APT1 as a name for malware.(Citation: Mandiant APT1)(Citation: Mandiant APT1 Appendix)|
|mitre-attack|enterprise-attack|Windows|T1114.001|Local Email Collection|

APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. GETMAIL extracts emails from archived Outlook .pst files.(Citation: Mandiant APT1)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|The

APT1 group is known to have used RDP during operations.(Citation: FireEye PLA)|
|mitre-attack|enterprise-attack|Windows|T1550.002|Pass the Hash|The

APT1 group is known to have used pass the hash.(Citation: Mandiant APT1)|