LuminousMoth

Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices. Thi

An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data a

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a bi

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries t

An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They incl

Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications chan

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow fo

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file s

Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a m

An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to cl

Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise

Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of p

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is don

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution. Ac

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run key

Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage o

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple w

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specifi

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authentic

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is activel

Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A to

Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting. Malicious software can in

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with exi

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation

PlugX is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.(Cita