APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. MAPIGET steals email still on Exchange servers that has not yet been archived.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

APT1 gathered a list of running processes on the system using

APT1 listed connected network shares.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

APT1 used the

APT1 used a batch script to perform a series of discovery techniques and saves it to a text file.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.001|Local Account|

APT1 used the commands

APT1 used the

APT1 used the commands

APT1 has collected files from a local victim.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

APT1 has used RAR to compress files before moving them outside of the victim network.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

APT1 has been known to use credential dumping using

Mimikatz.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|The file name AcroRD32.exe, a legitimate process name for Adobe's Acrobat Reader, was used by

APT1 as a name for malware.(Citation: Mandiant APT1)(Citation: Mandiant APT1 Appendix)|
|mitre-attack|enterprise-attack|Windows|T1114.001|Local Email Collection|