Silence has used PowerShell to download and execute payloads.(Citation: Cyber Forensicator Silence Jan 2019)(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.007|JavaScript|

Silence has used JS scripts.(Citation: Cyber Forensicator Silence Jan 2019)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Silence has sent emails with malicious DOCX, CHM, LNK and ZIP attachments. (Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

Silence has used scheduled tasks to stage its operation.(Citation: Cyber Forensicator Silence Jan 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Silence has used VBS scripts.(Citation: Cyber Forensicator Silence Jan 2019)|
|mitre-attack|enterprise-attack|Windows|T1569.002|Service Execution|

Silence has used

Winexe to install a service on the remote system.(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Silence has used Windows command-line to run commands.(Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Silence attempts to get users to launch malicious attachments delivered via spearphishing emails.(Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows|T1218.001|Compiled HTML File|