T1059.001 - Execution - Command and Scripting Interpreter: PowerShell,
T1071 - Command and Control - Application Layer Protocol,
T1204.002 - Execution - User Execution: Malicious File,
T1566.001 - Initial Access - Phishing: Spearphishing Attachment,
T1140 - Defense Evasion - Deobfuscate/Decode Files or Information,
T1001.002 - Command and Control - Data Obfuscation: Steganography,
T1059.005 - Execution - Command and Scripting Interpreter: Visual Basic,