GALLIUM used a modified version of

Mimikatz along with a PowerShell-based

Mimikatz to dump credentials on the victim machines.(Citation: Cybereason Soft Cell June 2019)(Citation: Microsoft GALLIUM December 2019)|
|mitre-attack|enterprise-attack|Windows|T1003.002|Security Account Manager|

GALLIUM used

GALLIUM used the Windows command shell to execute commands.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

GALLIUM used WMI for execution to assist in lateral movement as well as for installing tools across multiple assets.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

GALLIUM used PowerShell for execution to assist in lateral movement as well as for dumping credentials stored on compromised machines.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

GALLIUM used Web shells to persist in victim environments and assist in execution and exfiltration.(Citation: Cybereason Soft Cell June 2019)(Citation: Microsoft GALLIUM December 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1136.002|Domain Account|

GALLIUM created high-privileged domain user accounts to maintain access to victim networks.(Citation: Cybereason Soft Cell June 2019)(Citation: Microsoft GALLIUM December 2019)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

GALLIUM leveraged valid accounts to maintain access to a victim network.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|

GALLIUM used DLL side-loading to covertly load