Windshift has used malware to identify installed software.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Windshift has used tools to deploy additional payloads to compromised hosts.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|

Windshift has used malware to identify installed AV and commonly used forensic and malware analysis tools.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Windshift has used Visual Basic 6 (VB6) payloads.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Windshift has used tools that communicate with C2 over HTTP.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Windshift has used string encoding with floating point calculations.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1566.003|Spearphishing via Service|

Windshift has used fake personas on social media to engage and target victims.(Citation: SANS Windshift August 2018) |
|mitre-attack|enterprise-attack,mobile-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

Windshift has used compromised websites to register custom URL schemes on a remote system.(Citation: objective-see windtail1 dec 2018)|
|mitre-attack|enterprise-attack,mobile-attack|macOS,Windows|T1036.001|Invalid Code Signature|