Akira

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, enc

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functiona

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detectio

Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows mul

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow fo

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, an

Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own fina

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is don

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environ

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools crea

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The ad

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Later

Adversaries may leverage the SharePoint repository as a source to mine valuable information.(Citation: Information architecture guidance for SharePoin

Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.or

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense

AdFind is a free command-line query tool that can be used for gathering information from Active Directory.(

Akira ransomware, written in C++, is most prominently (but not exclusively) associated with the ransomware-

Akira _v2 is a Rust-based variant of Akira ransomware that has b

LaZagne is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modul

Megazord is a Rust-based variant of Akira ransomware that has be

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT

Rclone is a command line program for syncing files with cloud storage services such as Dropbox, Google Driv