menuPass

An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data a

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, enc

Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this techn

In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an i

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a bi

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries t

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to

Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote system

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in fol

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerabi

Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections

Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain res

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file s

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad

Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for in

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new ac

Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different creden

Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masqueradin

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is don

Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain

Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of ca

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vul

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environ

AdFind is a free command-line query tool that can be used for gathering information from Active Directory.(

ChChes is a Trojan that appears to be used exclusively by menuPass

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation

Ecipekac is a multi-layer loader that has been used by menuPass si

EvilGrab is a malware family with common reconnaissance capabilities. It has been deployed by [menuPass](ht

FYAnti is a loader that has been used by menuPass since at least 2

HUI Loader is a custom DLL loader that has been used since at least 2015 by China-based threat groups inclu

Impacket is an open source collection of modules written in Python for programmatically constructing and ma

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

The Net utility is a component of the Windows operating system. It is used in command-line operations for c

P8RAT is a fileless malware used by menuPass to download and execu

Ping is an operating system utility commonly used to troubleshoot and verify network connections. (Citation

PlugX is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.(Cita

PoisonIvy is a popular remote access tool (RAT) that has been used by many groups.(Citation: FireEye Poison

PowerSploit is an open source, offensive security framework comprised of [PowerShell](https://attack.mitre.

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT

QuasarRAT is an open-source, remote access tool that has been publicly available on GitHub since at least 2

RedLeaves is a malware family used by menuPass. The code overlaps

SNUGRIDE is a backdoor that has been used by menuPass as first sta

SodaMaster is a fileless malware used by menuPass to download and

UPPERCUT is a 32-bit HTTP-based backdoor that has been used by [menuPass](https://attack.mitre.org/groups/G

certutil is a command-line utility that can be used to obtain certificate authority information and configu

cmd is the Windows command-line interpreter that can be used to interact with systems and execute other pro

esentutl is a command-line tool that provides database utilities for the Windows Extensible Storage Engine.

pwdump is a credential dumper.