WIRTE

Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns wi

Adversaries may use compression to obfuscate their payloads or files. Compressed file formats such as ZIP, gzip, 7z, and RAR can compress and archive

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries t

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse

Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operation

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications chan

Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files

Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local s

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope

An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to cl

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is don

Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of ca

Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environ

Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a sp

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specifi

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based o

Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A to

Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting. Malicious software can in

Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows techn

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with exi

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the prima

AshTag is a modular.NET backdoor with multiple features that has been used by [WIRTE](https://attack.mitre

Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publ

Ferocious is a first stage implant composed of VBS and PowerShell scripts that has been used by [WIRTE](htt

Havoc is an open-source post-exploitation command and control (C2) framework first released on GitHub in Oc

IronWind is a custom loader malware that has been in use since at least 2023 by actors including [WIRTE](ht

LitePower is a downloader and second stage malware that has been used by [WIRTE](https://attack.mitre.org/g

Rclone is a command line program for syncing files with cloud storage services such as Dropbox, Google Driv

SameCoin is a multi-platform wiper with Windows and Android versions that has been used by [WIRTE](https://