Procedure examples

APT1 has been known to use credential dumping using Mimikatz.

APT1 has collected files from a local victim.

APT1 used the commands net start and tasklist to get a listing of the services on the system.

APT1 used the ipconfig /all command to gather network configuration information.

The APT1 group is known to have used RDP during operations.

The file name AcroRD32.exe, a legitimate process name for Adobe's Acrobat Reader, was used by APT1 as a name for malware.

APT1 used the net use command to get a listing on network connections.

APT1 gathered a list of running processes on the system using tasklist /v.

APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution.

APT1 used the commands net localgroup,net user, and net group to find accounts on the system.

APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. GETMAIL extracts emails from archived Outlook .pst files.

APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. MAPIGET steals email still on Exchange servers that has not yet been archived.

APT1 used a batch script to perform a series of discovery techniques and saves it to a text file.

APT1 listed connected network shares.

The APT1 group is known to have used pass the hash.

APT1 has used RAR to compress files before moving them outside of the victim network.

APT1 has sent spearphishing emails containing malicious attachments.

APT1 has sent spearphishing emails containing hyperlinks to malicious files.

APT1 has registered hundreds of domains for use in operations.

APT1 hijacked FQDNs associated with legitimate websites hosted by hop points.

APT1 has created email accounts for later use in social engineering, phishing, and when registering domains.

APT1 used publicly available malware for privilege escalation.

APT1 has used various open-source tools for privilege escalation purposes.