tlp:white,misp-galaxy:misp-attack-pattern="Initial Access - Phishing [T1566]",misp-galaxy:misp-attack-pattern="Credential Access - OS Credential Dumping: NTDS [T1003.003]",misp-galaxy:misp-attack-pattern="Persistence - Create Account: Local Account [T1136.001]",misp-galaxy:misp-attack-pattern="Exfiltration - Exfiltration Over Alternative Protocol [T1048]",misp-galaxy:misp-attack-pattern="Discovery - Permission Groups Discovery: Domain Groups [T1069.002]",misp-galaxy:misp-attack-pattern="Discovery - Query Registry [T1012]",misp-galaxy:misp-attack-pattern="Resource Development - Develop Capabilities: Malware [T1587.001]",misp-galaxy:misp-attack-pattern="Command and Control - Remote File Copy [T1105]",misp-galaxy:misp-attack-pattern="Lateral Movement - Remote Services: Remote Desktop Protocol [T1021.001]",misp-galaxy:misp-attack-pattern="Impact - Data Encrypted for Impact [T1486]",misp-galaxy:misp-attack-pattern="Discovery - Network Service Discovery[T1046]",misp-galaxy:misp-attack-pattern="Discovery - File and Directory Discovery [T1083]",misp-galaxy:misp-attack-pattern="Collection - Clipboard Data [T1115]",misp-galaxy:misp-attack-pattern="Exfiltration - Exfiltration Over Web Service: Exfiltration to Cloud Storage [T1567.002]",misp-galaxy:misp-attack-pattern="Discovery - Account Discovery: Domain Account [T1087.002]",misp-galaxy:misp-attack-pattern="Execution - Scheduled Task/Job: Scheduled Task [T1053.005]",misp-galaxy:misp-attack-pattern="Credential Access - Unsecured Credentials: Credentials In Files [T1552.001]",misp-galaxy:misp-attack-pattern="Execution - Command and Scripting Interpreter: Windows Command Shell [T1059.003]",misp-galaxy:misp-attack-pattern="Credential Access - OS Credential Dumping: LSASS Memory [T1003.001]",misp-galaxy:misp-attack-pattern="Command and Control - Remote Access Software [T1219]",misp-galaxy:misp-attack-pattern="Defense Evasion - Modify Registry [T1112]",misp-galaxy:misp-attack-pattern="Discovery - Network Share Discovery [T1135]",misp-galaxy:misp-attack-pattern="Discovery - Domain Trust Discovery [T1482]",misp-galaxy:misp-attack-pattern="Discovery - System Owner/User Discovery [T1033]",misp-galaxy:misp-attack-pattern="Defense Evasion - Impair Defenses: Disable or Modify Tools [T1562.001]",misp-galaxy:misp-attack-pattern="Privilege Escalation - Valid Accounts [T1078]",misp-galaxy:misp-attack-pattern="Defense Evasion - Impair Defenses: Disable or Modify System Firewall [T1562.004]",misp-galaxy:misp-attack-pattern="Discovery - Remote System Discovery [T1018]",misp-galaxy:misp-attack-pattern="Persistence - Account Manipulation [T1098]",misp-galaxy:misp-attack-pattern="Execution - Command and Scripting Interpreter: PowerShell [T1059.001]",misp-galaxy:misp-attack-pattern="Exfiltration - Transfer Data to Cloud Account [T1537]",misp-galaxy:malpedia="BianLian"