TrickBot modules.(Citation: CrowdStrike Grim Spider May 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Wizard Spider has used HTTP for network communications.(Citation: CrowdStrike Grim Spider May 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|

Wizard Spider has exfiltrated domain credentials and network enumeration information over command and control (C2) channels.(Citation: CrowdStrike Grim Spider May 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1021.001|Remote Desktop Protocol|

Wizard Spider has used RDP for lateral movement.(Citation: CrowdStrike Grim Spider May 2019)(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)(Citation: DFIR Ryuk 2 Hour Speed Run November 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1570|Lateral Tool Transfer|

Wizard Spider has used stolen credentials to copy tools into the

Wizard Spider has installed

TrickBot as a service named ControlServiceA in order to establish persistence.(Citation: CrowdStrike Grim Spider May 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Wizard Spider has used file deletion to remove some modules and configurations from an infected host after use.(Citation: CrowdStrike Grim Spider May 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.001|PowerShell|