Earth Lusca  has sent spearphishing emails that required the user to click on a malicious link and subsequently open a decoy document with a malicious loader.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1047|Windows Management Instrumentation|

Earth Lusca used a VBA script to execute WMI.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,Windows,macOS|T1059.006|Python|

Earth Lusca used Python scripts for port scanning or building reverse shells.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

Earth Lusca has used WinRAR to compress stolen files into an archive prior to exfiltration.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1003.001|LSASS Memory|

Earth Lusca has used ProcDump to obtain the hashes of credentials by dumping the memory of the LSASS process.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1003.006|DCSync|

Earth Lusca has used a

Mimikatz to retrieve credentials from an exploited controller.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1548.002|Bypass User Account Control|

Earth Lusca has used the Fodhelper UAC bypass technique to gain elevated privileges.(Citation: TrendMicro EarthLusca 2022)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Earth Lusca used the command

Earth Lusca used the command