MoustachedBouncer

Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rath

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversar

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environ

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and

Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality m

Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or

[Disco](https://attack.mitre.org/software/S1088) is a custom implant that has been used by [MoustachedBouncer](https://attack.mitre.org/groups/G1019)

[NightClub](https://attack.mitre.org/software/S1090) is a modular implant written in C++ that has been used by [MoustachedBouncer](https://attack.mitr

[SharpDisco](https://attack.mitre.org/software/S1089) is a dropper developed in C# that has been used by [MoustachedBouncer](https://attack.mitre.org/