Microsoft Windows

Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, security question responses, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations.

Evidence: 2026-09-16/chosen-brick-iran-telegram-c2-dissident-spyware · ATT&CK page ↗

Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction.

Evidence: 2026-07-31/unit42-autonomous-deepseek-hermes-netscaler-cve-2026-3055 · ATT&CK page ↗

Adversaries may scan victims for vulnerabilities that can be used during targeting. Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use.

Evidence: 2026-07-31/unit42-autonomous-deepseek-hermes-netscaler-cve-2026-3055 · ATT&CK page ↗

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations online, such as prominently placed within search engine results. These ads may make it more difficult for users to distinguish between actual search results and advertisements. Purchased ads may also target specific audiences using the advertising network’s capabilities, potentially further taking advantage of the trust inherently given to search engines and popular websites.

Evidence: 2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat · ATT&CK page ↗

Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control. Instead of purchasing a Server or Virtual Private Server, adversaries may compromise third-party servers in support of operations.

Evidence: 2026-09-30/star-blizzard-redflick-cosmicpulse-single-click-chain · ATT&CK page ↗

Adversaries may buy, steal, or download exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. Rather than developing their own exploits, an adversary may find/modify exploits from online or purchase them from exploit vendors.

Evidence: 2026-07-31/unit42-autonomous-deepseek-hermes-netscaler-cve-2026-3055 · ATT&CK page ↗

Adversaries may poison mechanisms that influence search engine optimization (SEO) to further lure staged capabilities towards potential victims. Search engines typically display results to users based on purchased ads as well as the site’s ranking/score/reputation calculated by their web crawlers and algorithms.

Evidence: 2026-08-12/lazarus-operation-dream-job-cve-2026-68820-afd-fudmodule · ATT&CK page ↗

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-09-21/nighteagle-apt-q-95-ghostcontainer-devtunnels-rdp2tcp-dcsync · 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · 2026-07-29/legacyhive-offline-registry-hive-profile-hijack-no-fix · ATT&CK page ↗

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · ATT&CK page ↗

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including:

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-09-21/nighteagle-apt-q-95-ghostcontainer-devtunnels-rdp2tcp-dcsync · 2026-08-23/spectre-uat-10147-byovd-edr-callback-unlink · 2026-08-12/lazarus-operation-dream-job-cve-2026-68820-afd-fudmodule · 2026-07-31/unit42-autonomous-deepseek-hermes-netscaler-cve-2026-3055 · 2026-06-10/cve-2026-47291-microsoft-june-patch-tuesday-http-sys-pre-aut · ATT&CK page ↗

Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.

Evidence: 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · ATT&CK page ↗

Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.

Evidence: 2026-09-30/star-blizzard-redflick-cosmicpulse-single-click-chain · ATT&CK page ↗

Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.

Evidence: 2026-10-14/cve-2026-96951-windows-shell-motw-bypass-zero-day-kev · 2026-09-30/star-blizzard-redflick-cosmicpulse-single-click-chain · 2026-09-03/moiclient-byovd-rpc-uac-bypass-invoice-backdoor · 2026-08-15/mustang-panda-coolclient-signed-kernel-driver-rootkit · ATT&CK page ↗

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.

Evidence: 2026-10-14/cve-2026-96951-windows-shell-motw-bypass-zero-day-kev · 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.

Evidence: 2026-09-21/conference-phishing-rogue-root-ca-mitm-persistence · 2026-09-16/chosen-brick-iran-telegram-c2-dissident-spyware · 2026-08-12/lazarus-operation-dream-job-cve-2026-68820-afd-fudmodule · ATT&CK page ↗

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat · 2026-09-30/star-blizzard-redflick-cosmicpulse-single-click-chain · 2026-09-24/closedquorum-llm-orchestrated-c2-implant · 2026-09-21/nighteagle-apt-q-95-ghostcontainer-devtunnels-rdp2tcp-dcsync · 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · 2026-09-03/moiclient-byovd-rpc-uac-bypass-invoice-backdoor +2 more · ATT&CK page ↗

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

Evidence: 2026-07-31/unit42-autonomous-deepseek-hermes-netscaler-cve-2026-3055 · ATT&CK page ↗

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. PowerShell can also be installed on Linux and macOS. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).

Evidence: 2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat · 2026-09-30/star-blizzard-redflick-cosmicpulse-single-click-chain · 2026-09-21/conference-phishing-rogue-root-ca-mitm-persistence · 2026-09-03/kimsuky-seafood-invoice-lnk-backblaze-b2-c2 · 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · ATT&CK page ↗

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH.

