Naikon

Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Offic

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries t

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense E

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Schedu

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is don

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vul

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run key

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Later

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple w

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a clo

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a sp

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through info

Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the

Aria-body is a custom backdoor that has been used by Naikon since

HDoor is malware that has been customized and used by the Naikon g

Nebulae Is a backdoor that has been used by Naikon since at least

The Net utility is a component of the Windows operating system. It is used in command-line operations for c

Ping is an operating system utility commonly used to troubleshoot and verify network connections. (Citation

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT

RARSTONE is malware used by the Naikon group that has some charact

RainyDay is a backdoor tool that has been used by Naikon since at

SslMM is a full-featured backdoor used by Naikon that has multiple

Sys10 is a backdoor that was used throughout 2013 by Naikon. (Cita

Systeminfo is a Windows utility that can be used to gather detailed information about a computer. (Citation

The Tasklist utility displays a list of applications and services with their Process IDs (PID) for all task

WinMM is a full-featured, simple backdoor used by Naikon. (Citatio

ftp is a utility commonly available with operating systems to transfer information over the File Transfer P

netsh is a scripting utility used to interact with networking components on local or remote systems. (Citat