APT39

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynami

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, enc

Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting

Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BI

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system ove

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: Trend

Adversaries may collect data stored in the clipboard from users copying information within or between applications. For example, on Windows adversar

Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. Code signing provides a level of authenticity on a p

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of intera

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with exi

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications chan

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a

Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file s

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide cred

Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new ac

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users,

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope

An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to cl

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is don

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vul

ASPXSpy is a Web shell. It has been modified by Threat Group-3390

Cadelspy is a backdoor that has been used by APT39.(Citation: Syma

CrackMapExec, or CME, is a post-exploitation tool developed in Python and designed for penetration testing

MechaFlounder is a python-based remote access tool (RAT) that has been used by [APT39](https://attack.mitre

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

NBTscan is an open source tool that has been used by state groups to conduct internal reconnaissance within

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT

Remexi is a Windows-based Trojan that was developed in the C programming language.(Citation: Securelist Rem

Windows Credential Editor is a password dumping tool.

ftp is a utility commonly available with operating systems to transfer information over the File Transfer P

pwdump is a credential dumper.