Axiom has been known to dump credentials.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Windows|T1546.008|Accessibility Features|

Axiom actors have been known to use the Sticky Keys replacement within RDP sessions to obtain persistence.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

Axiom has used RDP during operations.(Citation: Novetta-Axiom)|