Evidence: 2026-09-30/star-blizzard-redflick-cosmicpulse-single-click-chain · ATT&CK page ↗

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Evidence: 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · 2026-08-07/fake-zoom-dotnet-downloader-overlord-rat-macos · ATT&CK page ↗

Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the <code>python.exe</code> interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.

Evidence: 2026-09-30/star-blizzard-redflick-cosmicpulse-single-click-chain · 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · ATT&CK page ↗

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.

Evidence: 2026-09-03/kimsuky-seafood-invoice-lnk-backblaze-b2-c2 · 2026-07-28/medusahvnc-hidden-desktop-browser-session-hijacking · ATT&CK page ↗

Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.

Evidence: 2026-08-12/shieldbreak-defender-rogueplanet-patch-bypass-no-fix · ATT&CK page ↗

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.

Evidence: 2026-10-14/cve-2026-96951-windows-shell-motw-bypass-zero-day-kev · 2026-09-30/star-blizzard-redflick-cosmicpulse-single-click-chain · 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · 2026-09-21/conference-phishing-rogue-root-ca-mitm-persistence · 2026-09-16/chosen-brick-iran-telegram-c2-dissident-spyware · 2026-09-03/kimsuky-seafood-invoice-lnk-backblaze-b2-c2 +4 more · ATT&CK page ↗

An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter. One such strategy is "ClickFix," in which adversaries present users with seemingly helpful solutions (such as prompts to fix errors or complete CAPTCHAs) that instead instruct the user to copy and paste malicious code.

Evidence: 2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat · 2026-09-21/conference-phishing-rogue-root-ca-mitm-persistence · 2026-07-26/rapid7-exposed-webdav-delivery-lab-cve-2025-33053-clickfix · ATT&CK page ↗

Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces. Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE). Remote COM execution is facilitated by Remote Services such as Distributed Component Object Model (DCOM).

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.

Evidence: 2026-07-29/legacyhive-offline-registry-hive-profile-hijack-no-fix · ATT&CK page ↗

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat · 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · 2026-09-03/moiclient-byovd-rpc-uac-bypass-invoice-backdoor · 2026-08-28/nimbus-manticore-twostroke-backdoor-europe · 2026-08-28/cncmachinerms-babadeda-loader-enumtimeformats-shellcode · 2026-08-15/mustang-panda-coolclient-signed-kernel-driver-rootkit +2 more · ATT&CK page ↗

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat · 2026-09-30/star-blizzard-redflick-cosmicpulse-single-click-chain · 2026-09-24/closedquorum-llm-orchestrated-c2-implant · 2026-09-21/nighteagle-apt-q-95-ghostcontainer-devtunnels-rdp2tcp-dcsync · 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · 2026-09-03/moiclient-byovd-rpc-uac-bypass-invoice-backdoor +2 more · ATT&CK page ↗

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-09-21/nighteagle-apt-q-95-ghostcontainer-devtunnels-rdp2tcp-dcsync · 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · 2026-07-29/legacyhive-offline-registry-hive-profile-hijack-no-fix · ATT&CK page ↗

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

Evidence: 2026-09-30/star-blizzard-redflick-cosmicpulse-single-click-chain · 2026-08-23/btr-sys-defender-remediation-driver-kernel-primitive · 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · 2026-08-15/mustang-panda-coolclient-signed-kernel-driver-rootkit · 2026-07-29/legacyhive-offline-registry-hive-profile-hijack-no-fix · ATT&CK page ↗

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · ATT&CK page ↗

Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

Evidence: 2026-09-21/nighteagle-apt-q-95-ghostcontainer-devtunnels-rdp2tcp-dcsync · ATT&CK page ↗

Adversaries may abuse software extensions to establish persistent access to victim systems. Software extensions are modular components that enhance or customize the functionality of software applications, including web browsers, Integrated Development Environments (IDEs), and other platforms. Extensions are typically installed via official marketplaces, app stores, or manually loaded by users, and they often inherit the permissions and access levels of the host application.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.

Evidence: 2026-09-21/nighteagle-apt-q-95-ghostcontainer-devtunnels-rdp2tcp-dcsync · 2026-08-12/lazarus-operation-dream-job-cve-2026-68820-afd-fudmodule · ATT&CK page ↗

Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in <code>/System/Library/LaunchAgents</code>, <code>/Library/LaunchAgents</code>, and <code>~/Library/LaunchAgents</code>. Property list files use the <code>Label</code>, <code>ProgramArguments </code>, and <code>RunAtLoad</code> keys to identify the Launch Agent's name, executable location, and execution time. Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.

