NIMBUS MANTICORE

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves

Adversaries may execute their own malicious payloads by hijacking how the .NET `AppDomainManager` loads assemblies. The .NET framework uses the `AppDo

Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands

Adversaries may obtain access to generative artificial intelligence (AI) tools, such as large language models (LLMs), to aid various techniques during

Adversaries may create or manipulate audio, image, and video content to support targeting and malicious operations. Adversaries may also use synthetic

Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. Configuration settings as w

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense

Adversaries may buy and/or steal code signing certificates that can be used during targeting. Code signing is the process of digitally signing executa

Adversaries may use compression to obfuscate their payloads or files. Compressed file formats such as ZIP, gzip, 7z, and RAR can compress and archive

Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interfa

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries t

Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of informati

Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote system

Adversaries may employ various time-based methods to evade detection and analysis. These techniques often exploit system clocks, delays, or timing mec

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in fol

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense E

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a

Adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a

Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just

Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may

Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a m

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users,

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a sys

Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Ev

Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local s

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope

[CRASHPAD](https://attack.mitre.org/software/S9057) is a Windows executable written in C++ that gathers data from web browsers.(Citation: Mandiant_UNC

[DCSYNCER.SLICK](https://attack.mitre.org/software/S9065) is a Windows executable that is designed to gather credentials from victim devices.(Citation

[DEEPROOT](https://attack.mitre.org/software/S9063) is a Linux backdoor written in Golang.(Citation: Mandiant_UNC1549_Nov2025) [DEEPROOT](https://atta

[LIGHTRAIL](https://attack.mitre.org/software/S9061) is a tunneler malware.(Citation: Mandiant_UNC1549_Feb2024) [LIGHTRAIL](https://attack.mitre.org/s

[MiniBike](https://attack.mitre.org/software/S9059) is a custom backdoor written in C++ designed for command execution, data discovery, gathering, and

[MiniBrowse](https://attack.mitre.org/software/S9062) is a custom stealer designed for the theft of credentials in browsers and passwords stores. [Min

[MiniBus](https://attack.mitre.org/software/S9060) is a custom backdoor used for command execution, data discovery, gathering, and exfiltration. [Mini

[MiniFast](https://attack.mitre.org/software/S9052) is a custom malware designed for long-term persistence and remote code execution. [MiniFast](https

[MiniJunk](https://attack.mitre.org/software/S9053) is a custom malware designed for long-term persistence and remote code execution.(Citation: CheckP

[POLLBLEND](https://attack.mitre.org/software/S9066) is a Windows tunneler written C++ that has utilized hardcoded C2 servers and leveraged hardcoded

[SIGHTGRAB](https://attack.mitre.org/software/S9058) is a Windows executable written in C that captures and stages stolen data on victim devices.(Cita

[TRUSTTRAP](https://attack.mitre.org/software/S9064) is a malware that uses a fictitious prompt to trick users to submit their credentials.(Citation:

[TWOSTROKE](https://attack.mitre.org/software/S9067) is malicious backdoor written in C++ that is capable of discovery actions, executing payloads and