Microsoft Entra ID

Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts.

Evidence: 2026-07-15/proofpoint-oauth-client-id-spoofing-entra-id-evasion · ATT&CK page ↗

Adversaries may use voice communications to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient.

Evidence: 2026-08-07/unc6671-blackfile-multi-brand-passkey-vishing-aitm · 2026-07-18/abbott-exact-sciences-shinyhunters-entra-sso-vishing · ATT&CK page ↗

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · 2026-08-07/unc6671-blackfile-multi-brand-passkey-vishing-aitm · 2026-07-21/hollowgraph-m365-calendar-graph-api-c2-cavern · 2026-07-18/abbott-exact-sciences-shinyhunters-entra-sso-vishing · 2026-07-15/proofpoint-oauth-client-id-spoofing-entra-id-evasion · 2026-07-10/m365-conditional-access-gaps-railway-lshiy-campaigns · ATT&CK page ↗

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-08-23/cve-2026-69836-entra-id-exploited-flag-corrected · ATT&CK page ↗

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.

Evidence: 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.

Evidence: 2026-09-08/bigbear-2-0-phaas-m365-aitm-fido2-bypass · 2026-08-23/gtig-russia-clusters-app-passwords-whatsapp-linking · 2026-07-10/m365-conditional-access-gaps-railway-lshiy-campaigns · 2026-07-10/forg365-m365-phaas-aitm-devicecode-forgcookie · ATT&CK page ↗

Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient.

Evidence: 2026-08-07/unc6671-blackfile-multi-brand-passkey-vishing-aitm · 2026-07-18/abbott-exact-sciences-shinyhunters-entra-sso-vishing · 2026-07-10/helix-data-extortion-devicecode-vishing-sharepoint-exfil · ATT&CK page ↗

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. PowerShell can also be installed on Linux and macOS. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).

Evidence: 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.

Evidence: 2026-08-23/gtig-russia-clusters-app-passwords-whatsapp-linking · ATT&CK page ↗

An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter. One such strategy is "ClickFix," in which adversaries present users with seemingly helpful solutions (such as prompts to fix errors or complete CAPTCHAs) that instead instruct the user to copy and paste malicious code.

Evidence: 2026-08-23/blockchain-dead-drop-c2-commodity-graphspy · 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · 2026-08-07/unc6671-blackfile-multi-brand-passkey-vishing-aitm · 2026-07-21/hollowgraph-m365-calendar-graph-api-c2-cavern · 2026-07-18/abbott-exact-sciences-shinyhunters-entra-sso-vishing · 2026-07-15/proofpoint-oauth-client-id-spoofing-entra-id-evasion · 2026-07-10/m365-conditional-access-gaps-railway-lshiy-campaigns · ATT&CK page ↗

Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

Evidence: 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments. With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).

Evidence: 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.

Evidence: 2026-08-07/unc6671-blackfile-multi-brand-passkey-vishing-aitm · 2026-07-10/helix-data-extortion-devicecode-vishing-sharepoint-exfil · ATT&CK page ↗

Adversaries may abuse software extensions to establish persistent access to victim systems. Software extensions are modular components that enhance or customize the functionality of software applications, including web browsers, Integrated Development Environments (IDEs), and other platforms. Extensions are typically installed via official marketplaces, app stores, or manually loaded by users, and they often inherit the permissions and access levels of the host application.

Evidence: 2026-07-10/forg365-m365-phaas-aitm-devicecode-forgcookie · ATT&CK page ↗

Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in <code>/System/Library/LaunchAgents</code>, <code>/Library/LaunchAgents</code>, and <code>~/Library/LaunchAgents</code>. Property list files use the <code>Label</code>, <code>ProgramArguments </code>, and <code>RunAtLoad</code> keys to identify the Launch Agent's name, executable location, and execution time. Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.

Evidence: 2026-08-23/blockchain-dead-drop-c2-commodity-graphspy · ATT&CK page ↗

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.

Evidence: 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system. References to various COM objects are stored in the Registry.

Evidence: 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.

