sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
Uroburos can use a custom HTTP-based protocol for large data communications that can blend with normal network traffic by riding on top of standard HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Ursnif has used HTTPS for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
VBShower has attempted to obtain a VBS script from command and control (C2) nodes over HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
VERMIN uses HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Valak has used HTTP in communications with C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
VaporRage can use HTTP to download shellcode from compromised websites.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Vasport creates a backdoor by making a connection using a HTTP POST.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
WIREFIRE can respond to specific HTTP `POST` requests to `/api/v1/cav/client/visits`.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
WellMess can use HTTP and HTTPS in C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
WhisperGate can make an HTTPS connection to download additional files.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
WinMM uses HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
WindTail has the ability to use HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Winnti for Linux has used HTTP in outbound communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Winnti for Windows has the ability to use encapsulated HTTP/S in C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Woody RAT can communicate with its C2 server using HTTP requests.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Xbash uses HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
YAHOYAH uses HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
ZLib communicates over HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Zebrocy uses HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
ZeroT has used HTTP for C2.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
Zeus Panda uses HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
ZxShell has used HTTP for C2 connections.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
down_new has the ability to use HTTP in C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
httpclient uses HTTP for command and control.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
metaMain can use HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
njRAT has used HTTP for C2 communications.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
pngdowner uses HTTP for command and control.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
xCaon has communicated with the C2 server by sending POST requests over HTTP.
Technique: T1071.001 Application Layer Protocol: Web Protocols, Tactic: TA0011 Command and Control
During Operation Honeybee, the threat actors had the ability to use FTP for C2.
Technique: T1071.002 Application Layer Protocol: File Transfer Protocols, Tactic: TA0011 Command and Control
APT41 used exploit payloads that initiate download via ftp.
Technique: T1071.002 Application Layer Protocol: File Transfer Protocols, Tactic: TA0011 Command and Control
Dragonfly has used SMB for C2.
Technique: T1071.002 Application Layer Protocol: File Transfer Protocols, Tactic: TA0011 Command and Control
Kimsuky has used FTP to download additional malware to the target machine.
Technique: T1071.002 Application Layer Protocol: File Transfer Protocols, Tactic: TA0011 Command and Control
SilverTerrier uses FTP for C2 communications.
Technique: T1071.002 Application Layer Protocol: File Transfer Protocols, Tactic: TA0011 Command and Control
Attor has used FTP protocol for C2 communication.
Technique: T1071.002 Application Layer Protocol: File Transfer Protocols, Tactic: TA0011 Command and Control
BADHATCH can emulate an FTP server to connect to actor-controlled C2 servers.
Technique: T1071.002 Application Layer Protocol: File Transfer Protocols, Tactic: TA0011 Command and Control
CARROTBALL has the ability to use FTP in C2 communications.
Technique: T1071.002 Application Layer Protocol: File Transfer Protocols, Tactic: TA0011 Command and Control
Cobalt Strike can conduct peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.
Technique: T1071.002 Application Layer Protocol: File Transfer Protocols, Tactic: TA0011 Command and Control
Disco can use SMB to transfer files.
Technique: T1071.002 Application Layer Protocol: File Transfer Protocols, Tactic: TA0011 Command and Control
JPIN can communicate over FTP.
Technique: T1071.002 Application Layer Protocol: File Transfer Protocols, Tactic: TA0011 Command and Control
Kazuar uses FTP and FTPS to communicate with the C2 server.
Technique: T1071.002 Application Layer Protocol: File Transfer Protocols, Tactic: TA0011 Command and Control
Machete uses FTP for Command & Control.
Technique: T1071.002 Application Layer Protocol: File Transfer Protocols, Tactic: TA0011 Command and Control
Mythic supports SMB-based peer-to-peer C2 profiles.
Technique: T1071.002 Application Layer Protocol: File Transfer Protocols, Tactic: TA0011 Command and Control
NOKKI has used FTP for C2 communications.
Technique: T1071.002 Application Layer Protocol: File Transfer Protocols, Tactic: TA0011 Command and Control
PoetRAT has used FTP for C2 communications.
