misp-galaxy:threat-actor="APT 29",misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1193",misp-galaxy:mitre-attack-pattern="Execution through API - T1106",misp-galaxy:mitre-attack-pattern="Execution through Module Load - T1129",misp-galaxy:mitre-attack-pattern="PowerShell - T1086",misp-galaxy:mitre-attack-pattern="Rundll32 - T1085",misp-galaxy:mitre-attack-pattern="Scripting - T1064",misp-galaxy:mitre-attack-pattern="Service Execution - T1035",misp-galaxy:mitre-attack-pattern="Valid Accounts - T1078",misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140",misp-galaxy:mitre-attack-pattern="File Deletion - T1107",misp-galaxy:mitre-attack-pattern="Modify Registry - T1112",misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027",misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1060",misp-galaxy:mitre-attack-pattern="Scheduled Task - T1053",misp-galaxy:mitre-attack-pattern="Software Packing - T1045",misp-galaxy:mitre-attack-pattern="Web Service - T1102",misp-galaxy:mitre-attack-pattern="Windows Management Instrumentation Event Subscription - T1084",misp-galaxy:mitre-attack-pattern="Connection Proxy - T1090",misp-galaxy:mitre-attack-pattern="Data Obfuscation - T1001",misp-galaxy:mitre-attack-pattern="Data from Local System - T1005",misp-galaxy:mitre-attack-pattern="Data from Network Shared Drive - T1039",misp-galaxy:mitre-attack-pattern="Data from Removable Media - T1025",misp-galaxy:mitre-attack-pattern="Exfiltration Over Command and Control Channel - T1041",misp-galaxy:mitre-attack-pattern="Fallback Channels - T1008",misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083",misp-galaxy:mitre-attack-pattern="Network Share Discovery - T1135",misp-galaxy:mitre-attack-pattern="Process Discovery - T1057",misp-galaxy:mitre-attack-pattern="Standard Application Layer Protocol - T1071",misp-galaxy:mitre-attack-pattern="System Network Connections Discovery - T1049",misp-galaxy:mitre-attack-pattern="Windows Admin Shares - T1077"