Indrik Spider

Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notification

Adversaries may create an account to maintain access to victim systems. With a sufficient level of access,

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by use

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detectio

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense E

Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their op

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow fo

Adversaries may gather information about the victim's networks that can be used during targeting. Information about networks may include a variety of

Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of e

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just

Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users,

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope

Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of p

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is don

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution. Ac

Adversaries may acquire user credentials from third-party password managers. Password managers are appli

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environ

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. The Registry contai

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The ad

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Later

Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary ma

Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an

Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes

Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as wel

BitPaymer is a ransomware variant first observed in August 2017 targeting hospitals in the U.K. [BitPaymer]

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation

Donut is an open source framework used to generate position-independent shellcode.(

Dridex is a prolific banking Trojan that first appeared in 2014. By December 2019, the US Treasury estimate

Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publ

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT

WastedLocker is a ransomware family attributed to Indrik Spider th