Play

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, enc

Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notification

Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns wi

An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detectio

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense E

Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be se

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, an

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file s

Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own fina

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a

Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Ev

Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of p

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environ

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Later

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SM

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a clo

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through info

Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A to

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the prima

AdFind is a free command-line query tool that can be used for gathering information from Active Directory.(

BloodHound is an Active Directory (AD) reconnaissance tool that can reveal hidden relationships and identif

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation

Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publ

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

Nltest is a Windows command-line utility used to list domain controllers and enumerate domain trusts.(Citat

Playcrypt is a ransomware that has been used by Play since at leas

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT

Wevtutil is a Windows command-line utility that enables administrators to retrieve information about event