TA2541

Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections

Adversaries may use compression to obfuscate their payloads or files. Compressed file formats such as ZIP, gzip, 7z, and RAR can compress and archive

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detectio

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achie

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in nu

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope

An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to cl

Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is don

Adversaries may abuse mshta.exe to proxy execution of malicious.hta files and Javascript or VBScript through a trusted Windows utility. There are sev

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environ

Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a met

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run key

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple w

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a clo

Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a sp

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specifi

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and

Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A to

Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting. Malicious software can in

Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows techn

Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web

Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the

Agent Tesla is a spyware Trojan written for the.NET framework that has been observed since at least 2014.(

AsyncRAT is an open-source remote access tool originally available through the NYANxCAT Github repository t

Imminent Monitor was a commodity remote access tool (RAT) offered for sale from 2012 until 2019, when an op

NETWIRE is a publicly available, multiplatform remote administration tool (RAT) that has been used by crimi

njRAT is a remote access tool (RAT) that was first observed in 2012. It has been used by threat actors in t

Revenge RAT is a freely available remote access tool written in.NET (C#).(Citation: Cylance Shaheen Nov 20

Snip3 is a sophisticated crypter-as-a-service that has been used since at least 2021 to obfuscate and load

WarzoneRAT is a malware-as-a-service remote access tool (RAT) written in C++ that has been publicly availab

jRAT is a cross-platform, Java-based backdoor originally available for purchase in 2012. Variants of [jRAT]