FIN7 has performed C2 using DNS via A, OPT, and TXT records.(Citation: FireEye FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1113|Screen Capture|

FIN7 captured screenshots and desktop video recordings.(Citation: DOJ FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|

FIN7 has used fragmented strings, environment variables, standard input (stdin), and native character-replacement functionalities to obfuscate commands.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye FIN7 Aug 2018)(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1559.002|Dynamic Data Exchange|

FIN7 spear phishing campaigns have included malicious Word documents with DDE execution.(Citation: CyberScoop FIN7 Oct 2017)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1218.005|Mshta|

FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.(Citation: FireEye FIN7 April 2017)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.001|PowerShell|

FIN7 used a PowerShell script to launch shellcode that retrieved an additional payload.(Citation: FireEye FIN7 April 2017)(Citation: Morphisec FIN7 June 2017)(Citation: FBI Flash FIN7 USB)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.(Citation: FireEye FIN7 April 2017)(Citation: FireEye FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1053.005|Scheduled Task|