Evidence: 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

Evidence: 2026-08-23/gtig-russia-clusters-app-passwords-whatsapp-linking · 2026-08-23/blockchain-dead-drop-c2-commodity-graphspy · 2026-08-07/unc6671-blackfile-multi-brand-passkey-vishing-aitm · 2026-07-18/abbott-exact-sciences-shinyhunters-entra-sso-vishing · 2026-07-10/m365-conditional-access-gaps-railway-lshiy-campaigns · ATT&CK page ↗

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · 2026-08-07/unc6671-blackfile-multi-brand-passkey-vishing-aitm · 2026-07-21/hollowgraph-m365-calendar-graph-api-c2-cavern · 2026-07-18/abbott-exact-sciences-shinyhunters-entra-sso-vishing · 2026-07-15/proofpoint-oauth-client-id-spoofing-entra-id-evasion · 2026-07-10/m365-conditional-access-gaps-railway-lshiy-campaigns · ATT&CK page ↗

Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

Evidence: 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments. With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).

Evidence: 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · ATT&CK page ↗

Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.

Evidence: 2026-08-07/unc6671-blackfile-multi-brand-passkey-vishing-aitm · 2026-07-10/helix-data-extortion-devicecode-vishing-sharepoint-exfil · ATT&CK page ↗

Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in <code>/System/Library/LaunchAgents</code>, <code>/Library/LaunchAgents</code>, and <code>~/Library/LaunchAgents</code>. Property list files use the <code>Label</code>, <code>ProgramArguments </code>, and <code>RunAtLoad</code> keys to identify the Launch Agent's name, executable location, and execution time. Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.

Evidence: 2026-08-23/blockchain-dead-drop-c2-commodity-graphspy · ATT&CK page ↗

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.

Evidence: 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system. References to various COM objects are stored in the Registry.

Evidence: 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.

Evidence: 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.

Evidence: 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Evidence: 2026-07-21/hollowgraph-m365-calendar-graph-api-c2-cavern · ATT&CK page ↗

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

Evidence: 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · 2026-07-21/hollowgraph-m365-calendar-graph-api-c2-cavern · ATT&CK page ↗

Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests.

Evidence: 2026-08-07/unc6671-blackfile-multi-brand-passkey-vishing-aitm · ATT&CK page ↗

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · 2026-08-07/unc6671-blackfile-multi-brand-passkey-vishing-aitm · 2026-07-21/hollowgraph-m365-calendar-graph-api-c2-cavern · 2026-07-18/abbott-exact-sciences-shinyhunters-entra-sso-vishing · 2026-07-15/proofpoint-oauth-client-id-spoofing-entra-id-evasion · 2026-07-10/m365-conditional-access-gaps-railway-lshiy-campaigns · ATT&CK page ↗

Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system. Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.

Evidence: 2026-09-27/wwahost-appx-webauthbroker-oauth-token-theft · ATT&CK page ↗

Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code

Evidence: 2026-08-23/gtig-russia-clusters-app-passwords-whatsapp-linking · ATT&CK page ↗

Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.

Evidence: 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims.

Evidence: 2026-08-07/unc6671-blackfile-multi-brand-passkey-vishing-aitm · ATT&CK page ↗

Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

Evidence: 2026-08-23/gtig-russia-clusters-app-passwords-whatsapp-linking · 2026-08-23/blockchain-dead-drop-c2-commodity-graphspy · 2026-08-07/unc6671-blackfile-multi-brand-passkey-vishing-aitm · 2026-07-18/abbott-exact-sciences-shinyhunters-entra-sso-vishing · 2026-07-10/m365-conditional-access-gaps-railway-lshiy-campaigns · ATT&CK page ↗

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.

Evidence: 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.

Evidence: 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords.

Evidence: 2026-10-18/connectwise-cloud-backup-skykick-m365-app-credential-abuse · 2026-07-10/m365-conditional-access-gaps-railway-lshiy-campaigns · ATT&CK page ↗

Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed. The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts.

Evidence: 2026-07-15/proofpoint-oauth-client-id-spoofing-entra-id-evasion · ATT&CK page ↗

Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms.

Evidence: 2026-09-08/bigbear-2-0-phaas-m365-aitm-fido2-bypass · ATT&CK page ↗

Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.

Evidence: 2026-09-27/wwahost-appx-webauthbroker-oauth-token-theft · 2026-08-23/gtig-russia-clusters-app-passwords-whatsapp-linking · 2026-08-23/blockchain-dead-drop-c2-commodity-graphspy · 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · 2026-07-10/m365-conditional-access-gaps-railway-lshiy-campaigns · 2026-07-10/helix-data-extortion-devicecode-vishing-sharepoint-exfil +1 more · ATT&CK page ↗

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.

