TA505 has used a variety of tools in their operations, including

AdFind,

BloodHound,

Mimikatz, and

PowerSploit.(Citation: NCC Group TA505)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

TA505 has decrypted packed DLLs with an XOR key.(Citation: NCC Group TA505)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|

TA505 has used malware to disable Windows Defender through modification of the Registry.(Citation: Korean FSI TA505 2020)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

TA505 has registered domains to impersonate services such as Dropbox to distribute malware.(Citation: Korean FSI TA505 2020)|
|mitre-attack|enterprise-attack|Windows|T1553.005|Mark-of-the-Web Bypass|

TA505 has used .iso files to deploy malicious .lnk files.(Citation: TrendMicro TA505 Aug 2019)|
|mitre-attack|enterprise-attack|Windows|T1055.001|Dynamic-link Library Injection|

TA505 has been seen injecting a DLL into winword.exe.(Citation: IBM TA505 April 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

TA505 has used HTTP to communicate with C2 nodes.(Citation: IBM TA505 April 2020)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1027.002|Software Packing|

TA505 has used UPX to obscure malicious code.(Citation: IBM TA505 April 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1078.002|Domain Accounts|

TA505 has used stolen domain admin accounts to compromise additional hosts.(Citation: IBM TA505 April 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers|T1069|Permission Groups Discovery|