DarkHydrus

Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in wh

Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be display

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environ

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a sp

Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts. For example, Micros

Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A to

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

RogueRobin is a payload used by DarkHydrus that has been developed