import xlsxwriter

# Data to be inserted in the table
data = [
    ##Reconnaisance
    ('Acquire Infrastructure', 'acqinf', 'attack.t1583'),
    ('Compromise Accounts', 'compacc', 'attack.t1586'),
    ('Compromise Infrastructure', 'cominf', 'attack.t1584'),
    ('Develop Capabilities', 'devcap', 'attack.t1587'),
    ('Establish Accounts', 'estacc', 'attack.t1585'),
    ('Obtain Capabilities', 'obtcap', 'attack.t1588'),
    ('Stage Capabilities', 'stcap', 'attack.t1608'),
    ##Resource Development
    ('Active Scanning', 'ascan', 'attack.t1595'),
    ('Gather Victim Host Information', 'gathvhi', 'attack.t1592'),
    ('Gather Victim Identity Information', 'gathvii', 'attack.t1589'),
    ('Gather Victim Network Information', 'gathvni', 'attack.t1590'),
    ('Gather Victim Org Information', 'gathvoi', 'attack.t1519'),
    ('Phishing for Information', 'phish', 'attack.t1598'),
    ('Search Closed Sources', 'scs', 'attack.t1597'),
    ('Search Open Technical Databases', 'sotd', 'attack.t1596'),
    ('Search Open Websites/Domains', 'sowd', 'attack.t1593'),
    ('Search Victim-Owned Websites', 'svow', 'attack.t1594'),
    ('Drive-by Compromise', 'dvcomp', 'attack.t1189'),
    ('Exploit Public-Facing Application', 'exppfa', 'attack.t1190'),
    ('External Remote Services', 'extrs', 'attack.t1133'),
    ('Hardware Additions', 'hwadd', 'attack.t1200'),
    ('Phishing', 'phish', 'attack.t1566'),
    ('Replication Through Removable Media', 'rtrmed', 'attack.t1091'),
    ('Supply Chain Compromise', 'sccomp', 'attack.t1195'),
    ('Trusted Relationship', 'trrel', 'attack.t1199'),
    #Initial Access
    ('Drive-by Compromise', 'dvcomp', 'attack.t1189'),
    ('Exploit Public-Facing Application', 'exppfa', 'attack.t1190'),
    ('External Remote Services', 'extrs', 'attack.t1133'),
    ('Hardware Additions', 'hwadd', 'attack.t1200'),
    ('Phishing', 'phish', 'attack.t1566'),
    ('Replication Through Removable Media', 'rtrmed', 'attack.t1091'),
    ('Supply Chain Compromise', 'sccomp', 'attack.t1195'),
    ('Trusted Relationship', 'trrel', 'attack.t1199'),
    #Execution
    ('Command and Scripting Interpreter', 'c&sint', 'attack.t1059'),
    ('Native API', 'natapi', 'attack.t1106'),
    ('Container Administration Command', 'cadcom', 'attack.t1609'),
    ('Deploy Container', 'depcon', 'attack.t1610'),
    ('Exploitation for Client Execution', 'expfce', 'attack.t1203'),
    ('Inter-Process Communication', 'intpcom', 'attack.t1559'),
    ('Serverless Execution', 'slexec', 'attack.t1648'),
    ('Shared Modules', 'shmod', 'attack.t1129'),
    ('Software Deployment Tools', 'swdtool', 'attack.t1072'),
    ('System Services', 'sysserv', 'attack.t1569'),
    ('User Execution', 'usrexe', 'attack.t1204'),
    ('Windows Management Instrumentation', 'winmin', 'attack.t1047'),
    #Persistence
    ('Account Manipulation', 'accman', 'attack.t1098'),
    ('BITS Jobs', 'bits', 'attack.t1197'),
    ('Browser Extensions', 'browext', 'attack.t1176'),
    ('Compromise Client Software Binary', 'ccsb', 'attack.t1554'),
    ('Create Account', 'creacc', 'attack.t1136'),
    ('External Remote Services', 'extrs', 'attack.t1133'),
    ('Implant Internal Image', 'iintim', 'attack.t1525'),
    ('Office Application Startup', 'oappst', 'attack.t1105'),
    ('Pre-OS Boot', 'preosb', 'attack.t1542'),
