Digital Information Bearer

Access Control Configuration

Access Control Group

Access Control List

Access Mediator

Access Process

Access Token

Activity Dependency

Actuator

Address Space

Administrative Network Traffic

Alias

Allocate Memory

Anonymous Pipe

Application

Application Configuration

Application Configuration Database

Application Configuration Database Record

Application Configuration File

Application Installer

Application Inventory Sensor

Application Layer Firewall

Application Layer Link

Application Process

Application Process Configuration

Application Rule

Application Shim

Archive File

Artifact Server

Asset Inventory Agent

Asymmetric Key

Audio Input Device

Authenticate User

Authentication Function

Authentication Log

Authentication Server

Authentication Service

Authentication Service Application

Authorization Log

Authorization Service

Barcode Scanner Input Device

Binary Large Object

Binary Segment

Bitmap Image

Bitmap Image File

Block Device

Boot Loader

Boot Record

Boot Sector

Browser

Browser Extension

Build Tool

Bus Message

Bus Network

Bus Network Frame

Bus Network Node

Bus Network Traffic

Business Communication Platform Client

CA Certificate File

Processor Cache Memory

Call Stack

Central Processing Unit

Certificate

Certificate File

Certificate Trust Store

Chatroom Client

Child Process

Client Application

Client Computer

Clipboard

Cloud-based Database Application

Cloud Configuration

Cloud Instance Metadata

Cloud Service Sensor

Cloud Storage

Cloud User Account

Code Analyzer

Code Repository

Codec Application

Codec Library

Collaborative Software

Command

Command History Log

Command History Log File

Command Line Interface

Compiler

Compiler Configuration File

Computer Network Node

Computer Platform

Computing Image

Computing Server

Computing Snapshot

Configuration Database

Configuration Database Record

Configuration File

Configuration Management Database

Configuration Resource

Connect Socket

Console Output Function

Container Build Tool

Container Image

Container Orchestration Software

Container Process

Container Runtime

Content Policy

Copy Memory Function

Copy Token

Create File

Create Process

Create Socket

Create Thread

Credential

Credential Management System

Cryptographic Key

Custom Archive File

Cyber Sensor

DHCP Network Traffic

DHCP Server

DHCP Service

DHCP Service Application

DNS Lookup

DNS Network Traffic

DNS Record

DNS Server

Data Artifact Server

Data Dependency

Data Link Link

Database

Database Application

Database File

Database Query

Database Record

Database Server

Database Service

Database Service Application

Decoder Application

Decoy Artifact

Default User Account

Delete File

Dependency

Deserialization Function

Desktop Computer

Developer Application

Dial Up Modem

Differential Volume Snapshot

Digital Artifact

Digital Audio

Digital Audio Visual Media

Digital Document

Digital Event Record

Digital Fingerprint

Digital Identity

Digital Image

Digital Information

Digital Information Bearer

Digital Media

Digital Message

Digital Multimedia

Digital System

Digital Text

Digital Video

Properties

id: d3f:DigitalInformationBearer

name: Digital Information Bearer
definition: A digital information bearer is a physical or virtual entity that stores, transmits, or processes digital information.

json

Neighbors

DigitalInformationBearer has no direct neighbors in this release.

Inferred Relationships

This page is experimental and may change significantly in future releases.

Hierarchy

(filtered)

Related Countermeasure Techniques

        graph LR;

