BRONZE BUTLER has used tools to enumerate software installed on an infected host.(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036|Masquerading|

BRONZE BUTLER has masked executables with document file icons including Word and Adobe PDF.(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1059.006|Python|

BRONZE BUTLER has made use of Python-based remote access tools.(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1036.002|Right-to-Left Override|

BRONZE BUTLER has used Right-to-Left Override to deceive victims into executing several strains of malware.(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Windows,Office 365,SaaS,Linux,macOS|T1080|Taint Shared Content|

BRONZE BUTLER has placed malware on file shares and given it the same name as legitimate documents on the share.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

BRONZE BUTLER has used VBS and VBE scripts for execution.(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

BRONZE BUTLER has used

schtasks to register a scheduled task to execute malware during lateral movement.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

BRONZE BUTLER compromised three Japanese websites using a Flash exploit to perform watering hole attacks.(Citation: Symantec Tick Apr 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|