Evidence: 2026-08-07/fake-zoom-dotnet-downloader-overlord-rat-macos · ATT&CK page ↗

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.

Evidence: 2026-08-23/btr-sys-defender-remediation-driver-kernel-primitive · 2026-08-15/mustang-panda-coolclient-signed-kernel-driver-rootkit · ATT&CK page ↗

Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user login, or the computer's uptime.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · ATT&CK page ↗

Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User Unix Shells execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. The login shell executes scripts from the system (<code>/etc</code>) and the user’s home directory (<code>~/</code>) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.

Evidence: 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · ATT&CK page ↗

Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system. References to various COM objects are stored in the Registry.

Evidence: 2026-09-22/cve-2026-66804-windows-dangling-com-privesc · ATT&CK page ↗

Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon. These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel.

Evidence: 2026-08-28/cncmachinerms-babadeda-loader-enumtimeformats-shellcode · ATT&CK page ↗

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.

Evidence: 2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat · 2026-09-24/closedquorum-llm-orchestrated-c2-implant · 2026-09-16/chosen-brick-iran-telegram-c2-dissident-spyware · 2026-08-23/btr-sys-defender-remediation-driver-kernel-primitive · 2026-07-28/medusahvnc-hidden-desktop-browser-session-hijacking · ATT&CK page ↗

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat · 2026-09-30/star-blizzard-redflick-cosmicpulse-single-click-chain · 2026-09-24/closedquorum-llm-orchestrated-c2-implant · 2026-09-21/nighteagle-apt-q-95-ghostcontainer-devtunnels-rdp2tcp-dcsync · 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · 2026-09-03/moiclient-byovd-rpc-uac-bypass-invoice-backdoor +2 more · ATT&CK page ↗

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · 2026-08-28/cncmachinerms-babadeda-loader-enumtimeformats-shellcode · 2026-08-15/mustang-panda-coolclient-signed-kernel-driver-rootkit · 2026-08-12/lazarus-operation-dream-job-cve-2026-68820-afd-fudmodule · 2026-07-28/medusahvnc-hidden-desktop-browser-session-hijacking · ATT&CK page ↗

Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges. APC injection is a method of executing arbitrary code in the address space of a separate live process.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · 2026-08-23/spectre-uat-10147-byovd-edr-callback-unlink · ATT&CK page ↗

Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · 2026-09-21/conference-phishing-rogue-root-ca-mitm-persistence · 2026-09-03/moiclient-byovd-rpc-uac-bypass-invoice-backdoor · 2026-08-23/spectre-uat-10147-byovd-edr-callback-unlink · ATT&CK page ↗

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-09-22/cve-2026-66804-windows-dangling-com-privesc · 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · 2026-09-09/windows-september-2026-two-exploited-lpe-zero-days-kev · 2026-08-23/spectre-uat-10147-byovd-edr-callback-unlink · 2026-08-12/shieldbreak-defender-rogueplanet-patch-bypass-no-fix · 2026-08-12/lazarus-operation-dream-job-cve-2026-68820-afd-fudmodule +2 more · ATT&CK page ↗

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-09-21/nighteagle-apt-q-95-ghostcontainer-devtunnels-rdp2tcp-dcsync · 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · 2026-07-29/legacyhive-offline-registry-hive-profile-hijack-no-fix · ATT&CK page ↗

Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`. The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread.

Evidence: 2026-08-23/spectre-uat-10147-byovd-edr-callback-unlink · ATT&CK page ↗

Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in <code>/System/Library/LaunchAgents</code>, <code>/Library/LaunchAgents</code>, and <code>~/Library/LaunchAgents</code>. Property list files use the <code>Label</code>, <code>ProgramArguments </code>, and <code>RunAtLoad</code> keys to identify the Launch Agent's name, executable location, and execution time. Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.

Evidence: 2026-08-07/fake-zoom-dotnet-downloader-overlord-rat-macos · ATT&CK page ↗

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.

Evidence: 2026-08-23/btr-sys-defender-remediation-driver-kernel-primitive · 2026-08-15/mustang-panda-coolclient-signed-kernel-driver-rootkit · ATT&CK page ↗

Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user login, or the computer's uptime.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · ATT&CK page ↗

Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User Unix Shells execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. The login shell executes scripts from the system (<code>/etc</code>) and the user’s home directory (<code>~/</code>) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.

