Procedure examples

APT3 has used a tool to dump credentials by injecting itself into lsass.exe and triggering with the argument "dig."

APT3 will identify Microsoft Office documents on the victim's computer.

A keylogging tool used by APT3 gathers network information from the victim, including the MAC address, IP address, WINS, DHCP server, and gateway.

APT3 has a tool that can detect the existence of remote systems.

APT3 enables the Remote Desktop Protocol for persistence. APT3 has also interacted with compromised systems to browse and copy files through RDP sessions.

APT3 will copy files over to Windows Admin Shares (like ADMIN$) as part of lateral movement.

APT3 obfuscates files or information to help evade defensive measures.

APT3 has been known to pack their tools.

APT3 has been known to remove indicators of compromise from tools.

An APT3 downloader uses the Windows command "cmd.exe" /C whoami to verify that it is running with the elevated privileges of “System.”

APT3 has been known to create or enable accounts, such as support_388945a0.

APT3 has a tool that exfiltrates data over the C2 channel.

APT3 has a tool that can enumerate current network connections.

An APT3 downloader creates persistence by creating the following scheduled task: schtasks /create /tn "mysc" /tr C:\Users\Public\test.exe /sc ONLOGON /ru "System".

APT3 has used a keylogging tool that records keystrokes in encrypted files.

APT3 has a tool that can list out currently running processes.

APT3 has used PowerShell on victim systems to download and run payloads after exploitation.

An APT3 downloader uses the Windows command "cmd.exe" /C whoami. The group also uses a tool to execute commands on remote computers.

APT3 has a tool that can enumerate the permissions associated with Windows groups.

APT3 has a tool that can delete files.

APT3 has been known to stage files for exfiltration in a single location.

APT3 leverages valid accounts after gaining credentials for use within the victim domain.

APT3 has a tool that can obtain information about the local system.

APT3 has a tool that looks for files and directories on the local file system.

APT3 has used a tool that can obtain info about local and global group users, power users, and administrators.

An APT3 downloader establishes SOCKS5 connections for its initial C2.

An APT3 downloader establishes SOCKS5 connections for its initial C2.

APT3 has been known to add created accounts to local admin groups to maintain elevated access.

An APT3 downloader first establishes a SOCKS5 connection to 192.157.198[.]103 using TCP port 1913; once the server response is verified, it then requests a connection to 192.184.60[.]229 on TCP port 81.

APT3 has a tool that can copy files to remote machines.

APT3 has been known to brute force password hashes to be able to leverage plain text credentials.

APT3 has been known to create or enable accounts, such as support_388945a0.

APT3 has exploited the Adobe Flash Player vulnerability CVE-2015-3113 and Internet Explorer vulnerability CVE-2014-1776.

APT3 has lured victims into clicking malicious links delivered through spearphishing.

APT3 has a tool that can run DLLs.

APT3 has a tool that creates a new service for persistence.

APT3 replaces the Sticky Keys binary C:\Windows\System32\sethc.exe for persistence.

APT3 places scripts in the startup folder for persistence.

APT3 has a tool that can locate credentials in files on the file system such as those from Firefox or Chrome.

APT3 has used tools to dump passwords from browsers.

APT3 has used tools to compress data before exfilling it.

APT3 has been known to use -WindowStyle Hidden to conceal PowerShell windows.

APT3 has sent spearphishing emails containing malicious links.

APT3 has been known to side load DLLs with a valid version of Chrome with one of their tools.