The Gentlemen

Spearphishing Attachment

Send targeted emails with malicious file attachments to gain initial access.

Spearphishing Link

Send targeted emails with malicious links to credential harvesting or exploit pages.

Valid Accounts

Use legitimate credentials to authenticate and gain access.

Exploit Public-Facing Application

Exploit vulnerabilities in internet-facing applications to gain access.

External Remote Services

Abuse remote services like VPNs or RDP to gain access to the network.

Data Encrypted for Impact

Encrypt victim data to disrupt availability, typically for ransom.

Inhibit System Recovery

Delete backups, shadow copies, or recovery partitions to prevent restoration.

Service Stop

Stop critical services to disrupt operations or aid in data destruction.

Defacement

Modify visual content on websites or systems to deliver messaging.

Data Destruction

Destroy data and files on victim systems to disrupt operations.

Obfuscated Files or Information

Encrypt, encode, or obfuscate payloads and data to evade detection.

System Binary Proxy Execution

Use signed system binaries to proxy execution of malicious content.

T1562.001

T1070.004

T1003.003

T1567.002

T1484.001

T1112

T1087.002

T1482

T1021.004

T1074.001

T1039

T1048.001

T1071.001

T1550

File and Directory Discovery

Enumerate files and directories to find sensitive data or binaries.

Network Service Discovery

Scan for services running on remote hosts across the network.

Remote Desktop Protocol

Use RDP to connect to and control remote systems.

SMB/Windows Admin Shares

Use SMB and administrative shares (C$, ADMIN$) to access remote systems.

Windows Management Instrumentation

Use WMI to execute commands and manage systems remotely.

PowerShell

Use PowerShell commands and scripts for execution and automation.

Windows Command Shell

Use cmd.exe to execute commands and batch scripts.

LSASS Memory

Access LSASS process memory to extract credential material.

Credentials from Password Stores

Extract credentials from password managers, browsers, or keychains.

Exfiltration Over Alternative Protocol

Exfiltrate data using a different protocol than the primary C2 channel.

Remote Access Software

Use legitimate remote access tools like TeamViewer or AnyDesk for C2.

Ingress Tool Transfer

Download additional tools or payloads from an external system.

Proxy

Route C2 traffic through intermediary proxies to obscure the source.

Exploitation for Privilege Escalation

Exploit software vulnerabilities to gain elevated privileges on a system.