Confucius

Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this techn

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications chan

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow fo

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file s

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number. This can be done

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope

An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to cl

Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are sev

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environ

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run key

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple w

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a sp

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specifi

Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts. For example, Micros

Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows techn

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with exi

Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web

[WarzoneRAT](https://attack.mitre.org/software/S0670) is a malware-as-a-service remote access tool (RAT) written in C++ that has been publicly availab