APT29

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains a

Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account. For example, the Ad

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functiona

Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email No

Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its priv

Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature

Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remot

Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish

Adversaries may compromise cloud accounts that can be used during targeting. Adversaries can use compromised cloud accounts to further their operation

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense

Adversaries may abuse cloud management services to execute commands within virtual machines. Resources such as AWS Systems Manager, Azure RunCommand,

Adversaries may log into accessible cloud services within a compromised environment using Valid Accounts

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which ha

Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They in

An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection

Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achie

Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operation

Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a co

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversar

Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, an

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a

Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. HTML documents can sto

Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure. This can be accomplished by identifying an

Adversaries may patch, modify, or otherwise backdoor cloud authentication processes that are tied to on-premises user identities in order to bypass ty

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

AADInternals is a PowerShell-based framework for administering, enumerating, and exploiting Azure Active Di

AdFind is a free command-line query tool that can be used for gathering information from Active Directory.(

BloodHound is an Active Directory (AD) reconnaissance tool that can reveal hidden relationships and identif

BoomBox is a downloader responsible for executing next stage components that has been used by [APT29](https

CloudDuke is malware that was used by APT29 in 2015. (Citation: F-

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation

CosmicDuke is malware that was used by APT29 from 2010 to 2015. (C

CozyCar is malware that was used by APT29 from 2010 to 2015. It is

EnvyScout is a dropper that has been used by APT29 since at least

FatDuke is a backdoor used by APT29 since at least 2016.(Citation:

FoggyWeb is a passive and highly-targeted backdoor capable of remotely exfiltrating sensitive information f

GeminiDuke is malware that was used by APT29 from 2009 to 2012. (C

GoldFinder is a custom HTTP tracer tool written in Go that logs the route a packet takes between a compromi

GoldMax is a second-stage C2 backdoor written in Go with Windows and Linux variants that are nearly identic

HAMMERTOSS is a backdoor that was used by APT29 in 2015. (Citation

Impacket is an open source collection of modules written in Python for programmatically constructing and ma

LiteDuke is a third stage backdoor that was used by APT29, primari

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

MiniDuke is malware that was used by APT29 from 2010 to 2015. The

NativeZone is the name given collectively to disposable custom [Cobalt Strike](https://attack.mitre.org/sof

The Net utility is a component of the Windows operating system. It is used in command-line operations for c

OnionDuke is malware that was used by APT29 from 2013 to 2015. (Ci

POSHSPY is a backdoor that has been used by APT29 since at least 2

PinchDuke is malware that was used by APT29 from 2008 to 2010. (Ci

PolyglotDuke is a downloader that has been used by APT29 since at

PowerDuke is a backdoor that was used by APT29 in 2016. It has pri

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT

QUIETEXIT is a novel backdoor, based on the open-source Dropbear SSH client-server software, that has been

ROADTools is a framework for enumerating Azure Active Directory environments. The tool is written in Python

Raindrop is a loader used by APT29 that was discovered on some vic

Operation Ghost was an APT29 campaign starting in 2013 that inclu

The SolarWinds Compromise was a sophisticated supply chain cyber operation conducted by [APT29](https://at