^[1]

^[1]

^[2]

APT1 used the commandsnet localgroup,net user, andnet group to find accounts on the system.^[1]

APT1 has registered hundreds of domains for use in operations.^[1]

APT1 has used RAR to compress files before moving them outside of the victim network.^[1]

APT1 used a batch script to perform a series of discovery techniques and saves it to a text file.^[1]

APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution.^[1]

APT1 hijacked FQDNs associated with legitimate websites hosted by hop points.^[1]

APT1 has collected files from a local victim.^[1]

APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. GETMAIL extracts emails from archived Outlook .pst files.^[1]

APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. MAPIGET steals email still on Exchange servers that has not yet been archived.^[1]

APT1 has created email accounts for later use in social engineering, phishing, and when registering domains.^[1]

The file name AcroRD32.exe, a legitimate process name for Adobe's Acrobat Reader, was used byAPT1 as a name for malware.^[1][3]

APT1 listed connected network shares.^[1]

APT1 used publicly available malware for privilege escalation.^[1]

APT1 has used various open-source tools for privilege escalation purposes.^[1]

APT1 has been known to use credential dumping usingMimikatz.^[1]

APT1 has sent spearphishing emails containing malicious attachments.^[1]

APT1 has sent spearphishing emails containing hyperlinks to malicious files.^[1]

APT1 gathered a list of running processes on the system usingtasklist /v.^[1]

TheAPT1 group is known to have used RDP during operations.^[4]

APT1 used theipconfig /all command to gather network configuration information.^[1]

APT1 used thenet use command to get a listing on network connections.^[1]

APT1 used the commandsnet start andtasklist to get a listing of the services on the system.^[1]

TheAPT1 group is known to have used pass the hash.^[1]