Dragonfly has commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Dragonfly has used batch scripts to enumerate network information, including information about trusts, zones, and the domain.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

Dragonfly has likely obtained a list of hosts in the victim environment.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1053.005|Scheduled Task|

Dragonfly has used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1012|Query Registry|

Dragonfly has queried the Registry to identify victim information.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1069.002|Domain Groups|

Dragonfly has used batch scripts to enumerate administrators and users in the domain.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1598.003|Spearphishing Link|

Dragonfly has used spearphishing with PDF attachments containing malicious links that redirected to credential harvesting websites.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1598.002|Spearphishing Attachment|

Dragonfly has used spearphishing with Microsoft Office attachments to enable harvesting of user credentials.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1021.001|Remote Desktop Protocol|