Evidence: 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · ATT&CK page ↗

Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system. References to various COM objects are stored in the Registry.

Evidence: 2026-09-22/cve-2026-66804-windows-dangling-com-privesc · ATT&CK page ↗

Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon. These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel.

Evidence: 2026-08-28/cncmachinerms-babadeda-loader-enumtimeformats-shellcode · ATT&CK page ↗

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.

Evidence: 2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat · 2026-09-24/closedquorum-llm-orchestrated-c2-implant · 2026-09-16/chosen-brick-iran-telegram-c2-dissident-spyware · 2026-08-23/btr-sys-defender-remediation-driver-kernel-primitive · 2026-07-28/medusahvnc-hidden-desktop-browser-session-hijacking · ATT&CK page ↗

Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.

Evidence: 2026-08-12/shieldbreak-defender-rogueplanet-patch-bypass-no-fix · 2026-07-29/legacyhive-offline-registry-hive-profile-hijack-no-fix · ATT&CK page ↗

Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.

Evidence: 2026-09-03/moiclient-byovd-rpc-uac-bypass-invoice-backdoor · 2026-08-15/mustang-panda-coolclient-signed-kernel-driver-rootkit · ATT&CK page ↗

Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.

Evidence: 2026-08-23/spectre-uat-10147-byovd-edr-callback-unlink · 2026-08-15/mustang-panda-coolclient-signed-kernel-driver-rootkit · 2026-08-12/lazarus-operation-dream-job-cve-2026-68820-afd-fudmodule · ATT&CK page ↗

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Evidence: 2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat · 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · 2026-09-03/kimsuky-seafood-invoice-lnk-backblaze-b2-c2 · 2026-08-28/nimbus-manticore-twostroke-backdoor-europe · 2026-08-28/cncmachinerms-babadeda-loader-enumtimeformats-shellcode +4 more · ATT&CK page ↗

Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files.

Evidence: 2026-09-30/star-blizzard-redflick-cosmicpulse-single-click-chain · ATT&CK page ↗

Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis. Malware commonly uses various Native API functions provided by the OS to perform various tasks such as those involving processes, files, and other system artifacts.

Evidence: 2026-08-12/shieldbreak-defender-rogueplanet-patch-bypass-no-fix · ATT&CK page ↗

Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherwise seemingly benign files (such as scripts and executables) may be abused to carry and obfuscate malicious payloads and content. In some cases, embedded payloads may also enable adversaries to Subvert Trust Controls by not impacting execution controls such as digital signatures and notarization tickets.

Evidence: 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · 2026-08-12/lazarus-operation-dream-job-cve-2026-68820-afd-fudmodule · ATT&CK page ↗

Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., Phishing and Drive-by Compromise) or interactively via Command and Scripting Interpreter.

Evidence: 2026-09-21/conference-phishing-rogue-root-ca-mitm-persistence · ATT&CK page ↗

Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within a file used in an intrusion. Many other techniques, such as Software Packing, Steganography, and Embedded Payloads, share this same broad objective. Encrypting and/or encoding files could lead to a lapse in detection of static signatures, only for this malicious content to be revealed (i.e., Deobfuscate/Decode Files or Information) at the time of execution/use.

Evidence: 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · 2026-08-07/fake-zoom-dotnet-downloader-overlord-rat-macos · ATT&CK page ↗

Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description. Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones.

Evidence: 2026-09-30/star-blizzard-redflick-cosmicpulse-single-click-chain · ATT&CK page ↗

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

Evidence: 2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat · 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · 2026-09-21/nighteagle-apt-q-95-ghostcontainer-devtunnels-rdp2tcp-dcsync · 2026-08-15/mustang-panda-coolclient-signed-kernel-driver-rootkit · 2026-08-12/shieldbreak-defender-rogueplanet-patch-bypass-no-fix · 2026-08-07/fake-zoom-dotnet-downloader-overlord-rat-macos · ATT&CK page ↗

Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type. For example, the header of a JPEG file, is <code> 0xFF 0xD8</code> and the file extension is either `.JPE`, `.JPEG` or `.JPG`.

