HAFNIUM has checked for network connectivity from a compromised host using

HAFNIUM has used

HAFNIUM has used

HAFNIUM has enumerated domain controllers using

HAFNIUM has granted privileges to domain accounts.(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

HAFNIUM has used

HAFNIUM has used

HAFNIUM has downloaded malware and tools--including Nishang and PowerCat--onto a compromised host.(Citation: Microsoft HAFNIUM March 2020)(Citation: Rapid7 HAFNIUM Mar 2021) |
|mitre-attack|enterprise-attack|Windows,Linux,macOS,Network|T1095|Non-Application Layer Protocol|

HAFNIUM has used TCP for C2.(Citation: Microsoft HAFNIUM March 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1132.001|Standard Encoding|

HAFNIUM has used ASCII encoding for C2 traffic.(Citation: Microsoft HAFNIUM March 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1078.003|Local Accounts|

HAFNIUM has used the NT AUTHORITY\SYSTEM account to create files on Exchange servers.(Citation: FireEye Exchange Zero Days March 2021)|
|mitre-attack|enterprise-attack|PRE|T1590.005|IP Addresses|

HAFNIUM has obtained IP addresses for publicly-accessible Exchange servers.(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1136.002|Domain Account|

HAFNIUM has created domain accounts.(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|PRE|T1590|Gather Victim Network Information|