Ping.(Citation: NCC Group APT15 Alive and Strong)|
|mitre-attack|enterprise-attack|Windows,Office 365|T1213.002|Sharepoint|

Ke3chang used a SharePoint enumeration and data dumping tool known as spwebmember.(Citation: NCC Group APT15 Alive and Strong)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Ke3chang malware including RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer (IE) by using the COM interface IWebBrowser2.(Citation: NCC Group APT15 Alive and Strong)(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

Ke3chang has used keyloggers.(Citation: NCC Group APT15 Alive and Strong)(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|Windows|T1558.001|Golden Ticket|

Ke3chang has used

Mimikatz to generate Kerberos golden tickets.(Citation: NCC Group APT15 Alive and Strong)|
|mitre-attack|enterprise-attack|Windows|T1569.002|Service Execution|

Ke3chang has used a tool known as RemoteExec (similar to

PsExec) to remotely execute batch scripts and binaries.(Citation: NCC Group APT15 Alive and Strong)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Ke3chang has used batch scripts in its malware to install persistence mechanisms.(Citation: NCC Group APT15 Alive and Strong)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|Several

Ke3chang backdoors achieved persistence by adding a Run key.(Citation: NCC Group APT15 Alive and Strong)|
|mitre-attack|enterprise-attack|Office 365,Windows,Google Workspace|T1114.002|Remote Email Collection|