GOLD SOUTHFIELD

Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns wi

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compro

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, an

Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishi

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environ

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools crea

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality m

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses

ConnectWise is a legitimate remote administration tool that has been used since at least 2016 by threat act

REvil is a ransomware family that has been linked to the [GOLD SOUTHFIELD](https://attack.mitre.org/groups/