APT3

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains a

An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain. On Win

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, enc

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by use

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web bro

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries t

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense E

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications chan

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding

Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file s

Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be display

Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify t

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new ac

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a sys

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users,

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files

An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to cl

Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign. This will typically occur during [Crea

Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple

Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The l

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents

Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password

Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environ

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common

LaZagne is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modul

OSInfo is a custom tool used by APT3 to do internal discovery on a

PlugX is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.(Cita

RemoteCMD is a custom tool used by APT3 to execute commands on a r

SHOTPUT is a custom backdoor used by APT3. (Citation: FireEye Clan

schtasks is used to schedule execution of programs or scripts on a Windows system to run at a specific date