APT32

An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data a

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notification

Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns wi

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of intera

Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information th

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries t

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code

Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be

Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications chan

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The d

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversar

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file s

Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format ot

Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety o

Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files

Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be display

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just

Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does not execute, or if it does execut

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new ac

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a

Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., [Ingress T

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Anal

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a sys

Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Ev

Arp displays and modifies information about a system's Address Resolution Protocol (ARP) cache. (Citation:

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation

Denis is a Windows backdoor and Trojan used by APT32. [Denis](http

Goopy is a Windows backdoor and Trojan used by APT32 and shares se

KOMPROGO is a signature backdoor used by APT32 that is capable of

Kerrdown is a custom downloader that has been used by APT32 since

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

The Net utility is a component of the Windows operating system. It is used in command-line operations for c

OSX_OCEANLOTUS.D is a macOS backdoor used by APT32. First discover

PHOREAL is a signature backdoor used by APT32. (Citation: FireEye

RotaJakiro is a 64-bit Linux backdoor used by APT32. First seen in

SOUNDBITE is a signature backdoor used by APT32. (Citation: FireEy

WINDSHIELD is a signature backdoor used by APT32. (Citation: FireE

ipconfig is a Windows utility that can be used to find information about a system's TCP/IP, DNS, DHCP, and

netsh is a scripting utility used to interact with networking components on local or remote systems. (Citat