Obtain Capabilities: Tool

APT-C-36 obtained and used a modified variant of Imminent Monitor.^[2]

APT1 has used various open-source tools for privilege escalation purposes.^[3]

APT19 has obtained and used publicly-available tools like Empire.^[4][5]

APT28 has obtained and used open-source tools like Koadic, Mimikatz, and Responder.^[6][7][8]

APT29 has obtained and used a variety of tools including Mimikatz, SDelete, Tor, meek, and Cobalt Strike.^[9][10][11]

APT32 has obtained and used tools such as Mimikatz and Cobalt Strike, and a variety of other open-source tools from GitHub.^[12][13]

APT33 has obtained and leveraged publicly-available tools for early intrusion activities.^[14][15]

APT38 has obtained and used open-source tools such as Mimikatz.^[16]

APT39 has modified and used customized versions of publicly-available tools like PLINK and Mimikatz.^[17][18]

APT41 has obtained and used tools such as Mimikatz, pwdump, PowerSploit, and Windows Credential Editor.^[19]

Aquatic Panda has acquired and used Cobalt Strike in its operations.^[20]

BackdoorDiplomacy has obtained a variety of open-source reconnaissance and red team tools for discovery and lateral movement.^[21]

BlackTech has obtained and used tools such as Putty, SNScan, and PsExec for its operations.^[22]

Blue Mockingbird has obtained and used tools such as Mimikatz.^[23]

BRONZE BUTLER has obtained and used open-source tools such as Mimikatz, gsecdump, and Windows Credential Editor.^[24]

Carbanak has obtained and used open-source tools such as PsExec and Mimikatz.^[25]

Chimera has obtained and used tools such as BloodHound, Cobalt Strike, Mimikatz, and PsExec.^[26][27]

Cleaver has obtained and used open-source tools such as PsExec, Windows Credential Editor, and Mimikatz.^[28]

Cobalt Group has obtained and used a variety of tools including Mimikatz, PsExec, Cobalt Strike, and SDelete.^[29]

CopyKittens has used Metasploit and Empire for post-exploitation activities.^[30]

CostaRicto has obtained open source tools to use in their operations.^[31]

DarkHydrus has obtained and used tools such as Mimikatz, Empire, and Cobalt Strike.^[32]

DarkVishnya has obtained and used tools such as Impacket, Winexe, and PsExec.^[33]

Dragonfly has obtained and used tools such as Mimikatz, CrackMapExec, and PsExec.^[34]

Ferocious Kitten has obtained open source tools for its operations, including JsonCPP and Psiphon.^[35]

FIN10 has relied on publicly-available software to gain footholds and establish persistence in victim environments.^[36]

FIN5 has obtained and used a customized version of PsExec, as well as use other tools such as pwdump, SDelete, and Windows Credential Editor.^[37]

FIN6 has obtained and used tools such as Mimikatz, Cobalt Strike, and AdFind.^[38][39]

Frankenstein has obtained and used Empire to deploy agents.^[40]

GALLIUM has used a variety of widely-available tools, which in some cases they modified to add functionality and/or subvert antimalware solutions.^[41]

Gorgon Group has obtained and used tools such as QuasarRAT and Remcos.^[42]

Inception has obtained and used open-source tools such as LaZagne.^[43]

IndigoZebra has acquired open source tools such as NBTscan and Meterpreter for their operations.^[44][45]

Ke3chang has obtained and used tools such as Mimikatz.^[46]

Kimsuky has obtained and used tools such as Nirsoft WebBrowserPassVIew, Mimikatz, and PsExec.^[47][48]

Lazarus Group has obtained a variety of tools for their operations, including Responder, PuTTy PSCP, Wake-On-Lan, ChromePass, and dbxcli.^[49][50][51]

Leafminer has obtained and used tools such as LaZagne, Mimikatz, PsExec, and MailSniper.^[52]

Magic Hound has obtained and used open-source penetration testing tools like Havij, sqlmap, Metasploit, and Mimikatz.^[53][54][55]

menuPass has used and modified open-source tools like Impacket, Mimikatz, and pwdump.^[56]

MuddyWater has made use of legitimate tools ConnectWise and RemoteUtilities for access to target environments.^[57]

Night Dragon has obtained and used tools such as gsecdump.^[58]

Patchwork has obtained and used open-source tools such as QuasarRAT.^[59]

PittyTiger has obtained and used tools such as Mimikatz and gsecdump.^[60]

Sandworm Team has acquired open-source tools for some of it's operations; for example it acquired Invoke-PSImage to establish an encrypted channel from a compromised host to Sandworm Team's C2 server as part of its preparation for the 2018 Winter Olympics attack.^[61]

Silence has obtained and modified versions of publicly-available tools like Empire and PsExec.^{[62] [63]}

Silent Librarian has obtained free and publicly available tools including SingleFile and HTTrack to copy login pages of targeted organizations.^[64][65]

TEMP.Veles has obtained and used tools such as Mimikatz and PsExec.^[66]

Threat Group-3390 has obtained and used tools such as Impacket, pwdump, Mimikatz, gsecdump, NBTscan, and Windows Credential Editor.^[67][68]

Thrip has obtained and used tools such as Mimikatz and PsExec.^[69]

Turla has obtained and customized publicly-available tools like Mimikatz.^[70]

Whitefly has obtained and used tools such as Mimikatz.^[71]

WIRTE has obtained and used Empire for post-exploitation activities.^[72]

Wizard Spider has obtained and used publicly-available post-exploitation frameworks and tools like Metasploit, Empire, Mimikatz.^[73]

This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.