    ('Server Software Component', 'sscomp', 'attack.t1505'),
    ('Traffic Signaling', 'trsig', 'attack.t1205'),
    ('Valid Accounts', 'valacc', 'attack.t1078'),
    #Privilege Escalation
    ('Scheduled Task/Job', 'scht', 'attack.t1053'),
    ('Boot or Logon Autostart Execution', 'bolae', 'attack.t1547'),
    ('Abuse Elevation Control Mechanism', 'aecm', 'attack.t1548'),
    ('Access Token Manipulation', 'acctm', 'attack.t1134'),
    ('Event Triggered Execution', 'etexec', 'attack.t1546'),
    ('Boot or Logon Initialization Scripts', 'bolis', 'attack.t1037'),
    ('Create or Modify System Process', 'comsp', 'attack.t1543'),
    ('Domain Policy Modification', 'dpmod', 'attack.t1484'),
    ('Escape to Host', 'escth', 'attack.t1611'),
    ('Exploitation for Privilege Escalation','expfpe','attack.t1068'),
    ('Hijack Execution Flow', 'hijexf', 'attack.t1574'),
    ('Process Injection', 'prinj', 'attack.t1055'),
    #Defense Evasion
    ('Abuse Elevation Control Mechanism', 'aecm', 'attack.t1548'),
    ('Build Image on Host', 'bimonh', 'attack.t1612'),
    ('Debuger Evasion', 'debev', 'attack.t1622'),
    ('Deobfuscate/Decode Files or Information', 'dcfoi', 'attack.t1140'),
    ('Direct Volume Access', 'dirvac', 'attack.t1006'),
    ('Domain Policy Modification', 'dpmod', 'attack.t1484'),
    ('Exploitation for Defense Evasion', 'expfde', 'attack.t1211'),
    ('File and Directory Permissions Modification', 'fadpmod', 'attack.t1222'),
    ('Hide Artifacts', 'hidart', 'attack.t1564'),
    ('Impair Defenses', 'impdef', 'attack.t1562'),
    ('Indicator Removal', 'indrem', 'attack.t1070'),
    ('Indirect Command Execution', 'incexec', 'attack.t1202'),
    ('Masquerading', 'masq', 'attack.t1036'),
    ('Modify Authentication Process', 'modauthp', 'attack.t1556'),
    ('Modify Cloud Compute Infrastructure', 'modcci', 'attack.t1578'),
    ('Modify Registry', 'modr', 'attack.t1112'),
    ('Modify System Image', 'modsi', 'attack.t1601'),
    ('Network Boundary Bridging', 'nwbbr', 'attack.t1599'),
    ('Obfuscated Files or Information', 'obfoi', 'attack.t1027'),
    ('Plist File Modification', 'plfmod', 'attack.t1647'),
    ('Reflective Code Loading', 'refclo', 'attack.t1620'),
    ('Rogue Domain Controller', 'rogdc', 'attack.t1207'),
    ('Rootkit', 'rootkit', 'attack.t1014'),
    ('Subvert Trust Controls', 'strcon', 'attack.t1553'),
    ('System Binary Proxy Execution', 'sbpe', 'attack.t1218'),
    ('System Script Proxy Execution', 'sspe', 'attack.t1216'),
    ('Template Injection', 'tempinj', 'attack.t1221'),
    ('Trusted Developer Utilities Proxy Execution', 'tdupe', 'attack.t1127'),
    ('Unused/Unsupported Cloud Regions', 'ucreg', 'attack.t1535'),
    ('Use Alternate Authentication Material', 'uaam', 'attack.t1550'),
    ('Virtualization/Sandbox Evasion', 'vmevas', 'attack.t1497'),
    ('Weaken Encryption', 'wencr', 'attack.t1600'),
    ('XSL Script Processing', 'xslsp', 'attack.t1220'),
    #Credential Access
    ('OS Credential Dumping','crdump','attack.t1003'),
    ('Brute Force','brufor','attack.t1110'),
    ('Credentials from Password Stores','crfps','attack.t1555'),
    ('Unsecured Credentials','unsecc','attack.t1552'),
    ('Forced Authentication','forauth','attack.t1187'),
    ('Input Capture','inpcap','attack.t1056'),