Technique: T1071.002 Application Layer Protocol: File Transfer Protocols, Tactic: TA0011 Command and Control
The Regin malware platform supports many standard protocols, including SMB.
Technique: T1071.002 Application Layer Protocol: File Transfer Protocols, Tactic: TA0011 Command and Control
SYSCON has the ability to use FTP in C2 communications.
Technique: T1071.002 Application Layer Protocol: File Transfer Protocols, Tactic: TA0011 Command and Control
ShadowPad has used FTP for C2 communications.
Technique: T1071.002 Application Layer Protocol: File Transfer Protocols, Tactic: TA0011 Command and Control
SharpDisco has the ability to transfer data between SMB shares.
Technique: T1071.002 Application Layer Protocol: File Transfer Protocols, Tactic: TA0011 Command and Control
XAgentOSX contains the ftpUpload function to use the FTPManager:uploadFile method to upload files from the target system.
Technique: T1071.002 Application Layer Protocol: File Transfer Protocols, Tactic: TA0011 Command and Control
ZxShell has used FTP for C2 connections.
Technique: T1071.002 Application Layer Protocol: File Transfer Protocols, Tactic: TA0011 Command and Control
APT28 has used IMAP, POP3, and SMTP for a communication channel in various implants, including using self-registered Google Mail accounts and later compromised email servers of its victims.
Technique: T1071.003 Application Layer Protocol: Mail Protocols, Tactic: TA0011 Command and Control
APT32 has used email for C2 via an Office macro.
Technique: T1071.003 Application Layer Protocol: Mail Protocols, Tactic: TA0011 Command and Control
Kimsuky has used e-mail to send exfiltrated data to C2 servers.
Technique: T1071.003 Application Layer Protocol: Mail Protocols, Tactic: TA0011 Command and Control
SilverTerrier uses SMTP for C2 communications.
Technique: T1071.003 Application Layer Protocol: Mail Protocols, Tactic: TA0011 Command and Control
Turla has used multiple backdoors which communicate with a C2 server via email attachments.
Technique: T1071.003 Application Layer Protocol: Mail Protocols, Tactic: TA0011 Command and Control
Agent Tesla has used SMTP for C2 communications.
Technique: T1071.003 Application Layer Protocol: Mail Protocols, Tactic: TA0011 Command and Control
BadPatch uses SMTP for C2.
Technique: T1071.003 Application Layer Protocol: Mail Protocols, Tactic: TA0011 Command and Control
Various implementations of CHOPSTICK communicate with C2 over SMTP and POP3.
Technique: T1071.003 Application Layer Protocol: Mail Protocols, Tactic: TA0011 Command and Control
CORESHELL can communicate over SMTP and POP3 for C2.
Technique: T1071.003 Application Layer Protocol: Mail Protocols, Tactic: TA0011 Command and Control
Cannon uses SMTP/S and POP3/S for C2 communications by sending and receiving emails.
Technique: T1071.003 Application Layer Protocol: Mail Protocols, Tactic: TA0011 Command and Control
ComRAT can use email attachments for command and control.
Technique: T1071.003 Application Layer Protocol: Mail Protocols, Tactic: TA0011 Command and Control
Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.
Technique: T1071.003 Application Layer Protocol: Mail Protocols, Tactic: TA0011 Command and Control
JPIN can send email over SMTP.
Technique: T1071.003 Application Layer Protocol: Mail Protocols, Tactic: TA0011 Command and Control
LightNeuron uses SMTP for C2.
Technique: T1071.003 Application Layer Protocol: Mail Protocols, Tactic: TA0011 Command and Control
NavRAT uses the email platform, Naver, for C2 communications, leveraging SMTP.
Technique: T1071.003 Application Layer Protocol: Mail Protocols, Tactic: TA0011 Command and Control
NightClub can use emails for C2 communications.
Technique: T1071.003 Application Layer Protocol: Mail Protocols, Tactic: TA0011 Command and Control
OLDBAIT can use SMTP for C2.
Technique: T1071.003 Application Layer Protocol: Mail Protocols, Tactic: TA0011 Command and Control
RDAT can use email attachments for C2 communications.
