Mandiant APT1

APT1 has been known to use credential dumping using Mimikatz.

Lslsass can dump active logon session password hashes from the lsass process.

Fgdump can dump Windows password hashes.

Cachedump can extract cached password hashes from cache entry information.

APT1 has collected files from a local victim.

APT1 used the commands net start and tasklist to get a listing of the services on the system.

BISCUIT malware contains a secondary fallback command and control server that is contacted after the primary command and control server.

APT1 used the ipconfig /all command to gather network configuration information.

The file name AcroRD32.exe, a legitimate process name for Adobe's Acrobat Reader, was used by APT1 as a name for malware.

APT1 used the net use command to get a listing on network connections.

APT1 gathered a list of running processes on the system using tasklist /v.

WEBC2 can open an interactive command shell.

APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution.

BISCUIT has a command to collect the processor type, operation system, computer name, and whether the system is a laptop or PC.

APT1 used the commands net localgroup,net user, and net group to find accounts on the system.

GLOOXMAIL communicates to servers operated by Google using the Jabber/XMPP protocol.

The CALENDAR malware communicates through the use of events in Google Calendar.

WEBC2 can download and execute a file.

APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. GETMAIL extracts emails from archived Outlook .pst files.

APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. MAPIGET steals email still on Exchange servers that has not yet been archived.

APT1 used a batch script to perform a series of discovery techniques and saves it to a text file.

BISCUIT has a command to collect the system `UPTIME`.

APT1 listed connected network shares.

The APT1 group is known to have used pass the hash.

Pass-The-Hash Toolkit can perform pass the hash.

APT1 has used RAR to compress files before moving them outside of the victim network.

APT1 has sent spearphishing emails containing malicious attachments.

APT1 has sent spearphishing emails containing hyperlinks to malicious files.

APT1 has registered hundreds of domains for use in operations.

APT1 hijacked FQDNs associated with legitimate websites hosted by hop points.

APT1 has created email accounts for later use in social engineering, phishing, and when registering domains.

APT1 used publicly available malware for privilege escalation.

APT1 has used various open-source tools for privilege escalation purposes.