Dragonfly

An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain. On Win

An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data a

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: Trend

Adversaries may gather information about the victim's business relationships that can be used during targeting. Information about an organization’s bu

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notification

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of intera

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compro

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gath

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in fol

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries dete

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code

Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerabi

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, an

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a

Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in w

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file s

Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in wh

Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are man

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different creden

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users,

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope

Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign. This will typically occur during [Crea

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution. Ac

Backdoor.Oldrea is a modular backdoor that used by Dragonfly again

CrackMapExec, or CME, is a post-exploitation tool developed in Python and designed for penetration testing

Impacket is an open source collection of modules written in Python for programmatically constructing and ma

MCMD is a remote access tool that provides remote command shell capability used by [Dragonfly](https://atta

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

The Net utility is a component of the Windows operating system. It is used in command-line operations for c

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT

Reg is a Windows utility used to interact with the Windows Registry. It can be used at the command-line int

Trojan.Karagany is a modular remote access tool used for recon and linked to [Dragonfly](https://attack.mit

netsh is a scripting utility used to interact with networking components on local or remote systems. (Citat