Scattered Spider

Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This inform

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves

An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example,

Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts

Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to expor

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense

An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This in

An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as s

Adversaries may log into accessible cloud services within a compromised environment using Valid Accounts

Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate s

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a bi

Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts. Conditional access policies are add

Adversaries may create an account to maintain access to victim systems. With a sufficient level of access,

An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses. Creating a new instanc

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by use

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one

Adversaries may access data from cloud storage. Many IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage,

Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to l

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detectio

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in fol

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries dete

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse

Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information

Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities

Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users to create inbox rules for vario

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications chan

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow fo

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversar

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, an

BlackCat is ransomware written in Rust that has been offered via the Ransomware-as-a-Service (RaaS) model.

ConnectWise is a legitimate remote administration tool that has been used since at least 2016 by threat act

LaZagne is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modul

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

.

Raccoon Stealer is an information stealer malware family active since at least 2019 as a malware-as-a-servi

Rclone is a command line program for syncing files with cloud storage services such as Dropbox, Google Driv

Tor is a software suite and network that provides increased anonymity on the Internet. It creates a multi-h

Vidar is a Windows infostealer that was first advertised in November 2018. Written in C++, [Vidar](https://

WarzoneRAT is a malware-as-a-service remote access tool (RAT) written in C++ that has been publicly availab

C0027 was a financially-motivated campaign linked to [Scattered Spider](https://attack.mitre.org/groups/G1