      Token-basedAuthentication["Token-based Authentication"] -->
          | uses | AccessToken["Access Token"]; class Token-basedAuthentication DefensiveTechniqueNode; class AccessToken ArtifactNode; click Token-basedAuthentication href "../../../technique/d3f:Token-basedAuthentication"; click AccessToken href "../../../dao/artifact/d3f:AccessToken";TokenBinding["Token Binding"] -->
          | strengthens | AccessToken["Access Token"]; class TokenBinding DefensiveTechniqueNode; class AccessToken ArtifactNode; click TokenBinding href "../../../technique/d3f:TokenBinding"; click AccessToken href "../../../dao/artifact/d3f:AccessToken";ApplicationConfigurationHardening["Application Configuration Hardening"] -->
          | hardens | ApplicationConfiguration["Application Configuration"]; class ApplicationConfigurationHardening DefensiveTechniqueNode; class ApplicationConfiguration ArtifactNode; click ApplicationConfigurationHardening href "../../../technique/d3f:ApplicationConfigurationHardening"; click ApplicationConfiguration href "../../../dao/artifact/d3f:ApplicationConfiguration";CertificateRotation["Certificate Rotation"] -->
          | regenerates | Certificate["Certificate"]; class CertificateRotation DefensiveTechniqueNode; class Certificate ArtifactNode; click CertificateRotation href "../../../technique/d3f:CertificateRotation"; click Certificate href "../../../dao/artifact/d3f:Certificate";Certificate-basedAuthentication["Certificate-based Authentication"] -->
          | reads | Certificate["Certificate"]; class Certificate-basedAuthentication DefensiveTechniqueNode; class Certificate ArtifactNode; click Certificate-basedAuthentication href "../../../technique/d3f:Certificate-basedAuthentication"; click Certificate href "../../../dao/artifact/d3f:Certificate";CertificatePinning["Certificate Pinning"] -->
          | hardens | Certificate["Certificate"]; class CertificatePinning DefensiveTechniqueNode; class Certificate ArtifactNode; click CertificatePinning href "../../../technique/d3f:CertificatePinning"; click Certificate href "../../../dao/artifact/d3f:Certificate";CertificateAnalysis["Certificate Analysis"] -->
          | analyzes | CertificateFile["Certificate File"]; class CertificateAnalysis DefensiveTechniqueNode; class CertificateFile ArtifactNode; click CertificateAnalysis href "../../../technique/d3f:CertificateAnalysis"; click CertificateFile href "../../../dao/artifact/d3f:CertificateFile";RestoreConfiguration["Restore Configuration"] -->
          | restores | ConfigurationResource["Configuration Resource"]; class RestoreConfiguration DefensiveTechniqueNode; class ConfigurationResource ArtifactNode; click RestoreConfiguration href "../../../technique/d3f:RestoreConfiguration"; click ConfigurationResource href "../../../dao/artifact/d3f:ConfigurationResource";ContentFiltering["Content Filtering"] -->
          | enforces | ContentPolicy["Content Policy"]; class ContentFiltering DefensiveTechniqueNode; class ContentPolicy ArtifactNode; click ContentFiltering href "../../../technique/d3f:ContentFiltering"; click ContentPolicy href "../../../dao/artifact/d3f:ContentPolicy";FileCreationAnalysis["File Creation Analysis"] -->
          | analyzes | CreateFile["Create File"]; class FileCreationAnalysis DefensiveTechniqueNode; class CreateFile ArtifactNode; click FileCreationAnalysis href "../../../technique/d3f:FileCreationAnalysis"; click CreateFile href "../../../dao/artifact/d3f:CreateFile";ProcessSpawnAnalysis["Process Spawn Analysis"] -->
          | analyzes | CreateProcess["Create Process"]; class ProcessSpawnAnalysis DefensiveTechniqueNode; class CreateProcess ArtifactNode; click ProcessSpawnAnalysis href "../../../technique/d3f:ProcessSpawnAnalysis"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";ExecutableDenylisting["Executable Denylisting"] -->
          | filters | CreateProcess["Create Process"]; class ExecutableDenylisting DefensiveTechniqueNode; class CreateProcess ArtifactNode; click ExecutableDenylisting href "../../../technique/d3f:ExecutableDenylisting"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";Hardware-basedProcessIsolation["Hardware-based Process Isolation"] -->
          | restricts | CreateProcess["Create Process"]; class Hardware-basedProcessIsolation DefensiveTechniqueNode; class CreateProcess ArtifactNode; click Hardware-basedProcessIsolation href "../../../technique/d3f:Hardware-basedProcessIsolation"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";ExecutableAllowlisting["Executable Allowlisting"] -->
          | filters | CreateProcess["Create Process"]; class ExecutableAllowlisting DefensiveTechniqueNode; class CreateProcess ArtifactNode; click ExecutableAllowlisting href "../../../technique/d3f:ExecutableAllowlisting"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";Multi-factorAuthentication["Multi-factor Authentication"] -->
          | uses | Credential["Credential"]; class Multi-factorAuthentication DefensiveTechniqueNode; class Credential ArtifactNode; click Multi-factorAuthentication href "../../../technique/d3f:Multi-factorAuthentication"; click Credential href "../../../dao/artifact/d3f:Credential";CredentialTransmissionScoping["Credential Transmission Scoping"] -->
          | isolates | Credential["Credential"]; class CredentialTransmissionScoping DefensiveTechniqueNode; class Credential ArtifactNode; click CredentialTransmissionScoping href "../../../technique/d3f:CredentialTransmissionScoping"; click Credential href "../../../dao/artifact/d3f:Credential";CredentialHardening["Credential Hardening"] -->
          | hardens | Credential["Credential"]; class CredentialHardening DefensiveTechniqueNode; class Credential ArtifactNode; click CredentialHardening href "../../../technique/d3f:CredentialHardening"; click Credential href "../../../dao/artifact/d3f:Credential";CredentialRotation["Credential Rotation"] -->
          | regenerates | Credential["Credential"]; class CredentialRotation DefensiveTechniqueNode; class Credential ArtifactNode; click CredentialRotation href "../../../technique/d3f:CredentialRotation"; click Credential href "../../../dao/artifact/d3f:Credential";CredentialCompromiseScopeAnalysis["Credential Compromise Scope Analysis"] -->
          | analyzes | Credential["Credential"]; class CredentialCompromiseScopeAnalysis DefensiveTechniqueNode; class Credential ArtifactNode; click CredentialCompromiseScopeAnalysis href "../../../technique/d3f:CredentialCompromiseScopeAnalysis"; click Credential href "../../../dao/artifact/d3f:Credential";AuthenticationCacheInvalidation["Authentication Cache Invalidation"] -->
          | deletes | Credential["Credential"]; class AuthenticationCacheInvalidation DefensiveTechniqueNode; class Credential ArtifactNode; click AuthenticationCacheInvalidation href "../../../technique/d3f:AuthenticationCacheInvalidation"; click Credential href "../../../dao/artifact/d3f:Credential";CredentialRevocation["Credential Revocation"] -->
          | deletes | Credential["Credential"]; class CredentialRevocation DefensiveTechniqueNode; class Credential ArtifactNode; click CredentialRevocation href "../../../technique/d3f:CredentialRevocation"; click Credential href "../../../dao/artifact/d3f:Credential";DecoyUserCredential["Decoy User Credential"] -->
          | spoofs | Credential["Credential"]; class DecoyUserCredential DefensiveTechniqueNode; class Credential ArtifactNode; click DecoyUserCredential href "../../../technique/d3f:DecoyUserCredential"; click Credential href "../../../dao/artifact/d3f:Credential";ReissueCredential["Reissue Credential"] -->
          | restores | Credential["Credential"]; class ReissueCredential DefensiveTechniqueNode; class Credential ArtifactNode; click ReissueCredential href "../../../technique/d3f:ReissueCredential"; click Credential href "../../../dao/artifact/d3f:Credential";DNSTrafficAnalysis["DNS Traffic Analysis"] -->
          | may-contain | DNSLookup["DNS Lookup"]; class DNSTrafficAnalysis DefensiveTechniqueNode; class DNSLookup ArtifactNode; click DNSTrafficAnalysis href "../../../technique/d3f:DNSTrafficAnalysis"; click DNSLookup href "../../../dao/artifact/d3f:DNSLookup";DNSDenylisting["DNS Denylisting"] -->
          | blocks | DNSNetworkTraffic["DNS Network Traffic"]; class DNSDenylisting DefensiveTechniqueNode; class DNSNetworkTraffic ArtifactNode; click DNSDenylisting href "../../../technique/d3f:DNSDenylisting"; click DNSNetworkTraffic href "../../../dao/artifact/d3f:DNSNetworkTraffic";DNSCacheEviction["DNS Cache Eviction"] -->
          | deletes | DNSRecord["DNS Record"]; class DNSCacheEviction DefensiveTechniqueNode; class DNSRecord ArtifactNode; click DNSCacheEviction href "../../../technique/d3f:DNSCacheEviction"; click DNSRecord href "../../../dao/artifact/d3f:DNSRecord";RestoreDatabase["Restore Database"] -->
          | restores | Database["Database"]; class RestoreDatabase DefensiveTechniqueNode; class Database ArtifactNode; click RestoreDatabase href "../../../technique/d3f:RestoreDatabase"; click Database href "../../../dao/artifact/d3f:Database";ContentQuarantine["Content Quarantine"] -->
          | quarantines | DatabaseRecord["Database Record"]; class ContentQuarantine DefensiveTechniqueNode; class DatabaseRecord ArtifactNode; click ContentQuarantine href "../../../technique/d3f:ContentQuarantine"; click DatabaseRecord href "../../../dao/artifact/d3f:DatabaseRecord";DecoyEnvironment["Decoy Environment"] -->
          | manages | DecoyArtifact["Decoy Artifact"]; class DecoyEnvironment DefensiveTechniqueNode; class DecoyArtifact ArtifactNode; click DecoyEnvironment href "../../../technique/d3f:DecoyEnvironment"; click DecoyArtifact href "../../../dao/artifact/d3f:DecoyArtifact";LocalFilePermissions["Local File Permissions"] -->
          | restricts | Directory["Directory"]; class LocalFilePermissions DefensiveTechniqueNode; class Directory ArtifactNode; click LocalFilePermissions href "../../../technique/d3f:LocalFilePermissions"; click Directory href "../../../dao/artifact/d3f:Directory";DomainTrustPolicy["Domain Trust Policy"] -->
          | restricts | DirectoryService["Directory Service"]; class DomainTrustPolicy DefensiveTechniqueNode; class DirectoryService ArtifactNode; click DomainTrustPolicy href "../../../technique/d3f:DomainTrustPolicy"; click DirectoryService href "../../../dao/artifact/d3f:DirectoryService";DynamicAnalysis["Dynamic Analysis"] -->
          | analyzes | DocumentFile["Document File"]; class DynamicAnalysis DefensiveTechniqueNode; class DocumentFile ArtifactNode; click DynamicAnalysis href "../../../technique/d3f:DynamicAnalysis"; click DocumentFile href "../../../dao/artifact/d3f:DocumentFile";EmulatedFileAnalysis["Emulated File Analysis"] -->
          | analyzes | DocumentFile["Document File"]; class EmulatedFileAnalysis DefensiveTechniqueNode; class DocumentFile ArtifactNode; click EmulatedFileAnalysis href "../../../technique/d3f:EmulatedFileAnalysis"; click DocumentFile href "../../../dao/artifact/d3f:DocumentFile";DomainAccountMonitoring["Domain Account Monitoring"] -->
          | monitors | DomainUserAccount["Domain User Account"]; class DomainAccountMonitoring DefensiveTechniqueNode; class DomainUserAccount ArtifactNode; click DomainAccountMonitoring href "../../../technique/d3f:DomainAccountMonitoring"; click DomainUserAccount href "../../../dao/artifact/d3f:DomainUserAccount";EmailRemoval["Email Removal"] -->
          | deletes | Email["Email"]; class EmailRemoval DefensiveTechniqueNode; class Email ArtifactNode; click EmailRemoval href "../../../technique/d3f:EmailRemoval"; click Email href "../../../dao/artifact/d3f:Email";RestoreEmail["Restore Email"] -->
          | restores | Email["Email"]; class RestoreEmail DefensiveTechniqueNode; class Email ArtifactNode; click RestoreEmail href "../../../technique/d3f:RestoreEmail"; click Email href "../../../dao/artifact/d3f:Email";EmailFiltering["Email Filtering"] -->
          | filters | Email["Email"]; class EmailFiltering DefensiveTechniqueNode; class Email ArtifactNode; click EmailFiltering href "../../../technique/d3f:EmailFiltering"; click Email href "../../../dao/artifact/d3f:Email";SenderMTAReputationAnalysis["Sender MTA Reputation Analysis"] -->
          | analyzes | Email["Email"]; class SenderMTAReputationAnalysis DefensiveTechniqueNode; class Email ArtifactNode; click SenderMTAReputationAnalysis href "../../../technique/d3f:SenderMTAReputationAnalysis"; click Email href "../../../dao/artifact/d3f:Email";SenderReputationAnalysis["Sender Reputation Analysis"] -->
          | analyzes | Email["Email"]; class SenderReputationAnalysis DefensiveTechniqueNode; class Email ArtifactNode; click SenderReputationAnalysis href "../../../technique/d3f:SenderReputationAnalysis"; click Email href "../../../dao/artifact/d3f:Email";HomoglyphDetection["Homoglyph Detection"] -->
          | analyzes | Email["Email"]; class HomoglyphDetection DefensiveTechniqueNode; class Email ArtifactNode; click HomoglyphDetection href "../../../technique/d3f:HomoglyphDetection"; click Email href "../../../dao/artifact/d3f:Email";ExecutableAllowlisting["Executable Allowlisting"] -->
          | blocks | ExecutableFile["Executable File"]; class ExecutableAllowlisting DefensiveTechniqueNode; class ExecutableFile ArtifactNode; click ExecutableAllowlisting href "../../../technique/d3f:ExecutableAllowlisting"; click ExecutableFile href "../../../dao/artifact/d3f:ExecutableFile";ExecutableDenylisting["Executable Denylisting"] -->
          | blocks | ExecutableFile["Executable File"]; class ExecutableDenylisting DefensiveTechniqueNode; class ExecutableFile ArtifactNode; click ExecutableDenylisting href "../../../technique/d3f:ExecutableDenylisting"; click ExecutableFile href "../../../dao/artifact/d3f:ExecutableFile";DynamicAnalysis["Dynamic Analysis"] -->
          | analyzes | ExecutableFile["Executable File"]; class DynamicAnalysis DefensiveTechniqueNode; class ExecutableFile ArtifactNode; click DynamicAnalysis href "../../../technique/d3f:DynamicAnalysis"; click ExecutableFile href "../../../dao/artifact/d3f:ExecutableFile";EmulatedFileAnalysis["Emulated File Analysis"] -->
          | analyzes | ExecutableFile["Executable File"]; class EmulatedFileAnalysis DefensiveTechniqueNode; class ExecutableFile ArtifactNode; click EmulatedFileAnalysis href "../../../technique/d3f:EmulatedFileAnalysis"; click ExecutableFile href "../../../dao/artifact/d3f:ExecutableFile";ContentModification["Content Modification"] -->
          | modifies | File["File"]; class ContentModification DefensiveTechniqueNode; class File ArtifactNode; click ContentModification href "../../../technique/d3f:ContentModification"; click File href "../../../dao/artifact/d3f:File";ContentQuarantine["Content Quarantine"] -->
          | quarantines | File["File"]; class ContentQuarantine DefensiveTechniqueNode; class File ArtifactNode; click ContentQuarantine href "../../../technique/d3f:ContentQuarantine"; click File href "../../../dao/artifact/d3f:File";ContentFiltering["Content Filtering"] -->
          | filters | File["File"]; class ContentFiltering DefensiveTechniqueNode; class File ArtifactNode; click ContentFiltering href "../../../technique/d3f:ContentFiltering"; click File href "../../../dao/artifact/d3f:File";FileEviction["File Eviction"] -->
          | deletes | File["File"]; class FileEviction DefensiveTechniqueNode; class File ArtifactNode; click FileEviction href "../../../technique/d3f:FileEviction"; click File href "../../../dao/artifact/d3f:File";RemoteFileAccessMediation["Remote File Access Mediation"] -->
          | isolates | File["File"]; class RemoteFileAccessMediation DefensiveTechniqueNode; class File ArtifactNode; click RemoteFileAccessMediation href "../../../technique/d3f:RemoteFileAccessMediation"; click File href "../../../dao/artifact/d3f:File";DecoyFile["Decoy File"] -->
          | spoofs | File["File"]; class DecoyFile DefensiveTechniqueNode; class File ArtifactNode; click DecoyFile href "../../../technique/d3f:DecoyFile"; click File href "../../../dao/artifact/d3f:File";FileEncryption["File Encryption"] -->
          | encrypts | File["File"]; class FileEncryption DefensiveTechniqueNode; class File ArtifactNode; click FileEncryption href "../../../technique/d3f:FileEncryption"; click File href "../../../dao/artifact/d3f:File";RestoreFile["Restore File"] -->
          | restores | File["File"]; class RestoreFile DefensiveTechniqueNode; class File ArtifactNode; click RestoreFile href "../../../technique/d3f:RestoreFile"; click File href "../../../dao/artifact/d3f:File";LocalFilePermissions["Local File Permissions"] -->
          | restricts | File["File"]; class LocalFilePermissions DefensiveTechniqueNode; class File ArtifactNode; click LocalFilePermissions href "../../../technique/d3f:LocalFilePermissions"; click File href "../../../dao/artifact/d3f:File";FileIntegrityMonitoring["File Integrity Monitoring"] -->
          | analyzes | File["File"]; class FileIntegrityMonitoring DefensiveTechniqueNode; class File ArtifactNode; click FileIntegrityMonitoring href "../../../technique/d3f:FileIntegrityMonitoring"; click File href "../../../dao/artifact/d3f:File";FileAnalysis["File Analysis"] -->
          | analyzes | File["File"]; class FileAnalysis DefensiveTechniqueNode; class File ArtifactNode; click FileAnalysis href "../../../technique/d3f:FileAnalysis"; click File href "../../../dao/artifact/d3f:File";ContentModification["Content Modification"] -->
          | filters | FileContentBlock["File Content Block"]; class ContentModification DefensiveTechniqueNode; class FileContentBlock ArtifactNode; click ContentModification href "../../../technique/d3f:ContentModification"; click FileContentBlock href "../../../dao/artifact/d3f:FileContentBlock";FileInternalStructureVerification["File Internal Structure Verification"] -->
          | analyzes | FileContentBlock["File Content Block"]; class FileInternalStructureVerification DefensiveTechniqueNode; class FileContentBlock ArtifactNode; click FileInternalStructureVerification href "../../../technique/d3f:FileInternalStructureVerification"; click FileContentBlock href "../../../dao/artifact/d3f:FileContentBlock";FileMetadataValueVerification["File Metadata Value Verification"] -->
          | analyzes | FileFooterBlock["File Footer Block"]; class FileMetadataValueVerification DefensiveTechniqueNode; class FileFooterBlock ArtifactNode; click FileMetadataValueVerification href "../../../technique/d3f:FileMetadataValueVerification"; click FileFooterBlock href "../../../dao/artifact/d3f:FileFooterBlock";FileMetadataValueVerification["File Metadata Value Verification"] -->
          | analyzes | FileHeaderBlock["File Header Block"]; class FileMetadataValueVerification DefensiveTechniqueNode; class FileHeaderBlock ArtifactNode; click FileMetadataValueVerification href "../../../technique/d3f:FileMetadataValueVerification"; click FileHeaderBlock href "../../../dao/artifact/d3f:FileHeaderBlock";FileFormatVerification["File Format Verification"] -->
          | analyzes | FileSection["File Section"]; class FileFormatVerification DefensiveTechniqueNode; class FileSection ArtifactNode; click FileFormatVerification href "../../../technique/d3f:FileFormatVerification"; click FileSection href "../../../dao/artifact/d3f:FileSection";FileCarving["File Carving"] -->
          | analyzes | FileTransferNetworkTraffic["File Transfer Network Traffic"]; class FileCarving DefensiveTechniqueNode; class FileTransferNetworkTraffic ArtifactNode; click FileCarving href "../../../technique/d3f:FileCarving"; click FileTransferNetworkTraffic href "../../../dao/artifact/d3f:FileTransferNetworkTraffic";DriverLoadIntegrityChecking["Driver Load Integrity Checking"] -->
          | authenticates | HardwareDriver["Hardware Driver"]; class DriverLoadIntegrityChecking DefensiveTechniqueNode; class HardwareDriver ArtifactNode; click DriverLoadIntegrityChecking href "../../../technique/d3f:DriverLoadIntegrityChecking"; click HardwareDriver href "../../../dao/artifact/d3f:HardwareDriver";RestoreNetworkAccess["Restore Network Access"] -->
          | restores | Host["Host"]; class RestoreNetworkAccess DefensiveTechniqueNode; class Host ArtifactNode; click RestoreNetworkAccess href "../../../technique/d3f:RestoreNetworkAccess"; click Host href "../../../dao/artifact/d3f:Host";ForwardResolutionIPDenylisting["Forward Resolution IP Denylisting"] -->
          | blocks | InboundInternetDNSResponseTraffic["Inbound Internet DNS Response Traffic"]; class ForwardResolutionIPDenylisting DefensiveTechniqueNode; class InboundInternetDNSResponseTraffic ArtifactNode; click ForwardResolutionIPDenylisting href "../../../technique/d3f:ForwardResolutionIPDenylisting"; click InboundInternetDNSResponseTraffic href "../../../dao/artifact/d3f:InboundInternetDNSResponseTraffic";InboundSessionVolumeAnalysis["Inbound Session Volume Analysis"] -->
          | analyzes | InboundInternetNetworkTraffic["Inbound Internet Network Traffic"]; class InboundSessionVolumeAnalysis DefensiveTechniqueNode; class InboundInternetNetworkTraffic ArtifactNode; click InboundSessionVolumeAnalysis href "../../../technique/d3f:InboundSessionVolumeAnalysis"; click InboundInternetNetworkTraffic href "../../../dao/artifact/d3f:InboundInternetNetworkTraffic";InboundTrafficFiltering["Inbound Traffic Filtering"] -->
          | filters | InboundNetworkTraffic["Inbound Network Traffic"]; class InboundTrafficFiltering DefensiveTechniqueNode; class InboundNetworkTraffic ArtifactNode; click InboundTrafficFiltering href "../../../technique/d3f:InboundTrafficFiltering"; click InboundNetworkTraffic href "../../../dao/artifact/d3f:InboundNetworkTraffic";IOPortRestriction["IO Port Restriction"] -->
          | filters | InputDevice["Input Device"]; class IOPortRestriction DefensiveTechniqueNode; class InputDevice ArtifactNode; click IOPortRestriction href "../../../technique/d3f:IOPortRestriction"; click InputDevice href "../../../dao/artifact/d3f:InputDevice";InputDeviceAnalysis["Input Device Analysis"] -->
          | analyzes | InputDevice["Input Device"]; class InputDeviceAnalysis DefensiveTechniqueNode; class InputDevice ArtifactNode; click InputDeviceAnalysis href "../../../technique/d3f:InputDeviceAnalysis"; click InputDevice href "../../../dao/artifact/d3f:InputDevice";AdministrativeNetworkActivityAnalysis["Administrative Network Activity Analysis"] -->
          | analyzes | IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class AdministrativeNetworkActivityAnalysis DefensiveTechniqueNode; class IntranetAdministrativeNetworkTraffic ArtifactNode; click AdministrativeNetworkActivityAnalysis href "../../../technique/d3f:AdministrativeNetworkActivityAnalysis"; click IntranetAdministrativeNetworkTraffic href "../../../dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";IPCTrafficAnalysis["IPC Traffic Analysis"] -->
          | analyzes | IntranetIPCNetworkTraffic["Intranet IPC Network Traffic"]; class IPCTrafficAnalysis DefensiveTechniqueNode; class IntranetIPCNetworkTraffic ArtifactNode; click IPCTrafficAnalysis href "../../../technique/d3f:IPCTrafficAnalysis"; click IntranetIPCNetworkTraffic href "../../../dao/artifact/d3f:IntranetIPCNetworkTraffic";EncryptedTunnels["Encrypted Tunnels"] -->
          | isolates | IntranetNetwork["Intranet Network"]; class EncryptedTunnels DefensiveTechniqueNode; class IntranetNetwork ArtifactNode; click EncryptedTunnels href "../../../technique/d3f:EncryptedTunnels"; click IntranetNetwork href "../../../dao/artifact/d3f:IntranetNetwork";IntegratedHoneynet["Integrated Honeynet"] -->
          | spoofs | IntranetNetwork["Intranet Network"]; class IntegratedHoneynet DefensiveTechniqueNode; class IntranetNetwork ArtifactNode; click IntegratedHoneynet href "../../../technique/d3f:IntegratedHoneynet"; click IntranetNetwork href "../../../dao/artifact/d3f:IntranetNetwork";StandaloneHoneynet["Standalone Honeynet"] -->
          | spoofs | IntranetNetwork["Intranet Network"]; class StandaloneHoneynet DefensiveTechniqueNode; class IntranetNetwork ArtifactNode; click StandaloneHoneynet href "../../../technique/d3f:StandaloneHoneynet"; click IntranetNetwork href "../../../dao/artifact/d3f:IntranetNetwork";ConnectionAttemptAnalysis["Connection Attempt Analysis"] -->
          | analyzes | IntranetNetworkTraffic["Intranet Network Traffic"]; class ConnectionAttemptAnalysis DefensiveTechniqueNode; class IntranetNetworkTraffic ArtifactNode; click ConnectionAttemptAnalysis href "../../../technique/d3f:ConnectionAttemptAnalysis"; click IntranetNetworkTraffic href "../../../dao/artifact/d3f:IntranetNetworkTraffic";LANAccessMediation["LAN Access Mediation"] -->
          | isolates | LocalAreaNetwork["Local Area Network"]; class LANAccessMediation DefensiveTechniqueNode; class LocalAreaNetwork ArtifactNode; click LANAccessMediation href "../../../technique/d3f:LANAccessMediation"; click LocalAreaNetwork href "../../../dao/artifact/d3f:LocalAreaNetwork";ConnectedHoneynet["Connected Honeynet"] -->
          | spoofs | LocalAreaNetwork["Local Area Network"]; class ConnectedHoneynet DefensiveTechniqueNode; class LocalAreaNetwork ArtifactNode; click ConnectedHoneynet href "../../../technique/d3f:ConnectedHoneynet"; click LocalAreaNetwork href "../../../dao/artifact/d3f:LocalAreaNetwork";BroadcastDomainIsolation["Broadcast Domain Isolation"] -->
          | filters | LocalAreaNetworkTraffic["Local Area Network Traffic"]; class BroadcastDomainIsolation DefensiveTechniqueNode; class LocalAreaNetworkTraffic ArtifactNode; click BroadcastDomainIsolation href "../../../technique/d3f:BroadcastDomainIsolation"; click LocalAreaNetworkTraffic href "../../../dao/artifact/d3f:LocalAreaNetworkTraffic";FileAccessPatternAnalysis["File Access Pattern Analysis"] -->
          | analyzes | LocalResourceAccess["Local Resource Access"]; class FileAccessPatternAnalysis DefensiveTechniqueNode; class LocalResourceAccess ArtifactNode; click FileAccessPatternAnalysis href "../../../technique/d3f:FileAccessPatternAnalysis"; click LocalResourceAccess href "../../../dao/artifact/d3f:LocalResourceAccess";LocalAccountMonitoring["Local Account Monitoring"] -->
          | analyzes | LocalUserAccount["Local User Account"]; class LocalAccountMonitoring DefensiveTechniqueNode; class LocalUserAccount ArtifactNode; click LocalAccountMonitoring href "../../../technique/d3f:LocalAccountMonitoring"; click LocalUserAccount href "../../../dao/artifact/d3f:LocalUserAccount";EmailRemoval["Email Removal"] -->
          | may-access | MailServer["Mail Server"]; class EmailRemoval DefensiveTechniqueNode; class MailServer ArtifactNode; click EmailRemoval href "../../../technique/d3f:EmailRemoval"; click MailServer href "../../../dao/artifact/d3f:MailServer";NetworkAccessMediation["Network Access Mediation"] -->
