Side-Loading T1073   Uses modified legitimate DLL to load the malicious DLL Process Injection T1055 Injects the decrypted payload into svchost.exe process Exfiltration Exfiltration Over Command and Control Channel T1041