Mimikatz.(Citation: Symantec Waterbug Jun 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.007|JavaScript|

Turla has used various JavaScript-based backdoors.(Citation: ESET Turla Mosquito Jan 2018)    |
|mitre-attack|enterprise-attack|Windows,macOS|T1553.006|Code Signing Policy Modification|

Turla has modified variables in kernel memory to turn off Driver Signature Enforcement after exploiting vulnerabilities that obtained kernel mode privileges.(Citation: Unit42 AcidBox June 2020)(Citation: GitHub Turla Driver Loader)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1016.001|Internet Connection Discovery|

Turla has used

Turla has exploited vulnerabilities in the VBoxDrv.sys driver to obtain kernel mode privileges.(Citation: Unit42 AcidBox June 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1059.006|Python|

Turla has used IronPython scripts as part of the

IronNetInjector toolchain to drop payloads.(Citation: Unit 42 IronNetInjector February 2021 )|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.003|Mail Protocols|

Turla has used multiple backdoors which communicate with a C2 server via email attachments.(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1078.003|Local Accounts|

Turla has abused local accounts that have the same password across the victim’s network.(Citation: ESET Crutch December 2020)|
|mitre-attack|enterprise-attack|PRE|T1583.006|Web Services|

Turla has created web accounts including Dropbox and GitHub for C2 and document exfiltration.(Citation: ESET Crutch December 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102|Web Service|