          | isolates | Network["Network"]; class NetworkAccessMediation DefensiveTechniqueNode; class Network ArtifactNode; click NetworkAccessMediation href "../../../technique/d3f:NetworkAccessMediation"; click Network href "../../../dao/artifact/d3f:Network";RoutingAccessMediation["Routing Access Mediation"] -->
          | isolates | Network["Network"]; class RoutingAccessMediation DefensiveTechniqueNode; class Network ArtifactNode; click RoutingAccessMediation href "../../../technique/d3f:RoutingAccessMediation"; click Network href "../../../dao/artifact/d3f:Network";EndpointHealthBeacon["Endpoint Health Beacon"] -->
          | monitors | NetworkNode["Network Node"]; class EndpointHealthBeacon DefensiveTechniqueNode; class NetworkNode ArtifactNode; click EndpointHealthBeacon href "../../../technique/d3f:EndpointHealthBeacon"; click NetworkNode href "../../../dao/artifact/d3f:NetworkNode";NetworkResourceAccessMediation["Network Resource Access Mediation"] -->
          | isolates | NetworkResource["Network Resource"]; class NetworkResourceAccessMediation DefensiveTechniqueNode; class NetworkResource ArtifactNode; click NetworkResourceAccessMediation href "../../../technique/d3f:NetworkResourceAccessMediation"; click NetworkResource href "../../../dao/artifact/d3f:NetworkResource";DecoyNetworkResource["Decoy Network Resource"] -->
          | spoofs | NetworkResource["Network Resource"]; class DecoyNetworkResource DefensiveTechniqueNode; class NetworkResource ArtifactNode; click DecoyNetworkResource href "../../../technique/d3f:DecoyNetworkResource"; click NetworkResource href "../../../dao/artifact/d3f:NetworkResource";UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -->
          | analyzes | NetworkTraffic["Network Traffic"]; class UserGeolocationLogonPatternAnalysis DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click UserGeolocationLogonPatternAnalysis href "../../../technique/d3f:UserGeolocationLogonPatternAnalysis"; click NetworkTraffic href "../../../dao/artifact/d3f:NetworkTraffic";NetworkTrafficFiltering["Network Traffic Filtering"] -->
          | filters | NetworkTraffic["Network Traffic"]; class NetworkTrafficFiltering DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click NetworkTrafficFiltering href "../../../technique/d3f:NetworkTrafficFiltering"; click NetworkTraffic href "../../../dao/artifact/d3f:NetworkTraffic";Client-serverPayloadProfiling["Client-server Payload Profiling"] -->
          | analyzes | NetworkTraffic["Network Traffic"]; class Client-serverPayloadProfiling DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click Client-serverPayloadProfiling href "../../../technique/d3f:Client-serverPayloadProfiling"; click NetworkTraffic href "../../../dao/artifact/d3f:NetworkTraffic";NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -->
          | analyzes | NetworkTraffic["Network Traffic"]; class NetworkTrafficCommunityDeviation DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click NetworkTrafficCommunityDeviation href "../../../technique/d3f:NetworkTrafficCommunityDeviation"; click NetworkTraffic href "../../../dao/artifact/d3f:NetworkTraffic";PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -->
          | analyzes | NetworkTraffic["Network Traffic"]; class PerHostDownload-UploadRatioAnalysis DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click PerHostDownload-UploadRatioAnalysis href "../../../technique/d3f:PerHostDownload-UploadRatioAnalysis"; click NetworkTraffic href "../../../dao/artifact/d3f:NetworkTraffic";ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -->
          | analyzes | NetworkTraffic["Network Traffic"]; class ProtocolMetadataAnomalyDetection DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click ProtocolMetadataAnomalyDetection href "../../../technique/d3f:ProtocolMetadataAnomalyDetection"; click NetworkTraffic href "../../../dao/artifact/d3f:NetworkTraffic";RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -->
          | analyzes | NetworkTraffic["Network Traffic"]; class RemoteTerminalSessionDetection DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click RemoteTerminalSessionDetection href "../../../technique/d3f:RemoteTerminalSessionDetection"; click NetworkTraffic href "../../../dao/artifact/d3f:NetworkTraffic";NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -->
          | analyzes | NetworkTraffic["Network Traffic"]; class NetworkTrafficSignatureAnalysis DefensiveTechniqueNode; class NetworkTraffic ArtifactNode; click NetworkTrafficSignatureAnalysis href "../../../technique/d3f:NetworkTrafficSignatureAnalysis"; click NetworkTraffic href "../../../dao/artifact/d3f:NetworkTraffic";ChangeDefaultPassword["Change Default Password"] -->
          | hardens | OTController["OT Controller"]; class ChangeDefaultPassword DefensiveTechniqueNode; class OTController ArtifactNode; click ChangeDefaultPassword href "../../../technique/d3f:ChangeDefaultPassword"; click OTController href "../../../dao/artifact/d3f:OTController";LocalFileAccessMediation["Local File Access Mediation"] -->
          | filters | OpenFile["Open File"]; class LocalFileAccessMediation DefensiveTechniqueNode; class OpenFile ArtifactNode; click LocalFileAccessMediation href "../../../technique/d3f:LocalFileAccessMediation"; click OpenFile href "../../../dao/artifact/d3f:OpenFile";OperatingModeRestriction["Operating Mode Restriction"] -->
          | restricts | OperatingMode["Operating Mode"]; class OperatingModeRestriction DefensiveTechniqueNode; class OperatingMode ArtifactNode; click OperatingModeRestriction href "../../../technique/d3f:OperatingModeRestriction"; click OperatingMode href "../../../dao/artifact/d3f:OperatingMode";OperatingModeMonitoring["Operating Mode Monitoring"] -->
          | monitors | OperatingMode["Operating Mode"]; class OperatingModeMonitoring DefensiveTechniqueNode; class OperatingMode ArtifactNode; click OperatingModeMonitoring href "../../../technique/d3f:OperatingModeMonitoring"; click OperatingMode href "../../../dao/artifact/d3f:OperatingMode";SystemFileAnalysis["System File Analysis"] -->
          | analyzes | OperatingSystemFile["Operating System File"]; class SystemFileAnalysis DefensiveTechniqueNode; class OperatingSystemFile ArtifactNode; click SystemFileAnalysis href "../../../technique/d3f:SystemFileAnalysis"; click OperatingSystemFile href "../../../dao/artifact/d3f:OperatingSystemFile";SystemDaemonMonitoring["System Daemon Monitoring"] -->
          | monitors | OperatingSystemProcess["Operating System Process"]; class SystemDaemonMonitoring DefensiveTechniqueNode; class OperatingSystemProcess ArtifactNode; click SystemDaemonMonitoring href "../../../technique/d3f:SystemDaemonMonitoring"; click OperatingSystemProcess href "../../../dao/artifact/d3f:OperatingSystemProcess";DNSAllowlisting["DNS Allowlisting"] -->
          | blocks | OutboundInternetDNSLookupTraffic["Outbound Internet DNS Lookup Traffic"]; class DNSAllowlisting DefensiveTechniqueNode; class OutboundInternetDNSLookupTraffic ArtifactNode; click DNSAllowlisting href "../../../technique/d3f:DNSAllowlisting"; click OutboundInternetDNSLookupTraffic href "../../../dao/artifact/d3f:OutboundInternetDNSLookupTraffic";ForwardResolutionDomainDenylisting["Forward Resolution Domain Denylisting"] -->
          | blocks | OutboundInternetDNSLookupTraffic["Outbound Internet DNS Lookup Traffic"]; class ForwardResolutionDomainDenylisting DefensiveTechniqueNode; class OutboundInternetDNSLookupTraffic ArtifactNode; click ForwardResolutionDomainDenylisting href "../../../technique/d3f:ForwardResolutionDomainDenylisting"; click OutboundInternetDNSLookupTraffic href "../../../dao/artifact/d3f:OutboundInternetDNSLookupTraffic";ReverseResolutionIPDenylisting["Reverse Resolution IP Denylisting"] -->
          | blocks | OutboundInternetDNSLookupTraffic["Outbound Internet DNS Lookup Traffic"]; class ReverseResolutionIPDenylisting DefensiveTechniqueNode; class OutboundInternetDNSLookupTraffic ArtifactNode; click ReverseResolutionIPDenylisting href "../../../technique/d3f:ReverseResolutionIPDenylisting"; click OutboundInternetDNSLookupTraffic href "../../../dao/artifact/d3f:OutboundInternetDNSLookupTraffic";DNSTrafficAnalysis["DNS Traffic Analysis"] -->
          | analyzes | OutboundInternetDNSLookupTraffic["Outbound Internet DNS Lookup Traffic"]; class DNSTrafficAnalysis DefensiveTechniqueNode; class OutboundInternetDNSLookupTraffic ArtifactNode; click DNSTrafficAnalysis href "../../../technique/d3f:DNSTrafficAnalysis"; click OutboundInternetDNSLookupTraffic href "../../../dao/artifact/d3f:OutboundInternetDNSLookupTraffic";RelayPatternAnalysis["Relay Pattern Analysis"] -->
          | analyzes | OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class RelayPatternAnalysis DefensiveTechniqueNode; class OutboundInternetNetworkTraffic ArtifactNode; click RelayPatternAnalysis href "../../../technique/d3f:RelayPatternAnalysis"; click OutboundInternetNetworkTraffic href "../../../dao/artifact/d3f:OutboundInternetNetworkTraffic";OutboundTrafficFiltering["Outbound Traffic Filtering"] -->
          | filters | OutboundNetworkTraffic["Outbound Network Traffic"]; class OutboundTrafficFiltering DefensiveTechniqueNode; class OutboundNetworkTraffic ArtifactNode; click OutboundTrafficFiltering href "../../../technique/d3f:OutboundTrafficFiltering"; click OutboundNetworkTraffic href "../../../dao/artifact/d3f:OutboundNetworkTraffic";DiskPartitioning["Disk Partitioning"] -->
          | creates | PartitionTable["Partition Table"]; class DiskPartitioning DefensiveTechniqueNode; class PartitionTable ArtifactNode; click DiskPartitioning href "../../../technique/d3f:DiskPartitioning"; click PartitionTable href "../../../dao/artifact/d3f:PartitionTable";ChangeDefaultPassword["Change Default Password"] -->
          | strengthens | Password["Password"]; class ChangeDefaultPassword DefensiveTechniqueNode; class Password ArtifactNode; click ChangeDefaultPassword href "../../../technique/d3f:ChangeDefaultPassword"; click Password href "../../../dao/artifact/d3f:Password";One-timePassword["One-time Password"] -->
          | use-limits | Password["Password"]; class One-timePassword DefensiveTechniqueNode; class Password ArtifactNode; click One-timePassword href "../../../technique/d3f:One-timePassword"; click Password href "../../../dao/artifact/d3f:Password";PasswordRotation["Password Rotation"] -->
          | regenerates | Password["Password"]; class PasswordRotation DefensiveTechniqueNode; class Password ArtifactNode; click PasswordRotation href "../../../technique/d3f:PasswordRotation"; click Password href "../../../dao/artifact/d3f:Password";PasswordAuthentication["Password Authentication"] -->
          | uses | Password["Password"]; class PasswordAuthentication DefensiveTechniqueNode; class Password ArtifactNode; click PasswordAuthentication href "../../../technique/d3f:PasswordAuthentication"; click Password href "../../../dao/artifact/d3f:Password";StrongPasswordPolicy["Strong Password Policy"] -->
          | strengthens | Password["Password"]; class StrongPasswordPolicy DefensiveTechniqueNode; class Password ArtifactNode; click StrongPasswordPolicy href "../../../technique/d3f:StrongPasswordPolicy"; click Password href "../../../dao/artifact/d3f:Password";SystemCallFiltering["System Call Filtering"] -->
          | isolates | Process["Process"]; class SystemCallFiltering DefensiveTechniqueNode; class Process ArtifactNode; click SystemCallFiltering href "../../../technique/d3f:SystemCallFiltering"; click Process href "../../../dao/artifact/d3f:Process";ProcessSelf-ModificationDetection["Process Self-Modification Detection"] -->
          | analyzes | Process["Process"]; class ProcessSelf-ModificationDetection DefensiveTechniqueNode; class Process ArtifactNode; click ProcessSelf-ModificationDetection href "../../../technique/d3f:ProcessSelf-ModificationDetection"; click Process href "../../../dao/artifact/d3f:Process";ProcessSpawnAnalysis["Process Spawn Analysis"] -->
          | analyzes | Process["Process"]; class ProcessSpawnAnalysis DefensiveTechniqueNode; class Process ArtifactNode; click ProcessSpawnAnalysis href "../../../technique/d3f:ProcessSpawnAnalysis"; click Process href "../../../dao/artifact/d3f:Process";Application-basedProcessIsolation["Application-based Process Isolation"] -->
          | isolates | Process["Process"]; class Application-basedProcessIsolation DefensiveTechniqueNode; class Process ArtifactNode; click Application-basedProcessIsolation href "../../../technique/d3f:Application-basedProcessIsolation"; click Process href "../../../dao/artifact/d3f:Process";Kernel-basedProcessIsolation["Kernel-based Process Isolation"] -->
          | isolates | Process["Process"]; class Kernel-basedProcessIsolation DefensiveTechniqueNode; class Process ArtifactNode; click Kernel-basedProcessIsolation href "../../../technique/d3f:Kernel-basedProcessIsolation"; click Process href "../../../dao/artifact/d3f:Process";Hardware-basedProcessIsolation["Hardware-based Process Isolation"] -->
          | isolates | Process["Process"]; class Hardware-basedProcessIsolation DefensiveTechniqueNode; class Process ArtifactNode; click Hardware-basedProcessIsolation href "../../../technique/d3f:Hardware-basedProcessIsolation"; click Process href "../../../dao/artifact/d3f:Process";ProcessLineageAnalysis["Process Lineage Analysis"] -->
          | analyzes | Process["Process"]; class ProcessLineageAnalysis DefensiveTechniqueNode; class Process ArtifactNode; click ProcessLineageAnalysis href "../../../technique/d3f:ProcessLineageAnalysis"; click Process href "../../../dao/artifact/d3f:Process";ProcessSuspension["Process Suspension"] -->
          | suspends | Process["Process"]; class ProcessSuspension DefensiveTechniqueNode; class Process ArtifactNode; click ProcessSuspension href "../../../technique/d3f:ProcessSuspension"; click Process href "../../../dao/artifact/d3f:Process";ProcessTermination["Process Termination"] -->
          | terminates | Process["Process"]; class ProcessTermination DefensiveTechniqueNode; class Process ArtifactNode; click ProcessTermination href "../../../technique/d3f:ProcessTermination"; click Process href "../../../dao/artifact/d3f:Process";HostShutdown["Host Shutdown"] -->
          | terminates | Process["Process"]; class HostShutdown DefensiveTechniqueNode; class Process ArtifactNode; click HostShutdown href "../../../technique/d3f:HostShutdown"; click Process href "../../../dao/artifact/d3f:Process";HostReboot["Host Reboot"] -->
          | terminates | Process["Process"]; class HostReboot DefensiveTechniqueNode; class Process ArtifactNode; click HostReboot href "../../../technique/d3f:HostReboot"; click Process href "../../../dao/artifact/d3f:Process";ProcessCodeSegmentVerification["Process Code Segment Verification"] -->
          | verifies | ProcessCodeSegment["Process Code Segment"]; class ProcessCodeSegmentVerification DefensiveTechniqueNode; class ProcessCodeSegment ArtifactNode; click ProcessCodeSegmentVerification href "../../../technique/d3f:ProcessCodeSegmentVerification"; click ProcessCodeSegment href "../../../dao/artifact/d3f:ProcessCodeSegment";MemoryBoundaryTracking["Memory Boundary Tracking"] -->
          | analyzes | ProcessCodeSegment["Process Code Segment"]; class MemoryBoundaryTracking DefensiveTechniqueNode; class ProcessCodeSegment ArtifactNode; click MemoryBoundaryTracking href "../../../technique/d3f:MemoryBoundaryTracking"; click ProcessCodeSegment href "../../../dao/artifact/d3f:ProcessCodeSegment";ProcessSegmentExecutionPrevention["Process Segment Execution Prevention"] -->
          | neutralizes | ProcessSegment["Process Segment"]; class ProcessSegmentExecutionPrevention DefensiveTechniqueNode; class ProcessSegment ArtifactNode; click ProcessSegmentExecutionPrevention href "../../../technique/d3f:ProcessSegmentExecutionPrevention"; click ProcessSegment href "../../../dao/artifact/d3f:ProcessSegment";SegmentAddressOffsetRandomization["Segment Address Offset Randomization"] -->
          | obfuscates | ProcessSegment["Process Segment"]; class SegmentAddressOffsetRandomization DefensiveTechniqueNode; class ProcessSegment ArtifactNode; click SegmentAddressOffsetRandomization href "../../../technique/d3f:SegmentAddressOffsetRandomization"; click ProcessSegment href "../../../dao/artifact/d3f:ProcessSegment";ProcessLineageAnalysis["Process Lineage Analysis"] -->
          | analyzes | ProcessTree["Process Tree"]; class ProcessLineageAnalysis DefensiveTechniqueNode; class ProcessTree ArtifactNode; click ProcessLineageAnalysis href "../../../technique/d3f:ProcessLineageAnalysis"; click ProcessTree href "../../../dao/artifact/d3f:ProcessTree";RPCTrafficAnalysis["RPC Traffic Analysis"] -->
          | analyzes | RPCNetworkTraffic["RPC Network Traffic"]; class RPCTrafficAnalysis DefensiveTechniqueNode; class RPCNetworkTraffic ArtifactNode; click RPCTrafficAnalysis href "../../../technique/d3f:RPCTrafficAnalysis"; click RPCNetworkTraffic href "../../../dao/artifact/d3f:RPCNetworkTraffic";IOPortRestriction["IO Port Restriction"] -->
          | filters | RemovableMediaDevice["Removable Media Device"]; class IOPortRestriction DefensiveTechniqueNode; class RemovableMediaDevice ArtifactNode; click IOPortRestriction href "../../../technique/d3f:IOPortRestriction"; click RemovableMediaDevice href "../../../dao/artifact/d3f:RemovableMediaDevice";UserDataTransferAnalysis["User Data Transfer Analysis"] -->
          | analyzes | ResourceAccess["Resource Access"]; class UserDataTransferAnalysis DefensiveTechniqueNode; class ResourceAccess ArtifactNode; click UserDataTransferAnalysis href "../../../technique/d3f:UserDataTransferAnalysis"; click ResourceAccess href "../../../dao/artifact/d3f:ResourceAccess";ScriptExecutionAnalysis["Script Execution Analysis"] -->
          | analyzes | ScriptApplicationProcess["Script Application Process"]; class ScriptExecutionAnalysis DefensiveTechniqueNode; class ScriptApplicationProcess ArtifactNode; click ScriptExecutionAnalysis href "../../../technique/d3f:ScriptExecutionAnalysis"; click ScriptApplicationProcess href "../../../dao/artifact/d3f:ScriptApplicationProcess";DiskFormatting["Disk Formatting"] -->
          | modifies | SecondaryStorage["Secondary Storage"]; class DiskFormatting DefensiveTechniqueNode; class SecondaryStorage ArtifactNode; click DiskFormatting href "../../../technique/d3f:DiskFormatting"; click SecondaryStorage href "../../../dao/artifact/d3f:SecondaryStorage";DiskErasure["Disk Erasure"] -->
          | erases | SecondaryStorage["Secondary Storage"]; class DiskErasure DefensiveTechniqueNode; class SecondaryStorage ArtifactNode; click DiskErasure href "../../../technique/d3f:DiskErasure"; click SecondaryStorage href "../../../dao/artifact/d3f:SecondaryStorage";WebSessionAccessMediation["Web Session Access Mediation"] -->
          | isolates | ServiceApplicationProcess["Service Application Process"]; class WebSessionAccessMediation DefensiveTechniqueNode; class ServiceApplicationProcess ArtifactNode; click WebSessionAccessMediation href "../../../technique/d3f:WebSessionAccessMediation"; click ServiceApplicationProcess href "../../../dao/artifact/d3f:ServiceApplicationProcess";SessionTermination["Session Termination"] -->
          | deletes | Session["Session"]; class SessionTermination DefensiveTechniqueNode; class Session ArtifactNode; click SessionTermination href "../../../technique/d3f:SessionTermination"; click Session href "../../../dao/artifact/d3f:Session";DecoySessionToken["Decoy Session Token"] -->
          | spoofs | SessionToken["Session Token"]; class DecoySessionToken DefensiveTechniqueNode; class SessionToken ArtifactNode; click DecoySessionToken href "../../../technique/d3f:DecoySessionToken"; click SessionToken href "../../../dao/artifact/d3f:SessionToken";StackFrameCanaryValidation["Stack Frame Canary Validation"] -->
          | validates | StackFrame["Stack Frame"]; class StackFrameCanaryValidation DefensiveTechniqueNode; class StackFrame ArtifactNode; click StackFrameCanaryValidation href "../../../technique/d3f:StackFrameCanaryValidation"; click StackFrame href "../../../dao/artifact/d3f:StackFrame";ShadowStackComparisons["Shadow Stack Comparisons"] -->
          | analyzes | StackFrame["Stack Frame"]; class ShadowStackComparisons DefensiveTechniqueNode; class StackFrame ArtifactNode; click ShadowStackComparisons href "../../../technique/d3f:ShadowStackComparisons"; click StackFrame href "../../../dao/artifact/d3f:StackFrame";DiskEncryption["Disk Encryption"] -->
          | encrypts | Storage["Storage"]; class DiskEncryption DefensiveTechniqueNode; class Storage ArtifactNode; click DiskEncryption href "../../../technique/d3f:DiskEncryption"; click Storage href "../../../dao/artifact/d3f:Storage";Hardware-basedWriteProtection["Hardware-based Write Protection"] -->
          | hardens | Storage["Storage"]; class Hardware-basedWriteProtection DefensiveTechniqueNode; class Storage ArtifactNode; click Hardware-basedWriteProtection href "../../../technique/d3f:Hardware-basedWriteProtection"; click Storage href "../../../dao/artifact/d3f:Storage";SystemCallFiltering["System Call Filtering"] -->
          | filters | SystemCall["System Call"]; class SystemCallFiltering DefensiveTechniqueNode; class SystemCall ArtifactNode; click SystemCallFiltering href "../../../technique/d3f:SystemCallFiltering"; click SystemCall href "../../../dao/artifact/d3f:SystemCall";SystemCallAnalysis["System Call Analysis"] -->
          | analyzes | SystemCall["System Call"]; class SystemCallAnalysis DefensiveTechniqueNode; class SystemCall ArtifactNode; click SystemCallAnalysis href "../../../technique/d3f:SystemCallAnalysis"; click SystemCall href "../../../dao/artifact/d3f:SystemCall";SystemConfigurationPermissions["System Configuration Permissions"] -->
          | restricts | SystemConfigurationDatabase["System Configuration Database"]; class SystemConfigurationPermissions DefensiveTechniqueNode; class SystemConfigurationDatabase ArtifactNode; click SystemConfigurationPermissions href "../../../technique/d3f:SystemConfigurationPermissions"; click SystemConfigurationDatabase href "../../../dao/artifact/d3f:SystemConfigurationDatabase";SystemInitConfigAnalysis["System Init Config Analysis"] -->
          | analyzes | SystemInitConfiguration["System Init Configuration"]; class SystemInitConfigAnalysis DefensiveTechniqueNode; class SystemInitConfiguration ArtifactNode; click SystemInitConfigAnalysis href "../../../technique/d3f:SystemInitConfigAnalysis"; click SystemInitConfiguration href "../../../dao/artifact/d3f:SystemInitConfiguration";DecoyPersona["Decoy Persona"] -->
          | spoofs | User["User"]; class DecoyPersona DefensiveTechniqueNode; class User ArtifactNode; click DecoyPersona href "../../../technique/d3f:DecoyPersona"; click User href "../../../dao/artifact/d3f:User";ChangeDefaultPassword["Change Default Password"] -->
          | strengthens | UserAccount["User Account"]; class ChangeDefaultPassword DefensiveTechniqueNode; class UserAccount ArtifactNode; click ChangeDefaultPassword href "../../../technique/d3f:ChangeDefaultPassword"; click UserAccount href "../../../dao/artifact/d3f:UserAccount";AgentAuthentication["Agent Authentication"] -->
          | strengthens | UserAccount["User Account"]; class AgentAuthentication DefensiveTechniqueNode; class UserAccount ArtifactNode; click AgentAuthentication href "../../../technique/d3f:AgentAuthentication"; click UserAccount href "../../../dao/artifact/d3f:UserAccount";AccountLocking["Account Locking"] -->
          | disables | UserAccount["User Account"]; class AccountLocking DefensiveTechniqueNode; class UserAccount ArtifactNode; click AccountLocking href "../../../technique/d3f:AccountLocking"; click UserAccount href "../../../dao/artifact/d3f:UserAccount";RestoreUserAccountAccess["Restore User Account Access"] -->
          | restores | UserAccount["User Account"]; class RestoreUserAccountAccess DefensiveTechniqueNode; class UserAccount ArtifactNode; click RestoreUserAccountAccess href "../../../technique/d3f:RestoreUserAccountAccess"; click UserAccount href "../../../dao/artifact/d3f:UserAccount";UnlockAccount["Unlock Account"] -->
          | restores | UserAccount["User Account"]; class UnlockAccount DefensiveTechniqueNode; class UserAccount ArtifactNode; click UnlockAccount href "../../../technique/d3f:UnlockAccount"; click UserAccount href "../../../dao/artifact/d3f:UserAccount";UserAccountPermissions["User Account Permissions"] -->
          | restricts | UserAccount["User Account"]; class UserAccountPermissions DefensiveTechniqueNode; class UserAccount ArtifactNode; click UserAccountPermissions href "../../../technique/d3f:UserAccountPermissions"; click UserAccount href "../../../dao/artifact/d3f:UserAccount";UserSessionInitConfigAnalysis["User Session Init Config Analysis"] -->
          | analyzes | UserInitConfigurationFile["User Init Configuration File"]; class UserSessionInitConfigAnalysis DefensiveTechniqueNode; class UserInitConfigurationFile ArtifactNode; click UserSessionInitConfigAnalysis href "../../../technique/d3f:UserSessionInitConfigAnalysis"; click UserInitConfigurationFile href "../../../dao/artifact/d3f:UserInitConfigurationFile";MessageAuthentication["Message Authentication"] -->
          | authenticates | UserToUserMessage["User to User Message"]; class MessageAuthentication DefensiveTechniqueNode; class UserToUserMessage ArtifactNode; click MessageAuthentication href "../../../technique/d3f:MessageAuthentication"; click UserToUserMessage href "../../../dao/artifact/d3f:UserToUserMessage";MessageEncryption["Message Encryption"] -->
          | encrypts | UserToUserMessage["User to User Message"]; class MessageEncryption DefensiveTechniqueNode; class UserToUserMessage ArtifactNode; click MessageEncryption href "../../../technique/d3f:MessageEncryption"; click UserToUserMessage href "../../../dao/artifact/d3f:UserToUserMessage";WebSessionActivityAnalysis["Web Session Activity Analysis"] -->
          | analyzes | WebResourceAccess["Web Resource Access"]; class WebSessionActivityAnalysis DefensiveTechniqueNode; class WebResourceAccess ArtifactNode; click WebSessionActivityAnalysis href "../../../technique/d3f:WebSessionActivityAnalysis"; click WebResourceAccess href "../../../dao/artifact/d3f:WebResourceAccess";RegistryKeyDeletion["Registry Key Deletion"] -->
          | deletes | WindowsRegistryKey["Windows Registry Key"]; class RegistryKeyDeletion DefensiveTechniqueNode; class WindowsRegistryKey ArtifactNode; click RegistryKeyDeletion href "../../../technique/d3f:RegistryKeyDeletion"; click WindowsRegistryKey href "../../../dao/artifact/d3f:WindowsRegistryKey";

