Silence has used

Silence has downloaded additional modules and malware to victim’s machines.(Citation: Group IB Silence Sept 2018)  |
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

Silence has used RDP for lateral movement.(Citation: Group IB Silence Sept 2018) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

Silence has used Nmap to scan the corporate network, build a network topology, and identify vulnerable hosts.(Citation: Group IB Silence Sept 2018)  |
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

Silence has used the Farse6.1 utility (based on

Mimikatz) to extract credentials from lsass.exe.(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|

Silence can create, delete, or modify a specified Registry key or value.(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Silence has named its backdoor "WINWORD.exe".(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

Silence has used compromised credentials to log on to other systems and escalate privileges.(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

Silence has used a valid certificate to sign their primary loader Silence.Downloader (aka TrueBot).(Citation: Group IB Silence Aug 2019)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|