Ke3chang has developed custom malware that allowed them to maintain persistence on victim networks.(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

Ke3chang has obtained and used tools such as

Mimikatz.(Citation: NCC Group APT15 Alive and Strong)|
|mitre-attack|enterprise-attack|Windows|T1003.004|LSA Secrets|

Ke3chang has dumped credentials, including by using gsecdump.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)|
|mitre-attack|enterprise-attack|Windows|T1003.002|Security Account Manager|

Ke3chang has dumped credentials, including by using gsecdump.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.001|Local Account|

Ke3chang performs account discovery using commands such as

Ke3chang malware RoyalDNS has used DNS for C2.(Citation: NCC Group APT15 Alive and Strong)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1036.002|Right-to-Left Override|

Ke3chang has used the right-to-left override character in spearphishing attachment names to trick targets into executing .scr and .exe files.(Citation: Mandiant Operation Ke3chang November 2014)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|

Ke3chang backdoor RoyalDNS established persistence through adding a service called

Ke3chang has used network scanning and enumeration tools, including

Ping.(Citation: NCC Group APT15 Alive and Strong)|
|mitre-attack|enterprise-attack|Windows,Office 365|T1213.002|Sharepoint|