APT33 has used a variety of publicly available tools like

LaZagne to gather credentials.(Citation: Symantec Elfin Mar 2019)(Citation: FireEye APT33 Guardrail)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers|T1110.003|Password Spraying|

APT33 has used password spraying to gain access to target systems.(Citation: FireEye APT33 Guardrail)(Citation: Microsoft Holmium June 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Containers|T1068|Exploitation for Privilege Escalation|

APT33 has used a publicly available exploit for CVE-2017-0213 to escalate privileges on a local system.(Citation: FireEye APT33 Guardrail)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS|T1573.001|Symmetric Cryptography|

APT33 has used AES for encryption of command and control traffic.(Citation: FireEye APT33 Guardrail)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

APT33 has used base64 to encode payloads.(Citation: FireEye APT33 Guardrail)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1132.001|Standard Encoding|

APT33 has used base64 to encode command and control traffic.(Citation: FireEye APT33 Guardrail)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1053.005|Scheduled Task|

APT33 has created a scheduled task to execute a .vbe file multiple times a day.(Citation: Symantec Elfin Mar 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1048.003|Exfiltration Over Unencrypted Non-C2 Protocol|