Carbanak

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system ove

Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gath

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Schedu

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is don

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools crea

Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://at

Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A to

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts pr

Carbanak is a full-featured, remote backdoor used by a group of the same name ([Carbanak](https://attack.mi

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT

netsh is a scripting utility used to interact with networking components on local or remote systems. (Citat