Capability

In the Diamond Model, the corner for the attacker's tools and techniques, such as the macro, PowerShell, certutil and the scheduled task used against Sam.