Ember Bear

Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and

An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data a

Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this techn

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: Trend

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by use

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with exi

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense

Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large n

Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information

Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to bui

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow fo

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerabi

Adversaries may buy, steal, or download exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to c

An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or us

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, an

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different creden

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a

Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., [Ingress T

Adversaries may enumerate system and service logs to find useful data. These logs may highlight various types of valuable insights for an adversary, s

Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masqueradin

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is don

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution. Ac

Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last p

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vul

Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The l

BloodHound is an Active Directory (AD) reconnaissance tool that can reveal hidden relationships and identif

CrackMapExec, or CME, is a post-exploitation tool developed in Python and designed for penetration testing

Impacket is an open source collection of modules written in Python for programmatically constructing and ma

.

P.A.S. Webshell is a publicly available multifunctional PHP webshell in use since at least 2016 that provid

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT

Rclone is a command line program for syncing files with cloud storage services such as Dropbox, Google Driv

Responder is an open source tool used for LLMNR, NBT-NS and MDNS poisoning, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporti

Saint Bot is a.NET downloader that has been used by Saint Bear si

WhisperGate is a multi-stage wiper designed to look like ransomware that has been used against multiple gov

reGeorg is an open-source web shell written in Python that can be used as a proxy to bypass firewall rules