Obtain Capabilities: Tool

APT-C-36 obtained and used a modified variant of Imminent Monitor.^[2]

APT1 has used various open-source tools for privilege escalation purposes.^[3]

APT19 has obtained and used publicly-available tools like Empire.^[4][5]

APT28 has obtained and used open-source tools like Koadic, Mimikatz, and Responder.^[6][7][8]

APT29 has obtained and used a variety of tools including Mimikatz, SDelete, Tor, meek, and Cobalt Strike.^[9][10][11]

APT32 has obtained and used tools such as Mimikatz and Cobalt Strike, and a variety of other open-source tools from GitHub.^[12][13]

APT33 has obtained and leveraged publicly-available tools for early intrusion activities.^[14][15]

APT38 has obtained and used open-source tools such as Mimikatz.^[16]

APT39 has modified and used customized versions of publicly-available tools like PLINK and Mimikatz.^[17][18]

APT41 has obtained and used tools such as Mimikatz, pwdump, PowerSploit, and Windows Credential Editor.^[19]

BackdoorDiplomacy has obtained a variety of open-source reconnaissance and red team tools for discovery and lateral movement.^[20]

Blue Mockingbird has obtained and used tools such as Mimikatz.^[21]

BRONZE BUTLER has obtained and used open-source tools such as Mimikatz, gsecdump, and Windows Credential Editor.^[22]

Carbanak has obtained and used open-source tools such as PsExec and Mimikatz.^[23]

Chimera has obtained and used tools such as BloodHound, Cobalt Strike, Mimikatz, and PsExec.^[24][25]

Cleaver has obtained and used open-source tools such as PsExec, Windows Credential Editor, and Mimikatz.^[26]

Cobalt Group has obtained and used a variety of tools including Mimikatz, PsExec, Cobalt Strike, and SDelete.^[27]

CopyKittens has used Metasploit and Empire for post-exploitation activities.^[28]

CostaRicto has obtained open source tools to use in their operations.^[29]

DarkHydrus has obtained and used tools such as Mimikatz, Empire, and Cobalt Strike.^[30]

DarkVishnya has obtained and used tools such as Impacket, Winexe, and PsExec.^[31]

Dragonfly has obtained and used tools such as Mimikatz, CrackMapExec, and PsExec.^[32]

Ferocious Kitten has obtained open source tools for its operations, including JsonCPP and Psiphon.^[33]

FIN10 has relied on publicly-available software to gain footholds and establish persistence in victim environments.^[34]

FIN5 has obtained and used a customized version of PsExec, as well as use other tools such as pwdump, SDelete, and Windows Credential Editor.^[35]

FIN6 has obtained and used tools such as Mimikatz, Cobalt Strike, and AdFind.^[36][37]

Frankenstein has obtained and used Empire to deploy agents.^[38]

GALLIUM has used a variety of widely-available tools, which in some cases they modified to add functionality and/or subvert antimalware solutions.^[39]

Gorgon Group has obtained and used tools such as QuasarRAT and Remcos.^[40]

Inception has obtained and used open-source tools such as LaZagne.^[41]

IndigoZebra has acquired open source tools such as NBTscan and Meterpreter for their operations.^[42][43]

Ke3chang has obtained and used tools such as Mimikatz.^[44]

Kimsuky has obtained and used tools such as Mimikatz and PsExec.^[45]

Leafminer has obtained and used tools such as LaZagne, Mimikatz, PsExec, and MailSniper.^[46]

Magic Hound has obtained and used open-source penetration testing tools like Havij, sqlmap, Metasploit, and Mimikatz.^[47][48]

menuPass has used and modified open-source tools like Impacket, Mimikatz, and pwdump.^[49]

MuddyWater has made use of legitimate tools ConnectWise and RemoteUtilities for access to target environments.^[50]

Night Dragon has obtained and used tools such as gsecdump.^[51]

Patchwork has obtained and used open-source tools such as QuasarRAT.^[52]

PittyTiger has obtained and used tools such as Mimikatz and gsecdump.^[53]

Sandworm Team has acquired open-source tools for some of it's operations; for example it acquired Invoke-PSImage to establish an encrypted channel from a compromised host to Sandworm Team's C2 server as part of its preparation for the 2018 Winter Olympics attack.^[54]

Silence has obtained and modified versions of publicly-available tools like Empire and PsExec.^{[55] [56]}

Silent Librarian has obtained free and publicly available tools including SingleFile and HTTrack to copy login pages of targeted organizations.^[57][58]

TEMP.Veles has obtained and used tools such as Mimikatz and PsExec.^[59]

Threat Group-3390 has obtained and used tools such as Impacket, pwdump, Mimikatz, gsecdump, NBTscan, and Windows Credential Editor.^{[60] [61]}

Thrip has obtained and used tools such as Mimikatz and PsExec.^[62]

Turla has obtained and customized publicly-available tools like Mimikatz.^[63]

Whitefly has obtained and used tools such as Mimikatz.^[64]

WIRTE has obtained and used Empire for post-exploitation activities.^[65]

Wizard Spider has obtained and used publicly-available post-exploitation frameworks and tools like Metasploit, Empire, Mimikatz.^[66]

This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.