Add T1210 (source: Ofélia Malheiros)

[pbjason9]

I saw you included end user attack, through phishing.
If you believe it is proper, what do you think about including T1210 "Exploitation of Remote Services"? It can be used to explore software, network and privileged account management vulnerabilities.