Related Weaknesses

Related Offensive Techniques

        graph LR;

    T1222["File and Directory Permissions Modification"] --> |modifies| AccessControlConfiguration["Access Control Configuration"]; class T1222 OffensiveTechniqueNode;
        class AccessControlConfiguration ArtifactNode; click T1222 href "../../../offensive-technique/attack/T1222/"; click AccessControlConfiguration href "../../../dao/artifact/d3f:AccessControlConfiguration";T1134005["SID-History Injection"] --> |modifies| AccessControlConfiguration["Access Control Configuration"]; class T1134005 OffensiveTechniqueNode;
        class AccessControlConfiguration ArtifactNode; click T1134005 href "../../../offensive-technique/attack/T1134.005/"; click AccessControlConfiguration href "../../../dao/artifact/d3f:AccessControlConfiguration";T1548001["Setuid and Setgid"] --> |modifies| AccessControlConfiguration["Access Control Configuration"]; class T1548001 OffensiveTechniqueNode;
        class AccessControlConfiguration ArtifactNode; click T1548001 href "../../../offensive-technique/attack/T1548.001/"; click AccessControlConfiguration href "../../../dao/artifact/d3f:AccessControlConfiguration";T1528["Steal Application Access Token"] --> |accesses| AccessToken["Access Token"]; class T1528 OffensiveTechniqueNode;
        class AccessToken ArtifactNode; click T1528 href "../../../offensive-technique/attack/T1528/"; click AccessToken href "../../../dao/artifact/d3f:AccessToken";T1134001["Token Impersonation/Theft"] --> |copies| AccessToken["Access Token"]; class T1134001 OffensiveTechniqueNode;
        class AccessToken ArtifactNode; click T1134001 href "../../../offensive-technique/attack/T1134.001/"; click AccessToken href "../../../dao/artifact/d3f:AccessToken";T1134002["Create Process with Token"] --> |copies| AccessToken["Access Token"]; class T1134002 OffensiveTechniqueNode;
        class AccessToken ArtifactNode; click T1134002 href "../../../offensive-technique/attack/T1134.002/"; click AccessToken href "../../../dao/artifact/d3f:AccessToken";T1134003["Make and Impersonate Token"] --> |copies| AccessToken["Access Token"]; class T1134003 OffensiveTechniqueNode;
        class AccessToken ArtifactNode; click T1134003 href "../../../offensive-technique/attack/T1134.003/"; click AccessToken href "../../../dao/artifact/d3f:AccessToken";T1550001["Application Access Token"] --> |uses| AccessToken["Access Token"]; class T1550001 OffensiveTechniqueNode;
        class AccessToken ArtifactNode; click T1550001 href "../../../offensive-technique/attack/T1550.001/"; click AccessToken href "../../../dao/artifact/d3f:AccessToken";T1563["Remote Service Session Hijacking"] --> |produces| AdministrativeNetworkTraffic["Administrative Network Traffic"]; class T1563 OffensiveTechniqueNode;
        class AdministrativeNetworkTraffic ArtifactNode; click T1563 href "../../../offensive-technique/attack/T1563/"; click AdministrativeNetworkTraffic href "../../../dao/artifact/d3f:AdministrativeNetworkTraffic";T1021001["Remote Desktop Protocol"] --> |produces| AdministrativeNetworkTraffic["Administrative Network Traffic"]; class T1021001 OffensiveTechniqueNode;
        class AdministrativeNetworkTraffic ArtifactNode; click T1021001 href "../../../offensive-technique/attack/T1021.001/"; click AdministrativeNetworkTraffic href "../../../dao/artifact/d3f:AdministrativeNetworkTraffic";T1021004["SSH"] --> |produces| AdministrativeNetworkTraffic["Administrative Network Traffic"]; class T1021004 OffensiveTechniqueNode;
        class AdministrativeNetworkTraffic ArtifactNode; click T1021004 href "../../../offensive-technique/attack/T1021.004/"; click AdministrativeNetworkTraffic href "../../../dao/artifact/d3f:AdministrativeNetworkTraffic";T1562002["Disable Windows Event Logging"] --> |may-modify| ApplicationConfiguration["Application Configuration"]; class T1562002 OffensiveTechniqueNode;
        class ApplicationConfiguration ArtifactNode; click T1562002 href "../../../offensive-technique/attack/T1562.002/"; click ApplicationConfiguration href "../../../dao/artifact/d3f:ApplicationConfiguration";T1114003["Email Forwarding Rule"] --> |modifies| ApplicationConfiguration["Application Configuration"]; class T1114003 OffensiveTechniqueNode;
        class ApplicationConfiguration ArtifactNode; click T1114003 href "../../../offensive-technique/attack/T1114.003/"; click ApplicationConfiguration href "../../../dao/artifact/d3f:ApplicationConfiguration";T1564008["Email Hiding Rules"] --> |modifies| ApplicationConfiguration["Application Configuration"]; class T1564008 OffensiveTechniqueNode;
        class ApplicationConfiguration ArtifactNode; click T1564008 href "../../../offensive-technique/attack/T1564.008/"; click ApplicationConfiguration href "../../../dao/artifact/d3f:ApplicationConfiguration";T1137004["Outlook Home Page"] --> |modifies| ApplicationConfigurationDatabase["Application Configuration Database"]; class T1137004 OffensiveTechniqueNode;
        class ApplicationConfigurationDatabase ArtifactNode; click T1137004 href "../../../offensive-technique/attack/T1137.004/"; click ApplicationConfigurationDatabase href "../../../dao/artifact/d3f:ApplicationConfigurationDatabase";T1137005["Outlook Rules"] --> |modifies| ApplicationConfigurationDatabase["Application Configuration Database"]; class T1137005 OffensiveTechniqueNode;
        class ApplicationConfigurationDatabase ArtifactNode; click T1137005 href "../../../offensive-technique/attack/T1137.005/"; click ApplicationConfigurationDatabase href "../../../dao/artifact/d3f:ApplicationConfigurationDatabase";T1547007["Re-opened Applications"] --> |modifies| ApplicationConfigurationFile["Application Configuration File"]; class T1547007 OffensiveTechniqueNode;
        class ApplicationConfigurationFile ArtifactNode; click T1547007 href "../../../offensive-technique/attack/T1547.007/"; click ApplicationConfigurationFile href "../../../dao/artifact/d3f:ApplicationConfigurationFile";T1547011["Plist Modification"] --> |modifies| ApplicationConfigurationFile["Application Configuration File"]; class T1547011 OffensiveTechniqueNode;
        class ApplicationConfigurationFile ArtifactNode; click T1547011 href "../../../offensive-technique/attack/T1547.011/"; click ApplicationConfigurationFile href "../../../dao/artifact/d3f:ApplicationConfigurationFile";T1560["Archive Collected Data"] --> |creates| ArchiveFile["Archive File"]; class T1560 OffensiveTechniqueNode;
        class ArchiveFile ArtifactNode; click T1560 href "../../../offensive-technique/attack/T1560/"; click ArchiveFile href "../../../dao/artifact/d3f:ArchiveFile";T1560001["Archive via Utility"] --> |creates| ArchiveFile["Archive File"]; class T1560001 OffensiveTechniqueNode;
        class ArchiveFile ArtifactNode; click T1560001 href "../../../offensive-technique/attack/T1560.001/"; click ArchiveFile href "../../../dao/artifact/d3f:ArchiveFile";T1560002["Archive via Library"] --> |creates| ArchiveFile["Archive File"]; class T1560002 OffensiveTechniqueNode;
        class ArchiveFile ArtifactNode; click T1560002 href "../../../offensive-technique/attack/T1560.002/"; click ArchiveFile href "../../../dao/artifact/d3f:ArchiveFile";T1123["Audio Capture"] --> |accesses| AudioInputDevice["Audio Input Device"]; class T1123 OffensiveTechniqueNode;
        class AudioInputDevice ArtifactNode; click T1123 href "../../../offensive-technique/attack/T1123/"; click AudioInputDevice href "../../../dao/artifact/d3f:AudioInputDevice";T1187["Forced Authentication"] --> |modifies| AuthenticationLog["Authentication Log"]; class T1187 OffensiveTechniqueNode;
        class AuthenticationLog ArtifactNode; click T1187 href "../../../offensive-technique/attack/T1187/"; click AuthenticationLog href "../../../dao/artifact/d3f:AuthenticationLog";T1110001["Password Guessing"] --> |modifies| AuthenticationLog["Authentication Log"]; class T1110001 OffensiveTechniqueNode;
        class AuthenticationLog ArtifactNode; click T1110001 href "../../../offensive-technique/attack/T1110.001/"; click AuthenticationLog href "../../../dao/artifact/d3f:AuthenticationLog";T1110003["Password Spraying"] --> |modifies| AuthenticationLog["Authentication Log"]; class T1110003 OffensiveTechniqueNode;
        class AuthenticationLog ArtifactNode; click T1110003 href "../../../offensive-technique/attack/T1110.003/"; click AuthenticationLog href "../../../dao/artifact/d3f:AuthenticationLog";T1110004["Credential Stuffing"] --> |modifies| AuthenticationLog["Authentication Log"]; class T1110004 OffensiveTechniqueNode;
        class AuthenticationLog ArtifactNode; click T1110004 href "../../../offensive-technique/attack/T1110.004/"; click AuthenticationLog href "../../../dao/artifact/d3f:AuthenticationLog";T1550["Use Alternate Authentication Material"] --> |accesses| AuthenticationService["Authentication Service"]; class T1550 OffensiveTechniqueNode;
        class AuthenticationService ArtifactNode; click T1550 href "../../../offensive-technique/attack/T1550/"; click AuthenticationService href "../../../dao/artifact/d3f:AuthenticationService";T1003001["LSASS Memory"] --> |accesses| AuthenticationService["Authentication Service"]; class T1003001 OffensiveTechniqueNode;
        class AuthenticationService ArtifactNode; click T1003001 href "../../../offensive-technique/attack/T1003.001/"; click AuthenticationService href "../../../dao/artifact/d3f:AuthenticationService";T1212["Exploitation for Credential Access"] --> |may-access| AuthenticationService["Authentication Service"]; class T1212 OffensiveTechniqueNode;
        class AuthenticationService ArtifactNode; click T1212 href "../../../offensive-technique/attack/T1212/"; click AuthenticationService href "../../../dao/artifact/d3f:AuthenticationService";T1003002["Security Account Manager"] --> |may-access| AuthenticationService["Authentication Service"]; class T1003002 OffensiveTechniqueNode;
        class AuthenticationService ArtifactNode; click T1003002 href "../../../offensive-technique/attack/T1003.002/"; click AuthenticationService href "../../../dao/artifact/d3f:AuthenticationService";T1556["Modify Authentication Process"] --> |modifies| AuthenticationService["Authentication Service"]; class T1556 OffensiveTechniqueNode;
        class AuthenticationService ArtifactNode; click T1556 href "../../../offensive-technique/attack/T1556/"; click AuthenticationService href "../../../dao/artifact/d3f:AuthenticationService";T1561001["Disk Content Wipe"] --> |modifies| BlockDevice["Block Device"]; class T1561001 OffensiveTechniqueNode;
        class BlockDevice ArtifactNode; click T1561001 href "../../../offensive-technique/attack/T1561.001/"; click BlockDevice href "../../../dao/artifact/d3f:BlockDevice";T1014["Rootkit"] --> |may-modify| BootSector["Boot Sector"]; class T1014 OffensiveTechniqueNode;
        class BootSector ArtifactNode; click T1014 href "../../../offensive-technique/attack/T1014/"; click BootSector href "../../../dao/artifact/d3f:BootSector";T1561001["Disk Content Wipe"] --> |may-modify| BootSector["Boot Sector"]; class T1561001 OffensiveTechniqueNode;
        class BootSector ArtifactNode; click T1561001 href "../../../offensive-technique/attack/T1561.001/"; click BootSector href "../../../dao/artifact/d3f:BootSector";T1561002["Disk Structure Wipe"] --> |may-modify| BootSector["Boot Sector"]; class T1561002 OffensiveTechniqueNode;
        class BootSector ArtifactNode; click T1561002 href "../../../offensive-technique/attack/T1561.002/"; click BootSector href "../../../dao/artifact/d3f:BootSector";T1542003["Bootkit"] --> |may-modify| BootSector["Boot Sector"]; class T1542003 OffensiveTechniqueNode;
        class BootSector ArtifactNode; click T1542003 href "../../../offensive-technique/attack/T1542.003/"; click BootSector href "../../../dao/artifact/d3f:BootSector";T1071["Application Layer Protocol"] --> |may-transfer| CertificateFile["Certificate File"]; class T1071 OffensiveTechniqueNode;
        class CertificateFile ArtifactNode; click T1071 href "../../../offensive-technique/attack/T1071/"; click CertificateFile href "../../../dao/artifact/d3f:CertificateFile";T1041["Exfiltration Over C2 Channel"] --> |may-transfer| CertificateFile["Certificate File"]; class T1041 OffensiveTechniqueNode;
        class CertificateFile ArtifactNode; click T1041 href "../../../offensive-technique/attack/T1041/"; click CertificateFile href "../../../dao/artifact/d3f:CertificateFile";T1048002["Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"] --> |may-transfer| CertificateFile["Certificate File"]; class T1048002 OffensiveTechniqueNode;
        class CertificateFile ArtifactNode; click T1048002 href "../../../offensive-technique/attack/T1048.002/"; click CertificateFile href "../../../dao/artifact/d3f:CertificateFile";T1071001["Web Protocols"] --> |may-transfer| CertificateFile["Certificate File"]; class T1071001 OffensiveTechniqueNode;
        class CertificateFile ArtifactNode; click T1071001 href "../../../offensive-technique/attack/T1071.001/"; click CertificateFile href "../../../dao/artifact/d3f:CertificateFile";T1573002["Asymmetric Cryptography"] --> |may-transfer| CertificateFile["Certificate File"]; class T1573002 OffensiveTechniqueNode;
        class CertificateFile ArtifactNode; click T1573002 href "../../../offensive-technique/attack/T1573.002/"; click CertificateFile href "../../../dao/artifact/d3f:CertificateFile";T1553004["Install Root Certificate"] --> |modifies| CertificateTrustStore["Certificate Trust Store"]; class T1553004 OffensiveTechniqueNode;
        class CertificateTrustStore ArtifactNode; click T1553004 href "../../../offensive-technique/attack/T1553.004/"; click CertificateTrustStore href "../../../dao/artifact/d3f:CertificateTrustStore";T1115["Clipboard Data"] --> |reads| Clipboard["Clipboard"]; class T1115 OffensiveTechniqueNode;
        class Clipboard ArtifactNode; click T1115 href "../../../offensive-technique/attack/T1115/"; click Clipboard href "../../../dao/artifact/d3f:Clipboard";T1538["Cloud Service Dashboard"] --> |accesses| CloudConfiguration["Cloud Configuration"]; class T1538 OffensiveTechniqueNode;
        class CloudConfiguration ArtifactNode; click T1538 href "../../../offensive-technique/attack/T1538/"; click CloudConfiguration href "../../../dao/artifact/d3f:CloudConfiguration";T1526["Cloud Service Discovery"] --> |reads| CloudConfiguration["Cloud Configuration"]; class T1526 OffensiveTechniqueNode;
        class CloudConfiguration ArtifactNode; click T1526 href "../../../offensive-technique/attack/T1526/"; click CloudConfiguration href "../../../dao/artifact/d3f:CloudConfiguration";T1552005["Cloud Instance Metadata API"] --> |accesses| CloudInstanceMetadata["Cloud Instance Metadata"]; class T1552005 OffensiveTechniqueNode;
        class CloudInstanceMetadata ArtifactNode; click T1552005 href "../../../offensive-technique/attack/T1552.005/"; click CloudInstanceMetadata href "../../../dao/artifact/d3f:CloudInstanceMetadata";T1619["Cloud Storage Object Discovery"] --> |accesses| CloudStorage["Cloud Storage"]; class T1619 OffensiveTechniqueNode;
        class CloudStorage ArtifactNode; click T1619 href "../../../offensive-technique/attack/T1619/"; click CloudStorage href "../../../dao/artifact/d3f:CloudStorage";T1136003["Cloud Account"] --> |creates| CloudUserAccount["Cloud User Account"]; class T1136003 OffensiveTechniqueNode;
        class CloudUserAccount ArtifactNode; click T1136003 href "../../../offensive-technique/attack/T1136.003/"; click CloudUserAccount href "../../../dao/artifact/d3f:CloudUserAccount";T1078004["Cloud Accounts"] --> |uses| CloudUserAccount["Cloud User Account"]; class T1078004 OffensiveTechniqueNode;
        class CloudUserAccount ArtifactNode; click T1078004 href "../../../offensive-technique/attack/T1078.004/"; click CloudUserAccount href "../../../dao/artifact/d3f:CloudUserAccount";T1087004["Cloud Account"] --> |enumerates| CloudUserAccount["Cloud User Account"]; class T1087004 OffensiveTechniqueNode;
        class CloudUserAccount ArtifactNode; click T1087004 href "../../../offensive-technique/attack/T1087.004/"; click CloudUserAccount href "../../../dao/artifact/d3f:CloudUserAccount";T1213003["Code Repositories"] --> |reads| CodeRepository["Code Repository"]; class T1213003 OffensiveTechniqueNode;
        class CodeRepository ArtifactNode; click T1213003 href "../../../offensive-technique/attack/T1213.003/"; click CodeRepository href "../../../dao/artifact/d3f:CodeRepository";T1070003["Clear Command History"] --> |modifies| CommandHistoryLog["Command History Log"]; class T1070003 OffensiveTechniqueNode;
        class CommandHistoryLog ArtifactNode; click T1070003 href "../../../offensive-technique/attack/T1070.003/"; click CommandHistoryLog href "../../../dao/artifact/d3f:CommandHistoryLog";T1552003["Bash History"] --> |accesses| CommandHistoryLogFile["Command History Log File"]; class T1552003 OffensiveTechniqueNode;
        class CommandHistoryLogFile ArtifactNode; click T1552003 href "../../../offensive-technique/attack/T1552.003/"; click CommandHistoryLogFile href "../../../dao/artifact/d3f:CommandHistoryLogFile";T1127001["MSBuild"] --> |modifies| CompilerConfigurationFile["Compiler Configuration File"]; class T1127001 OffensiveTechniqueNode;
        class CompilerConfigurationFile ArtifactNode; click T1127001 href "../../../offensive-technique/attack/T1127.001/"; click CompilerConfigurationFile href "../../../dao/artifact/d3f:CompilerConfigurationFile";T1614["System Location Discovery"] --> |accesses| ConfigurationResource["Configuration Resource"]; class T1614 OffensiveTechniqueNode;
        class ConfigurationResource ArtifactNode; click T1614 href "../../../offensive-technique/attack/T1614/"; click ConfigurationResource href "../../../dao/artifact/d3f:ConfigurationResource";T1546014["Emond"] --> |modifies| ConfigurationResource["Configuration Resource"]; class T1546014 OffensiveTechniqueNode;
        class ConfigurationResource ArtifactNode; click T1546014 href "../../../offensive-technique/attack/T1546.014/"; click ConfigurationResource href "../../../dao/artifact/d3f:ConfigurationResource";T1525["Implant Internal Image"] --> |adds| ContainerImage["Container Image"]; class T1525 OffensiveTechniqueNode;
        class ContainerImage ArtifactNode; click T1525 href "../../../offensive-technique/attack/T1525/"; click ContainerImage href "../../../dao/artifact/d3f:ContainerImage";T1033["System Owner/User Discovery"] --> |may-invoke| CopyToken["Copy Token"]; class T1033 OffensiveTechniqueNode;
        class CopyToken ArtifactNode; click T1033 href "../../../offensive-technique/attack/T1033/"; click CopyToken href "../../../dao/artifact/d3f:CopyToken";T1218001["Compiled HTML File"] --> |invokes| CreateFile["Create File"]; class T1218001 OffensiveTechniqueNode;
        class CreateFile ArtifactNode; click T1218001 href "../../../offensive-technique/attack/T1218.001/"; click CreateFile href "../../../dao/artifact/d3f:CreateFile";T1074001["Local Data Staging"] --> |may-invoke| CreateFile["Create File"]; class T1074001 OffensiveTechniqueNode;
        class CreateFile ArtifactNode; click T1074001 href "../../../offensive-technique/attack/T1074.001/"; click CreateFile href "../../../dao/artifact/d3f:CreateFile";T1140["Deobfuscate/Decode Files or Information"] --> |invokes| CreateProcess["Create Process"]; class T1140 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click T1140 href "../../../offensive-technique/attack/T1140/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";T1220["XSL Script Processing"] --> |invokes| CreateProcess["Create Process"]; class T1220 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click T1220 href "../../../offensive-technique/attack/T1220/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";T1053["Scheduled Task/Job"] --> |invokes| CreateProcess["Create Process"]; class T1053 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click T1053 href "../../../offensive-technique/attack/T1053/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";T1055013["Process Doppelgänging"] --> |invokes| CreateProcess["Create Process"]; class T1055013 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click T1055013 href "../../../offensive-technique/attack/T1055.013/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";T1134004["Parent PID Spoofing"] --> |invokes| CreateProcess["Create Process"]; class T1134004 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click T1134004 href "../../../offensive-technique/attack/T1134.004/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";T1218001["Compiled HTML File"] --> |invokes| CreateProcess["Create Process"]; class T1218001 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click T1218001 href "../../../offensive-technique/attack/T1218.001/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";T1218002["Control Panel"] --> |invokes| CreateProcess["Create Process"]; class T1218002 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click T1218002 href "../../../offensive-technique/attack/T1218.002/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";T1218003["CMSTP"] --> |invokes| CreateProcess["Create Process"]; class T1218003 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click T1218003 href "../../../offensive-technique/attack/T1218.003/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";T1548002["Bypass User Account Control"] --> |invokes| CreateProcess["Create Process"]; class T1548002 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click T1548002 href "../../../offensive-technique/attack/T1548.002/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";T1218005["Mshta"] --> |invokes| CreateProcess["Create Process"]; class T1218005 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click T1218005 href "../../../offensive-technique/attack/T1218.005/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";T1218011["Rundll32"] --> |invokes| CreateProcess["Create Process"]; class T1218011 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click T1218011 href "../../../offensive-technique/attack/T1218.011/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";T1007["System Service Discovery"] --> |may-invoke| CreateProcess["Create Process"]; class T1007 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click T1007 href "../../../offensive-technique/attack/T1007/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";T1010["Application Window Discovery"] --> |may-invoke| CreateProcess["Create Process"]; class T1010 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click T1010 href "../../../offensive-technique/attack/T1010/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";T1016["System Network Configuration Discovery"] --> |may-invoke| CreateProcess["Create Process"]; class T1016 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click T1016 href "../../../offensive-technique/attack/T1016/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";T1018["Remote System Discovery"] --> |may-invoke| CreateProcess["Create Process"]; class T1018 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click T1018 href "../../../offensive-technique/attack/T1018/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";T1033["System Owner/User Discovery"] --> |may-invoke| CreateProcess["Create Process"]; class T1033 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click T1033 href "../../../offensive-technique/attack/T1033/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";T1057["Process Discovery"] --> |may-invoke| CreateProcess["Create Process"]; class T1057 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click T1057 href "../../../offensive-technique/attack/T1057/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";T1082["System Information Discovery"] --> |may-invoke| CreateProcess["Create Process"]; class T1082 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click T1082 href "../../../offensive-technique/attack/T1082/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";T1124["System Time Discovery"] --> |may-invoke| CreateProcess["Create Process"]; class T1124 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click T1124 href "../../../offensive-technique/attack/T1124/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";T1047["Windows Management Instrumentation"] --> |may-invoke| CreateProcess["Create Process"]; class T1047 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click T1047 href "../../../offensive-technique/attack/T1047/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";T1055004["Asynchronous Procedure Call"] --> |may-invoke| CreateProcess["Create Process"]; class T1055004 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click T1055004 href "../../../offensive-technique/attack/T1055.004/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";T1505001["SQL Stored Procedures"] --> |invokes| CreateProcess["Create Process"]; class T1505001 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click T1505001 href "../../../offensive-technique/attack/T1505.001/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";T1546009["AppCert DLLs"] --> |invokes| CreateProcess["Create Process"]; class T1546009 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click T1546009 href "../../../offensive-technique/attack/T1546.009/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";T1546010["AppInit DLLs"] --> |invokes| CreateProcess["Create Process"]; class T1546010 OffensiveTechniqueNode;
        class CreateProcess ArtifactNode; click T1546010 href "../../../offensive-technique/attack/T1546.010/"; click CreateProcess href "../../../dao/artifact/d3f:CreateProcess";T1018["Remote System Discovery"] --> |may-invoke| CreateSocket["Create Socket"]; class T1018 OffensiveTechniqueNode;
        class CreateSocket ArtifactNode; click T1018 href "../../../offensive-technique/attack/T1018/"; click CreateSocket href "../../../dao/artifact/d3f:CreateSocket";T1218013["Mavinject"] --> |invokes| CreateThread["Create Thread"]; class T1218013 OffensiveTechniqueNode;
        class CreateThread ArtifactNode; click T1218013 href "../../../offensive-technique/attack/T1218.013/"; click CreateThread href "../../../dao/artifact/d3f:CreateThread";T1552["Unsecured Credentials"] --> |accesses| Credential["Credential"]; class T1552 OffensiveTechniqueNode;
        class Credential ArtifactNode; click T1552 href "../../../offensive-technique/attack/T1552/"; click Credential href "../../../dao/artifact/d3f:Credential";T1098001["Additional Cloud Credentials"] --> |creates| Credential["Credential"]; class T1098001 OffensiveTechniqueNode;
        class Credential ArtifactNode; click T1098001 href "../../../offensive-technique/attack/T1098.001/"; click Credential href "../../../dao/artifact/d3f:Credential";T1560003["Archive via Custom Method"] --> |creates| CustomArchiveFile["Custom Archive File"]; class T1560003 OffensiveTechniqueNode;
        class CustomArchiveFile ArtifactNode; click T1560003 href "../../../offensive-technique/attack/T1560.003/"; click CustomArchiveFile href "../../../dao/artifact/d3f:CustomArchiveFile";T1557003["DHCP Spoofing"] --> |creates| DHCPNetworkTraffic["DHCP Network Traffic"]; class T1557003 OffensiveTechniqueNode;
        class DHCPNetworkTraffic ArtifactNode; click T1557003 href "../../../offensive-technique/attack/T1557.003/"; click DHCPNetworkTraffic href "../../../dao/artifact/d3f:DHCPNetworkTraffic";T1040["Network Sniffing"] --> |may-produce| DNSLookup["DNS Lookup"]; class T1040 OffensiveTechniqueNode;
        class DNSLookup ArtifactNode; click T1040 href "../../../offensive-technique/attack/T1040/"; click DNSLookup href "../../../dao/artifact/d3f:DNSLookup";T1555003["Credentials from Web Browsers"] --> |accesses| DatabaseFile["Database File"]; class T1555003 OffensiveTechniqueNode;
        class DatabaseFile ArtifactNode; click T1555003 href "../../../offensive-technique/attack/T1555.003/"; click DatabaseFile href "../../../dao/artifact/d3f:DatabaseFile";T1555["Credentials from Password Stores"] --> |may-access| DatabaseFile["Database File"]; class T1555 OffensiveTechniqueNode;
        class DatabaseFile ArtifactNode; click T1555 href "../../../offensive-technique/attack/T1555/"; click DatabaseFile href "../../../dao/artifact/d3f:DatabaseFile";T1082["System Information Discovery"] --> |may-access| DecoyArtifact["Decoy Artifact"]; class T1082 OffensiveTechniqueNode;
