Threat Group-3390

An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive dat

Adversaries may abuse the at utility to perform task scheduling for initial or recurring execution of malic

Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this techn

Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its priv

Adversaries may buy and/or steal code signing certificates that can be used during targeting. Code signing is the process of digitally signing executa

Adversaries may use compression to obfuscate their payloads or files. Compressed file formats such as ZIP, gzip, 7z, and RAR can compress and archive

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compro

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries t

An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They

Adversaries may disable or modify the Windows Event Log to limit data that can be leveraged for detections and audits. Windows Event Log records user

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code

Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow fo

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversar

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerabi

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, an

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new ac

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different creden

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a sys

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope

ASPXSpy is a Web shell. It has been modified by Threat Group-3390

China Chopper is a Web Shell hosted on Web servers to prov

Clambling is a modular backdoor written in C++ that has been used by [Threat Group-3390](https://attack.mit

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation

HTTPBrowser is malware that has been used by several threat groups. (Citation: ThreatStream Evasion Analysi

HyperBro is a custom in-memory backdoor used by Threat Group-3390.

Impacket is an open source collection of modules written in Python for programmatically constructing and ma

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

NBTscan is an open source tool that has been used by state groups to conduct internal reconnaissance within

The Net utility is a component of the Windows operating system. It is used in command-line operations for c

Pandora is a multistage kernel rootkit with backdoor functionality that has been in use by [Threat Group-33

PlugX is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.(Cita

RCSession is a backdoor written in C++ that has been in use since at least 2018 by [Mustang Panda](https://

SysUpdate is a backdoor written in C++ that has been used by [Threat Group-3390](https://attack.mitre.org/g

Systeminfo is a Windows utility that can be used to gather detailed information about a computer. (Citation

The Tasklist utility displays a list of applications and services with their Process IDs (PID) for all task

Windows Credential Editor is a password dumping tool.

ZxShell is a remote administration tool and backdoor that can be downloaded from the Internet, particularly

certutil is a command-line utility that can be used to obtain certificate authority information and configu

gh0st RAT is a remote access tool (RAT). The source code is public and it has been used by multiple groups.

gsecdump is a publicly-available credential dumper used to obtain password hashes and LSA secrets from Wind

ipconfig is a Windows utility that can be used to find information about a system's TCP/IP, DNS, DHCP, and

netstat is an operating system utility that displays active TCP connections, listening ports, and network s

pwdump is a credential dumper.