process State | | Collection | MITRE ATT&CK |
| T0816 | Device Restart/Shutdown | | Inhibit Response Function | MITRE ATT&CK |
| T0881 | Service Stop | | Inhibit Response Function | MITRE ATT&CK |
| T0845_ICS | Program Upload | OT | Collection | MITRE ATT&CK |
| T0820 | Exploitation for Evasion | | Evasion | MITRE ATT&CK |
| T0866 | Exploitation of Remote Services | | Initial Access, Lateral Movement | MITRE ATT&CK |
| T0843 | Program Download | | Lateral Movement | MITRE ATT&CK |
| T0845 | Program Upload | | Collection | MITRE ATT&CK |
| T0822 | External Remote Services | | Initial Access | MITRE ATT&CK |
| T0843_ICS | Program Download | OT | Lateral Movement | MITRE ATT&CK |
| T0866_ICS | Exploitation of Remote Services | OT | Initial Access, Lateral Movement | MITRE ATT&CK |
| T0814 | Denial of Service | | Inhibit Response Function | MITRE ATT&CK |
| T0839 | Module Firmware | | Persistence, Impair Process Control | MITRE ATT&CK |
| T0861 | Point & Tag Identification | | Collection | MITRE ATT&CK |
| T0812 | Default Credentials | | Lateral Movement | MITRE ATT&CK |
| T0891 | Hardcoded Credentials | | Lateral Movement, Persistence | MITRE ATT&CK |
| T0821 | Modify Controller Tasking | | Execution | MITRE ATT&CK |
| T0835 | Manipulate I/O Image | | Inhibit Response Function | MITRE ATT&CK |
| T0857 | System Firmware | | Persistence, Inhibit Response Function | MITRE ATT&CK |
| T0873 | Project File Infection | | Persistence | MITRE ATT&CK |
| T0889 | Modify Program | | Persistence | MITRE ATT&CK |
| T1087.004_AWS | Account Discovery: Cloud Account (AWS) | AWS | Discovery | MITRE ATT&CK |
| T1204.002_AWS | User Execution: Malicious File (AWS) | AWS | Execution | MITRE ATT&CK |
| T1619_AWS | Cloud Storage Object Discovery(AWS) | AWS | Discovery | MITRE ATT&CK |
| T1528 | Steal Application Access Token | | Collection | MITRE ATT&CK |
| T1555.006 | Cloud Secrets Management Stores | | Credential Access | MITRE ATT&CK |
| T1565.003 | Runtime Data Manipulation | | Impact | MITRE ATT&CK |
| T1021.007 | Cloud Services | | Lateral Movement | MITRE ATT&CK |
| T1083 | File and Directory Discovery | | Discovery | MITRE ATT&CK |
| T1530 | Data from Cloud Storage | | Collection | MITRE ATT&CK |
| T1530_AWS | Data from Cloud Storage Object (AWS) | AWS | Collection | MITRE ATT&CK |
| T1537_AWS | Transfer Data to Cloud Account | AWS | Exfiltration | MITRE ATT&CK |
| T1580_AWS | Cloud Infrastructure Discovery(AWS) | AWS | Discovery | MITRE ATT&CK |
| T1526 | Cloud Service Discovery | | Discovery | MITRE ATT&CK |
| T1021.007_Azure | Remote Services: Cloud Services | Azure | Lateral Movement | MITRE ATT&CK |
| T1069.003_AWS | Permission Groups Discovery: Cloud Groups (AWS) | AWS | Discovery | MITRE ATT&CK |
| T1098.001 | Additional Cloud Credentials | | Persistence | MITRE ATT&CK |
| T1098.004 | SSH Authorized Keys | | Privilege Escalation, Persistence | MITRE ATT&CK |
| T1537 | Transfer Data to Cloud Account | | Exfiltration | MITRE ATT&CK |
| T1619 | Cloud Storage Object Discovery | | Discovery | MITRE ATT&CK |
| T1648 | Serverless Execution | | Execution | MITRE ATT&CK |