APT1

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, enc

Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this techn

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse

Adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registrat

Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their op

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a sys

Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local s

Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is don

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Col

Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass th

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The ad

Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credent

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a sp

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specifi

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through info

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems

Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as wel

Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A to

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the prima

BISCUIT is a backdoor that has been used by APT1 since as early as

CALENDAR is malware used by APT1 that mimics legitimate Gmail Cale

Cachedump is a publicly-available tool that program extracts cached password hashes from a system’s registr

GLOOXMAIL is malware used by APT1 that mimics legitimate Jabber/XM

Lslsass is a publicly-available tool that can dump active logon session password hashes from the lsass proc

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

The Net utility is a component of the Windows operating system. It is used in command-line operations for c

Pass-The-Hash Toolkit is a toolkit that allows an adversary to "pass" a password hash (without knowing the

PoisonIvy is a popular remote access tool (RAT) that has been used by many groups.(Citation: FireEye Poison

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT

Seasalt is malware that has been linked to APT1's 2010 operations.

The Tasklist utility displays a list of applications and services with their Process IDs (PID) for all task

WEBC2 is a family of backdoor malware used by APT1 as early as Jul

gsecdump is a publicly-available credential dumper used to obtain password hashes and LSA secrets from Wind

ipconfig is a Windows utility that can be used to find information about a system's TCP/IP, DNS, DHCP, and

pwdump is a credential dumper.

xCmd is an open source tool that is similar to PsExec and allows