Chimera

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, enc

Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this techn

Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notification

Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns wi

Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasio

Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated wit

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries t

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with exi

Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote system

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in fol

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense E

Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts.

Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows mul

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications chan

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow fo

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, an

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file s

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., [Ingress T

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a sys

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files

Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local s

Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries dete

Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number. This can be done

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is don

Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that ca

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain

Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of ca

BloodHound is an Active Directory (AD) reconnaissance tool that can reveal hidden relationships and identif

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

The Net utility is a component of the Windows operating system. It is used in command-line operations for c

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT

esentutl is a command-line tool that provides database utilities for the Windows Extensible Storage Engine.