menuPass has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as

UPPERCUT.(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: FireEye APT10 Sept 2018)(Citation: Symantec Cicada November 2020)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

menuPass has used a script (atexec.py) to execute a command on a target machine via Task Scheduler.(Citation: PWC Cloud Hopper Technical Annex April 2017)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

menuPass has used RDP connections to move across the victim network.(Citation: PWC Cloud Hopper April 2017)(Citation: District Court of NY APT10 Indictment December 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.002|External Proxy|

menuPass has used a global service provider's IP as a proxy for C2 traffic from a victim.(Citation: FireEye APT10 April 2017)(Citation: FireEye APT10 Sept 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

menuPass has installed updates and new malware on victims.(Citation: PWC Cloud Hopper April 2017)(Citation: District Court of NY APT10 Indictment December 2018)|