FIN7

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows A

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system ove

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a bi

Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns wi

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of intera

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compro

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with exi

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They

Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gath

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in fol

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries dete

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse

Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be

Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow fo

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerabi

Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable c

Adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a

Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files

Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be display

Adversaries may gather information about identities and roles within the victim organization that can be used during targeting. Information about busi

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries may simulate keystrokes on a victim’s computer by various means to perform any type of action on behalf of the user, such as launching the

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just

Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does not execute, or if it does execut

Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may

Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a m

AdFind is a free command-line query tool that can be used for gathering information from Active Directory.(

BOOSTWRITE is a loader crafted to be launched via abuse of the DLL search order of applications used by [FI

Carbanak is a full-featured, remote backdoor used by a group of the same name ([Carbanak](https://attack.mi

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation

CrackMapExec, or CME, is a post-exploitation tool developed in Python and designed for penetration testing

GRIFFON is a JavaScript backdoor used by FIN7. (Citation: SecureLi

HALFBAKED is a malware family consisting of multiple components intended to establish persistence in victim

JSS Loader is Remote Access Trojan (RAT) with.NET and C++ variants that has been used by [FIN7](https://at

Lizar is a modular remote access tool written using the.NET Framework that shares structural similarities

Maze ransomware, previously known as "ChaCha", was discovered in May 2019. In addition to encrypting files

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

POWERSOURCE is a PowerShell backdoor that is a heavily obfuscated and modified version of the publicly avai

Pillowmint is a point-of-sale malware used by FIN7 designed to cap

PowerSploit is an open source, offensive security framework comprised of [PowerShell](https://attack.mitre.

RDFSNIFFER is a module loaded by BOOSTWRITE which allows an atta

REvil is a ransomware family that has been linked to the [GOLD SOUTHFIELD](https://attack.mitre.org/groups/

SQLRat is malware that executes SQL scripts to avoid leaving traditional host artifacts. [FIN7](https://att

SystemBC is a malware family offered as a malware-as-a-service (MaaS) that is used to establish command and

TEXTMATE is a second-stage PowerShell backdoor that is memory-resident. It was observed being used along wi