the exact implementations that known threat groups have used. For example, APT29 (Cozy Bear) has been observed using T1566.001 (Spearphishing Attachment) by sending emails with malicious PDF attachments exploiting Adobe Reader vulnerabilities.