    ('Adversary-in-the-Middle','advitm','attack.t1557'),
    ('Exploitation for Credential Access','expfca','attack.t1212'),
    ('Forge Web Credentials','fwcred','attack.t1606'),
    ('Multi-Factor Authentication Interception','mfaint','attack.t1111'),
    ('Multi-Factor Authentication Request Generation','mfarg','attack.t1621'),
    ('Network Sniffing','nwsniff','attack.t1040'),
    ('Steal Application Access Token','stappat','attack.t1528'),
    ('Steal or Forge Authentication Certificates','saucrt','attack.t1649'),
    ('Steal or Forge Kerberos Tickets','stkerb','attack.t1558'),
    ('Steal Web Session Cookie','stwsc','attack.t1539'),
    #Discovery
    ('System Network Configuration Discovery', 'sncd', 'attack.t1016'),
    ('System Information Discovery', 'sid', 'attack.t1082'),
    ('Network Service Discovery', 'nsd', 'attack.t1046'),
    ('Account Discovery', 'ad', 'attack.t1087'),
    ('System Owner/User Discovery', 'sodisc', 'attack.t1033'),
    ('Remote System Discovery', 'rsdisc', 'attack.t1018'),
    ('System Network Configuration Discovery', 'sncdisc', 'attack.t1016'),
    ('System Network Connections Discovery', 'sncodisc', 'attack.t1049'),
    ('Permission Groups Discovery', 'pgdisc', 'attack.t1069'),
    ('Application Window Discovery', 'awdisc', 'attack.t1010'),
    ('Browser Bookmark Discovery', 'bbdisc', 'attack.t1217'),
    ('Cloud Infrastructure Discovery', 'cidisc', 'attack.t1580'),
    ('Cloud Service Dashboard', 'csdash', 'attack.t1538'),
    ('Cloud Service Discovery', 'csdisc', 'attack.t1526'),
    ('Cloud Storage Object Discovery', 'csodisc', 'attack.t1619'),
    ('Container and Resource Discovery', 'cardisc', 'attack.t1613'),
    ('Debugger Evasion', 'debeva', 'attack.t1622'),
    ('Domain Trust Discovery', 'dtdisc', 'attack.t1482'),
    ('File and Directory Discovery', 'faddisc', 'attack.t1083'),
    ('Group Policy Discovery', 'gpdisc', 'attack.t1615'),
    ('Password Policy Discovery', 'ppdisc', 'attack.t1201'),
    ('Peripheral Device Discovery', 'pddisc', 'attack.t1120'),
    ('Process Discovery', 'pdisc', 'attack.t1057'),
    ('Query Registry', 'qreg', 'attack.t1012'),
    ('Software Discocery', 'sdisc', 'attack.t1518'),
    ('System Time Discovery', 'stdisc', 'attack.t1124'),
    #Lateral Movement
    ('Exploitation of Remote Services', 'expors', 'attack.t1210' ),
    ('Internal Spearphishing', 'intspe', 'attack.t1534' ),
    ('Lateral Tool Transfer', 'lttr', 'attack.t1016'),
    ('Remote Service Session Hijacking', 'rsshij', 'attack.t1536'),
    ('Remote Services','remser','attack.t1021'),
    ('Replication Through Removable Media','rtrm', 'attack.t1091'),
    ('Software Deployment Tools', 'swdt', 'attack.t1072' ),
    ('Taint Shared Content', 'tscon', 'attack.t1080' ),
    #Collection
    ('Email Collection', 'emcol', 'attack.t1114'),
    ('Data from Local System', 'dfls', 'attack.t1005'),
    ('Automated Collection', 'acol', 'attack.t1119'),
    ('Screen Capture', 'scrcap', 'attack.t1113'),
    ('Clipboard Data', 'cldata', 'attack.t1115'),
    ('Data from Network Shared Drive', 'dfnsd', 'attack.t1039'),
    ('Archive Collected Data', 'arcd', 'attack.t1560'),
    ('Audio Capture', 'audcap', 'attack.t1123'),
    ('Browser Session Hijacking', 'brshij', 'attack.t1185'),
    ('Data from Cloud Storage', 'dfcs', 'attack.t1530'),