        class DecoyArtifact ArtifactNode; click T1082 href "../../../offensive-technique/attack/T1082/"; click DecoyArtifact href "../../../dao/artifact/d3f:DecoyArtifact";T1078001["Default Accounts"] --> |uses| DefaultUserAccount["Default User Account"]; class T1078001 OffensiveTechniqueNode;
        class DefaultUserAccount ArtifactNode; click T1078001 href "../../../offensive-technique/attack/T1078.001/"; click DefaultUserAccount href "../../../dao/artifact/d3f:DefaultUserAccount";T1083["File and Directory Discovery"] --> |accesses| Directory["Directory"]; class T1083 OffensiveTechniqueNode;
        class Directory ArtifactNode; click T1083 href "../../../offensive-technique/attack/T1083/"; click Directory href "../../../dao/artifact/d3f:Directory";T1564006["Run Virtual Instance"] --> |may-create| Directory["Directory"]; class T1564006 OffensiveTechniqueNode;
        class Directory ArtifactNode; click T1564006 href "../../../offensive-technique/attack/T1564.006/"; click Directory href "../../../dao/artifact/d3f:Directory";T1033["System Owner/User Discovery"] --> |may-access| DirectoryService["Directory Service"]; class T1033 OffensiveTechniqueNode;
        class DirectoryService ArtifactNode; click T1033 href "../../../offensive-technique/attack/T1033/"; click DirectoryService href "../../../dao/artifact/d3f:DirectoryService";T1113["Screen Capture"] --> |may-access| DisplayServer["Display Server"]; class T1113 OffensiveTechniqueNode;
        class DisplayServer ArtifactNode; click T1113 href "../../../offensive-technique/attack/T1113/"; click DisplayServer href "../../../dao/artifact/d3f:DisplayServer";T1136002["Domain Account"] --> |creates| DomainUserAccount["Domain User Account"]; class T1136002 OffensiveTechniqueNode;
        class DomainUserAccount ArtifactNode; click T1136002 href "../../../offensive-technique/attack/T1136.002/"; click DomainUserAccount href "../../../dao/artifact/d3f:DomainUserAccount";T1098002["Additional Email Delegate Permissions"] --> |modifies| DomainUserAccount["Domain User Account"]; class T1098002 OffensiveTechniqueNode;
        class DomainUserAccount ArtifactNode; click T1098002 href "../../../offensive-technique/attack/T1098.002/"; click DomainUserAccount href "../../../dao/artifact/d3f:DomainUserAccount";T1078002["Domain Accounts"] --> |uses| DomainUserAccount["Domain User Account"]; class T1078002 OffensiveTechniqueNode;
        class DomainUserAccount ArtifactNode; click T1078002 href "../../../offensive-technique/attack/T1078.002/"; click DomainUserAccount href "../../../dao/artifact/d3f:DomainUserAccount";T1087002["Domain Account"] --> |enumerates| DomainUserAccount["Domain User Account"]; class T1087002 OffensiveTechniqueNode;
        class DomainUserAccount ArtifactNode; click T1087002 href "../../../offensive-technique/attack/T1087.002/"; click DomainUserAccount href "../../../dao/artifact/d3f:DomainUserAccount";T1534["Internal Spearphishing"] --> |produces| Email["Email"]; class T1534 OffensiveTechniqueNode;
        class Email ArtifactNode; click T1534 href "../../../offensive-technique/attack/T1534/"; click Email href "../../../dao/artifact/d3f:Email";T1566001["Spearphishing Attachment"] --> |produces| Email["Email"]; class T1566001 OffensiveTechniqueNode;
        class Email ArtifactNode; click T1566001 href "../../../offensive-technique/attack/T1566.001/"; click Email href "../../../dao/artifact/d3f:Email";T1566002["Spearphishing Link"] --> |produces| Email["Email"]; class T1566002 OffensiveTechniqueNode;
        class Email ArtifactNode; click T1566002 href "../../../offensive-technique/attack/T1566.002/"; click Email href "../../../dao/artifact/d3f:Email";T1114001["Local Email Collection"] --> |reads| Email["Email"]; class T1114001 OffensiveTechniqueNode;
        class Email ArtifactNode; click T1114001 href "../../../offensive-technique/attack/T1114.001/"; click Email href "../../../dao/artifact/d3f:Email";T1564008["Email Hiding Rules"] --> |may-create| EmailRule["Email Rule"]; class T1564008 OffensiveTechniqueNode;
        class EmailRule ArtifactNode; click T1564008 href "../../../offensive-technique/attack/T1564.008/"; click EmailRule href "../../../dao/artifact/d3f:EmailRule";T1564008["Email Hiding Rules"] --> |may-modify| EmailRule["Email Rule"]; class T1564008 OffensiveTechniqueNode;
        class EmailRule ArtifactNode; click T1564008 href "../../../offensive-technique/attack/T1564.008/"; click EmailRule href "../../../dao/artifact/d3f:EmailRule";T1142["Keychain"] --> |accesses| EncryptedCredential["Encrypted Credential"]; class T1142 OffensiveTechniqueNode;
        class EncryptedCredential ArtifactNode; click T1142 href "../../../offensive-technique/attack/T1142/"; click EncryptedCredential href "../../../dao/artifact/d3f:EncryptedCredential";T1003003["NTDS"] --> |accesses| EncryptedCredential["Encrypted Credential"]; class T1003003 OffensiveTechniqueNode;
        class EncryptedCredential ArtifactNode; click T1003003 href "../../../offensive-technique/attack/T1003.003/"; click EncryptedCredential href "../../../dao/artifact/d3f:EncryptedCredential";T1003005["Cached Domain Credentials"] --> |accesses| EncryptedCredential["Encrypted Credential"]; class T1003005 OffensiveTechniqueNode;
        class EncryptedCredential ArtifactNode; click T1003005 href "../../../offensive-technique/attack/T1003.005/"; click EncryptedCredential href "../../../dao/artifact/d3f:EncryptedCredential";T1003008["/etc/passwd and /etc/shadow"] --> |accesses| EncryptedCredential["Encrypted Credential"]; class T1003008 OffensiveTechniqueNode;
        class EncryptedCredential ArtifactNode; click T1003008 href "../../../offensive-technique/attack/T1003.008/"; click EncryptedCredential href "../../../dao/artifact/d3f:EncryptedCredential";T1562009["Safe Mode Boot"] --> |disables| EndpointSensor["Endpoint Sensor"]; class T1562009 OffensiveTechniqueNode;
        class EndpointSensor ArtifactNode; click T1562009 href "../../../offensive-technique/attack/T1562.009/"; click EndpointSensor href "../../../dao/artifact/d3f:EndpointSensor";T1140["Deobfuscate/Decode Files or Information"] --> |may-modify| EventLog["Event Log"]; class T1140 OffensiveTechniqueNode;
        class EventLog ArtifactNode; click T1140 href "../../../offensive-technique/attack/T1140/"; click EventLog href "../../../dao/artifact/d3f:EventLog";T1134002["Create Process with Token"] --> |may-modify| EventLog["Event Log"]; class T1134002 OffensiveTechniqueNode;
        class EventLog ArtifactNode; click T1134002 href "../../../offensive-technique/attack/T1134.002/"; click EventLog href "../../../dao/artifact/d3f:EventLog";T1134003["Make and Impersonate Token"] --> |may-modify| EventLog["Event Log"]; class T1134003 OffensiveTechniqueNode;
        class EventLog ArtifactNode; click T1134003 href "../../../offensive-technique/attack/T1134.003/"; click EventLog href "../../../dao/artifact/d3f:EventLog";T1003006["DCSync"] --> |may-modify| EventLog["Event Log"]; class T1003006 OffensiveTechniqueNode;
        class EventLog ArtifactNode; click T1003006 href "../../../offensive-technique/attack/T1003.006/"; click EventLog href "../../../dao/artifact/d3f:EventLog";T1548003["Sudo and Sudo Caching"] --> |may-modify| EventLog["Event Log"]; class T1548003 OffensiveTechniqueNode;
        class EventLog ArtifactNode; click T1548003 href "../../../offensive-technique/attack/T1548.003/"; click EventLog href "../../../dao/artifact/d3f:EventLog";T1070001["Clear Windows Event Logs"] --> |modifies| EventLog["Event Log"]; class T1070001 OffensiveTechniqueNode;
        class EventLog ArtifactNode; click T1070001 href "../../../offensive-technique/attack/T1070.001/"; click EventLog href "../../../dao/artifact/d3f:EventLog";T1546003["Windows Management Instrumentation Event Subscription"] --> |modifies| EventLog["Event Log"]; class T1546003 OffensiveTechniqueNode;
        class EventLog ArtifactNode; click T1546003 href "../../../offensive-technique/attack/T1546.003/"; click EventLog href "../../../dao/artifact/d3f:EventLog";T1546005["Trap"] --> |modifies| EventLog["Event Log"]; class T1546005 OffensiveTechniqueNode;
        class EventLog ArtifactNode; click T1546005 href "../../../offensive-technique/attack/T1546.005/"; click EventLog href "../../../dao/artifact/d3f:EventLog";T1036001["Invalid Code Signature"] --> |creates| ExecutableBinary["Executable Binary"]; class T1036001 OffensiveTechniqueNode;
        class ExecutableBinary ArtifactNode; click T1036001 href "../../../offensive-technique/attack/T1036.001/"; click ExecutableBinary href "../../../dao/artifact/d3f:ExecutableBinary";T1546015["Component Object Model Hijacking"] --> |loads| ExecutableBinary["Executable Binary"]; class T1546015 OffensiveTechniqueNode;
        class ExecutableBinary ArtifactNode; click T1546015 href "../../../offensive-technique/attack/T1546.015/"; click ExecutableBinary href "../../../dao/artifact/d3f:ExecutableBinary";T1055003["Thread Execution Hijacking"] --> |may-add| ExecutableBinary["Executable Binary"]; class T1055003 OffensiveTechniqueNode;
        class ExecutableBinary ArtifactNode; click T1055003 href "../../../offensive-technique/attack/T1055.003/"; click ExecutableBinary href "../../../dao/artifact/d3f:ExecutableBinary";T1546008["Accessibility Features"] --> |may-modify| ExecutableBinary["Executable Binary"]; class T1546008 OffensiveTechniqueNode;
        class ExecutableBinary ArtifactNode; click T1546008 href "../../../offensive-technique/attack/T1546.008/"; click ExecutableBinary href "../../../dao/artifact/d3f:ExecutableBinary";T1027001["Binary Padding"] --> |modifies| ExecutableBinary["Executable Binary"]; class T1027001 OffensiveTechniqueNode;
        class ExecutableBinary ArtifactNode; click T1027001 href "../../../offensive-technique/attack/T1027.001/"; click ExecutableBinary href "../../../dao/artifact/d3f:ExecutableBinary";T1546006["LC_LOAD_DYLIB Addition"] --> |modifies| ExecutableBinary["Executable Binary"]; class T1546006 OffensiveTechniqueNode;
        class ExecutableBinary ArtifactNode; click T1546006 href "../../../offensive-technique/attack/T1546.006/"; click ExecutableBinary href "../../../dao/artifact/d3f:ExecutableBinary";T1027004["Compile After Delivery"] --> |creates| ExecutableFile["Executable File"]; class T1027004 OffensiveTechniqueNode;
        class ExecutableFile ArtifactNode; click T1027004 href "../../../offensive-technique/attack/T1027.004/"; click ExecutableFile href "../../../dao/artifact/d3f:ExecutableFile";T1574007["Path Interception by PATH Environment Variable"] --> |creates| ExecutableFile["Executable File"]; class T1574007 OffensiveTechniqueNode;
        class ExecutableFile ArtifactNode; click T1574007 href "../../../offensive-technique/attack/T1574.007/"; click ExecutableFile href "../../../dao/artifact/d3f:ExecutableFile";T1574008["Path Interception by Search Order Hijacking"] --> |creates| ExecutableFile["Executable File"]; class T1574008 OffensiveTechniqueNode;
        class ExecutableFile ArtifactNode; click T1574008 href "../../../offensive-technique/attack/T1574.008/"; click ExecutableFile href "../../../dao/artifact/d3f:ExecutableFile";T1574009["Path Interception by Unquoted Path"] --> |creates| ExecutableFile["Executable File"]; class T1574009 OffensiveTechniqueNode;
        class ExecutableFile ArtifactNode; click T1574009 href "../../../offensive-technique/attack/T1574.009/"; click ExecutableFile href "../../../dao/artifact/d3f:ExecutableFile";T1546002["Screensaver"] --> |creates| ExecutableFile["Executable File"]; class T1546002 OffensiveTechniqueNode;
        class ExecutableFile ArtifactNode; click T1546002 href "../../../offensive-technique/attack/T1546.002/"; click ExecutableFile href "../../../dao/artifact/d3f:ExecutableFile";T1204002["Malicious File"] --> |executes| ExecutableFile["Executable File"]; class T1204002 OffensiveTechniqueNode;
        class ExecutableFile ArtifactNode; click T1204002 href "../../../offensive-technique/attack/T1204.002/"; click ExecutableFile href "../../../dao/artifact/d3f:ExecutableFile";T1548002["Bypass User Account Control"] --> |executes| ExecutableFile["Executable File"]; class T1548002 OffensiveTechniqueNode;
        class ExecutableFile ArtifactNode; click T1548002 href "../../../offensive-technique/attack/T1548.002/"; click ExecutableFile href "../../../dao/artifact/d3f:ExecutableFile";T1140["Deobfuscate/Decode Files or Information"] --> |may-add| ExecutableFile["Executable File"]; class T1140 OffensiveTechniqueNode;
        class ExecutableFile ArtifactNode; click T1140 href "../../../offensive-technique/attack/T1140/"; click ExecutableFile href "../../../dao/artifact/d3f:ExecutableFile";T1036003["Rename Legitimate Utilities"] --> |may-create| ExecutableFile["Executable File"]; class T1036003 OffensiveTechniqueNode;
        class ExecutableFile ArtifactNode; click T1036003 href "../../../offensive-technique/attack/T1036.003/"; click ExecutableFile href "../../../dao/artifact/d3f:ExecutableFile";T1565003["Runtime Data Manipulation"] --> |may-modify| ExecutableFile["Executable File"]; class T1565003 OffensiveTechniqueNode;
        class ExecutableFile ArtifactNode; click T1565003 href "../../../offensive-technique/attack/T1565.003/"; click ExecutableFile href "../../../dao/artifact/d3f:ExecutableFile";T1027002["Software Packing"] --> |obfuscates| ExecutableFile["Executable File"]; class T1027002 OffensiveTechniqueNode;
        class ExecutableFile ArtifactNode; click T1027002 href "../../../offensive-technique/attack/T1027.002/"; click ExecutableFile href "../../../dao/artifact/d3f:ExecutableFile";T1059["Command and Scripting Interpreter"] --> |executes| ExecutableScript["Executable Script"]; class T1059 OffensiveTechniqueNode;
        class ExecutableScript ArtifactNode; click T1059 href "../../../offensive-technique/attack/T1059/"; click ExecutableScript href "../../../dao/artifact/d3f:ExecutableScript";T1220["XSL Script Processing"] --> |interprets| ExecutableScript["Executable Script"]; class T1220 OffensiveTechniqueNode;
        class ExecutableScript ArtifactNode; click T1220 href "../../../offensive-technique/attack/T1220/"; click ExecutableScript href "../../../dao/artifact/d3f:ExecutableScript";T1137001["Office Template Macros"] --> |may-add| ExecutableScript["Executable Script"]; class T1137001 OffensiveTechniqueNode;
        class ExecutableScript ArtifactNode; click T1137001 href "../../../offensive-technique/attack/T1137.001/"; click ExecutableScript href "../../../dao/artifact/d3f:ExecutableScript";T1546005["Trap"] --> |may-create| ExecutableScript["Executable Script"]; class T1546005 OffensiveTechniqueNode;
        class ExecutableScript ArtifactNode; click T1546005 href "../../../offensive-technique/attack/T1546.005/"; click ExecutableScript href "../../../dao/artifact/d3f:ExecutableScript";T1016["System Network Configuration Discovery"] --> |may-execute| ExecutableScript["Executable Script"]; class T1016 OffensiveTechniqueNode;
        class ExecutableScript ArtifactNode; click T1016 href "../../../offensive-technique/attack/T1016/"; click ExecutableScript href "../../../dao/artifact/d3f:ExecutableScript";T1137001["Office Template Macros"] --> |may-modify| ExecutableScript["Executable Script"]; class T1137001 OffensiveTechniqueNode;
        class ExecutableScript ArtifactNode; click T1137001 href "../../../offensive-technique/attack/T1137.001/"; click ExecutableScript href "../../../dao/artifact/d3f:ExecutableScript";T1546005["Trap"] --> |may-modify| ExecutableScript["Executable Script"]; class T1546005 OffensiveTechniqueNode;
        class ExecutableScript ArtifactNode; click T1546005 href "../../../offensive-technique/attack/T1546.005/"; click ExecutableScript href "../../../dao/artifact/d3f:ExecutableScript";T1005["Data from Local System"] --> |accesses| File["File"]; class T1005 OffensiveTechniqueNode;
        class File ArtifactNode; click T1005 href "../../../offensive-technique/attack/T1005/"; click File href "../../../dao/artifact/d3f:File";T1119["Automated Collection"] --> |accesses| File["File"]; class T1119 OffensiveTechniqueNode;
        class File ArtifactNode; click T1119 href "../../../offensive-technique/attack/T1119/"; click File href "../../../dao/artifact/d3f:File";T1083["File and Directory Discovery"] --> |accesses| File["File"]; class T1083 OffensiveTechniqueNode;
        class File ArtifactNode; click T1083 href "../../../offensive-technique/attack/T1083/"; click File href "../../../dao/artifact/d3f:File";T1552001["Credentials In Files"] --> |accesses| File["File"]; class T1552001 OffensiveTechniqueNode;
        class File ArtifactNode; click T1552001 href "../../../offensive-technique/attack/T1552.001/"; click File href "../../../dao/artifact/d3f:File";T1220["XSL Script Processing"] --> |adds| File["File"]; class T1220 OffensiveTechniqueNode;
        class File ArtifactNode; click T1220 href "../../../offensive-technique/attack/T1220/"; click File href "../../../dao/artifact/d3f:File";T1072["Software Deployment Tools"] --> |adds| File["File"]; class T1072 OffensiveTechniqueNode;
        class File ArtifactNode; click T1072 href "../../../offensive-technique/attack/T1072/"; click File href "../../../dao/artifact/d3f:File";T1036006["Space after Filename"] --> |creates| File["File"]; class T1036006 OffensiveTechniqueNode;
        class File ArtifactNode; click T1036006 href "../../../offensive-technique/attack/T1036.006/"; click File href "../../../dao/artifact/d3f:File";T1564006["Run Virtual Instance"] --> |creates| File["File"]; class T1564006 OffensiveTechniqueNode;
        class File ArtifactNode; click T1564006 href "../../../offensive-technique/attack/T1564.006/"; click File href "../../../dao/artifact/d3f:File";T1070004["File Deletion"] --> |deletes| File["File"]; class T1070004 OffensiveTechniqueNode;
        class File ArtifactNode; click T1070004 href "../../../offensive-technique/attack/T1070.004/"; click File href "../../../dao/artifact/d3f:File";T1074001["Local Data Staging"] --> |may-create| File["File"]; class T1074001 OffensiveTechniqueNode;
        class File ArtifactNode; click T1074001 href "../../../offensive-technique/attack/T1074.001/"; click File href "../../../dao/artifact/d3f:File";T1036005["Match Legitimate Resource Name or Location"] --> |may-create| File["File"]; class T1036005 OffensiveTechniqueNode;
        class File ArtifactNode; click T1036005 href "../../../offensive-technique/attack/T1036.005/"; click File href "../../../dao/artifact/d3f:File";T1070004["File Deletion"] --> |may-modify| File["File"]; class T1070004 OffensiveTechniqueNode;
        class File ArtifactNode; click T1070004 href "../../../offensive-technique/attack/T1070.004/"; click File href "../../../dao/artifact/d3f:File";T1565001["Stored Data Manipulation"] --> |modifies| File["File"]; class T1565001 OffensiveTechniqueNode;
        class File ArtifactNode; click T1565001 href "../../../offensive-technique/attack/T1565.001/"; click File href "../../../dao/artifact/d3f:File";T1566003["Spearphishing via Service"] --> |produces| File["File"]; class T1566003 OffensiveTechniqueNode;
        class File ArtifactNode; click T1566003 href "../../../offensive-technique/attack/T1566.003/"; click File href "../../../dao/artifact/d3f:File";T1049["System Network Connections Discovery"] --> |may-invoke| GetOpenSockets["Get Open Sockets"]; class T1049 OffensiveTechniqueNode;
        class GetOpenSockets ArtifactNode; click T1049 href "../../../offensive-technique/attack/T1049/"; click GetOpenSockets href "../../../dao/artifact/d3f:GetOpenSockets";T1010["Application Window Discovery"] --> |may-invoke| GetOpenWindows["Get Open Windows"]; class T1010 OffensiveTechniqueNode;
        class GetOpenWindows ArtifactNode; click T1010 href "../../../offensive-technique/attack/T1010/"; click GetOpenWindows href "../../../dao/artifact/d3f:GetOpenWindows";T1007["System Service Discovery"] --> |may-invoke| GetRunningProcesses["Get Running Processes"]; class T1007 OffensiveTechniqueNode;
        class GetRunningProcesses ArtifactNode; click T1007 href "../../../offensive-technique/attack/T1007/"; click GetRunningProcesses href "../../../dao/artifact/d3f:GetRunningProcesses";T1057["Process Discovery"] --> |may-invoke| GetRunningProcesses["Get Running Processes"]; class T1057 OffensiveTechniqueNode;
        class GetRunningProcesses ArtifactNode; click T1057 href "../../../offensive-technique/attack/T1057/"; click GetRunningProcesses href "../../../dao/artifact/d3f:GetRunningProcesses";T1518001["Security Software Discovery"] --> |may-invoke| GetRunningProcesses["Get Running Processes"]; class T1518001 OffensiveTechniqueNode;
        class GetRunningProcesses ArtifactNode; click T1518001 href "../../../offensive-technique/attack/T1518.001/"; click GetRunningProcesses href "../../../dao/artifact/d3f:GetRunningProcesses";T1113["Screen Capture"] --> |may-invoke| GetScreenCapture["Get Screen Capture"]; class T1113 OffensiveTechniqueNode;
        class GetScreenCapture ArtifactNode; click T1113 href "../../../offensive-technique/attack/T1113/"; click GetScreenCapture href "../../../dao/artifact/d3f:GetScreenCapture";T1033["System Owner/User Discovery"] --> |may-access| GetSystemConfigValue["Get System Config Value"]; class T1033 OffensiveTechniqueNode;
        class GetSystemConfigValue ArtifactNode; click T1033 href "../../../offensive-technique/attack/T1033/"; click GetSystemConfigValue href "../../../dao/artifact/d3f:GetSystemConfigValue";T1012["Query Registry"] --> |may-invoke| GetSystemConfigValue["Get System Config Value"]; class T1012 OffensiveTechniqueNode;
        class GetSystemConfigValue ArtifactNode; click T1012 href "../../../offensive-technique/attack/T1012/"; click GetSystemConfigValue href "../../../dao/artifact/d3f:GetSystemConfigValue";T1016["System Network Configuration Discovery"] --> |may-invoke| GetSystemNetworkConfigValue["Get System Network Config Value"]; class T1016 OffensiveTechniqueNode;
        class GetSystemNetworkConfigValue ArtifactNode; click T1016 href "../../../offensive-technique/attack/T1016/"; click GetSystemNetworkConfigValue href "../../../dao/artifact/d3f:GetSystemNetworkConfigValue";T1124["System Time Discovery"] --> |may-invoke| GetSystemTime["Get System Time"]; class T1124 OffensiveTechniqueNode;
        class GetSystemTime ArtifactNode; click T1124 href "../../../offensive-technique/attack/T1124/"; click GetSystemTime href "../../../dao/artifact/d3f:GetSystemTime";T1497003["Time Based Evasion"] --> |may-invoke| GetSystemTime["Get System Time"]; class T1497003 OffensiveTechniqueNode;
        class GetSystemTime ArtifactNode; click T1497003 href "../../../offensive-technique/attack/T1497.003/"; click GetSystemTime href "../../../dao/artifact/d3f:GetSystemTime";T1098003["Additional Cloud Roles"] --> |modifies| GlobalUserAccount["Global User Account"]; class T1098003 OffensiveTechniqueNode;
        class GlobalUserAccount ArtifactNode; click T1098003 href "../../../offensive-technique/attack/T1098.003/"; click GlobalUserAccount href "../../../dao/artifact/d3f:GlobalUserAccount";T1056002["GUI Input Capture"] --> |accesses| GraphicalUserInterface["Graphical User Interface"]; class T1056002 OffensiveTechniqueNode;
        class GraphicalUserInterface ArtifactNode; click T1056002 href "../../../offensive-technique/attack/T1056.002/"; click GraphicalUserInterface href "../../../dao/artifact/d3f:GraphicalUserInterface";T1552006["Group Policy Preferences"] --> |accesses| GroupPolicy["Group Policy"]; class T1552006 OffensiveTechniqueNode;
        class GroupPolicy ArtifactNode; click T1552006 href "../../../offensive-technique/attack/T1552.006/"; click GroupPolicy href "../../../dao/artifact/d3f:GroupPolicy";T1484["Domain or Tenant Policy Modification"] --> |modifies| GroupPolicy["Group Policy"]; class T1484 OffensiveTechniqueNode;
        class GroupPolicy ArtifactNode; click T1484 href "../../../offensive-technique/attack/T1484/"; click GroupPolicy href "../../../dao/artifact/d3f:GroupPolicy";T1615["Group Policy Discovery"] --> |reads| GroupPolicy["Group Policy"]; class T1615 OffensiveTechniqueNode;
        class GroupPolicy ArtifactNode; click T1615 href "../../../offensive-technique/attack/T1615/"; click GroupPolicy href "../../../dao/artifact/d3f:GroupPolicy";T1200["Hardware Additions"] --> |connects| HardwareDevice["Hardware Device"]; class T1200 OffensiveTechniqueNode;
        class HardwareDevice ArtifactNode; click T1200 href "../../../offensive-technique/attack/T1200/"; click HardwareDevice href "../../../dao/artifact/d3f:HardwareDevice";T1195003["Compromise Hardware Supply Chain"] --> |modifies| HardwareDevice["Hardware Device"]; class T1195003 OffensiveTechniqueNode;
        class HardwareDevice ArtifactNode; click T1195003 href "../../../offensive-technique/attack/T1195.003/"; click HardwareDevice href "../../../dao/artifact/d3f:HardwareDevice";T1555002["Securityd Memory"] --> |accesses| In-memoryPasswordStore["In-memory Password Store"]; class T1555002 OffensiveTechniqueNode;
        class In-memoryPasswordStore ArtifactNode; click T1555002 href "../../../offensive-technique/attack/T1555.002/"; click In-memoryPasswordStore href "../../../dao/artifact/d3f:In-memoryPasswordStore";T1555003["Credentials from Web Browsers"] --> |may-access| In-memoryPasswordStore["In-memory Password Store"]; class T1555003 OffensiveTechniqueNode;
        class In-memoryPasswordStore ArtifactNode; click T1555003 href "../../../offensive-technique/attack/T1555.003/"; click In-memoryPasswordStore href "../../../dao/artifact/d3f:In-memoryPasswordStore";T1566001["Spearphishing Attachment"] --> |produces| InboundInternetMailTraffic["Inbound Internet Mail Traffic"]; class T1566001 OffensiveTechniqueNode;
        class InboundInternetMailTraffic ArtifactNode; click T1566001 href "../../../offensive-technique/attack/T1566.001/"; click InboundInternetMailTraffic href "../../../dao/artifact/d3f:InboundInternetMailTraffic";T1566002["Spearphishing Link"] --> |produces| InboundInternetMailTraffic["Inbound Internet Mail Traffic"]; class T1566002 OffensiveTechniqueNode;
        class InboundInternetMailTraffic ArtifactNode; click T1566002 href "../../../offensive-technique/attack/T1566.002/"; click InboundInternetMailTraffic href "../../../dao/artifact/d3f:InboundInternetMailTraffic";T1498001["Direct Network Flood"] --> |creates| InboundInternetNetworkTraffic["Inbound Internet Network Traffic"]; class T1498001 OffensiveTechniqueNode;
        class InboundInternetNetworkTraffic ArtifactNode; click T1498001 href "../../../offensive-technique/attack/T1498.001/"; click InboundInternetNetworkTraffic href "../../../dao/artifact/d3f:InboundInternetNetworkTraffic";T1190["Exploit Public-Facing Application"] --> |produces| InboundInternetNetworkTraffic["Inbound Internet Network Traffic"]; class T1190 OffensiveTechniqueNode;
        class InboundInternetNetworkTraffic ArtifactNode; click T1190 href "../../../offensive-technique/attack/T1190/"; click InboundInternetNetworkTraffic href "../../../dao/artifact/d3f:InboundInternetNetworkTraffic";T1498002["Reflection Amplification"] --> |produces| InboundInternetNetworkTraffic["Inbound Internet Network Traffic"]; class T1498002 OffensiveTechniqueNode;
        class InboundInternetNetworkTraffic ArtifactNode; click T1498002 href "../../../offensive-technique/attack/T1498.002/"; click InboundInternetNetworkTraffic href "../../../dao/artifact/d3f:InboundInternetNetworkTraffic";T1499002["Service Exhaustion Flood"] --> |produces| InboundInternetNetworkTraffic["Inbound Internet Network Traffic"]; class T1499002 OffensiveTechniqueNode;
        class InboundInternetNetworkTraffic ArtifactNode; click T1499002 href "../../../offensive-technique/attack/T1499.002/"; click InboundInternetNetworkTraffic href "../../../dao/artifact/d3f:InboundInternetNetworkTraffic";T1011["Exfiltration Over Other Network Medium"] --> |produces| InternetNetworkTraffic["Internet Network Traffic"]; class T1011 OffensiveTechniqueNode;
        class InternetNetworkTraffic ArtifactNode; click T1011 href "../../../offensive-technique/attack/T1011/"; click InternetNetworkTraffic href "../../../dao/artifact/d3f:InternetNetworkTraffic";T1020["Automated Exfiltration"] --> |produces| InternetNetworkTraffic["Internet Network Traffic"]; class T1020 OffensiveTechniqueNode;
        class InternetNetworkTraffic ArtifactNode; click T1020 href "../../../offensive-technique/attack/T1020/"; click InternetNetworkTraffic href "../../../dao/artifact/d3f:InternetNetworkTraffic";T1029["Scheduled Transfer"] --> |produces| InternetNetworkTraffic["Internet Network Traffic"]; class T1029 OffensiveTechniqueNode;
