Darkhotel

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a bi

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file s

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new ac

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is don

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run key

Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage o

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a clo

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a sp

Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections p

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based o

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through info

An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such a

Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositorie

Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. This may include changing behaviors

Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the re

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the prima