Magic Hound

Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account. For example, the Ad

An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain. On Win

Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, enc

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system ove

In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an i

Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns wi

Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated wit

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense

Adversaries may gather the victim's physical location(s) that can be used during targeting. Information about physical locations of a target organizat

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detectio

Adversaries may disable or modify the Windows Event Log to limit data that can be leveraged for detections and audits. Windows Event Log records user

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense E

Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows mul

Adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registrat

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code

Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address li

Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their op

Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operation

Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email

Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information

Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a co

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file s

CharmPower is a PowerShell-based, modular backdoor that has been used by [Magic Hound](https://attack.mitre

DownPaper is a backdoor Trojan; its main functionality is to download and run second stage malware. (Citati

FRP, which stands for Fast Reverse Proxy, is an openly available tool that is capable of exposing a server

Impacket is an open source collection of modules written in Python for programmatically constructing and ma

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

The Net utility is a component of the Windows operating system. It is used in command-line operations for c

Ping is an operating system utility commonly used to troubleshoot and verify network connections. (Citation

PowerLess is a PowerShell-based modular backdoor that has been used by [Magic Hound](https://attack.mitre.o

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT

Pupy is an open source, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploi

Systeminfo is a Windows utility that can be used to gather detailed information about a computer. (Citation

ipconfig is a Windows utility that can be used to find information about a system's TCP/IP, DNS, DHCP, and

netsh is a scripting utility used to interact with networking components on local or remote systems. (Citat