Technique: T1071.003 Application Layer Protocol: Mail Protocols, Tactic: TA0011 Command and Control
Remsec is capable of using SMTP for C2.
Technique: T1071.003 Application Layer Protocol: Mail Protocols, Tactic: TA0011 Command and Control
A SUGARDUMP variant used SMTP for C2.
Technique: T1071.003 Application Layer Protocol: Mail Protocols, Tactic: TA0011 Command and Control
Uroburos can use custom communications protocols that ride over SMTP.
Technique: T1071.003 Application Layer Protocol: Mail Protocols, Tactic: TA0011 Command and Control
Zebrocy uses SMTP and POP3 for C2.
Technique: T1071.003 Application Layer Protocol: Mail Protocols, Tactic: TA0011 Command and Control
During Cutting Edge, threat actors used DNS to tunnel IPv4 C2 traffic.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
APT18 uses DNS for C2 communications.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
APT39 has used remote access tools that leverage DNS in communications with C2.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
APT41 used DNS for C2 communications.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Chimera has used Cobalt Strike to encapsulate C2 in DNS traffic.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Cobalt Group has used DNS tunneling for C2.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
FIN7 has performed C2 using DNS via A, OPT, and TXT records.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Ke3chang malware RoyalDNS has used DNS for C2.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
LazyScripter has leveraged dynamic DNS providers for C2 communications.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
OilRig has used DNS for C2 including the publicly available `requestbin.net` tunneling service.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Tropic Trooper's backdoor has communicated to the C2 over the DNS protocol.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Variants of Anchor can use DNS tunneling to communicate with C2.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
BONDUPDATER can use DNS and TXT records within its DNS tunneling protocol for command and control.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Brute Ratel C4 can use DNS over HTTPS for C2.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Cobalt Strike can use a custom command and control protocol that can be encapsulated in DNS. All protocols use their standard assigned ports.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Cobian RAT uses DNS for C2.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
DanBot can use use IPv4 A records and IPv6 AAAA DNS records in C2 communications.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
DarkGate can cloak command and control traffic in DNS records from legitimate services to avoid reputation-based detection techniques.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Denis has used DNS tunneling for C2 communications.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
DnsSystem  can direct queries to custom DNS servers and return C2 commands using TXT records.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Ebury has used DNS requests over UDP port 53 for C2.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Gelsemium has the ability to use DNS in communication with C2.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Goopy has the ability to communicate with its C2 over DNS.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Green Lambert can use DNS for C2 communications.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
HTTPBrowser has used DNS for command and control.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Helminth can use DNS for C2.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Heyoka Backdoor can use DNS tunneling for C2 communications.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
InvisiMole has used a custom implementation of DNS tunneling to embed C2 communications in DNS requests and replies.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Variants of Kevin can communicate over DNS through queries to the server for constructed domain names with embedded information.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Matryoshka uses DNS for C2.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Milan has the ability to use DNS for C2 communications.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Mori can use DNS tunneling to communicate with C2.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Mythic supports DNS-based C2 profiles.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
NanHaiShu uses DNS for the C2 communications.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
NightClub can use a DNS tunneling plugin to exfiltrate data by adding it to the subdomain portion of a DNS request.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
POWERSOURCE uses DNS TXT records for C2.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
POWRUNER can use DNS for C2 communications.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Pisloader uses DNS as its C2 protocol.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
PlugX can be configured to use DNS for command and control.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
QUADAGENT uses DNS for C2 communications.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
RDAT has used DNS to communicate with the C2.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Remsec is capable of using DNS for C2.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
SOUNDBITE communicates via DNS for C2.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
SUNBURST used DNS for C2 traffic designed to mimic normal SolarWinds API communications.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
ShadowPad has used DNS tunneling for C2 communications.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Shark can use DNS in C2 communications.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Sliver can support C2 communications over DNS.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
SombRAT can communicate over DNS with the C2 server.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
SysUpdate has used DNS TXT requests as for its C2 communication.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
TEXTMATE uses DNS TXT records for C2.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
Uroburos has encoded outbound C2 communications in DNS requests consisting of character strings made to resemble standard domain names. The actual information transmitted by Uroburos is contained in the part of the character string prior to the first ‘.’ character.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
WellMess has the ability to use DNS tunneling for C2 communications.