        class InternetNetworkTraffic ArtifactNode; click T1029 href "../../../offensive-technique/attack/T1029/"; click InternetNetworkTraffic href "../../../dao/artifact/d3f:InternetNetworkTraffic";T1030["Data Transfer Size Limits"] --> |produces| InternetNetworkTraffic["Internet Network Traffic"]; class T1030 OffensiveTechniqueNode;
        class InternetNetworkTraffic ArtifactNode; click T1030 href "../../../offensive-technique/attack/T1030/"; click InternetNetworkTraffic href "../../../dao/artifact/d3f:InternetNetworkTraffic";T1041["Exfiltration Over C2 Channel"] --> |produces| InternetNetworkTraffic["Internet Network Traffic"]; class T1041 OffensiveTechniqueNode;
        class InternetNetworkTraffic ArtifactNode; click T1041 href "../../../offensive-technique/attack/T1041/"; click InternetNetworkTraffic href "../../../dao/artifact/d3f:InternetNetworkTraffic";T1048["Exfiltration Over Alternative Protocol"] --> |produces| InternetNetworkTraffic["Internet Network Traffic"]; class T1048 OffensiveTechniqueNode;
        class InternetNetworkTraffic ArtifactNode; click T1048 href "../../../offensive-technique/attack/T1048/"; click InternetNetworkTraffic href "../../../dao/artifact/d3f:InternetNetworkTraffic";T1559["Inter-Process Communication"] --> |injects| InterprocessCommunication["Interprocess Communication"]; class T1559 OffensiveTechniqueNode;
        class InterprocessCommunication ArtifactNode; click T1559 href "../../../offensive-technique/attack/T1559/"; click InterprocessCommunication href "../../../dao/artifact/d3f:InterprocessCommunication";T1047["Windows Management Instrumentation"] --> |may-create| IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class T1047 OffensiveTechniqueNode;
        class IntranetAdministrativeNetworkTraffic ArtifactNode; click T1047 href "../../../offensive-technique/attack/T1047/"; click IntranetAdministrativeNetworkTraffic href "../../../dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";T1110003["Password Spraying"] --> |may-create| IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class T1110003 OffensiveTechniqueNode;
        class IntranetAdministrativeNetworkTraffic ArtifactNode; click T1110003 href "../../../offensive-technique/attack/T1110.003/"; click IntranetAdministrativeNetworkTraffic href "../../../dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";T1110004["Credential Stuffing"] --> |may-create| IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class T1110004 OffensiveTechniqueNode;
        class IntranetAdministrativeNetworkTraffic ArtifactNode; click T1110004 href "../../../offensive-technique/attack/T1110.004/"; click IntranetAdministrativeNetworkTraffic href "../../../dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";T1546008["Accessibility Features"] --> |may-create| IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class T1546008 OffensiveTechniqueNode;
        class IntranetAdministrativeNetworkTraffic ArtifactNode; click T1546008 href "../../../offensive-technique/attack/T1546.008/"; click IntranetAdministrativeNetworkTraffic href "../../../dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";T1207["Rogue Domain Controller"] --> |produces| IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class T1207 OffensiveTechniqueNode;
        class IntranetAdministrativeNetworkTraffic ArtifactNode; click T1207 href "../../../offensive-technique/attack/T1207/"; click IntranetAdministrativeNetworkTraffic href "../../../dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";T1098001["Additional Cloud Credentials"] --> |produces| IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class T1098001 OffensiveTechniqueNode;
        class IntranetAdministrativeNetworkTraffic ArtifactNode; click T1098001 href "../../../offensive-technique/attack/T1098.001/"; click IntranetAdministrativeNetworkTraffic href "../../../dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";T1003006["DCSync"] --> |produces| IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class T1003006 OffensiveTechniqueNode;
        class IntranetAdministrativeNetworkTraffic ArtifactNode; click T1003006 href "../../../offensive-technique/attack/T1003.006/"; click IntranetAdministrativeNetworkTraffic href "../../../dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";T1546003["Windows Management Instrumentation Event Subscription"] --> |produces| IntranetAdministrativeNetworkTraffic["Intranet Administrative Network Traffic"]; class T1546003 OffensiveTechniqueNode;
        class IntranetAdministrativeNetworkTraffic ArtifactNode; click T1546003 href "../../../offensive-technique/attack/T1546.003/"; click IntranetAdministrativeNetworkTraffic href "../../../dao/artifact/d3f:IntranetAdministrativeNetworkTraffic";T1570["Lateral Tool Transfer"] --> |produces| IntranetFileTransferTraffic["Intranet File Transfer Traffic"]; class T1570 OffensiveTechniqueNode;
        class IntranetFileTransferTraffic ArtifactNode; click T1570 href "../../../offensive-technique/attack/T1570/"; click IntranetFileTransferTraffic href "../../../dao/artifact/d3f:IntranetFileTransferTraffic";T1197["BITS Jobs"] --> |may-produce| IntranetIPCNetworkTraffic["Intranet IPC Network Traffic"]; class T1197 OffensiveTechniqueNode;
        class IntranetIPCNetworkTraffic ArtifactNode; click T1197 href "../../../offensive-technique/attack/T1197/"; click IntranetIPCNetworkTraffic href "../../../dao/artifact/d3f:IntranetIPCNetworkTraffic";T1557001["LLMNR/NBT-NS Poisoning and SMB Relay"] --> |produces| IntranetMulticastNetworkTraffic["Intranet Multicast Network Traffic"]; class T1557001 OffensiveTechniqueNode;
        class IntranetMulticastNetworkTraffic ArtifactNode; click T1557001 href "../../../offensive-technique/attack/T1557.001/"; click IntranetMulticastNetworkTraffic href "../../../dao/artifact/d3f:IntranetMulticastNetworkTraffic";T1021["Remote Services"] --> |produces| IntranetNetworkTraffic["Intranet Network Traffic"]; class T1021 OffensiveTechniqueNode;
        class IntranetNetworkTraffic ArtifactNode; click T1021 href "../../../offensive-technique/attack/T1021/"; click IntranetNetworkTraffic href "../../../dao/artifact/d3f:IntranetNetworkTraffic";T1199["Trusted Relationship"] --> |produces| IntranetNetworkTraffic["Intranet Network Traffic"]; class T1199 OffensiveTechniqueNode;
        class IntranetNetworkTraffic ArtifactNode; click T1199 href "../../../offensive-technique/attack/T1199/"; click IntranetNetworkTraffic href "../../../dao/artifact/d3f:IntranetNetworkTraffic";T1210["Exploitation of Remote Services"] --> |produces| IntranetNetworkTraffic["Intranet Network Traffic"]; class T1210 OffensiveTechniqueNode;
        class IntranetNetworkTraffic ArtifactNode; click T1210 href "../../../offensive-technique/attack/T1210/"; click IntranetNetworkTraffic href "../../../dao/artifact/d3f:IntranetNetworkTraffic";T1090001["Internal Proxy"] --> |produces| IntranetNetworkTraffic["Intranet Network Traffic"]; class T1090001 OffensiveTechniqueNode;
        class IntranetNetworkTraffic ArtifactNode; click T1090001 href "../../../offensive-technique/attack/T1090.001/"; click IntranetNetworkTraffic href "../../../dao/artifact/d3f:IntranetNetworkTraffic";T1197["BITS Jobs"] --> |may-produce| IntranetWebNetworkTraffic["Intranet Web Network Traffic"]; class T1197 OffensiveTechniqueNode;
        class IntranetWebNetworkTraffic ArtifactNode; click T1197 href "../../../offensive-technique/attack/T1197/"; click IntranetWebNetworkTraffic href "../../../dao/artifact/d3f:IntranetWebNetworkTraffic";T1027006["HTML Smuggling"] --> |creates| JavaScriptBlob["JavaScript Blob"]; class T1027006 OffensiveTechniqueNode;
        class JavaScriptBlob ArtifactNode; click T1027006 href "../../../offensive-technique/attack/T1027.006/"; click JavaScriptBlob href "../../../dao/artifact/d3f:JavaScriptBlob";T1558["Steal or Forge Kerberos Tickets"] --> |may-access| KerberosTicket["Kerberos Ticket"]; class T1558 OffensiveTechniqueNode;
        class KerberosTicket ArtifactNode; click T1558 href "../../../offensive-technique/attack/T1558/"; click KerberosTicket href "../../../dao/artifact/d3f:KerberosTicket";T1558["Steal or Forge Kerberos Tickets"] --> |may-create| KerberosTicket["Kerberos Ticket"]; class T1558 OffensiveTechniqueNode;
        class KerberosTicket ArtifactNode; click T1558 href "../../../offensive-technique/attack/T1558/"; click KerberosTicket href "../../../dao/artifact/d3f:KerberosTicket";T1558001["Golden Ticket"] --> |forges| KerberosTicketGrantingTicket["Kerberos Ticket Granting Ticket"]; class T1558001 OffensiveTechniqueNode;
        class KerberosTicketGrantingTicket ArtifactNode; click T1558001 href "../../../offensive-technique/attack/T1558.001/"; click KerberosTicketGrantingTicket href "../../../dao/artifact/d3f:KerberosTicketGrantingTicket";T1014["Rootkit"] --> |may-modify| KernelModule["Kernel Module"]; class T1014 OffensiveTechniqueNode;
        class KernelModule ArtifactNode; click T1014 href "../../../offensive-technique/attack/T1014/"; click KernelModule href "../../../dao/artifact/d3f:KernelModule";T1547006["Kernel Modules and Extensions"] --> |modifies| KernelModule["Kernel Module"]; class T1547006 OffensiveTechniqueNode;
        class KernelModule ArtifactNode; click T1547006 href "../../../offensive-technique/attack/T1547.006/"; click KernelModule href "../../../dao/artifact/d3f:KernelModule";T1518001["Security Software Discovery"] --> |may-access| KernelProcessTable["Kernel Process Table"]; class T1518001 OffensiveTechniqueNode;
        class KernelProcessTable ArtifactNode; click T1518001 href "../../../offensive-technique/attack/T1518.001/"; click KernelProcessTable href "../../../dao/artifact/d3f:KernelProcessTable";T1056001["Keylogging"] --> |accesses| KeyboardInputDevice["Keyboard Input Device"]; class T1056001 OffensiveTechniqueNode;
        class KeyboardInputDevice ArtifactNode; click T1056001 href "../../../offensive-technique/attack/T1056.001/"; click KeyboardInputDevice href "../../../dao/artifact/d3f:KeyboardInputDevice";T1562010["Downgrade Attack"] --> |accesses| LegacySystem["Legacy System"]; class T1562010 OffensiveTechniqueNode;
        class LegacySystem ArtifactNode; click T1562010 href "../../../offensive-technique/attack/T1562.010/"; click LegacySystem href "../../../dao/artifact/d3f:LegacySystem";T1005["Data from Local System"] --> |accesses| LocalResource["Local Resource"]; class T1005 OffensiveTechniqueNode;
        class LocalResource ArtifactNode; click T1005 href "../../../offensive-technique/attack/T1005/"; click LocalResource href "../../../dao/artifact/d3f:LocalResource";T1136001["Local Account"] --> |creates| LocalUserAccount["Local User Account"]; class T1136001 OffensiveTechniqueNode;
        class LocalUserAccount ArtifactNode; click T1136001 href "../../../offensive-technique/attack/T1136.001/"; click LocalUserAccount href "../../../dao/artifact/d3f:LocalUserAccount";T1078003["Local Accounts"] --> |uses| LocalUserAccount["Local User Account"]; class T1078003 OffensiveTechniqueNode;
        class LocalUserAccount ArtifactNode; click T1078003 href "../../../offensive-technique/attack/T1078.003/"; click LocalUserAccount href "../../../dao/artifact/d3f:LocalUserAccount";T1087001["Local Account"] --> |enumerates| LocalUserAccount["Local User Account"]; class T1087001 OffensiveTechniqueNode;
        class LocalUserAccount ArtifactNode; click T1087001 href "../../../offensive-technique/attack/T1087.001/"; click LocalUserAccount href "../../../dao/artifact/d3f:LocalUserAccount";T1003005["Cached Domain Credentials"] --> |may-modify| Log["Log"]; class T1003005 OffensiveTechniqueNode;
        class Log ArtifactNode; click T1003005 href "../../../offensive-technique/attack/T1003.005/"; click Log href "../../../dao/artifact/d3f:Log";T1199["Trusted Relationship"] --> |creates| LoginSession["Login Session"]; class T1199 OffensiveTechniqueNode;
        class LoginSession ArtifactNode; click T1199 href "../../../offensive-technique/attack/T1199/"; click LoginSession href "../../../dao/artifact/d3f:LoginSession";T1134003["Make and Impersonate Token"] --> |creates| LoginSession["Login Session"]; class T1134003 OffensiveTechniqueNode;
        class LoginSession ArtifactNode; click T1134003 href "../../../offensive-technique/attack/T1134.003/"; click LoginSession href "../../../dao/artifact/d3f:LoginSession";T1555001["Keychain"] --> |accesses| MacOSKeychain["MacOS Keychain"]; class T1555001 OffensiveTechniqueNode;
        class MacOSKeychain ArtifactNode; click T1555001 href "../../../offensive-technique/attack/T1555.001/"; click MacOSKeychain href "../../../dao/artifact/d3f:MacOSKeychain";T1114002["Remote Email Collection"] --> |accesses| MailServer["Mail Server"]; class T1114002 OffensiveTechniqueNode;
        class MailServer ArtifactNode; click T1114002 href "../../../offensive-technique/attack/T1114.002/"; click MailServer href "../../../dao/artifact/d3f:MailServer";T1505002["Transport Agent"] --> |modifies| MailServer["Mail Server"]; class T1505002 OffensiveTechniqueNode;
        class MailServer ArtifactNode; click T1505002 href "../../../offensive-technique/attack/T1505.002/"; click MailServer href "../../../dao/artifact/d3f:MailServer";T1505002["Transport Agent"] --> |adds| MessageTransferAgent["Message Transfer Agent"]; class T1505002 OffensiveTechniqueNode;
        class MessageTransferAgent ArtifactNode; click T1505002 href "../../../offensive-technique/attack/T1505.002/"; click MessageTransferAgent href "../../../dao/artifact/d3f:MessageTransferAgent";T1218005["Mshta"] --> |interprets| MicrosoftHTMLApplication["Microsoft HTML Application"]; class T1218005 OffensiveTechniqueNode;
        class MicrosoftHTMLApplication ArtifactNode; click T1218005 href "../../../offensive-technique/attack/T1218.005/"; click MicrosoftHTMLApplication href "../../../dao/artifact/d3f:MicrosoftHTMLApplication";T1036005["Match Legitimate Resource Name or Location"] --> |invokes| MoveFile["Move File"]; class T1036005 OffensiveTechniqueNode;
        class MoveFile ArtifactNode; click T1036005 href "../../../offensive-technique/attack/T1036.005/"; click MoveFile href "../../../dao/artifact/d3f:MoveFile";T1039["Data from Network Shared Drive"] --> |accesses| NetworkFileShareResource["Network File Share Resource"]; class T1039 OffensiveTechniqueNode;
        class NetworkFileShareResource ArtifactNode; click T1039 href "../../../offensive-technique/attack/T1039/"; click NetworkFileShareResource href "../../../dao/artifact/d3f:NetworkFileShareResource";T1070005["Network Share Connection Removal"] --> |unmounts| NetworkFileShareResource["Network File Share Resource"]; class T1070005 OffensiveTechniqueNode;
        class NetworkFileShareResource ArtifactNode; click T1070005 href "../../../offensive-technique/attack/T1070.005/"; click NetworkFileShareResource href "../../../dao/artifact/d3f:NetworkFileShareResource";T1037003["Network Logon Script"] --> |modifies| NetworkInitScriptFileResource["Network Init Script File Resource"]; class T1037003 OffensiveTechniqueNode;
        class NetworkInitScriptFileResource ArtifactNode; click T1037003 href "../../../offensive-technique/attack/T1037.003/"; click NetworkInitScriptFileResource href "../../../dao/artifact/d3f:NetworkInitScriptFileResource";T1080["Taint Shared Content"] --> |modifies| NetworkResource["Network Resource"]; class T1080 OffensiveTechniqueNode;
        class NetworkResource ArtifactNode; click T1080 href "../../../offensive-technique/attack/T1080/"; click NetworkResource href "../../../dao/artifact/d3f:NetworkResource";T1074002["Remote Data Staging"] --> |modifies| NetworkResource["Network Resource"]; class T1074002 OffensiveTechniqueNode;
        class NetworkResource ArtifactNode; click T1074002 href "../../../offensive-technique/attack/T1074.002/"; click NetworkResource href "../../../dao/artifact/d3f:NetworkResource";T1491002["External Defacement"] --> |modifies| NetworkResource["Network Resource"]; class T1491002 OffensiveTechniqueNode;
        class NetworkResource ArtifactNode; click T1491002 href "../../../offensive-technique/attack/T1491.002/"; click NetworkResource href "../../../dao/artifact/d3f:NetworkResource";T1133["External Remote Services"] --> |produces| NetworkSession["Network Session"]; class T1133 OffensiveTechniqueNode;
        class NetworkSession ArtifactNode; click T1133 href "../../../offensive-technique/attack/T1133/"; click NetworkSession href "../../../dao/artifact/d3f:NetworkSession";T1565002["Transmitted Data Manipulation"] --> |may-modify| NetworkTraffic["Network Traffic"]; class T1565002 OffensiveTechniqueNode;
        class NetworkTraffic ArtifactNode; click T1565002 href "../../../offensive-technique/attack/T1565.002/"; click NetworkTraffic href "../../../dao/artifact/d3f:NetworkTraffic";T1218003["CMSTP"] --> |may-produce| NetworkTraffic["Network Traffic"]; class T1218003 OffensiveTechniqueNode;
        class NetworkTraffic ArtifactNode; click T1218003 href "../../../offensive-technique/attack/T1218.003/"; click NetworkTraffic href "../../../dao/artifact/d3f:NetworkTraffic";T1550001["Application Access Token"] --> |may-produce| NetworkTraffic["Network Traffic"]; class T1550001 OffensiveTechniqueNode;
        class NetworkTraffic ArtifactNode; click T1550001 href "../../../offensive-technique/attack/T1550.001/"; click NetworkTraffic href "../../../dao/artifact/d3f:NetworkTraffic";T1018["Remote System Discovery"] --> |produces| NetworkTraffic["Network Traffic"]; class T1018 OffensiveTechniqueNode;
        class NetworkTraffic ArtifactNode; click T1018 href "../../../offensive-technique/attack/T1018/"; click NetworkTraffic href "../../../dao/artifact/d3f:NetworkTraffic";T1205["Traffic Signaling"] --> |produces| NetworkTraffic["Network Traffic"]; class T1205 OffensiveTechniqueNode;
        class NetworkTraffic ArtifactNode; click T1205 href "../../../offensive-technique/attack/T1205/"; click NetworkTraffic href "../../../dao/artifact/d3f:NetworkTraffic";T1557["Adversary-in-the-Middle"] --> |produces| NetworkTraffic["Network Traffic"]; class T1557 OffensiveTechniqueNode;
        class NetworkTraffic ArtifactNode; click T1557 href "../../../offensive-technique/attack/T1557/"; click NetworkTraffic href "../../../dao/artifact/d3f:NetworkTraffic";T1205001["Port Knocking"] --> |produces| NetworkTraffic["Network Traffic"]; class T1205001 OffensiveTechniqueNode;
        class NetworkTraffic ArtifactNode; click T1205001 href "../../../offensive-technique/attack/T1205.001/"; click NetworkTraffic href "../../../dao/artifact/d3f:NetworkTraffic";T1055002["Portable Executable Injection"] --> |may-add| ObjectFile["Object File"]; class T1055002 OffensiveTechniqueNode;
        class ObjectFile ArtifactNode; click T1055002 href "../../../offensive-technique/attack/T1055.002/"; click ObjectFile href "../../../dao/artifact/d3f:ObjectFile";T1137003["Outlook Forms"] --> |adds| OfficeApplicationFile["Office Application File"]; class T1137003 OffensiveTechniqueNode;
        class OfficeApplicationFile ArtifactNode; click T1137003 href "../../../offensive-technique/attack/T1137.003/"; click OfficeApplicationFile href "../../../dao/artifact/d3f:OfficeApplicationFile";T1564007["VBA Stomping"] --> |modifies| OfficeApplicationFile["Office Application File"]; class T1564007 OffensiveTechniqueNode;
        class OfficeApplicationFile ArtifactNode; click T1564007 href "../../../offensive-technique/attack/T1564.007/"; click OfficeApplicationFile href "../../../dao/artifact/d3f:OfficeApplicationFile";T1562002["Disable Windows Event Logging"] --> |may-modify| OperatingSystemConfigurationComponent["Operating System Configuration Component"]; class T1562002 OffensiveTechniqueNode;
        class OperatingSystemConfigurationComponent ArtifactNode; click T1562002 href "../../../offensive-technique/attack/T1562.002/"; click OperatingSystemConfigurationComponent href "../../../dao/artifact/d3f:OperatingSystemConfigurationComponent";T1018["Remote System Discovery"] --> |may-access| OperatingSystemConfigurationFile["Operating System Configuration File"]; class T1018 OffensiveTechniqueNode;
        class OperatingSystemConfigurationFile ArtifactNode; click T1018 href "../../../offensive-technique/attack/T1018/"; click OperatingSystemConfigurationFile href "../../../dao/artifact/d3f:OperatingSystemConfigurationFile";T1543002["Systemd Service"] --> |may-create| OperatingSystemConfigurationFile["Operating System Configuration File"]; class T1543002 OffensiveTechniqueNode;
        class OperatingSystemConfigurationFile ArtifactNode; click T1543002 href "../../../offensive-technique/attack/T1543.002/"; click OperatingSystemConfigurationFile href "../../../dao/artifact/d3f:OperatingSystemConfigurationFile";T1556003["Pluggable Authentication Modules"] --> |may-modify| OperatingSystemConfigurationFile["Operating System Configuration File"]; class T1556003 OffensiveTechniqueNode;
        class OperatingSystemConfigurationFile ArtifactNode; click T1556003 href "../../../offensive-technique/attack/T1556.003/"; click OperatingSystemConfigurationFile href "../../../dao/artifact/d3f:OperatingSystemConfigurationFile";T1543002["Systemd Service"] --> |may-modify| OperatingSystemConfigurationFile["Operating System Configuration File"]; class T1543002 OffensiveTechniqueNode;
        class OperatingSystemConfigurationFile ArtifactNode; click T1543002 href "../../../offensive-technique/attack/T1543.002/"; click OperatingSystemConfigurationFile href "../../../dao/artifact/d3f:OperatingSystemConfigurationFile";T1548003["Sudo and Sudo Caching"] --> |modifies| OperatingSystemConfigurationFile["Operating System Configuration File"]; class T1548003 OffensiveTechniqueNode;
        class OperatingSystemConfigurationFile ArtifactNode; click T1548003 href "../../../offensive-technique/attack/T1548.003/"; click OperatingSystemConfigurationFile href "../../../dao/artifact/d3f:OperatingSystemConfigurationFile";T1574006["Dynamic Linker Hijacking"] --> |modifies| OperatingSystemConfigurationFile["Operating System Configuration File"]; class T1574006 OffensiveTechniqueNode;
        class OperatingSystemConfigurationFile ArtifactNode; click T1574006 href "../../../offensive-technique/attack/T1574.006/"; click OperatingSystemConfigurationFile href "../../../dao/artifact/d3f:OperatingSystemConfigurationFile";T1036003["Rename Legitimate Utilities"] --> |may-modify| OperatingSystemExecutableFile["Operating System Executable File"]; class T1036003 OffensiveTechniqueNode;
        class OperatingSystemExecutableFile ArtifactNode; click T1036003 href "../../../offensive-technique/attack/T1036.003/"; click OperatingSystemExecutableFile href "../../../dao/artifact/d3f:OperatingSystemExecutableFile";T1055009["Proc Memory"] --> |accesses| OperatingSystemFile["Operating System File"]; class T1055009 OffensiveTechniqueNode;
        class OperatingSystemFile ArtifactNode; click T1055009 href "../../../offensive-technique/attack/T1055.009/"; click OperatingSystemFile href "../../../dao/artifact/d3f:OperatingSystemFile";T1003007["Proc Filesystem"] --> |accesses| OperatingSystemFile["Operating System File"]; class T1003007 OffensiveTechniqueNode;
        class OperatingSystemFile ArtifactNode; click T1003007 href "../../../offensive-technique/attack/T1003.007/"; click OperatingSystemFile href "../../../dao/artifact/d3f:OperatingSystemFile";T1055009["Proc Memory"] --> |may-modify| OperatingSystemFile["Operating System File"]; class T1055009 OffensiveTechniqueNode;
        class OperatingSystemFile ArtifactNode; click T1055009 href "../../../offensive-technique/attack/T1055.009/"; click OperatingSystemFile href "../../../dao/artifact/d3f:OperatingSystemFile";T1070002["Clear Linux or Mac System Logs"] --> |modifies| OperatingSystemLogFile["Operating System Log File"]; class T1070002 OffensiveTechniqueNode;
        class OperatingSystemLogFile ArtifactNode; click T1070002 href "../../../offensive-technique/attack/T1070.002/"; click OperatingSystemLogFile href "../../../dao/artifact/d3f:OperatingSystemLogFile";T1562001["Disable or Modify Tools"] --> |disables| OperatingSystemProcess["Operating System Process"]; class T1562001 OffensiveTechniqueNode;
        class OperatingSystemProcess ArtifactNode; click T1562001 href "../../../offensive-technique/attack/T1562.001/"; click OperatingSystemProcess href "../../../dao/artifact/d3f:OperatingSystemProcess";T1556003["Pluggable Authentication Modules"] --> |may-modify| OperatingSystemSharedLibraryFile["Operating System Shared Library File"]; class T1556003 OffensiveTechniqueNode;
        class OperatingSystemSharedLibraryFile ArtifactNode; click T1556003 href "../../../offensive-technique/attack/T1556.003/"; click OperatingSystemSharedLibraryFile href "../../../dao/artifact/d3f:OperatingSystemSharedLibraryFile";T1568["Dynamic Resolution"] --> |produces| OutboundInternetDNSLookupTraffic["Outbound Internet DNS Lookup Traffic"]; class T1568 OffensiveTechniqueNode;
        class OutboundInternetDNSLookupTraffic ArtifactNode; click T1568 href "../../../offensive-technique/attack/T1568/"; click OutboundInternetDNSLookupTraffic href "../../../dao/artifact/d3f:OutboundInternetDNSLookupTraffic";T1071004["DNS"] --> |produces| OutboundInternetDNSLookupTraffic["Outbound Internet DNS Lookup Traffic"]; class T1071004 OffensiveTechniqueNode;
        class OutboundInternetDNSLookupTraffic ArtifactNode; click T1071004 href "../../../offensive-technique/attack/T1071.004/"; click OutboundInternetDNSLookupTraffic href "../../../dao/artifact/d3f:OutboundInternetDNSLookupTraffic";T1567001["Exfiltration to Code Repository"] --> |may-produce| OutboundInternetEncryptedRemoteTerminalTraffic["Outbound Internet Encrypted Remote Terminal Traffic"]; class T1567001 OffensiveTechniqueNode;
        class OutboundInternetEncryptedRemoteTerminalTraffic ArtifactNode; click T1567001 href "../../../offensive-technique/attack/T1567.001/"; click OutboundInternetEncryptedRemoteTerminalTraffic href "../../../dao/artifact/d3f:OutboundInternetEncryptedRemoteTerminalTraffic";T1573001["Symmetric Cryptography"] --> |creates| OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"]; class T1573001 OffensiveTechniqueNode;
        class OutboundInternetEncryptedTraffic ArtifactNode; click T1573001 href "../../../offensive-technique/attack/T1573.001/"; click OutboundInternetEncryptedTraffic href "../../../dao/artifact/d3f:OutboundInternetEncryptedTraffic";T1573002["Asymmetric Cryptography"] --> |creates| OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"]; class T1573002 OffensiveTechniqueNode;
        class OutboundInternetEncryptedTraffic ArtifactNode; click T1573002 href "../../../offensive-technique/attack/T1573.002/"; click OutboundInternetEncryptedTraffic href "../../../dao/artifact/d3f:OutboundInternetEncryptedTraffic";T1573["Encrypted Channel"] --> |produces| OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"]; class T1573 OffensiveTechniqueNode;
        class OutboundInternetEncryptedTraffic ArtifactNode; click T1573 href "../../../offensive-technique/attack/T1573/"; click OutboundInternetEncryptedTraffic href "../../../dao/artifact/d3f:OutboundInternetEncryptedTraffic";T1048001["Exfiltration Over Symmetric Encrypted Non-C2 Protocol"] --> |produces| OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"]; class T1048001 OffensiveTechniqueNode;
        class OutboundInternetEncryptedTraffic ArtifactNode; click T1048001 href "../../../offensive-technique/attack/T1048.001/"; click OutboundInternetEncryptedTraffic href "../../../dao/artifact/d3f:OutboundInternetEncryptedTraffic";T1048002["Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"] --> |produces| OutboundInternetEncryptedTraffic["Outbound Internet Encrypted Traffic"]; class T1048002 OffensiveTechniqueNode;
        class OutboundInternetEncryptedTraffic ArtifactNode; click T1048002 href "../../../offensive-technique/attack/T1048.002/"; click OutboundInternetEncryptedTraffic href "../../../dao/artifact/d3f:OutboundInternetEncryptedTraffic";T1567001["Exfiltration to Code Repository"] --> |may-produce| OutboundInternetEncryptedWebTraffic["Outbound Internet Encrypted Web Traffic"]; class T1567001 OffensiveTechniqueNode;