    ('Data from Configuration Repository', 'dfcr', 'attack.t1602'),
    ('Data from Information Repositories', 'dfir', 'attack.t1213'),
    ('Data from Local System', 'dfls', 'attack.t1005'),
    ('Data from Removable Media', 'dfrm', 'attack.t1025'),
    ('Data Staged', 'datsta', 'attack.t1074'),
    ('Input Capture', 'inpcap', 'attack.t1056'),
    ('Video Capture', 'vidcap', 'attack.t1125'),
    #Command and Control
    ('Application Layer Protocol', 'applp', 'attack.t1071'),
    ('Non-Application Layer Protocol', 'napplp', 'attack.t1095'),
    ('Proxy', 'proxy', 'attack.t1090'),
    ('Communication Through Removable Media', 'ctrmed', 'attack.t1092'),
    ('Data Encoding', 'datenc', 'attack.t1132'),
    ('Data Obfuscation', 'datobf', 'attack.t1001'),
    ('Dynamic Resolution', 'dynres', 'attack.t1568'),
    ('Encrypted Channel', 'encrc', 'attack.t1573'),
    ('Fallback Channels', 'fallch', 'attack.t1008'),
    ('Ingress Tool Transfer', 'ingttr', 'attack.t1105'),
    ('Multi-Stage Channels', 'mschan', 'attack.t1104'),
    ('Protocol Tunneling', 'prtunn', 'attack.t1572'),
    ('Remote Access Software', 'rasw', 'attack.t1205'),
    ('Web Service', 'webserv', 'attack.t1102'),
    #Exfiltration
    ('Automated Exfiltration', 'auexf', 'attack.t1020'),
    ('Exfiltration Over C2 Channel', 'exfoc2ch', 'attack.t1041'),
    ('Exfiltration Over Alternative Protocol', 'exfoap', 'attack.t1048'),
    ('Transfer Data to Cloud Account', 'trdtca', 'attack.t1537'),
    ('Exfiltration Over Physical Medium', 'exfopm', 'attack.t1052'),
    ('Data Transfer Size Limits', 'dtsl', 'attack.t1030'),
    ('Exfiltration Over Other Network Medium', 'exfoonm', 'attack.t1011'),
    ('Exfiltration Over Web Service', 'exfows', 'attack.t1567'),
    ('Scheduled Transfer', 'schtr', 'attack.t1029'),
    #Impact
    ('Endpoint Denial of Service', 'edos', 'attack.t1499'),
    ('Defacement', 'def', 'attack.t1491'),
    ('Data encrypted', 'dencr', 'attack.t1486'),
    ('Inhibit System Recovery', 'insr', 'attack.t1490'),
    ('Account Access Removal', 'acacre', 'attack.t1531'),
    ('Data Destruction', 'datdes', 'attack.t1485'),
    ('Data Manipulation', 'datman', 'attack.t1565'),
    ('Disk Wipe', 'dwipe', 'attack.t1561'),
    ('Firmware Corruption', 'fwcorr', 'attack.t1495'),
    ('Network Denial of Service', 'ndos', 'attack.t1498'),
    ('Resource Hijacking', 'rhij', 'attack.t1496'),
    ('Service Stop', 'serstop', 'attack.t1489'),
    ('System Shutdown/Reboot', 'syssh', 'attack.t1529')
]

# Create a new workbook and add a worksheet
workbook = xlsxwriter.Workbook('techniques.xlsx')
worksheet = workbook.add_worksheet()

# Define cell formats
header_format = workbook.add_format({'bold': True, 'align': 'center', 'valign': 'vcenter', 'border': True})
cell_format = workbook.add_format({'align': 'center', 'valign': 'vcenter', 'border': True})

# Write the headers
worksheet.write(0, 0, 'Technique', header_format)
worksheet.write(0, 1, 'Abbreviation', header_format)
worksheet.write(0, 2, 'Tag', header_format)

# Write the data
for i, row in enumerate(data):
    worksheet.write(i+1, 0, row[0], cell_format)
    worksheet.write(i+1, 1, row[1], cell_format)
    worksheet.write(i+1, 2, row[2], cell_format)

# Adjust the column widths
worksheet.set_column(0, 2, 25)

# Save the workbook
workbook.close()
