Velvet Ant

Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands

Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries t

Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be e

Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gath

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detectio

Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored compone

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, an

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file s

Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist

Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., [Ingress T

Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Ev

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is don

Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network

Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a met

Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s startup. These files allow system admini

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SM

Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (servic

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, tho

Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the

Impacket is an open source collection of modules written in Python for programmatically constructing and ma

PlugX is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.(Cita