Cinnamon Tempest

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries t

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense E

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow fo

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a

Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own fina

Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of e

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environ

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enabl

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and

Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SM

Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositorie

Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A to

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the prima

Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts pr

Cheerscrypt is a ransomware that was developed by Cinnamon Tempest

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation

HUI Loader is a custom DLL loader that has been used since at least 2015 by China-based threat groups inclu

Impacket is an open source collection of modules written in Python for programmatically constructing and ma

Pandora is a multistage kernel rootkit with backdoor functionality that has been in use by [Threat Group-33

PlugX is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.(Cita

Rclone is a command line program for syncing files with cloud storage services such as Dropbox, Google Driv

Sliver is an open source, cross-platform, red team command and control (C2) framework written in Golang. [S