Fox Kitten has searched local system resources to access sensitive documents.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1039|Data from Network Shared Drive|

Fox Kitten has searched network shares to access sensitive documents.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,SaaS,Office 365,Google Workspace,IaaS|T1213|Data from Information Repositories|

Fox Kitten has accessed victim security and IT environments and Microsoft Teams to mine valuable information.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1021.005|VNC|

Fox Kitten has installed TightVNC server and client on compromised servers and endpoints for lateral movement.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS|T1021.004|SSH|

Fox Kitten has used the PuTTY and Plink tools for lateral movement.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Windows|T1021.002|SMB/Windows Admin Shares|

Fox Kitten has used valid accounts to access SMB shares.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1217|Browser Information Discovery|

Fox Kitten has used Google Chrome bookmarks to identify internal resources and assets.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|