Dragonfly has moved laterally via RDP.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows,Linux|T1135|Network Share Discovery|

Dragonfly has identified and browsed file servers in the victim network, sometimes , viewing files pertaining to ICS or Supervisory Control and Data Acquisition (SCADA) systems.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1003.002|Security Account Manager|

Dragonfly has dropped and executed SecretsDump to dump password hashes.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1003.003|NTDS|

Dragonfly has dropped and executed SecretsDump to dump password hashes. They also obtained ntds.dit from domain controllers.(Citation: US-CERT TA18-074A)(Citation: Core Security Impacket)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1003.004|LSA Secrets|

Dragonfly has dropped and executed SecretsDump to dump password hashes.(Citation: US-CERT TA18-074A)(Citation: Core Security Impacket)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1070.001|Clear Windows Event Logs|

Dragonfly has cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Dragonfly has deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|