Evidence: 2026-09-30/star-blizzard-redflick-cosmicpulse-single-click-chain · 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · ATT&CK page ↗

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · 2026-08-28/cncmachinerms-babadeda-loader-enumtimeformats-shellcode · 2026-08-15/mustang-panda-coolclient-signed-kernel-driver-rootkit · 2026-08-12/lazarus-operation-dream-job-cve-2026-68820-afd-fudmodule · 2026-07-28/medusahvnc-hidden-desktop-browser-session-hijacking · ATT&CK page ↗

Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges. APC injection is a method of executing arbitrary code in the address space of a separate live process.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · 2026-08-23/spectre-uat-10147-byovd-edr-callback-unlink · ATT&CK page ↗

Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · 2026-09-21/conference-phishing-rogue-root-ca-mitm-persistence · 2026-09-03/moiclient-byovd-rpc-uac-bypass-invoice-backdoor · 2026-08-23/spectre-uat-10147-byovd-edr-callback-unlink · ATT&CK page ↗

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

Evidence: 2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat · 2026-09-03/kimsuky-seafood-invoice-lnk-backblaze-b2-c2 · 2026-08-12/shieldbreak-defender-rogueplanet-patch-bypass-no-fix · ATT&CK page ↗

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-09-21/nighteagle-apt-q-95-ghostcontainer-devtunnels-rdp2tcp-dcsync · 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · 2026-07-29/legacyhive-offline-registry-hive-profile-hijack-no-fix · ATT&CK page ↗

Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`. The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread.

Evidence: 2026-08-23/spectre-uat-10147-byovd-edr-callback-unlink · ATT&CK page ↗

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.

Evidence: 2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat · 2026-09-30/star-blizzard-redflick-cosmicpulse-single-click-chain · 2026-08-12/lazarus-operation-dream-job-cve-2026-68820-afd-fudmodule · 2026-07-28/medusahvnc-hidden-desktop-browser-session-hijacking · ATT&CK page ↗

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking cmd. For example, Forfiles, the Program Compatibility Assistant (`pcalua.exe`), components of the Windows Subsystem for Linux (WSL), `Scriptrunner.exe`, as well as other utilities may invoke the execution of programs and commands from a Command and Scripting Interpreter, Run window, or via scripts. Adversaries may also abuse the `ssh.exe` binary to execute malicious commands via the `ProxyCommand` and `LocalCommand` options, which can be invoked via the `-o` flag or by modifying the SSH config file.

Evidence: 2026-09-30/star-blizzard-redflick-cosmicpulse-single-click-chain · ATT&CK page ↗

Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system. Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.

Evidence: 2026-09-27/wwahost-appx-webauthbroker-oauth-token-theft · 2026-08-12/shieldbreak-defender-rogueplanet-patch-bypass-no-fix · ATT&CK page ↗

Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.

Evidence: 2026-09-30/star-blizzard-redflick-cosmicpulse-single-click-chain · ATT&CK page ↗

Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi). The Msiexec.exe binary may also be digitally signed by Microsoft.

Evidence: 2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat · 2026-09-30/star-blizzard-redflick-cosmicpulse-single-click-chain · 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: <code>rundll32.exe {DLLname, DLLfunction}</code>).

Evidence: 2026-07-26/rapid7-exposed-webdav-delivery-lab-cve-2025-33053-clickfix · ATT&CK page ↗

Adversaries may constrain execution or actions based on the presence of a mutex associated with malware. A mutex is a locking mechanism used to synchronize access to a resource. Only one thread or process can acquire a mutex at a given time.

Evidence: 2026-09-16/chosen-brick-iran-telegram-c2-dissident-spyware · ATT&CK page ↗

Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.

Evidence: 2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat · ATT&CK page ↗

Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. This may include enumerating time-based properties, such as uptime or the system clock.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · ATT&CK page ↗

Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks.

Evidence: 2026-07-28/medusahvnc-hidden-desktop-browser-session-hijacking · ATT&CK page ↗

Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. Within MFT entries are file attributes, such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files).

Evidence: 2026-08-23/btr-sys-defender-remediation-driver-kernel-primitive · ATT&CK page ↗

Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.

Evidence: 2026-07-29/legacyhive-offline-registry-hive-profile-hijack-no-fix · ATT&CK page ↗

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat · 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · 2026-09-03/moiclient-byovd-rpc-uac-bypass-invoice-backdoor · 2026-08-28/nimbus-manticore-twostroke-backdoor-europe · 2026-08-28/cncmachinerms-babadeda-loader-enumtimeformats-shellcode · 2026-08-15/mustang-panda-coolclient-signed-kernel-driver-rootkit +2 more · ATT&CK page ↗

Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules).