Technique: T1071.004 Application Layer Protocol: DNS, Tactic: TA0011 Command and Control
During C0018, the threat actors used PDQ Deploy to move AvosLocker and tools across the network.
Technique: T1072 Software Deployment Tools, Tactic: TA0002 Execution TA0008 Lateral Movement
APT32 compromised McAfee ePO to move laterally by distributing malware as a software deployment task.
Technique: T1072 Software Deployment Tools, Tactic: TA0002 Execution TA0008 Lateral Movement
Sandworm Team has used the commercially available tool RemoteExec for agentless remote code execution.
Technique: T1072 Software Deployment Tools, Tactic: TA0002 Execution TA0008 Lateral Movement
Silence has used RAdmin, a remote software tool used to remotely control workstations and ATMs.
Technique: T1072 Software Deployment Tools, Tactic: TA0002 Execution TA0008 Lateral Movement
Threat Group-1314 actors used a victim's endpoint management platform, Altiris, for lateral movement.
Technique: T1072 Software Deployment Tools, Tactic: TA0002 Execution TA0008 Lateral Movement
It is believed that a patch management system for an anti-virus product commonly installed among targeted companies was used to distribute the Wiper malware.
Technique: T1072 Software Deployment Tools, Tactic: TA0002 Execution TA0008 Lateral Movement
Scattered Spider stages data in a centralized database prior to exfiltration.
Technique: T1074 Data Staged, Tactic: TA0009 Collection
Volt Typhoon has staged collected data in password-protected archives.
Technique: T1074 Data Staged, Tactic: TA0009 Collection
Wizard Spider has collected and staged credentials and network enumeration information, using  the networkdll and psfin TrickBot modules.
Technique: T1074 Data Staged, Tactic: TA0009 Collection
Kevin can create directories to store logs and other collected data.
Technique: T1074 Data Staged, Tactic: TA0009 Collection
Kobalos can write captured SSH connection credentials to a file under the `/var/run` directory with a `.pid` extension for exfiltration.
Technique: T1074 Data Staged, Tactic: TA0009 Collection
QUIETCANARY has the ability to stage data prior to exfiltration.
Technique: T1074 Data Staged, Tactic: TA0009 Collection
Shark has stored information in folders named `U1` and `U2` prior to exfiltration.
Technique: T1074 Data Staged, Tactic: TA0009 Collection
During C0015, PowerView's file share enumeration results were stored in the file `c:\ProgramData\found_shares.txt`.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
During C0017, APT41 copied the local `SAM` and `SYSTEM` Registry hives to a staging directory.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
During the C0032 campaign, TEMP.Veles used staging folders that are infrequently used by legitimate users or processes to store data for exfiltration and tool deployment.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
During Operation Honeybee, stolen data was copied into a text file using the format `From <COMPUTER-NAME> (<Month>-<Day> <Hour>-<Minute>-<Second>).txt` prior to compression, encoding, and exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
During Operation Wocao, threat actors staged archived files in a temporary directory prior to exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
APT28 has stored captured credential information in a file named pi.log.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
APT3 has been known to stage files for exfiltration in a single location.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
APT39 has utilized tools to aggregate data prior to exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
APT5 has staged data on compromised systems prior to exfiltration often in `C:\Users\Public`.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
BackdoorDiplomacy has copied files of interest to the main drive's recycle bin.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Chimera has staged stolen data locally on compromised hosts.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Dragonfly has created a directory named "out" in the user's %AppData% folder and copied files to it.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
FIN13 has utilized the following temporary folders on compromised Windows and Linux systems for their operations prior to exfiltration: `C:\Windows\Temp` and `/tmp`.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
FIN5 scripts save memory dump data into a specific directory on hosts in the victim environment.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
GALLIUM compressed and staged files in multi-part archives in the Recycle Bin prior to exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Indrik Spider has stored collected date in a .tmp file.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Kimsuky has staged collected data files under `C:\Program Files\Common Files\System\Ole DB\`.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Leviathan has used C:\Windows\Debug and C:\Perflogs as staging directories.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
MuddyWater has stored a decoy PDF file within a victim's `%temp%` folder.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Mustang Panda has stored collected credential files in `c:\windows\temp` prior to exfiltration. Mustang Panda has also stored documents for exfiltration in a hidden folder on USB drives.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Patchwork copied all targeted files to a directory called index that was eventually uploaded to the C&C server.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Sidewinder has collected stolen files in a temporary folder in preparation for exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
