Dragonfly has used PowerShell scripts for execution.(Citation: US-CERT TA18-074A)(Citation: Symantec Dragonfly Sept 2017)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network,Office 365,Azure AD,IaaS,Google Workspace|T1059|Command and Scripting Interpreter|

Dragonfly has used the command line for execution.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Office 365,Azure AD,Network|T1110.002|Password Cracking|

Dragonfly has dropped and executed tools used for password cracking, including Hydra and

CrackMapExec.(Citation: US-CERT TA18-074A)(Citation: Kali Hydra)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1071|Application Layer Protocol|

Dragonfly has used SMB for C2.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1560|Archive Collected Data|

Dragonfly has compressed data into .zip files prior to exfiltration.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Dragonfly has added the registry value ntdll to the Registry Run key to establish persistence.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,IaaS,Linux,macOS,Google Workspace,SaaS,Network|T1098|Account Manipulation|

Dragonfly has added newly created accounts to the administrators group to maintain elevated access.(Citation: US-CERT TA18-074A)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1087.002|Domain Account|