APT3 obfuscates files or information to help evade defensive measures.(Citation: Symantec Buckeye)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

APT3 has a tool that can enumerate current network connections.(Citation: Symantec Buckeye)(Citation: FireEye Clandestine Fox)(Citation: evolution of pirpi)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1078.002|Domain Accounts|

APT3 leverages valid accounts after gaining credentials for use within the victim domain.(Citation: Symantec Buckeye)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

APT3 has been known to stage files for exfiltration in a single location.(Citation: aptsim)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

APT3 has used a keylogging tool that records keystrokes in encrypted files.(Citation: Symantec Buckeye)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

APT3 has used a tool to dump credentials by injecting itself into lsass.exe and triggering with the argument "dig."(Citation: Symantec Buckeye)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.001|Local Account|

APT3 has used a tool that can obtain info about local and global group users, power users, and administrators.(Citation: Symantec Buckeye)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|A keylogging tool used by

APT3 gathers network information from the victim, including the MAC address, IP address, WINS, DHCP server, and gateway.(Citation: Symantec Buckeye)(Citation: evolution of pirpi)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1104|Multi-Stage Channels|An