TeamTNT has aggregated collected credentials in text files before exfiltrating.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Threat Group-3390 has locally staged encrypted archives for later exfiltration efforts.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Volt Typhoon has saved stolen files including the ntds.dit database and the `SYSTEM` and `SECURITY` Registry hives locally to the `C:\Windows\Temp\` directory.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Wizard Spider has staged ZIP files in local directories such as, `C:\PerfLogs\1\` and `C:\User\1\` prior to exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
menuPass stages data prior to exfiltration in multi-part archives, often saved in the Recycle Bin.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
ADVSTORESHELL stores output from command execution in a .dat file in the %TEMP% directory.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
AppleSeed can stage files in a central location prior to exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Astaroth collects data in a plaintext file named r1.log before exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Attor has staged collected data in a central upload directory prior to exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
AuTo Stealer can store collected data from an infected host to a file named `Hostname_UserName.txt` prior to exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
BADNEWS copies documents under 15MB found on the victim system to is the user's `%temp%\SMB\` folder. It also copies files from USB devices to a predefined directory.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
BadPatch stores collected data in log files before exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
BoxCaon has created a working folder for collected files that it sends to the C2 server.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Carbon creates a base directory that contains the files and folders that are collected.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Catchamas stores the gathered data from the machine in .db files and .bmp files under four separate locations.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Chrommme can store captured system information locally prior to exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Crutch has staged stolen files in the `C:\AMD\Temp` directory.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
DarkWatchman can stage local data in the Windows Registry.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Dtrack can save collected data to disk, different file formats, and network shares.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Modules can be pushed to and executed by Duqu that copy data to a staging area, compress it, and XOR encrypt it.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
DustySky created folders in temp directories to host collected files before exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Dyre has the ability to create files in a TEMP folder to act as a database to store information.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
ECCENTRICBANDWAGON has stored keystrokes and screenshots within the `%temp%\GoogleChrome`, `%temp%\Downloads`, and `%temp%\TrendMicroUpdate` directories.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Elise creates a file in `AppData\Local\Microsoft\Windows\Explorer` and stores all harvested data in that file.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Exaramel for Windows specifies a path to store files scheduled for exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
FLASHFLOOD stages data it copies from the local system or removable drives in the "%WINDIR%\$NtUninstallKB885884$\" directory.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
FrameworkPOS can identifiy payment card track data on the victim and copy it to a local file in a subdirectory of C:\Windows\.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
FunnyDream can stage collected information including screen captures and logged keystrokes locally.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Gold Dragon stores information gathered from the endpoint in a file named 1.hwp.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Helminth creates folders to store output from batch scripts prior to sending the information to its C2 server.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
InvisiMole determines a working directory where it stores all the gathered data about the compromised machine.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
KGH_SPY can save collected system information to a file named "info" before exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
KOPILUWAK has piped the results from executed C2 commands to `%TEMP%\result2.dat` on the local machine.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Kazuar stages command output and collected data in files before exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
LightNeuron can store email data in files and directories specified in its configuration, such as `C:\Windows\ServiceProfiles\NetworkService\appdata\Local\Temp\`.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
LoFiSe can save files to be evaluated for further exfiltration in the `C:\Programdata\Microsoft\` and 	`C:\windows\temp\` folders.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
MESSAGETAP stored targeted SMS messages that matched its target list in CSV files on the compromised system.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
MacMa has stored collected files locally before exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Machete stores files and logs in a folder on the local drive.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Mafalda can place retrieved files into a destination directory.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
MarkiRAT can store collected data locally in a created .nfo file.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Milan has saved files prior to upload from a compromised host to folders beginning with the characters `a9850d2f`.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Mis-Type has temporarily stored collected information to the files `“%AppData%\{Unique Identifier}\HOSTRURKLSR”` and `“%AppData%\{Unique Identifier}\NEWERSSEMP”`.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
