GALLIUM

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, enc

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a bi

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries t

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services wh

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications chan

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a

Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, an

Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify t

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a

Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., [Ingress T

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents

Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass th

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environ

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Later

Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple w

Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through

Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, a

Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through info

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is activel

Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A to

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openl

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the prima

BlackMould is a web shell based on China Chopper for servers run

China Chopper is a Web Shell hosted on Web servers to prov

HTRAN is a tool that proxies connections through intermediate hops and aids users in disguising their true

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

NBTscan is an open source tool that has been used by state groups to conduct internal reconnaissance within

The Net utility is a component of the Windows operating system. It is used in command-line operations for c

Ping is an operating system utility commonly used to troubleshoot and verify network connections. (Citation

PingPull is a remote access Trojan (RAT) written in Visual C++ that has been used by [GALLIUM](https://atta

PlugX is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.(Cita

PoisonIvy is a popular remote access tool (RAT) that has been used by many groups.(Citation: FireEye Poison

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT

Reg is a Windows utility used to interact with the Windows Registry. It can be used at the command-line int

Windows Credential Editor is a password dumping tool.

at is used to schedule tasks on a system to run at a specified date or time.(Citation

cmd is the Windows command-line interpreter that can be used to interact with systems and execute other pro

ipconfig is a Windows utility that can be used to find information about a system's TCP/IP, DNS, DHCP, and