DarkVishnya used PowerShell to create shellcode loaders.(Citation: Securelist DarkVishnya Dec 2018)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|

DarkVishnya created new services for shellcode loaders distribution.(Citation: Securelist DarkVishnya Dec 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1571|Non-Standard Port|

DarkVishnya used ports 5190 and 7900 for shellcode listeners, and 4444, 4445, 31337 for shellcode C2.(Citation: Securelist DarkVishnya Dec 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1135|Network Share Discovery|

DarkVishnya scanned the network for public shared folders.(Citation: Securelist DarkVishnya Dec 2018)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1200|Hardware Additions|

DarkVishnya used Bash Bunny, Raspberry Pi, netbooks or inexpensive laptops to connect to the company’s local network.(Citation: Securelist DarkVishnya Dec 2018)|