APT3 has been known to use

PowerShell windows.(Citation: FireEye Operation Double Tap)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.002|External Proxy|An

APT3 downloader establishes SOCKS5 connections for its initial C2.(Citation: FireEye Operation Double Tap)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,IaaS,Linux,macOS,Google Workspace,SaaS,Network|T1098|Account Manipulation|

APT3 has been known to add created accounts to local admin groups to maintain elevated access.(Citation: aptsim)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,Azure AD,Network|T1110.002|Password Cracking|

APT3 has been known to brute force password hashes to be able to leverage plain text credentials.(Citation: APT3 Adversary Emulation Plan)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.005|Indicator Removal from Tools|

APT3 has been known to remove indicators of compromise from tools.(Citation: APT3 Adversary Emulation Plan)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1027.002|Software Packing|

APT3 has been known to pack their tools.(Citation: APT3 Adversary Emulation Plan)(Citation: FireEye Clandestine Wolf) |
|mitre-attack|enterprise-attack|Windows|T1218.011|Rundll32|

APT3 has a tool that can run DLLs.(Citation: FireEye Clandestine Fox)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|

APT3 has been known to side load DLLs with a valid version of Chrome with one of their tools.(Citation: FireEye Clandestine Fox)(Citation: FireEye Clandestine Fox Part 2)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|