Procedure examples

APT29 has used the `reg save` command to save registry hives.

APT29 has used the `reg save` command to extract LSA secrets offline.

APT29 has stolen data from compromised hosts.

APT29 has ensured web servers in a victim environment are Internet accessible before copying tools or malware to it.

APT29 has leveraged compromised high-privileged on-premises accounts synced to Office 365 to move laterally into a cloud environment, including through the use of Azure AD PowerShell.

APT29 used large size files to avoid detection by security solutions with hardcoded size limits.

APT29 used UPX to pack files.

APT29 has embedded an ISO file within an HTML attachment that contained JavaScript code to initiate malware execution.

APT29 has renamed malicious DLLs with legitimate names to appear benign; they have also created an Azure AD certificate with a Common Name that matched the display name of the compromised service principal.

APT29 has hijacked legitimate application-specific startup scripts to enable malware to execute on system startup.

APT29 has installed a run command on a compromised system to enable malware execution on system startup.

APT29 used WMI to steal credentials and execute backdoors at a future time.

APT29 has used named and hijacked scheduled tasks to establish persistence.

APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke.

APT29 has developed malware variants written in Python.

APT29 has leveraged the Microsoft Graph API to perform various actions across Azure and M365 environments. They have also utilized AADInternals PowerShell Modules to access the API

APT29 has exploited CVE-2021-36934 to escalate privileges on a compromised host.

APT29 has used SDelete to remove artifacts from victim networks.

APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory.

APT29 has used a compromised account to access an organization's VPN infrastructure.

APT29 targets dormant or inactive user accounts, accounts belonging to individuals no longer at the organization but whose accounts remain on the system, for access and persistence.

APT29 has gained access to a global administrator account in Azure AD and has used `Service Principal` credentials in Exchange.

APT29 has conducted enumeration of Azure AD accounts.

APT29 uses compromised residential endpoints as proxies for defense evasion and network access.

A backdoor used by APT29 created a Tor hidden service to forward traffic from the Tor client to local ports 3389 (RDP), 139 (Netbios), and 445 (SMB) enabling full remote access from outside the network and has also used TOR.

APT29 has used the meek domain fronting plugin for Tor to hide the destination of C2 traffic.

APT29 has used a compromised global administrator account in Azure AD to backdoor a service principal with `ApplicationImpersonation` rights to start collecting emails from targeted mailboxes; APT29 has also used compromised accounts holding `ApplicationImpersonation` rights in Exchange to collect emails.

APT29 has enrolled their own devices into compromised cloud tenants, including enrolling a device in MFA to an Azure AD environment following a successful password guessing attack against a dormant account.

APT29 has downloaded additional tools and malware onto compromised networks.

APT29 has successfully conducted password guessing attacks against a list of mailboxes.

APT29 has conducted brute force password spray attacks.

APT29 has collected emails from targeted mailboxes within a compromised Azure AD tenant and compromised Exchange servers, including via Exchange Web Services (EWS) API requests.

APT29 has used compromised identities to access networks via VPNs and Citrix.

APT29 can create new users through Azure AD.

APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access.

APT29 has compromised IT, cloud services, and managed services providers to gain broad access to multiple customers for subsequent operations.

APT29 has used multiple software exploits for common client software, like Microsoft Word, Exchange, and Adobe Reader, to gain code execution.

APT29 has used various forms of spearphishing attempting to get a user to click on a malicious link.

APT29 has used various forms of spearphishing attempting to get a user to open attachments, including, but not limited to, malicious Microsoft Word documents, .pdf, and .lnk files.

APT29 has use `mshta` to execute malicious scripts on a compromised host.

APT29 has installed web shells on exploited Microsoft Exchange servers.

APT29 uses stolen tokens to access victim accounts, without needing a password.

APT29 has used WMI event subscriptions for persistence.

APT29 used sticky-keys to obtain unauthenticated, privileged console access.

APT29 added Registry Run keys to establish persistence.

APT29 has bypassed UAC.

APT29 used Kerberos ticket attacks for lateral movement.

APT29 has embedded ISO images and VHDX files in HTML to evade Mark-of-the-Web.

APT29 has edited the `Microsoft.IdentityServer.Servicehost.exe.config` file to load a malicious DLL into the AD FS process, thereby enabling persistent access to any service federated with AD FS for a user with a specified User Principal Name.

APT29 has used spearphishing emails with an attachment to deliver files with exploits to initial victims.