Aquatic Panda

Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This inform

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, enc

In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an i

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notification

Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns wi

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries t

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detectio

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense E

Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the e

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a

Adversaries may enumerate system and service logs to find useful data. These logs may highlight various types of valuable insights for an adversary, s

Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Schedu

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is don

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution. Ac

Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass th

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environ

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The ad

Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet,

Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://at

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SM

Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary ma

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a clo

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is activel

Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as wel

Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A to

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation

njRAT is a remote access tool (RAT) that was first observed in 2012. It has been used by threat actors in t

ShadowPad is a modular backdoor that was first identified in a supply chain compromise of the NetSarang sof

Wevtutil is a Windows command-line utility that enables administrators to retrieve information about event

Winnti for Linux is a trojan, seen since at least 2015, designed specifically for targeting Linux systems.

Winnti for Windows is a modular remote access Trojan (RAT) that has been used likely by multiple groups to