MoonWind saves information from its keylogging routine as a .zip file in the present working directory.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
NETWIRE has the ability to write collected data to a file created in the `./LOGS` directory.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
NOKKI can collect data from the victim and stage it in `LOCALAPPDATA%\MicroSoft Updatea\uplog.tmp`.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
NavRAT writes multiple outputs to a TMP file using the >> method.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
NightClub has copied captured files and keystrokes to the `%TEMP%` directory of compromised hosts.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
ObliqueRAT can copy specific files, webcam captures, and screenshots to local directories.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Octopus has stored collected information in the Application Data directory on a compromised host.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
OopsIE stages the output from command execution and collected files in specific folders before exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
PACEMAKER has written extracted data to `tmp/dsserver-check.statementcounters`.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
PUNCHBUGGY has saved information to a random temp file before exfil.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
PUNCHTRACK aggregates collected data in a tmp file.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
PoisonIvy stages collected data in a text file.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
PowerLess can stage stolen browser data in `C:\\Windows\\Temp\\cup.tmp` and keylogger data in `C:\\Windows\\Temp\\Report.06E17A5A-7325-4325-8E5D-E172EBA7FC5BK`.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Prikormka creates a directory, `%USERPROFILE%\AppData\Local\SKC\`, which is used to store collected log files.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Pteranodon creates various subdirectories under `%Temp%\reports\%` and copies files to those subdirectories. It also creates a folder at `C:\Users\<Username>\AppData\Roaming\Microsoft\store` to store screenshot JPEG files.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
QakBot has stored stolen emails and other data into new folders prior to exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
RainyDay can use a file exfiltration tool to copy files to `C:\ProgramData\Adobe\temp` prior to exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Ramsay can stage data prior to exfiltration in `%APPDATA%\Microsoft\UserSetting` and `%APPDATA%\Microsoft\UserSetting\MediaCache`.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Data captured by RawPOS is placed in a temporary file under a directory named "memdump".
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Rover copies files from removable drives to `C:\system`.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
SLIGHTPULSE has piped the output from executed commands to `/tmp/1`.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
SLOWPULSE can write logged ACE credentials to `/home/perl/PAUS.pm` in append mode, using the format string `%s:%s\n`.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
SPACESHIP identifies files with certain extensions and copies them to a directory in the user's profile.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
STARWHALE has stored collected data in a file called `stari.txt`.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
SUGARDUMP has stored collected data under `%<malware_execution_folder>%\\CrashLog.txt`.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
SocGholish can send output from `whoami` to a local temp file using the naming convention `rad<5-hex-chars>.tmp`.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
SombRAT can store harvested data in a custom database under the %TEMP% directory.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Trojan.Karagany can create directories to store plugin output and stage data for exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Turian can store copied files in a specific directory prior to exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
USBStealer collects files matching certain criteria from the victim and stores them in a local directory for later exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Ursnif has used tmp files to stage gathered information.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
Zebrocy stores all collected information in a single file before exfiltration.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
ccf32 can temporarily store files in a hidden directory on the local host.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
metaMain has stored the collected system files in a working directory.
Technique: T1074.001 Data Staged: Local Data Staging, Tactic: TA0009 Collection
During Night Dragon, threat actors copied files to company web servers and subsequently downloaded them.
Technique: T1074.002 Data Staged: Remote Data Staging, Tactic: TA0009 Collection
During the SolarWinds Compromise, APT29 staged data and files in password-protected archives on a victim's OWA server.
Technique: T1074.002 Data Staged: Remote Data Staging, Tactic: TA0009 Collection
APT28 has staged archives of collected data on a target's Outlook Web Access (OWA) server.
Technique: T1074.002 Data Staged: Remote Data Staging, Tactic: TA0009 Collection
Chimera has staged stolen data on designated servers in the target environment.
Technique: T1074.002 Data Staged: Remote Data Staging, Tactic: TA0009 Collection
FIN6 actors have compressed data from remote systems and moved it to another staging system before exfiltration.
