Sowbug

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, enc

Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote system

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file s

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new ac

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is don

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Col

Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password.

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and

Adversaries may abuse the Windows command shell for execution. The Windows command shell ([cmd](https://attack.mitre.org/software/S0106)) is the prima

[Felismus](https://attack.mitre.org/software/S0171) is a modular backdoor that has been used by [Sowbug](https://attack.mitre.org/groups/G0054). (Cita

[Starloader](https://attack.mitre.org/software/S0188) is a loader component that has been observed loading [Felismus](https://attack.mitre.org/softwar