APT18 can collect system information from the victim’s machine.(Citation: PaloAlto DNS Requests May 2016)|
|mitre-attack|enterprise-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

APT18 actors leverage legitimate credentials to log into external remote services.(Citation: RSA2017 Detect and Respond Adair)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1053.002|At|

APT18 actors used the native

at Windows task scheduler tool to use scheduled tasks for execution on a victim network.(Citation: Dell Lateral Movement)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

APT18 actors leverage legitimate credentials to log into external remote services.(Citation: RSA2017 Detect and Respond Adair)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

APT18 actors deleted tools and batch files from victim systems.(Citation: Dell Lateral Movement)|