        class OutboundInternetEncryptedWebTraffic ArtifactNode; click T1567001 href "../../../offensive-technique/attack/T1567.001/"; click OutboundInternetEncryptedWebTraffic href "../../../dao/artifact/d3f:OutboundInternetEncryptedWebTraffic";T1090004["Domain Fronting"] --> |produces| OutboundInternetEncryptedWebTraffic["Outbound Internet Encrypted Web Traffic"]; class T1090004 OffensiveTechniqueNode;
        class OutboundInternetEncryptedWebTraffic ArtifactNode; click T1090004 href "../../../offensive-technique/attack/T1090.004/"; click OutboundInternetEncryptedWebTraffic href "../../../dao/artifact/d3f:OutboundInternetEncryptedWebTraffic";T1567002["Exfiltration to Cloud Storage"] --> |produces| OutboundInternetEncryptedWebTraffic["Outbound Internet Encrypted Web Traffic"]; class T1567002 OffensiveTechniqueNode;
        class OutboundInternetEncryptedWebTraffic ArtifactNode; click T1567002 href "../../../offensive-technique/attack/T1567.002/"; click OutboundInternetEncryptedWebTraffic href "../../../dao/artifact/d3f:OutboundInternetEncryptedWebTraffic";T1071002["File Transfer Protocols"] --> |produces| OutboundInternetFileTransferTraffic["Outbound Internet File Transfer Traffic"]; class T1071002 OffensiveTechniqueNode;
        class OutboundInternetFileTransferTraffic ArtifactNode; click T1071002 href "../../../offensive-technique/attack/T1071.002/"; click OutboundInternetFileTransferTraffic href "../../../dao/artifact/d3f:OutboundInternetFileTransferTraffic";T1071003["Mail Protocols"] --> |produces| OutboundInternetMailTraffic["Outbound Internet Mail Traffic"]; class T1071003 OffensiveTechniqueNode;
        class OutboundInternetMailTraffic ArtifactNode; click T1071003 href "../../../offensive-technique/attack/T1071.003/"; click OutboundInternetMailTraffic href "../../../dao/artifact/d3f:OutboundInternetMailTraffic";T1001["Data Obfuscation"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1001 OffensiveTechniqueNode;
        class OutboundInternetNetworkTraffic ArtifactNode; click T1001 href "../../../offensive-technique/attack/T1001/"; click OutboundInternetNetworkTraffic href "../../../dao/artifact/d3f:OutboundInternetNetworkTraffic";T1008["Fallback Channels"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1008 OffensiveTechniqueNode;
        class OutboundInternetNetworkTraffic ArtifactNode; click T1008 href "../../../offensive-technique/attack/T1008/"; click OutboundInternetNetworkTraffic href "../../../dao/artifact/d3f:OutboundInternetNetworkTraffic";T1071["Application Layer Protocol"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1071 OffensiveTechniqueNode;
        class OutboundInternetNetworkTraffic ArtifactNode; click T1071 href "../../../offensive-technique/attack/T1071/"; click OutboundInternetNetworkTraffic href "../../../dao/artifact/d3f:OutboundInternetNetworkTraffic";T1095["Non-Application Layer Protocol"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1095 OffensiveTechniqueNode;
        class OutboundInternetNetworkTraffic ArtifactNode; click T1095 href "../../../offensive-technique/attack/T1095/"; click OutboundInternetNetworkTraffic href "../../../dao/artifact/d3f:OutboundInternetNetworkTraffic";T1104["Multi-Stage Channels"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1104 OffensiveTechniqueNode;
        class OutboundInternetNetworkTraffic ArtifactNode; click T1104 href "../../../offensive-technique/attack/T1104/"; click OutboundInternetNetworkTraffic href "../../../dao/artifact/d3f:OutboundInternetNetworkTraffic";T1105["Ingress Tool Transfer"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1105 OffensiveTechniqueNode;
        class OutboundInternetNetworkTraffic ArtifactNode; click T1105 href "../../../offensive-technique/attack/T1105/"; click OutboundInternetNetworkTraffic href "../../../dao/artifact/d3f:OutboundInternetNetworkTraffic";T1132["Data Encoding"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1132 OffensiveTechniqueNode;
        class OutboundInternetNetworkTraffic ArtifactNode; click T1132 href "../../../offensive-technique/attack/T1132/"; click OutboundInternetNetworkTraffic href "../../../dao/artifact/d3f:OutboundInternetNetworkTraffic";T1219["Remote Access Tools"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1219 OffensiveTechniqueNode;
        class OutboundInternetNetworkTraffic ArtifactNode; click T1219 href "../../../offensive-technique/attack/T1219/"; click OutboundInternetNetworkTraffic href "../../../dao/artifact/d3f:OutboundInternetNetworkTraffic";T1571["Non-Standard Port"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1571 OffensiveTechniqueNode;
        class OutboundInternetNetworkTraffic ArtifactNode; click T1571 href "../../../offensive-technique/attack/T1571/"; click OutboundInternetNetworkTraffic href "../../../dao/artifact/d3f:OutboundInternetNetworkTraffic";T1572["Protocol Tunneling"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1572 OffensiveTechniqueNode;
        class OutboundInternetNetworkTraffic ArtifactNode; click T1572 href "../../../offensive-technique/attack/T1572/"; click OutboundInternetNetworkTraffic href "../../../dao/artifact/d3f:OutboundInternetNetworkTraffic";T1048003["Exfiltration Over Unencrypted Non-C2 Protocol"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1048003 OffensiveTechniqueNode;
        class OutboundInternetNetworkTraffic ArtifactNode; click T1048003 href "../../../offensive-technique/attack/T1048.003/"; click OutboundInternetNetworkTraffic href "../../../dao/artifact/d3f:OutboundInternetNetworkTraffic";T1189["Drive-by Compromise"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1189 OffensiveTechniqueNode;
        class OutboundInternetNetworkTraffic ArtifactNode; click T1189 href "../../../offensive-technique/attack/T1189/"; click OutboundInternetNetworkTraffic href "../../../dao/artifact/d3f:OutboundInternetNetworkTraffic";T1090002["External Proxy"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1090002 OffensiveTechniqueNode;
        class OutboundInternetNetworkTraffic ArtifactNode; click T1090002 href "../../../offensive-technique/attack/T1090.002/"; click OutboundInternetNetworkTraffic href "../../../dao/artifact/d3f:OutboundInternetNetworkTraffic";T1090003["Multi-hop Proxy"] --> |produces| OutboundInternetNetworkTraffic["Outbound Internet Network Traffic"]; class T1090003 OffensiveTechniqueNode;
        class OutboundInternetNetworkTraffic ArtifactNode; click T1090003 href "../../../offensive-technique/attack/T1090.003/"; click OutboundInternetNetworkTraffic href "../../../dao/artifact/d3f:OutboundInternetNetworkTraffic";T1197["BITS Jobs"] --> |may-produce| OutboundInternetWebTraffic["Outbound Internet Web Traffic"]; class T1197 OffensiveTechniqueNode;
        class OutboundInternetWebTraffic ArtifactNode; click T1197 href "../../../offensive-technique/attack/T1197/"; click OutboundInternetWebTraffic href "../../../dao/artifact/d3f:OutboundInternetWebTraffic";T1102["Web Service"] --> |produces| OutboundInternetWebTraffic["Outbound Internet Web Traffic"]; class T1102 OffensiveTechniqueNode;
        class OutboundInternetWebTraffic ArtifactNode; click T1102 href "../../../offensive-technique/attack/T1102/"; click OutboundInternetWebTraffic href "../../../dao/artifact/d3f:OutboundInternetWebTraffic";T1567["Exfiltration Over Web Service"] --> |produces| OutboundInternetWebTraffic["Outbound Internet Web Traffic"]; class T1567 OffensiveTechniqueNode;
        class OutboundInternetWebTraffic ArtifactNode; click T1567 href "../../../offensive-technique/attack/T1567/"; click OutboundInternetWebTraffic href "../../../dao/artifact/d3f:OutboundInternetWebTraffic";T1071001["Web Protocols"] --> |produces| OutboundInternetWebTraffic["Outbound Internet Web Traffic"]; class T1071001 OffensiveTechniqueNode;
        class OutboundInternetWebTraffic ArtifactNode; click T1071001 href "../../../offensive-technique/attack/T1071.001/"; click OutboundInternetWebTraffic href "../../../dao/artifact/d3f:OutboundInternetWebTraffic";T1204001["Malicious Link"] --> |produces| OutboundInternetWebTraffic["Outbound Internet Web Traffic"]; class T1204001 OffensiveTechniqueNode;
        class OutboundInternetWebTraffic ArtifactNode; click T1204001 href "../../../offensive-technique/attack/T1204.001/"; click OutboundInternetWebTraffic href "../../../dao/artifact/d3f:OutboundInternetWebTraffic";T1561001["Disk Content Wipe"] --> |may-modify| Partition["Partition"]; class T1561001 OffensiveTechniqueNode;
        class Partition ArtifactNode; click T1561001 href "../../../offensive-technique/attack/T1561.001/"; click Partition href "../../../dao/artifact/d3f:Partition";T1561001["Disk Content Wipe"] --> |may-modify| PartitionTable["Partition Table"]; class T1561001 OffensiveTechniqueNode;
        class PartitionTable ArtifactNode; click T1561001 href "../../../offensive-technique/attack/T1561.001/"; click PartitionTable href "../../../dao/artifact/d3f:PartitionTable";T1561002["Disk Structure Wipe"] --> |may-modify| PartitionTable["Partition Table"]; class T1561002 OffensiveTechniqueNode;
        class PartitionTable ArtifactNode; click T1561002 href "../../../offensive-technique/attack/T1561.002/"; click PartitionTable href "../../../dao/artifact/d3f:PartitionTable";T1110001["Password Guessing"] --> |accesses| Password["Password"]; class T1110001 OffensiveTechniqueNode;
        class Password ArtifactNode; click T1110001 href "../../../offensive-technique/attack/T1110.001/"; click Password href "../../../dao/artifact/d3f:Password";T1110002["Password Cracking"] --> |accesses| Password["Password"]; class T1110002 OffensiveTechniqueNode;
        class Password ArtifactNode; click T1110002 href "../../../offensive-technique/attack/T1110.002/"; click Password href "../../../dao/artifact/d3f:Password";T1110003["Password Spraying"] --> |accesses| Password["Password"]; class T1110003 OffensiveTechniqueNode;
        class Password ArtifactNode; click T1110003 href "../../../offensive-technique/attack/T1110.003/"; click Password href "../../../dao/artifact/d3f:Password";T1003008["/etc/passwd and /etc/shadow"] --> |accesses| PasswordFile["Password File"]; class T1003008 OffensiveTechniqueNode;
        class PasswordFile ArtifactNode; click T1003008 href "../../../offensive-technique/attack/T1003.008/"; click PasswordFile href "../../../dao/artifact/d3f:PasswordFile";T1033["System Owner/User Discovery"] --> |may-access| PasswordFile["Password File"]; class T1033 OffensiveTechniqueNode;
        class PasswordFile ArtifactNode; click T1033 href "../../../offensive-technique/attack/T1033/"; click PasswordFile href "../../../dao/artifact/d3f:PasswordFile";T1555["Credentials from Password Stores"] --> |accesses| PasswordStore["Password Store"]; class T1555 OffensiveTechniqueNode;
        class PasswordStore ArtifactNode; click T1555 href "../../../offensive-technique/attack/T1555/"; click PasswordStore href "../../../dao/artifact/d3f:PasswordStore";T1546013["PowerShell Profile"] --> |modifies| PowerShellProfileScript["PowerShell Profile Script"]; class T1546013 OffensiveTechniqueNode;
        class PowerShellProfileScript ArtifactNode; click T1546013 href "../../../offensive-technique/attack/T1546.013/"; click PowerShellProfileScript href "../../../dao/artifact/d3f:PowerShellProfileScript";T1003001["LSASS Memory"] --> |accesses| Process["Process"]; class T1003001 OffensiveTechniqueNode;
        class Process ArtifactNode; click T1003001 href "../../../offensive-technique/attack/T1003.001/"; click Process href "../../../dao/artifact/d3f:Process";T1003002["Security Account Manager"] --> |may-access| Process["Process"]; class T1003002 OffensiveTechniqueNode;
        class Process ArtifactNode; click T1003002 href "../../../offensive-technique/attack/T1003.002/"; click Process href "../../../dao/artifact/d3f:Process";T1003004["LSA Secrets"] --> |may-access| Process["Process"]; class T1003004 OffensiveTechniqueNode;
        class Process ArtifactNode; click T1003004 href "../../../offensive-technique/attack/T1003.004/"; click Process href "../../../dao/artifact/d3f:Process";T1505003["Web Shell"] --> |produces| Process["Process"]; class T1505003 OffensiveTechniqueNode;
        class Process ArtifactNode; click T1505003 href "../../../offensive-technique/attack/T1505.003/"; click Process href "../../../dao/artifact/d3f:Process";T1546007["Netsh Helper DLL"] --> |produces| Process["Process"]; class T1546007 OffensiveTechniqueNode;
        class Process ArtifactNode; click T1546007 href "../../../offensive-technique/attack/T1546.007/"; click Process href "../../../dao/artifact/d3f:Process";T1212["Exploitation for Credential Access"] --> |may-modify| ProcessCodeSegment["Process Code Segment"]; class T1212 OffensiveTechniqueNode;
        class ProcessCodeSegment ArtifactNode; click T1212 href "../../../offensive-technique/attack/T1212/"; click ProcessCodeSegment href "../../../dao/artifact/d3f:ProcessCodeSegment";T1211["Exploitation for Defense Evasion"] --> |may-modify| ProcessCodeSegment["Process Code Segment"]; class T1211 OffensiveTechniqueNode;
        class ProcessCodeSegment ArtifactNode; click T1211 href "../../../offensive-technique/attack/T1211/"; click ProcessCodeSegment href "../../../dao/artifact/d3f:ProcessCodeSegment";T1210["Exploitation of Remote Services"] --> |may-modify| ProcessCodeSegment["Process Code Segment"]; class T1210 OffensiveTechniqueNode;
        class ProcessCodeSegment ArtifactNode; click T1210 href "../../../offensive-technique/attack/T1210/"; click ProcessCodeSegment href "../../../dao/artifact/d3f:ProcessCodeSegment";T1056004["Credential API Hooking"] --> |may-modify| ProcessCodeSegment["Process Code Segment"]; class T1056004 OffensiveTechniqueNode;
        class ProcessCodeSegment ArtifactNode; click T1056004 href "../../../offensive-technique/attack/T1056.004/"; click ProcessCodeSegment href "../../../dao/artifact/d3f:ProcessCodeSegment";T1068["Exploitation for Privilege Escalation"] --> |modifies| ProcessCodeSegment["Process Code Segment"]; class T1068 OffensiveTechniqueNode;
        class ProcessCodeSegment ArtifactNode; click T1068 href "../../../offensive-technique/attack/T1068/"; click ProcessCodeSegment href "../../../dao/artifact/d3f:ProcessCodeSegment";T1055012["Process Hollowing"] --> |modifies| ProcessCodeSegment["Process Code Segment"]; class T1055012 OffensiveTechniqueNode;
        class ProcessCodeSegment ArtifactNode; click T1055012 href "../../../offensive-technique/attack/T1055.012/"; click ProcessCodeSegment href "../../../dao/artifact/d3f:ProcessCodeSegment";T1203["Exploitation for Client Execution"] --> |modifies| ProcessCodeSegment["Process Code Segment"]; class T1203 OffensiveTechniqueNode;
        class ProcessCodeSegment ArtifactNode; click T1203 href "../../../offensive-technique/attack/T1203/"; click ProcessCodeSegment href "../../../dao/artifact/d3f:ProcessCodeSegment";T1562003["Impair Command History Logging"] --> |modifies| ProcessEnvironmentVariable["Process Environment Variable"]; class T1562003 OffensiveTechniqueNode;
        class ProcessEnvironmentVariable ArtifactNode; click T1562003 href "../../../offensive-technique/attack/T1562.003/"; click ProcessEnvironmentVariable href "../../../dao/artifact/d3f:ProcessEnvironmentVariable";T1003007["Proc Filesystem"] --> |accesses| ProcessImage["Process Image"]; class T1003007 OffensiveTechniqueNode;
        class ProcessImage ArtifactNode; click T1003007 href "../../../offensive-technique/attack/T1003.007/"; click ProcessImage href "../../../dao/artifact/d3f:ProcessImage";T1033["System Owner/User Discovery"] --> |may-access| ProcessSegment["Process Segment"]; class T1033 OffensiveTechniqueNode;
        class ProcessSegment ArtifactNode; click T1033 href "../../../offensive-technique/attack/T1033/"; click ProcessSegment href "../../../dao/artifact/d3f:ProcessSegment";T1210["Exploitation of Remote Services"] --> |may-modify| ProcessSegment["Process Segment"]; class T1210 OffensiveTechniqueNode;
        class ProcessSegment ArtifactNode; click T1210 href "../../../offensive-technique/attack/T1210/"; click ProcessSegment href "../../../dao/artifact/d3f:ProcessSegment";T1620["Reflective Code Loading"] --> |modifies| ProcessSegment["Process Segment"]; class T1620 OffensiveTechniqueNode;
        class ProcessSegment ArtifactNode; click T1620 href "../../../offensive-technique/attack/T1620/"; click ProcessSegment href "../../../dao/artifact/d3f:ProcessSegment";T1189["Drive-by Compromise"] --> |modifies| ProcessSegment["Process Segment"]; class T1189 OffensiveTechniqueNode;
        class ProcessSegment ArtifactNode; click T1189 href "../../../offensive-technique/attack/T1189/"; click ProcessSegment href "../../../dao/artifact/d3f:ProcessSegment";T1190["Exploit Public-Facing Application"] --> |modifies| ProcessSegment["Process Segment"]; class T1190 OffensiveTechniqueNode;
        class ProcessSegment ArtifactNode; click T1190 href "../../../offensive-technique/attack/T1190/"; click ProcessSegment href "../../../dao/artifact/d3f:ProcessSegment";T1218013["Mavinject"] --> |modifies| ProcessSegment["Process Segment"]; class T1218013 OffensiveTechniqueNode;
        class ProcessSegment ArtifactNode; click T1218013 href "../../../offensive-technique/attack/T1218.013/"; click ProcessSegment href "../../../dao/artifact/d3f:ProcessSegment";T1053004["Launchd"] --> |creates| PropertyListFile["Property List File"]; class T1053004 OffensiveTechniqueNode;
        class PropertyListFile ArtifactNode; click T1053004 href "../../../offensive-technique/attack/T1053.004/"; click PropertyListFile href "../../../dao/artifact/d3f:PropertyListFile";T1543001["Launch Agent"] --> |creates| PropertyListFile["Property List File"]; class T1543001 OffensiveTechniqueNode;
        class PropertyListFile ArtifactNode; click T1543001 href "../../../offensive-technique/attack/T1543.001/"; click PropertyListFile href "../../../dao/artifact/d3f:PropertyListFile";T1546014["Emond"] --> |may-create| PropertyListFile["Property List File"]; class T1546014 OffensiveTechniqueNode;
        class PropertyListFile ArtifactNode; click T1546014 href "../../../offensive-technique/attack/T1546.014/"; click PropertyListFile href "../../../dao/artifact/d3f:PropertyListFile";T1546014["Emond"] --> |may-modify| PropertyListFile["Property List File"]; class T1546014 OffensiveTechniqueNode;
        class PropertyListFile ArtifactNode; click T1546014 href "../../../offensive-technique/attack/T1546.014/"; click PropertyListFile href "../../../dao/artifact/d3f:PropertyListFile";T1564003["Hidden Window"] --> |may-modify| PropertyListFile["Property List File"]; class T1564003 OffensiveTechniqueNode;
        class PropertyListFile ArtifactNode; click T1564003 href "../../../offensive-technique/attack/T1564.003/"; click PropertyListFile href "../../../dao/artifact/d3f:PropertyListFile";T1543004["Launch Daemon"] --> |modifies| PropertyListFile["Property List File"]; class T1543004 OffensiveTechniqueNode;
        class PropertyListFile ArtifactNode; click T1543004 href "../../../offensive-technique/attack/T1543.004/"; click PropertyListFile href "../../../dao/artifact/d3f:PropertyListFile";T1563002["RDP Hijacking"] --> |accesses| RDPSession["RDP Session"]; class T1563002 OffensiveTechniqueNode;
        class RDPSession ArtifactNode; click T1563002 href "../../../offensive-technique/attack/T1563.002/"; click RDPSession href "../../../dao/artifact/d3f:RDPSession";T1021001["Remote Desktop Protocol"] --> |creates| RDPSession["RDP Session"]; class T1021001 OffensiveTechniqueNode;
        class RDPSession ArtifactNode; click T1021001 href "../../../offensive-technique/attack/T1021.001/"; click RDPSession href "../../../dao/artifact/d3f:RDPSession";T1558003["Kerberoasting"] --> |may-produce| RPCNetworkTraffic["RPC Network Traffic"]; class T1558003 OffensiveTechniqueNode;
        class RPCNetworkTraffic ArtifactNode; click T1558003 href "../../../offensive-technique/attack/T1558.003/"; click RPCNetworkTraffic href "../../../dao/artifact/d3f:RPCNetworkTraffic";T1555003["Credentials from Web Browsers"] --> |may-invoke| ReadFile["Read File"]; class T1555003 OffensiveTechniqueNode;
        class ReadFile ArtifactNode; click T1555003 href "../../../offensive-technique/attack/T1555.003/"; click ReadFile href "../../../dao/artifact/d3f:ReadFile";T1563["Remote Service Session Hijacking"] --> |accesses| RemoteSession["Remote Session"]; class T1563 OffensiveTechniqueNode;
        class RemoteSession ArtifactNode; click T1563 href "../../../offensive-technique/attack/T1563/"; click RemoteSession href "../../../dao/artifact/d3f:RemoteSession";T1025["Data from Removable Media"] --> |accesses| RemovableMediaDevice["Removable Media Device"]; class T1025 OffensiveTechniqueNode;
        class RemovableMediaDevice ArtifactNode; click T1025 href "../../../offensive-technique/attack/T1025/"; click RemovableMediaDevice href "../../../dao/artifact/d3f:RemovableMediaDevice";T1091["Replication Through Removable Media"] --> |executes| RemovableMediaDevice["Removable Media Device"]; class T1091 OffensiveTechniqueNode;
        class RemovableMediaDevice ArtifactNode; click T1091 href "../../../offensive-technique/attack/T1091/"; click RemovableMediaDevice href "../../../dao/artifact/d3f:RemovableMediaDevice";T1092["Communication Through Removable Media"] --> |modifies| RemovableMediaDevice["Removable Media Device"]; class T1092 OffensiveTechniqueNode;
        class RemovableMediaDevice ArtifactNode; click T1092 href "../../../offensive-technique/attack/T1092/"; click RemovableMediaDevice href "../../../dao/artifact/d3f:RemovableMediaDevice";T1052001["Exfiltration over USB"] --> |modifies| RemovableMediaDevice["Removable Media Device"]; class T1052001 OffensiveTechniqueNode;
        class RemovableMediaDevice ArtifactNode; click T1052001 href "../../../offensive-technique/attack/T1052.001/"; click RemovableMediaDevice href "../../../dao/artifact/d3f:RemovableMediaDevice";T1114["Email Collection"] --> |accesses| Resource["Resource"]; class T1114 OffensiveTechniqueNode;
        class Resource ArtifactNode; click T1114 href "../../../offensive-technique/attack/T1114/"; click Resource href "../../../dao/artifact/d3f:Resource";T1213["Data from Information Repositories"] --> |accesses| Resource["Resource"]; class T1213 OffensiveTechniqueNode;
        class Resource ArtifactNode; click T1213 href "../../../offensive-technique/attack/T1213/"; click Resource href "../../../dao/artifact/d3f:Resource";T1491001["Internal Defacement"] --> |modifies| Resource["Resource"]; class T1491001 OffensiveTechniqueNode;
        class Resource ArtifactNode; click T1491001 href "../../../offensive-technique/attack/T1491.001/"; click Resource href "../../../dao/artifact/d3f:Resource";T1074["Data Staged"] --> |reads| Resource["Resource"]; class T1074 OffensiveTechniqueNode;
        class Resource ArtifactNode; click T1074 href "../../../offensive-technique/attack/T1074/"; click Resource href "../../../dao/artifact/d3f:Resource";T1564009["Resource Forking"] --> |may-create| ResourceFork["Resource Fork"]; class T1564009 OffensiveTechniqueNode;
        class ResourceFork ArtifactNode; click T1564009 href "../../../offensive-technique/attack/T1564.009/"; click ResourceFork href "../../../dao/artifact/d3f:ResourceFork";T1564009["Resource Forking"] --> |may-modify| ResourceFork["Resource Fork"]; class T1564009 OffensiveTechniqueNode;
        class ResourceFork ArtifactNode; click T1564009 href "../../../offensive-technique/attack/T1564.009/"; click ResourceFork href "../../../dao/artifact/d3f:ResourceFork";T1563001["SSH Hijacking"] --> |accesses| SSHSession["SSH Session"]; class T1563001 OffensiveTechniqueNode;
        class SSHSession ArtifactNode; click T1563001 href "../../../offensive-technique/attack/T1563.001/"; click SSHSession href "../../../dao/artifact/d3f:SSHSession";T1021004["SSH"] --> |creates| SSHSession["SSH Session"]; class T1021004 OffensiveTechniqueNode;
        class SSHSession ArtifactNode; click T1021004 href "../../../offensive-technique/attack/T1021.004/"; click SSHSession href "../../../dao/artifact/d3f:SSHSession";T1053["Scheduled Task/Job"] --> |executes| ScheduledJob["Scheduled Job"]; class T1053 OffensiveTechniqueNode;
        class ScheduledJob ArtifactNode; click T1053 href "../../../offensive-technique/attack/T1053/"; click ScheduledJob href "../../../dao/artifact/d3f:ScheduledJob";T1053005["Scheduled Task"] --> |executes| ScheduledJob["Scheduled Job"]; class T1053005 OffensiveTechniqueNode;
        class ScheduledJob ArtifactNode; click T1053005 href "../../../offensive-technique/attack/T1053.005/"; click ScheduledJob href "../../../dao/artifact/d3f:ScheduledJob";T1111["Multi-Factor Authentication Interception"] --> |may-access| SecurityToken["Security Token"]; class T1111 OffensiveTechniqueNode;
        class SecurityToken ArtifactNode; click T1111 href "../../../offensive-technique/attack/T1111/"; click SecurityToken href "../../../dao/artifact/d3f:SecurityToken";T1539["Steal Web Session Cookie"] --> |accesses| SessionCookie["Session Cookie"]; class T1539 OffensiveTechniqueNode;
        class SessionCookie ArtifactNode; click T1539 href "../../../offensive-technique/attack/T1539/"; click SessionCookie href "../../../dao/artifact/d3f:SessionCookie";T1550004["Web Session Cookie"] --> |adds| SessionCookie["Session Cookie"]; class T1550004 OffensiveTechniqueNode;
        class SessionCookie ArtifactNode; click T1550004 href "../../../offensive-technique/attack/T1550.004/"; click SessionCookie href "../../../dao/artifact/d3f:SessionCookie";T1574012["COR_PROFILER"] --> |adds| SharedLibraryFile["Shared Library File"]; class T1574012 OffensiveTechniqueNode;
        class SharedLibraryFile ArtifactNode; click T1574012 href "../../../offensive-technique/attack/T1574.012/"; click SharedLibraryFile href "../../../dao/artifact/d3f:SharedLibraryFile";T1218011["Rundll32"] --> |loads| SharedLibraryFile["Shared Library File"]; class T1218011 OffensiveTechniqueNode;
        class SharedLibraryFile ArtifactNode; click T1218011 href "../../../offensive-technique/attack/T1218.011/"; click SharedLibraryFile href "../../../dao/artifact/d3f:SharedLibraryFile";T1546009["AppCert DLLs"] --> |loads| SharedLibraryFile["Shared Library File"]; class T1546009 OffensiveTechniqueNode;
        class SharedLibraryFile ArtifactNode; click T1546009 href "../../../offensive-technique/attack/T1546.009/"; click SharedLibraryFile href "../../../dao/artifact/d3f:SharedLibraryFile";T1546010["AppInit DLLs"] --> |loads| SharedLibraryFile["Shared Library File"]; class T1546010 OffensiveTechniqueNode;
        class SharedLibraryFile ArtifactNode; click T1546010 href "../../../offensive-technique/attack/T1546.010/"; click SharedLibraryFile href "../../../dao/artifact/d3f:SharedLibraryFile";T1055014["VDSO Hijacking"] --> |accesses| SharedLibraryFile["Shared Library File"]; class T1055014 OffensiveTechniqueNode;
        class SharedLibraryFile ArtifactNode; click T1055014 href "../../../offensive-technique/attack/T1055.014/"; click SharedLibraryFile href "../../../dao/artifact/d3f:SharedLibraryFile";T1055001["Dynamic-link Library Injection"] --> |adds| SharedLibraryFile["Shared Library File"]; class T1055001 OffensiveTechniqueNode;
        class SharedLibraryFile ArtifactNode; click T1055001 href "../../../offensive-technique/attack/T1055.001/"; click SharedLibraryFile href "../../../dao/artifact/d3f:SharedLibraryFile";T1556002["Password Filter DLL"] --> |creates| SharedLibraryFile["Shared Library File"]; class T1556002 OffensiveTechniqueNode;
        class SharedLibraryFile ArtifactNode; click T1556002 href "../../../offensive-technique/attack/T1556.002/"; click SharedLibraryFile href "../../../dao/artifact/d3f:SharedLibraryFile";T1055001["Dynamic-link Library Injection"] --> |loads| SharedLibraryFile["Shared Library File"]; class T1055001 OffensiveTechniqueNode;
        class SharedLibraryFile ArtifactNode; click T1055001 href "../../../offensive-technique/attack/T1055.001/"; click SharedLibraryFile href "../../../dao/artifact/d3f:SharedLibraryFile";T1547008["LSASS Driver"] --> |may-create| SharedLibraryFile["Shared Library File"]; class T1547008 OffensiveTechniqueNode;
        class SharedLibraryFile ArtifactNode; click T1547008 href "../../../offensive-technique/attack/T1547.008/"; click SharedLibraryFile href "../../../dao/artifact/d3f:SharedLibraryFile";T1574001["DLL"] --> |may-create| SharedLibraryFile["Shared Library File"]; class T1574001 OffensiveTechniqueNode;
