Storm-1811

Adversaries may create accounts with cloud providers that can be used during targeting. Adversaries can use cloud accounts to further their operations

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries t

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in fol

Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows mul

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse

Adversaries may flood targeted email addresses with an overwhelming volume of messages. This may bury legitimate emails in a flood of spam and disrupt

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file

Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control ch

Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide cred

Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., [Ingress T

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope

Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign. This will typically occur during [Crea

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masqueradin

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is don

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environ

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run key

An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. De

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SM

Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary ma

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specifi

Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It i

Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a sp

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is activel

Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A to

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the prima

BITSAdmin is a command line tool used to create and manage [BITS Jobs](https://attack.mitre.org/techniques/

Black Basta is ransomware written in C++ that has been offered within the ransomware-as-a-service (RaaS) mo

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation

Impacket is an open source collection of modules written in Python for programmatically constructing and ma

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT

QakBot is a modular banking trojan that has been used primarily by financially-motivated actors since at le

Quick Assist is a remote assistance tool primarily for Microsoft Windows, although a macOS version also exi