Turla

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, enc

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system ove

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: Trend

Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. Code signing provides a level of authenticity on a p

Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns wi

Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from an

Adversaries may leverage databases to mine valuable information. These databases may be hosted on-premises or in the cloud (both in platform-as-a-serv

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detectio

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in fol

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries dete

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code

Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. D

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow fo

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversar

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file s

Adversaries may attempt to hide their file-based artifacts by writing them to specific folders or file names excluded from antivirus (AV) scanning and

Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format ot

Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and

Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify t

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist

Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in nu

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just

Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., [Ingress T

Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a sys

Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Ev

Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries dete

Arp displays and modifies information about a system's Address Resolution Protocol (ARP) cache. (Citation:

Carbon is a sophisticated, second-stage backdoor and framework that can be used to steal sensitive informat

ComRAT is a second stage implant suspected of being a descendant of [Agent.btz](https://attack.mitre.org/so

Crutch is a backdoor designed for document theft that has been used by [Turla](https://attack.mitre.org/gro

Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publ

Epic is a backdoor that has been used by Turla. (Citation: Kaspers

Gazer is a backdoor used by Turla since at least 2016. (Citation:

HyperStack is a RPC-based backdoor used by Turla since at least 20

IronNetInjector is a Turla toolchain that utilizes scripts from th

KOPILUWAK is a JavaScript-based reconnaissance tool that has been used for victim profiling and C2 since at

Kazuar is a fully featured, multi-platform backdoor Trojan written using the Microsoft.NET framework. (Cit

LightNeuron is a sophisticated backdoor that has targeted Microsoft Exchange servers since at least 2014. [

LunarLoader is the loader component for the LunarWeb and [LunarM

LunarMail is a backdoor that has been used by Turla since at least

LunarWeb is a backdoor that has been used by Turla since at least

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

Mosquito is a Win32 backdoor that has been used by Turla. [Mosquit

NBTscan is an open source tool that has been used by state groups to conduct internal reconnaissance within

The Net utility is a component of the Windows operating system. It is used in command-line operations for c

Penquin is a remote access trojan (RAT) with multiple versions used by [Turla](https://attack.mitre.org/gro

PowerStallion is a lightweight PowerShell backdoor used by

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT

Reg is a Windows utility used to interact with the Windows Registry. It can be used at the command-line int

Systeminfo is a Windows utility that can be used to gather detailed information about a computer. (Citation

The Tasklist utility displays a list of applications and services with their Process IDs (PID) for all task

TinyTurla is a backdoor that has been used by Turla against target

Uroburos is a sophisticated cyber espionage tool written in C that has been used by units within Russia's F

certutil is a command-line utility that can be used to obtain certificate authority information and configu

nbtstat is a utility used to troubleshoot NetBIOS name resolution.

netstat is an operating system utility that displays active TCP connections, listening ports, and network s