Technique: T1074.002 Data Staged: Remote Data Staging, Tactic: TA0009 Collection
FIN8 aggregates staged data from a network into a single location.
Technique: T1074.002 Data Staged: Remote Data Staging, Tactic: TA0009 Collection
Leviathan has staged data remotely prior to exfiltration.
Technique: T1074.002 Data Staged: Remote Data Staging, Tactic: TA0009 Collection
MoustachedBouncer has used plugins to save captured screenshots to `.\AActdata\` on an SMB share.
Technique: T1074.002 Data Staged: Remote Data Staging, Tactic: TA0009 Collection
Threat Group-3390 has moved staged encrypted archives to Internet-facing servers that had previously been compromised with China Chopper prior to exfiltration.
Technique: T1074.002 Data Staged: Remote Data Staging, Tactic: TA0009 Collection
ToddyCat manually transferred collected files to an exfiltration host using xcopy.
Technique: T1074.002 Data Staged: Remote Data Staging, Tactic: TA0009 Collection
menuPass has staged data on remote MSP systems or other victim networks prior to exfiltration.
Technique: T1074.002 Data Staged: Remote Data Staging, Tactic: TA0009 Collection
ccf32 has copied files to a remote machine infected with Chinoxy or another backdoor.
Technique: T1074.002 Data Staged: Remote Data Staging, Tactic: TA0009 Collection
During the 2015 Ukraine Electric Power Attack, Sandworm Team used valid accounts on the corporate network to escalate privileges, move laterally, and establish persistence within the corporate network.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
During the C0032 campaign, TEMP.Veles used compromised VPN accounts.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
During Night Dragon, threat actors used compromised VPN accounts to gain access to victim systems.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
During Operation Wocao, threat actors used valid VPN credentials to gain initial access.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
During the SolarWinds Compromise, APT29 used different compromised credentials for remote access and to move laterally.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
APT18 actors leverage legitimate credentials to log into external remote services.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
APT28 has used legitimate credentials to gain initial access, maintain access, and exfiltrate data from a victim network. The group has specifically used credentials stolen through a spearphishing email to login to the DCCC network. The group has also leveraged default manufacturer's passwords to gain initial access to corporate networks via IoT devices such as a VOIP phone, printer, and video decoder.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
APT29 has used a compromised account to access an organization's VPN infrastructure.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
APT33 has used valid accounts for initial access and privilege escalation.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
APT39 has used stolen credentials to compromise Outlook Web Access (OWA).
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
APT41 used compromised credentials to log on to other systems.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Akira uses valid account information to remotely access victim networks, such as VPN credentials.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Axiom has used previously compromised administrative accounts to escalate privileges.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Carbanak actors used legitimate credentials of banking employees to perform operations that sent them millions of dollars.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Chimera has used a valid account to maintain persistence via scheduled task.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Cinnamon Tempest has used compromised user accounts to deploy payloads and create system services.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Dragonfly has compromised user credentials and used valid accounts for operations.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
FIN10 has used stolen credentials to connect remotely to victim networks using VPNs protected with only a single factor.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
FIN4 has used legitimate credentials to hijack email communications.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
FIN5 has used legitimate VPN, RDP, Citrix, or VNC credentials to maintain access to a victim environment.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
To move laterally on a victim network, FIN6 has used credentials stolen from various systems on which it gathered usernames and password hashes.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
FIN7 has harvested valid administrative credentials for lateral movement.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
FIN8 has used valid accounts for persistence and lateral movement.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Fox Kitten has used valid credentials with various services during lateral movement.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
GALLIUM leveraged valid accounts to maintain access to a victim network.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Ke3chang has used credential dumpers or stealers to obtain legitimate credentials, which they used to gain access to victim accounts.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
LAPSUS$ has used compromised credentials and/or session tokens to gain access into a victim's VPN, VDI, RDP, and IAMs.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation
Lazarus Group has used administrator credentials to gain access to restricted network segments.
Technique: T1078 Valid Accounts, Tactic: TA0005 Defense Evasion TA0001 Initial Access TA0003 Persistence TA0004 Privilege Escalation