Evidence: 2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat · 2026-08-12/lazarus-operation-dream-job-cve-2026-68820-afd-fudmodule · ATT&CK page ↗

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

Evidence: 2026-09-30/star-blizzard-redflick-cosmicpulse-single-click-chain · 2026-08-23/btr-sys-defender-remediation-driver-kernel-primitive · 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · 2026-08-15/mustang-panda-coolclient-signed-kernel-driver-rootkit · 2026-07-29/legacyhive-offline-registry-hive-profile-hijack-no-fix · ATT&CK page ↗

Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apple’s security model to ensure only trusted applications are executed on a host. Gatekeeper was built on top of File Quarantine in Snow Leopard (10.6, 2009) and has grown to include Code Signing, security policy compliance, Notarization, and more. Gatekeeper also treats applications running for the first time differently than reopened applications.

Evidence: 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · ATT&CK page ↗

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. The certificates used during an operation may be created, acquired, or stolen by the adversary. Unlike Invalid Code Signature, this activity will result in a valid signature.

Evidence: 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · 2026-09-21/conference-phishing-rogue-root-ca-mitm-persistence · 2026-08-15/mustang-panda-coolclient-signed-kernel-driver-rootkit · ATT&CK page ↗

Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate. Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.

Evidence: 2026-09-21/conference-phishing-rogue-root-ca-mitm-persistence · ATT&CK page ↗

Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, when files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named <code>Zone.Identifier</code> with a specific value known as the MOTW. Files that are tagged with MOTW are protected and cannot perform certain actions. For example, starting in MS Office 10, if a MS Office file has the MOTW, it will open in Protected View. Executables tagged with the MOTW will be processed by Windows Defender SmartScreen that compares files with an allowlist of well-known executables. If the file is not known/trusted, SmartScreen will prevent the execution and warn the user not to run it.

Evidence: 2026-10-14/cve-2026-96951-windows-shell-motw-bypass-zero-day-kev · 2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat · 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.

Evidence: 2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat · 2026-09-24/closedquorum-llm-orchestrated-c2-implant · 2026-09-21/nighteagle-apt-q-95-ghostcontainer-devtunnels-rdp2tcp-dcsync · 2026-09-16/chosen-brick-iran-telegram-c2-dissident-spyware · 2026-09-03/moiclient-byovd-rpc-uac-bypass-invoice-backdoor · 2026-08-23/spectre-uat-10147-byovd-edr-callback-unlink +5 more · ATT&CK page ↗

Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot.

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · ATT&CK page ↗

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · ATT&CK page ↗

Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the <code>net user</code> command. Enumerating the SAM database requires SYSTEM level access.

Evidence: 2026-08-23/spectre-uat-10147-byovd-edr-callback-unlink · ATT&CK page ↗

Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API) to simulate the replication process from a remote domain controller using a technique called DCSync.

Evidence: 2026-09-21/nighteagle-apt-q-95-ghostcontainer-devtunnels-rdp2tcp-dcsync · ATT&CK page ↗

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · 2026-08-07/fake-zoom-dotnet-downloader-overlord-rat-macos · ATT&CK page ↗

Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords.

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · ATT&CK page ↗

Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.

Evidence: 2026-05-08/cve-2026-32202-windows-shell-ntlm-coercion-apt28-itw-cvss-4 · ATT&CK page ↗

Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.

Evidence: 2026-09-27/wwahost-appx-webauthbroker-oauth-token-theft · ATT&CK page ↗

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.

Evidence: 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · 2026-07-31/unit42-autonomous-deepseek-hermes-netscaler-cve-2026-3055 · 2026-07-28/medusahvnc-hidden-desktop-browser-session-hijacking · ATT&CK page ↗

Adversaries may search the command history on compromised systems for insecurely stored credentials.

Evidence: 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · ATT&CK page ↗

Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service.

Evidence: 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · ATT&CK page ↗

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · 2026-09-03/moiclient-byovd-rpc-uac-bypass-invoice-backdoor · 2026-08-23/spectre-uat-10147-byovd-edr-callback-unlink · 2026-07-28/medusahvnc-hidden-desktop-browser-session-hijacking · ATT&CK page ↗

Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults).

Evidence: 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · ATT&CK page ↗

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.

Evidence: 2026-09-21/conference-phishing-rogue-root-ca-mitm-persistence · ATT&CK page ↗

Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket. Kerberos is an authentication protocol widely used in modern Windows domain environments. In Kerberos environments, referred to as “realms”, there are three basic participants: client, service, and Key Distribution Center (KDC). Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated. The KDC is responsible for both authentication and ticket granting. Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.