Evidence: 2026-09-08/bigbear-2-0-phaas-m365-aitm-fido2-bypass · 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · 2026-07-10/forg365-m365-phaas-aitm-devicecode-forgcookie · ATT&CK page ↗

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.

Evidence: 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

Evidence: 2026-08-23/gtig-russia-clusters-app-passwords-whatsapp-linking · 2026-08-23/blockchain-dead-drop-c2-commodity-graphspy · 2026-08-07/unc6671-blackfile-multi-brand-passkey-vishing-aitm · 2026-07-18/abbott-exact-sciences-shinyhunters-entra-sso-vishing · 2026-07-10/m365-conditional-access-gaps-railway-lshiy-campaigns · ATT&CK page ↗

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.

Evidence: 2026-08-07/unc6671-blackfile-multi-brand-passkey-vishing-aitm · 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.

Evidence: 2026-08-07/unc6671-blackfile-multi-brand-passkey-vishing-aitm · ATT&CK page ↗

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes.

Evidence: 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.

Evidence: 2026-09-24/microsoft-entra-id-sspr-enumeration-resetspy · ATT&CK page ↗

Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.

Evidence: 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Evidence: 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.

Evidence: 2026-09-27/wwahost-appx-webauthbroker-oauth-token-theft · 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · 2026-07-10/m365-conditional-access-gaps-railway-lshiy-campaigns · ATT&CK page ↗

Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated.

Evidence: 2026-09-08/bigbear-2-0-phaas-m365-aitm-fido2-bypass · ATT&CK page ↗

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.

Evidence: 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.

Evidence: 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as MailSniper can be used to automate searches for specific keywords.

Evidence: 2026-08-07/unc6671-blackfile-multi-brand-passkey-vishing-aitm · ATT&CK page ↗

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

Evidence: 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.

Evidence: 2026-08-23/gtig-russia-clusters-app-passwords-whatsapp-linking · 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files.

Evidence: 2026-08-23/gtig-russia-clusters-app-passwords-whatsapp-linking · 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint:

Evidence: 2026-08-07/unc6671-blackfile-multi-brand-passkey-vishing-aitm · 2026-07-18/abbott-exact-sciences-shinyhunters-entra-sso-vishing · 2026-07-10/helix-data-extortion-devicecode-vishing-sharepoint-exfil · ATT&CK page ↗

Adversaries may access data from cloud storage.

Evidence: 2026-08-07/unc6671-blackfile-multi-brand-passkey-vishing-aitm · 2026-07-18/abbott-exact-sciences-shinyhunters-entra-sso-vishing · ATT&CK page ↗

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.

Evidence: 2026-08-07/unc6671-blackfile-multi-brand-passkey-vishing-aitm · 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.

Evidence: 2026-07-21/hollowgraph-m365-calendar-graph-api-c2-cavern · ATT&CK page ↗

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-07-21/hollowgraph-m365-calendar-graph-api-c2-cavern · ATT&CK page ↗

Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion.

Evidence: 2026-08-07/unc6671-blackfile-multi-brand-passkey-vishing-aitm · ATT&CK page ↗

Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.

Evidence: 2026-08-23/blockchain-dead-drop-c2-commodity-graphspy · ATT&CK page ↗

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.

Evidence: 2026-07-21/hollowgraph-m365-calendar-graph-api-c2-cavern · ATT&CK page ↗

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).

Evidence: 2026-07-21/hollowgraph-m365-calendar-graph-api-c2-cavern · ATT&CK page ↗

Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.

Evidence: 2026-07-21/hollowgraph-m365-calendar-graph-api-c2-cavern · ATT&CK page ↗

Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.

Evidence: 2026-07-21/hollowgraph-m365-calendar-graph-api-c2-cavern · ATT&CK page ↗

Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal.

Evidence: 2026-08-01/captivecrunch-storm-2945-hospitality-captive-portal-rat · ATT&CK page ↗

Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware, business email compromise (BEC) and fraud, "pig butchering," bank hacking, and exploiting cryptocurrency networks.

Evidence: 2026-08-07/unc6671-blackfile-multi-brand-passkey-vishing-aitm · ATT&CK page ↗