APT29 used Kerberos ticket attacks for lateral movement.(Citation: Mandiant No Easy Breach)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

APT29 used WMI to steal credentials and execute backdoors at a future time.(Citation: Mandiant No Easy Breach)|
|mitre-attack|enterprise-attack|Windows|T1548.002|Bypass User Account Control|

APT29 has bypassed UAC.(Citation: Mandiant No Easy Breach)|
|mitre-attack|enterprise-attack|Windows|T1546.003|Windows Management Instrumentation Event Subscription|

APT29 has used WMI event subscriptions for persistence.(Citation: Mandiant No Easy Breach)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

APT29 added Registry Run keys to establish persistence.(Citation: Mandiant No Easy Breach)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

APT29 has used named and hijacked scheduled tasks to establish persistence.(Citation: Mandiant No Easy Breach)|
|mitre-attack|enterprise-attack|Windows|T1546.008|Accessibility Features|

APT29 used sticky-keys to obtain unauthenticated, privileged console access.(Citation: Mandiant No Easy Breach)(Citation: FireEye APT29 Domain Fronting)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

APT29 has used encoded PowerShell scripts uploaded to

CozyCar installations to download and install

SeaDuke.(Citation: Symantec Seaduke 2015)(Citation: Mandiant No Easy Breach)(Citation: ESET T3 Threat Report 2021)(Citation: Secureworks IRON HEMLOCK Profile)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

APT29 has used

SDelete to remove artifacts from victim networks.(Citation: Mandiant No Easy Breach)|