Cobalt Group has sent emails containing malicious attachments that require users to execute a file or macro to infect the victim machine.(Citation: Talos Cobalt Group July 2018)(Citation: Unit 42 Cobalt Gang Oct 2018)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

Cobalt Group leveraged an open-source tool called SoftPerfect Network Scanner to perform network scanning.(Citation: PTSecurity Cobalt Group Aug 2017)(Citation: PTSecurity Cobalt Dec 2016)(Citation: Group IB Cobalt Aug 2017)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|

Cobalt Group has created new services to establish persistence.(Citation: Group IB Cobalt Aug 2017)|
|mitre-attack|enterprise-attack|Windows|T1559.002|Dynamic Data Exchange|

Cobalt Group has sent malicious Word OLE compound documents to victims.(Citation: Talos Cobalt Group July 2018)|
|mitre-attack|enterprise-attack|Windows|T1220|XSL Script Processing|

Cobalt Group used msxsl.exe to bypass AppLocker and to invoke Jscript code from an XSL file.(Citation: Talos Cobalt Group July 2018)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution.(Citation: Talos Cobalt Group July 2018)(Citation: PTSecurity Cobalt Group Aug 2017)(Citation: Group IB Cobalt Aug 2017)(Citation: Morphisec Cobalt Gang Oct 2018)(Citation: Unit 42 Cobalt Gang Oct 2018)(Citation: TrendMicro Cobalt Group Nov 2017)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|