Evidence: 2026-09-21/nighteagle-apt-q-95-ghostcontainer-devtunnels-rdp2tcp-dcsync · ATT&CK page ↗

Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using Ping, <code>tracert</code>, and GET requests to websites, or performing initial speed testing to confirm bandwidth.

Evidence: 2026-09-03/kimsuky-seafood-invoice-lnk-backblaze-b2-c2 · ATT&CK page ↗

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping, <code>net view</code> using Net, or, on ESXi servers, `esxcli network diag ping`.

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · ATT&CK page ↗

Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping. The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Evidence: 2026-08-15/mustang-panda-coolclient-signed-kernel-driver-rootkit · ATT&CK page ↗

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

Evidence: 2026-08-15/mustang-panda-coolclient-signed-kernel-driver-rootkit · ATT&CK page ↗

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Evidence: 2026-09-16/chosen-brick-iran-telegram-c2-dissident-spyware · 2026-09-03/kimsuky-seafood-invoice-lnk-backblaze-b2-c2 · 2026-08-12/lazarus-operation-dream-job-cve-2026-68820-afd-fudmodule · ATT&CK page ↗

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes.

Evidence: 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · 2026-09-16/chosen-brick-iran-telegram-c2-dissident-spyware · 2026-09-03/kimsuky-seafood-invoice-lnk-backblaze-b2-c2 · 2026-08-15/mustang-panda-coolclient-signed-kernel-driver-rootkit · 2026-08-12/lazarus-operation-dream-job-cve-2026-68820-afd-fudmodule · ATT&CK page ↗

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · ATT&CK page ↗

Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.

Evidence: 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · ATT&CK page ↗

Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.

Evidence: 2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat · ATT&CK page ↗

Adversaries may employ various time-based methods to detect virtualization and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time. This may include enumerating time-based properties, such as uptime or the system clock.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · ATT&CK page ↗

Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Evidence: 2026-09-21/conference-phishing-rogue-root-ca-mitm-persistence · ATT&CK page ↗

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Evidence: 2026-09-21/nighteagle-apt-q-95-ghostcontainer-devtunnels-rdp2tcp-dcsync · 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · ATT&CK page ↗

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.

Evidence: 2026-09-21/nighteagle-apt-q-95-ghostcontainer-devtunnels-rdp2tcp-dcsync · ATT&CK page ↗

Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.

Evidence: 2026-09-27/wwahost-appx-webauthbroker-oauth-token-theft · ATT&CK page ↗

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

Evidence: 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · 2026-09-16/chosen-brick-iran-telegram-c2-dissident-spyware · ATT&CK page ↗

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · 2026-08-07/fake-zoom-dotnet-downloader-overlord-rat-macos · ATT&CK page ↗

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.

Evidence: 2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat · 2026-09-16/chosen-brick-iran-telegram-c2-dissident-spyware · 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · 2026-08-12/lazarus-operation-dream-job-cve-2026-68820-afd-fudmodule · 2026-08-07/fake-zoom-dotnet-downloader-overlord-rat-macos · ATT&CK page ↗

Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files.

Evidence: 2026-09-16/chosen-brick-iran-telegram-c2-dissident-spyware · ATT&CK page ↗

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

Evidence: 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · 2026-07-28/medusahvnc-hidden-desktop-browser-session-hijacking · ATT&CK page ↗

Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a Command and Scripting Interpreter to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals.

Evidence: 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · ATT&CK page ↗

An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.

Evidence: 2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat · 2026-09-16/chosen-brick-iran-telegram-c2-dissident-spyware · 2026-08-07/fake-zoom-dotnet-downloader-overlord-rat-macos · ATT&CK page ↗

An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files.

Evidence: 2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat · 2026-08-07/fake-zoom-dotnet-downloader-overlord-rat-macos · ATT&CK page ↗

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

Evidence: 2026-07-28/medusahvnc-hidden-desktop-browser-session-hijacking · ATT&CK page ↗

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.

Evidence: 2026-09-21/conference-phishing-rogue-root-ca-mitm-persistence · ATT&CK page ↗

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.

Evidence: 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · ATT&CK page ↗

Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.

