FIN6

Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windo

An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data a

An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival

Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections

Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this techn

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a bi

Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns wi

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of intera

Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web bro

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may leverage databases to mine valuable information. These databases may be hosted on-premises or in the cloud (both in platform-as-a-serv

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detectio

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in fol

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The d

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversar

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Schedu

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vul

Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The l

Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environ

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enabl

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run key

Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The ad

AdFind is a free command-line query tool that can be used for gathering information from Active Directory.(

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation

FlawedAmmyy is a remote access tool (RAT) that was first seen in early 2016. The code for [FlawedAmmyy](htt

FrameworkPOS is a point of sale (POS) malware used by FIN6 to stea

GrimAgent is a backdoor that has been used before the deployment of [Ryuk](https://attack.mitre.org/softwar

LockerGoga is ransomware that was first reported in January 2019, and has been tied to various attacks on E

Maze ransomware, previously known as "ChaCha", was discovered in May 2019. In addition to encrypting files

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

More_eggs is a JScript backdoor used by Cobalt Group and [FIN6](ht

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT

Ryuk is a ransomware designed to target enterprise environments that has been used in attacks since at leas

Windows Credential Editor is a password dumping tool.