Updated December 19th CISA advisory (retrieved from https://us-cert.cisa.gov/sites/default/files/publications/AA20-352A.stix.xml via https://twitter.com/kr3at)
Initial Access - Supply Chain Compromise - T1195
Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system. Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals.
Execution - Service Execution - T1035
Adversaries may execute a binary, command, or script via a method that interacts with Windows services, such as the Service Control Manager. This can be done by either creating a new service or modifying an existing service.