📄️ T1027: Obfuscation
Covers: T1027 - Obfuscated Files or Information, T1027.010 - Command Obfuscation
📄️ T1070: Indicator Removal
Covers: T1070.001 - Clear Windows Event Logs, T1070.004 - File Deletion, T1070.006 - Timestomp
📄️ T1218: Signed Binary Proxy Execution
Covers: T1218.010 - Regsvr32, T1218.005 - Mshta, T1218.011 - Rundll32, T1105/T1140 - Certutil, T1216 - Wscript/Cscript
📄️ T1562.001: Disable or Modify Security Tools
Covers: T1562.001 - Disable or Modify Tools, T1562.004 - Disable or Modify System Firewall, T1562.006 - Indicator Blocking (AuditPol)