APT5

An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain. On Win

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, enc

Adversaries may buy, lease, or rent a network of compromised systems that can be used during targeting. A botnet is a network of compromised systems t

In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an i

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense

Adversaries may modify host software binaries to establish persistent access to systems. Software binaries/executables provide a wide range of system

Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code.(Citation: 20 macO

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detectio

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense E

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file s

Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new ac

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users,

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files

Adversaries may enumerate system and service logs to find useful data. These logs may highlight various types of valuable insights for an adversary, s

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is don

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environ

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a met

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The ad

Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary ma

Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems

Adversaries may modify file time attributes to hide new files or changes to existing files. Timestomping is a technique that modifies the timestamps o

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openl

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the prima

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

The Net utility is a component of the Windows operating system. It is used in command-line operations for c

PACEMAKER is a credential stealer that was used by APT5 as early a

PULSECHECK is a web shell written in Perl that was used by APT5 as

PcShare is an open source remote access tool that has been modified and used by Chinese threat actors, most

PoisonIvy is a popular remote access tool (RAT) that has been used by many groups.(Citation: FireEye Poison

RAPIDPULSE is a web shell that exists as a modification to a legitimate Pulse Secure file that has been use

SLIGHTPULSE is a web shell that was used by APT5 as early as 2020

SLOWPULSE is a malware that was used by APT5 as early as 2020 incl

Skeleton Key is malware used to inject false credentials into domain controllers with the intent of creatin

The Tasklist utility displays a list of applications and services with their Process IDs (PID) for all task

gh0st RAT is a remote access tool (RAT). The source code is public and it has been used by multiple groups.

netstat is an operating system utility that displays active TCP connections, listening ports, and network s

SPACEHOP Activity is conducted through commercially leased Virtual Private Servers (VPS), otherwise known