Axiom

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains a

An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data a

Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting. A botnet is a network of compromised syste

Adversaries may set up their own Domain Name System (DNS) servers that can be used during targeting. During post-compromise activity, adversaries may

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password.

Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishi

Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment. Remote desktop is a common feature in opera

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The ad

Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques

Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating sy

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense

Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell

Derusbi is malware used by multiple Chinese APT groups.(Citation: ThreatConnect An

Hikit is malware that has been used by Axiom for late-stage persis

Hydraq is a data-theft trojan first used by Elderwood in the 2009

PlugX is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.(Cita

PoisonIvy is a popular remote access tool (RAT) that has been used by many groups.(Citation: FireEye Poison

Zox is a remote access tool that has been used by Axiom since at l

ZxShell is a remote administration tool and backdoor that can be downloaded from the Internet, particularly

gh0st RAT is a remote access tool (RAT). The source code is public and it has been used by multiple groups.