        class SharedLibraryFile ArtifactNode; click T1574001 href "../../../offensive-technique/attack/T1574.001/"; click SharedLibraryFile href "../../../dao/artifact/d3f:SharedLibraryFile";T1574002["DLL Side-Loading"] --> |may-create| SharedLibraryFile["Shared Library File"]; class T1574002 OffensiveTechniqueNode;
        class SharedLibraryFile ArtifactNode; click T1574002 href "../../../offensive-technique/attack/T1574.002/"; click SharedLibraryFile href "../../../dao/artifact/d3f:SharedLibraryFile";T1574004["Dylib Hijacking"] --> |may-create| SharedLibraryFile["Shared Library File"]; class T1574004 OffensiveTechniqueNode;
        class SharedLibraryFile ArtifactNode; click T1574004 href "../../../offensive-technique/attack/T1574.004/"; click SharedLibraryFile href "../../../dao/artifact/d3f:SharedLibraryFile";T1014["Rootkit"] --> |may-modify| SharedLibraryFile["Shared Library File"]; class T1014 OffensiveTechniqueNode;
        class SharedLibraryFile ArtifactNode; click T1014 href "../../../offensive-technique/attack/T1014/"; click SharedLibraryFile href "../../../dao/artifact/d3f:SharedLibraryFile";T1574002["DLL Side-Loading"] --> |may-modify| SharedLibraryFile["Shared Library File"]; class T1574002 OffensiveTechniqueNode;
        class SharedLibraryFile ArtifactNode; click T1574002 href "../../../offensive-technique/attack/T1574.002/"; click SharedLibraryFile href "../../../dao/artifact/d3f:SharedLibraryFile";T1574004["Dylib Hijacking"] --> |may-modify| SharedLibraryFile["Shared Library File"]; class T1574004 OffensiveTechniqueNode;
        class SharedLibraryFile ArtifactNode; click T1574004 href "../../../offensive-technique/attack/T1574.004/"; click SharedLibraryFile href "../../../dao/artifact/d3f:SharedLibraryFile";T1546011["Application Shimming"] --> |modifies| ShimDatabase["Shim Database"]; class T1546011 OffensiveTechniqueNode;
        class ShimDatabase ArtifactNode; click T1546011 href "../../../offensive-technique/attack/T1546.011/"; click ShimDatabase href "../../../dao/artifact/d3f:ShimDatabase";T1068["Exploitation for Privilege Escalation"] --> |may-modify| StackFrame["Stack Frame"]; class T1068 OffensiveTechniqueNode;
        class StackFrame ArtifactNode; click T1068 href "../../../offensive-technique/attack/T1068/"; click StackFrame href "../../../dao/artifact/d3f:StackFrame";T1212["Exploitation for Credential Access"] --> |may-modify| StackFrame["Stack Frame"]; class T1212 OffensiveTechniqueNode;
        class StackFrame ArtifactNode; click T1212 href "../../../offensive-technique/attack/T1212/"; click StackFrame href "../../../dao/artifact/d3f:StackFrame";T1211["Exploitation for Defense Evasion"] --> |may-modify| StackFrame["Stack Frame"]; class T1211 OffensiveTechniqueNode;
        class StackFrame ArtifactNode; click T1211 href "../../../offensive-technique/attack/T1211/"; click StackFrame href "../../../dao/artifact/d3f:StackFrame";T1210["Exploitation of Remote Services"] --> |may-modify| StackFrame["Stack Frame"]; class T1210 OffensiveTechniqueNode;
        class StackFrame ArtifactNode; click T1210 href "../../../offensive-technique/attack/T1210/"; click StackFrame href "../../../dao/artifact/d3f:StackFrame";T1203["Exploitation for Client Execution"] --> |modifies| StackFrame["Stack Frame"]; class T1203 OffensiveTechniqueNode;
        class StackFrame ArtifactNode; click T1203 href "../../../offensive-technique/attack/T1203/"; click StackFrame href "../../../dao/artifact/d3f:StackFrame";T1564005["Hidden File System"] --> |modifies| Storage["Storage"]; class T1564005 OffensiveTechniqueNode;
        class Storage ArtifactNode; click T1564005 href "../../../offensive-technique/attack/T1564.005/"; click Storage href "../../../dao/artifact/d3f:Storage";T1547009["Shortcut Modification"] --> |may-modify| SymbolicLink["Symbolic Link"]; class T1547009 OffensiveTechniqueNode;
        class SymbolicLink ArtifactNode; click T1547009 href "../../../offensive-technique/attack/T1547.009/"; click SymbolicLink href "../../../dao/artifact/d3f:SymbolicLink";T1106["Native API"] --> |invokes| SystemCall["System Call"]; class T1106 OffensiveTechniqueNode;
        class SystemCall ArtifactNode; click T1106 href "../../../offensive-technique/attack/T1106/"; click SystemCall href "../../../dao/artifact/d3f:SystemCall";T1055001["Dynamic-link Library Injection"] --> |invokes| SystemCall["System Call"]; class T1055001 OffensiveTechniqueNode;
        class SystemCall ArtifactNode; click T1055001 href "../../../offensive-technique/attack/T1055.001/"; click SystemCall href "../../../dao/artifact/d3f:SystemCall";T1055003["Thread Execution Hijacking"] --> |invokes| SystemCall["System Call"]; class T1055003 OffensiveTechniqueNode;
        class SystemCall ArtifactNode; click T1055003 href "../../../offensive-technique/attack/T1055.003/"; click SystemCall href "../../../dao/artifact/d3f:SystemCall";T1055005["Thread Local Storage"] --> |invokes| SystemCall["System Call"]; class T1055005 OffensiveTechniqueNode;
        class SystemCall ArtifactNode; click T1055005 href "../../../offensive-technique/attack/T1055.005/"; click SystemCall href "../../../dao/artifact/d3f:SystemCall";T1055008["Ptrace System Calls"] --> |invokes| SystemCall["System Call"]; class T1055008 OffensiveTechniqueNode;
        class SystemCall ArtifactNode; click T1055008 href "../../../offensive-technique/attack/T1055.008/"; click SystemCall href "../../../dao/artifact/d3f:SystemCall";T1055014["VDSO Hijacking"] --> |invokes| SystemCall["System Call"]; class T1055014 OffensiveTechniqueNode;
        class SystemCall ArtifactNode; click T1055014 href "../../../offensive-technique/attack/T1055.014/"; click SystemCall href "../../../dao/artifact/d3f:SystemCall";T1548004["Elevated Execution with Prompt"] --> |invokes| SystemCall["System Call"]; class T1548004 OffensiveTechniqueNode;
        class SystemCall ArtifactNode; click T1548004 href "../../../offensive-technique/attack/T1548.004/"; click SystemCall href "../../../dao/artifact/d3f:SystemCall";T1552002["Credentials in Registry"] --> |accesses| SystemConfigurationDatabase["System Configuration Database"]; class T1552002 OffensiveTechniqueNode;
        class SystemConfigurationDatabase ArtifactNode; click T1552002 href "../../../offensive-technique/attack/T1552.002/"; click SystemConfigurationDatabase href "../../../dao/artifact/d3f:SystemConfigurationDatabase";T1548004["Elevated Execution with Prompt"] --> |creates| SystemConfigurationDatabase["System Configuration Database"]; class T1548004 OffensiveTechniqueNode;
        class SystemConfigurationDatabase ArtifactNode; click T1548004 href "../../../offensive-technique/attack/T1548.004/"; click SystemConfigurationDatabase href "../../../dao/artifact/d3f:SystemConfigurationDatabase";T1564003["Hidden Window"] --> |may-modify| SystemConfigurationDatabase["System Configuration Database"]; class T1564003 OffensiveTechniqueNode;
        class SystemConfigurationDatabase ArtifactNode; click T1564003 href "../../../offensive-technique/attack/T1564.003/"; click SystemConfigurationDatabase href "../../../dao/artifact/d3f:SystemConfigurationDatabase";T1564005["Hidden File System"] --> |may-modify| SystemConfigurationDatabase["System Configuration Database"]; class T1564005 OffensiveTechniqueNode;
        class SystemConfigurationDatabase ArtifactNode; click T1564005 href "../../../offensive-technique/attack/T1564.005/"; click SystemConfigurationDatabase href "../../../dao/artifact/d3f:SystemConfigurationDatabase";T1218014["MMC"] --> |may-modify| SystemConfigurationDatabase["System Configuration Database"]; class T1218014 OffensiveTechniqueNode;
        class SystemConfigurationDatabase ArtifactNode; click T1218014 href "../../../offensive-technique/attack/T1218.014/"; click SystemConfigurationDatabase href "../../../dao/artifact/d3f:SystemConfigurationDatabase";T1546015["Component Object Model Hijacking"] --> |modifies| SystemConfigurationDatabase["System Configuration Database"]; class T1546015 OffensiveTechniqueNode;
        class SystemConfigurationDatabase ArtifactNode; click T1546015 href "../../../offensive-technique/attack/T1546.015/"; click SystemConfigurationDatabase href "../../../dao/artifact/d3f:SystemConfigurationDatabase";T1543003["Windows Service"] --> |modifies| SystemConfigurationDatabase["System Configuration Database"]; class T1543003 OffensiveTechniqueNode;
        class SystemConfigurationDatabase ArtifactNode; click T1543003 href "../../../offensive-technique/attack/T1543.003/"; click SystemConfigurationDatabase href "../../../dao/artifact/d3f:SystemConfigurationDatabase";T1546012["Image File Execution Options Injection"] --> |modifies| SystemConfigurationDatabase["System Configuration Database"]; class T1546012 OffensiveTechniqueNode;
        class SystemConfigurationDatabase ArtifactNode; click T1546012 href "../../../offensive-technique/attack/T1546.012/"; click SystemConfigurationDatabase href "../../../dao/artifact/d3f:SystemConfigurationDatabase";T1614001["System Language Discovery"] --> |queries| SystemConfigurationDatabase["System Configuration Database"]; class T1614001 OffensiveTechniqueNode;
        class SystemConfigurationDatabase ArtifactNode; click T1614001 href "../../../offensive-technique/attack/T1614.001/"; click SystemConfigurationDatabase href "../../../dao/artifact/d3f:SystemConfigurationDatabase";T1012["Query Registry"] --> |accesses| SystemConfigurationDatabase["System Configuration Database"]; class T1012 OffensiveTechniqueNode;
        class SystemConfigurationDatabase ArtifactNode; click T1012 href "../../../offensive-technique/attack/T1012/"; click SystemConfigurationDatabase href "../../../dao/artifact/d3f:SystemConfigurationDatabase";T1137006["Add-ins"] --> |may-modify| SystemConfigurationDatabase["System Configuration Database"]; class T1137006 OffensiveTechniqueNode;
        class SystemConfigurationDatabase ArtifactNode; click T1137006 href "../../../offensive-technique/attack/T1137.006/"; click SystemConfigurationDatabase href "../../../dao/artifact/d3f:SystemConfigurationDatabase";T1207["Rogue Domain Controller"] --> |modifies| SystemConfigurationDatabase["System Configuration Database"]; class T1207 OffensiveTechniqueNode;
        class SystemConfigurationDatabase ArtifactNode; click T1207 href "../../../offensive-technique/attack/T1207/"; click SystemConfigurationDatabase href "../../../dao/artifact/d3f:SystemConfigurationDatabase";T1518001["Security Software Discovery"] --> |may-access| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1518001 OffensiveTechniqueNode;
        class SystemConfigurationDatabaseRecord ArtifactNode; click T1518001 href "../../../offensive-technique/attack/T1518.001/"; click SystemConfigurationDatabaseRecord href "../../../dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1137001["Office Template Macros"] --> |may-modify| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1137001 OffensiveTechniqueNode;
        class SystemConfigurationDatabaseRecord ArtifactNode; click T1137001 href "../../../offensive-technique/attack/T1137.001/"; click SystemConfigurationDatabaseRecord href "../../../dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1218002["Control Panel"] --> |may-modify| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1218002 OffensiveTechniqueNode;
        class SystemConfigurationDatabaseRecord ArtifactNode; click T1218002 href "../../../offensive-technique/attack/T1218.002/"; click SystemConfigurationDatabaseRecord href "../../../dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1548002["Bypass User Account Control"] --> |may-modify| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1548002 OffensiveTechniqueNode;
        class SystemConfigurationDatabaseRecord ArtifactNode; click T1548002 href "../../../offensive-technique/attack/T1548.002/"; click SystemConfigurationDatabaseRecord href "../../../dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1546008["Accessibility Features"] --> |may-modify| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1546008 OffensiveTechniqueNode;
        class SystemConfigurationDatabaseRecord ArtifactNode; click T1546008 href "../../../offensive-technique/attack/T1546.008/"; click SystemConfigurationDatabaseRecord href "../../../dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1137002["Office Test"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1137002 OffensiveTechniqueNode;
        class SystemConfigurationDatabaseRecord ArtifactNode; click T1137002 href "../../../offensive-technique/attack/T1137.002/"; click SystemConfigurationDatabaseRecord href "../../../dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1547002["Authentication Package"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1547002 OffensiveTechniqueNode;
        class SystemConfigurationDatabaseRecord ArtifactNode; click T1547002 href "../../../offensive-technique/attack/T1547.002/"; click SystemConfigurationDatabaseRecord href "../../../dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1547003["Time Providers"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1547003 OffensiveTechniqueNode;
        class SystemConfigurationDatabaseRecord ArtifactNode; click T1547003 href "../../../offensive-technique/attack/T1547.003/"; click SystemConfigurationDatabaseRecord href "../../../dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1547004["Winlogon Helper DLL"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1547004 OffensiveTechniqueNode;
        class SystemConfigurationDatabaseRecord ArtifactNode; click T1547004 href "../../../offensive-technique/attack/T1547.004/"; click SystemConfigurationDatabaseRecord href "../../../dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1547005["Security Support Provider"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1547005 OffensiveTechniqueNode;
        class SystemConfigurationDatabaseRecord ArtifactNode; click T1547005 href "../../../offensive-technique/attack/T1547.005/"; click SystemConfigurationDatabaseRecord href "../../../dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1547010["Port Monitors"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1547010 OffensiveTechniqueNode;
        class SystemConfigurationDatabaseRecord ArtifactNode; click T1547010 href "../../../offensive-technique/attack/T1547.010/"; click SystemConfigurationDatabaseRecord href "../../../dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1553003["SIP and Trust Provider Hijacking"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1553003 OffensiveTechniqueNode;
        class SystemConfigurationDatabaseRecord ArtifactNode; click T1553003 href "../../../offensive-technique/attack/T1553.003/"; click SystemConfigurationDatabaseRecord href "../../../dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1556002["Password Filter DLL"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1556002 OffensiveTechniqueNode;
        class SystemConfigurationDatabaseRecord ArtifactNode; click T1556002 href "../../../offensive-technique/attack/T1556.002/"; click SystemConfigurationDatabaseRecord href "../../../dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1574012["COR_PROFILER"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1574012 OffensiveTechniqueNode;
        class SystemConfigurationDatabaseRecord ArtifactNode; click T1574012 href "../../../offensive-technique/attack/T1574.012/"; click SystemConfigurationDatabaseRecord href "../../../dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1546001["Change Default File Association"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1546001 OffensiveTechniqueNode;
        class SystemConfigurationDatabaseRecord ArtifactNode; click T1546001 href "../../../offensive-technique/attack/T1546.001/"; click SystemConfigurationDatabaseRecord href "../../../dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1546002["Screensaver"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1546002 OffensiveTechniqueNode;
        class SystemConfigurationDatabaseRecord ArtifactNode; click T1546002 href "../../../offensive-technique/attack/T1546.002/"; click SystemConfigurationDatabaseRecord href "../../../dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1546007["Netsh Helper DLL"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1546007 OffensiveTechniqueNode;
        class SystemConfigurationDatabaseRecord ArtifactNode; click T1546007 href "../../../offensive-technique/attack/T1546.007/"; click SystemConfigurationDatabaseRecord href "../../../dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1546009["AppCert DLLs"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1546009 OffensiveTechniqueNode;
        class SystemConfigurationDatabaseRecord ArtifactNode; click T1546009 href "../../../offensive-technique/attack/T1546.009/"; click SystemConfigurationDatabaseRecord href "../../../dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1546010["AppInit DLLs"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1546010 OffensiveTechniqueNode;
        class SystemConfigurationDatabaseRecord ArtifactNode; click T1546010 href "../../../offensive-technique/attack/T1546.010/"; click SystemConfigurationDatabaseRecord href "../../../dao/artifact/d3f:SystemConfigurationDatabaseRecord";T1562009["Safe Mode Boot"] --> |disables| SystemConfigurationInitDatabaseRecord["System Configuration Init Database Record"]; class T1562009 OffensiveTechniqueNode;
        class SystemConfigurationInitDatabaseRecord ArtifactNode; click T1562009 href "../../../offensive-technique/attack/T1562.009/"; click SystemConfigurationInitDatabaseRecord href "../../../dao/artifact/d3f:SystemConfigurationInitDatabaseRecord";T1547001["Registry Run Keys / Startup Folder"] --> |may-modify| SystemConfigurationInitDatabaseRecord["System Configuration Init Database Record"]; class T1547001 OffensiveTechniqueNode;
        class SystemConfigurationInitDatabaseRecord ArtifactNode; click T1547001 href "../../../offensive-technique/attack/T1547.001/"; click SystemConfigurationInitDatabaseRecord href "../../../dao/artifact/d3f:SystemConfigurationInitDatabaseRecord";T1574011["Services Registry Permissions Weakness"] --> |modifies| SystemConfigurationInitDatabaseRecord["System Configuration Init Database Record"]; class T1574011 OffensiveTechniqueNode;
        class SystemConfigurationInitDatabaseRecord ArtifactNode; click T1574011 href "../../../offensive-technique/attack/T1574.011/"; click SystemConfigurationInitDatabaseRecord href "../../../dao/artifact/d3f:SystemConfigurationInitDatabaseRecord";T1518001["Security Software Discovery"] --> |may-access| SystemFirewallConfiguration["System Firewall Configuration"]; class T1518001 OffensiveTechniqueNode;
        class SystemFirewallConfiguration ArtifactNode; click T1518001 href "../../../offensive-technique/attack/T1518.001/"; click SystemFirewallConfiguration href "../../../dao/artifact/d3f:SystemFirewallConfiguration";T1562004["Disable or Modify System Firewall"] --> |modifies| SystemFirewallConfiguration["System Firewall Configuration"]; class T1562004 OffensiveTechniqueNode;
        class SystemFirewallConfiguration ArtifactNode; click T1562004 href "../../../offensive-technique/attack/T1562.004/"; click SystemFirewallConfiguration href "../../../dao/artifact/d3f:SystemFirewallConfiguration";T1037004["RC Scripts"] --> |modifies| SystemInitScript["System Init Script"]; class T1037004 OffensiveTechniqueNode;
        class SystemInitScript ArtifactNode; click T1037004 href "../../../offensive-technique/attack/T1037.004/"; click SystemInitScript href "../../../dao/artifact/d3f:SystemInitScript";T1003002["Security Account Manager"] --> |may-access| SystemPasswordDatabase["System Password Database"]; class T1003002 OffensiveTechniqueNode;
        class SystemPasswordDatabase ArtifactNode; click T1003002 href "../../../offensive-technique/attack/T1003.002/"; click SystemPasswordDatabase href "../../../dao/artifact/d3f:SystemPasswordDatabase";T1003004["LSA Secrets"] --> |may-access| SystemPasswordDatabase["System Password Database"]; class T1003004 OffensiveTechniqueNode;
        class SystemPasswordDatabase ArtifactNode; click T1003004 href "../../../offensive-technique/attack/T1003.004/"; click SystemPasswordDatabase href "../../../dao/artifact/d3f:SystemPasswordDatabase";T1037005["Startup Items"] --> |modifies| SystemStartupDirectory["System Startup Directory"]; class T1037005 OffensiveTechniqueNode;
        class SystemStartupDirectory ArtifactNode; click T1037005 href "../../../offensive-technique/attack/T1037.005/"; click SystemStartupDirectory href "../../../dao/artifact/d3f:SystemStartupDirectory";T1542005["TFTP Boot"] --> |creates| TFTPNetworkTraffic["TFTP Network Traffic"]; class T1542005 OffensiveTechniqueNode;
        class TFTPNetworkTraffic ArtifactNode; click T1542005 href "../../../offensive-technique/attack/T1542.005/"; click TFTPNetworkTraffic href "../../../dao/artifact/d3f:TFTPNetworkTraffic";T1136["Create Account"] --> |creates| UserAccount["User Account"]; class T1136 OffensiveTechniqueNode;
        class UserAccount ArtifactNode; click T1136 href "../../../offensive-technique/attack/T1136/"; click UserAccount href "../../../dao/artifact/d3f:UserAccount";T1098["Account Manipulation"] --> |modifies| UserAccount["User Account"]; class T1098 OffensiveTechniqueNode;
        class UserAccount ArtifactNode; click T1098 href "../../../offensive-technique/attack/T1098/"; click UserAccount href "../../../dao/artifact/d3f:UserAccount";T1531["Account Access Removal"] --> |modifies| UserAccount["User Account"]; class T1531 OffensiveTechniqueNode;
        class UserAccount ArtifactNode; click T1531 href "../../../offensive-technique/attack/T1531/"; click UserAccount href "../../../dao/artifact/d3f:UserAccount";T1078["Valid Accounts"] --> |uses| UserAccount["User Account"]; class T1078 OffensiveTechniqueNode;
        class UserAccount ArtifactNode; click T1078 href "../../../offensive-technique/attack/T1078/"; click UserAccount href "../../../dao/artifact/d3f:UserAccount";T1564002["Hidden Users"] --> |modifies| UserInitConfigurationFile["User Init Configuration File"]; class T1564002 OffensiveTechniqueNode;
        class UserInitConfigurationFile ArtifactNode; click T1564002 href "../../../offensive-technique/attack/T1564.002/"; click UserInitConfigurationFile href "../../../dao/artifact/d3f:UserInitConfigurationFile";T1546004["Unix Shell Configuration Modification"] --> |modifies| UserInitConfigurationFile["User Init Configuration File"]; class T1546004 OffensiveTechniqueNode;
        class UserInitConfigurationFile ArtifactNode; click T1546004 href "../../../offensive-technique/attack/T1546.004/"; click UserInitConfigurationFile href "../../../dao/artifact/d3f:UserInitConfigurationFile";T1562003["Impair Command History Logging"] --> |may-modify| UserInitScript["User Init Script"]; class T1562003 OffensiveTechniqueNode;
        class UserInitScript ArtifactNode; click T1562003 href "../../../offensive-technique/attack/T1562.003/"; click UserInitScript href "../../../dao/artifact/d3f:UserInitScript";T1037001["Logon Script (Windows)"] --> |modifies| UserInitScript["User Init Script"]; class T1037001 OffensiveTechniqueNode;
        class UserInitScript ArtifactNode; click T1037001 href "../../../offensive-technique/attack/T1037.001/"; click UserInitScript href "../../../dao/artifact/d3f:UserInitScript";T1037002["Login Hook"] --> |modifies| UserInitScript["User Init Script"]; class T1037002 OffensiveTechniqueNode;
        class UserInitScript ArtifactNode; click T1037002 href "../../../offensive-technique/attack/T1037.002/"; click UserInitScript href "../../../dao/artifact/d3f:UserInitScript";T1547015["Login Items"] --> |modifies| UserLogonInitResource["User Logon Init Resource"]; class T1547015 OffensiveTechniqueNode;
        class UserLogonInitResource ArtifactNode; click T1547015 href "../../../offensive-technique/attack/T1547.015/"; click UserLogonInitResource href "../../../dao/artifact/d3f:UserLogonInitResource";T1547001["Registry Run Keys / Startup Folder"] --> |may-modify| UserStartupScriptFile["User Startup Script File"]; class T1547001 OffensiveTechniqueNode;
        class UserStartupScriptFile ArtifactNode; click T1547001 href "../../../offensive-technique/attack/T1547.001/"; click UserStartupScriptFile href "../../../dao/artifact/d3f:UserStartupScriptFile";T1547009["Shortcut Modification"] --> |may-modify| UserStartupScriptFile["User Startup Script File"]; class T1547009 OffensiveTechniqueNode;
        class UserStartupScriptFile ArtifactNode; click T1547009 href "../../../offensive-technique/attack/T1547.009/"; click UserStartupScriptFile href "../../../dao/artifact/d3f:UserStartupScriptFile";T1125["Video Capture"] --> |accesses| VideoInputDevice["Video Input Device"]; class T1125 OffensiveTechniqueNode;
        class VideoInputDevice ArtifactNode; click T1125 href "../../../offensive-technique/attack/T1125/"; click VideoInputDevice href "../../../dao/artifact/d3f:VideoInputDevice";T1006["Direct Volume Access"] --> |accesses| Volume["Volume"]; class T1006 OffensiveTechniqueNode;
        class Volume ArtifactNode; click T1006 href "../../../offensive-technique/attack/T1006/"; click Volume href "../../../dao/artifact/d3f:Volume";T1561001["Disk Content Wipe"] --> |may-modify| Volume["Volume"]; class T1561001 OffensiveTechniqueNode;
        class Volume ArtifactNode; click T1561001 href "../../../offensive-technique/attack/T1561.001/"; click Volume href "../../../dao/artifact/d3f:Volume";T1542003["Bootkit"] --> |may-modify| VolumeBootRecord["Volume Boot Record"]; class T1542003 OffensiveTechniqueNode;
        class VolumeBootRecord ArtifactNode; click T1542003 href "../../../offensive-technique/attack/T1542.003/"; click VolumeBootRecord href "../../../dao/artifact/d3f:VolumeBootRecord";T1213002["Sharepoint"] --> |accesses| WebFileResource["Web File Resource"]; class T1213002 OffensiveTechniqueNode;
        class WebFileResource ArtifactNode; click T1213002 href "../../../offensive-technique/attack/T1213.002/"; click WebFileResource href "../../../dao/artifact/d3f:WebFileResource";T1213001["Confluence"] --> |accesses| WebFileResource["Web File Resource"]; class T1213001 OffensiveTechniqueNode;
        class WebFileResource ArtifactNode; click T1213001 href "../../../offensive-technique/attack/T1213.001/"; click WebFileResource href "../../../dao/artifact/d3f:WebFileResource";T1185["Browser Session Hijacking"] --> |produces| WebNetworkTraffic["Web Network Traffic"]; class T1185 OffensiveTechniqueNode;
        class WebNetworkTraffic ArtifactNode; click T1185 href "../../../offensive-technique/attack/T1185/"; click WebNetworkTraffic href "../../../dao/artifact/d3f:WebNetworkTraffic";T1550004["Web Session Cookie"] --> |produces| WebNetworkTraffic["Web Network Traffic"]; class T1550004 OffensiveTechniqueNode;
        class WebNetworkTraffic ArtifactNode; click T1550004 href "../../../offensive-technique/attack/T1550.004/"; click WebNetworkTraffic href "../../../dao/artifact/d3f:WebNetworkTraffic";T1505003["Web Shell"] --> |adds| WebScriptFile["Web Script File"]; class T1505003 OffensiveTechniqueNode;
        class WebScriptFile ArtifactNode; click T1505003 href "../../../offensive-technique/attack/T1505.003/"; click WebScriptFile href "../../../dao/artifact/d3f:WebScriptFile";T1505003["Web Shell"] --> |modifies| WebServer["Web Server"]; class T1505003 OffensiveTechniqueNode;
        class WebServer ArtifactNode; click T1505003 href "../../../offensive-technique/attack/T1505.003/"; click WebServer href "../../../dao/artifact/d3f:WebServer";T1112["Modify Registry"] --> |modifies| WindowsRegistry["Windows Registry"]; class T1112 OffensiveTechniqueNode;
        class WindowsRegistry ArtifactNode; click T1112 href "../../../offensive-technique/attack/T1112/"; click WindowsRegistry href "../../../dao/artifact/d3f:WindowsRegistry";T1562003["Impair Command History Logging"] --> |may-modify| WindowsRegistryKey["Windows Registry Key"]; class T1562003 OffensiveTechniqueNode;
        class WindowsRegistryKey ArtifactNode; click T1562003 href "../../../offensive-technique/attack/T1562.003/"; click WindowsRegistryKey href "../../../dao/artifact/d3f:WindowsRegistryKey";T1187["Forced Authentication"] --> |may-modify| WindowsShortcutFile["Windows Shortcut File"]; class T1187 OffensiveTechniqueNode;
        class WindowsShortcutFile ArtifactNode; click T1187 href "../../../offensive-technique/attack/T1187/"; click WindowsShortcutFile href "../../../dao/artifact/d3f:WindowsShortcutFile";