Evidence: 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · ATT&CK page ↗

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · 2026-09-21/conference-phishing-rogue-root-ca-mitm-persistence · 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · 2026-08-28/nimbus-manticore-twostroke-backdoor-europe · 2026-08-23/spectre-uat-10147-byovd-edr-callback-unlink · 2026-08-15/mustang-panda-coolclient-signed-kernel-driver-rootkit +1 more · ATT&CK page ↗

Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.

Evidence: 2026-08-28/nimbus-manticore-twostroke-backdoor-europe · 2026-08-15/mustang-panda-coolclient-signed-kernel-driver-rootkit · ATT&CK page ↗

Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment.

Evidence: 2026-09-21/nighteagle-apt-q-95-ghostcontainer-devtunnels-rdp2tcp-dcsync · ATT&CK page ↗

Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion.

Evidence: 2026-09-16/chosen-brick-iran-telegram-c2-dissident-spyware · ATT&CK page ↗

Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.

Evidence: 2026-07-31/unit42-autonomous-deepseek-hermes-netscaler-cve-2026-3055 · ATT&CK page ↗

Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites, cloud services, and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google, Microsoft, or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.

Evidence: 2026-09-03/kimsuky-seafood-invoice-lnk-backblaze-b2-c2 · 2026-07-31/unit42-autonomous-deepseek-hermes-netscaler-cve-2026-3055 · ATT&CK page ↗

Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.

Evidence: 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · ATT&CK page ↗

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · 2026-09-21/conference-phishing-rogue-root-ca-mitm-persistence · 2026-09-16/chosen-brick-iran-telegram-c2-dissident-spyware · 2026-08-12/lazarus-operation-dream-job-cve-2026-68820-afd-fudmodule · ATT&CK page ↗

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).

Evidence: 2026-10-04/chatgpt-custom-gpt-clickfix-sideloaded-in-memory-rat · 2026-09-30/star-blizzard-redflick-cosmicpulse-single-click-chain · 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · 2026-08-15/mustang-panda-coolclient-signed-kernel-driver-rootkit · 2026-08-12/lazarus-operation-dream-job-cve-2026-68820-afd-fudmodule · 2026-08-07/fake-zoom-dotnet-downloader-overlord-rat-macos +1 more · ATT&CK page ↗

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

Evidence: 2026-09-21/conference-phishing-rogue-root-ca-mitm-persistence · 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · 2026-08-15/mustang-panda-coolclient-signed-kernel-driver-rootkit · ATT&CK page ↗

Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.

Evidence: 2026-08-07/fake-zoom-dotnet-downloader-overlord-rat-macos · ATT&CK page ↗

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.

Evidence: 2026-09-21/nighteagle-apt-q-95-ghostcontainer-devtunnels-rdp2tcp-dcsync · 2026-08-28/nimbus-manticore-twostroke-backdoor-europe · ATT&CK page ↗

Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.

Evidence: 2026-08-07/fake-zoom-dotnet-downloader-overlord-rat-macos · ATT&CK page ↗

Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.

Evidence: 2026-09-10/bluemoon-exploit-kit-four-state-actors-chrome-windows-chain · ATT&CK page ↗

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

Evidence: 2026-09-16/chosen-brick-iran-telegram-c2-dissident-spyware · ATT&CK page ↗

Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services.

Evidence: 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop · ATT&CK page ↗

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.

Evidence: 2026-09-16/chosen-brick-iran-telegram-c2-dissident-spyware · 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · ATT&CK page ↗

Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server. Many public and commercial services, such as Discord, Slack, and `webhook.site`, support the creation of webhook endpoints that can be used by other services, such as Github, Jira, or Trello. When changes happen in the linked services (such as pushing a repository update or modifying a ticket), these services will automatically post the data to the webhook endpoint for use by the consuming application.

Evidence: 2026-09-24/closedquorum-llm-orchestrated-c2-implant · ATT&CK page ↗

Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives. Common operating system file deletion commands such as <code>del</code> and <code>rm</code> often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.

Evidence: 2026-09-16/chosen-brick-iran-telegram-c2-dissident-spyware · ATT&CK page ↗

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.

Evidence: 2026-08-17/akira-safe-mode-boot-edr-blinding-sonicwall-vpn · ATT&CK page ↗

Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users. Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition. Example services include websites, email services, DNS, and web-based applications. Adversaries have been observed conducting DoS attacks for political purposes and to support other malicious activities, including distraction, hacktivism, and extortion.

Evidence: 2026-06-10/cve-2026-47291-microsoft-june-patch-tuesday-http-sys-pre-aut · ATT&CK page ↗