Magic Hound has used rundll32.exe to execute MiniDump from comsvcs.dll when dumping LSASS memory.(Citation: DFIR Report APT35 ProxyShell March 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1136.001|Local Account|

Magic Hound has created local accounts named

Magic Hound has used Powershell to discover email accounts.(Citation: DFIR Report APT35 ProxyShell March 2022)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

Magic Hound has used a tool to run

Magic Hound has added the following rule to a victim's Windows firewall to allow RDP traffic -

Magic Hound has modified Registry settings for security tools.(Citation: DFIR Report APT35 ProxyShell March 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1070.003|Clear Command History|

Magic Hound has removed mailbox export requests from compromised Exchange servers.(Citation: DFIR Report APT35 ProxyShell March 2022)|
|mitre-attack|enterprise-attack|Office 365,Windows,Google Workspace|T1114.002|Remote Email Collection|

Magic Hound has exported emails from compromised Exchange servers including through use of the cmdlet

Magic Hound has used a web shell to exfiltrate a ZIP file containing a dump of LSASS memory on a compromised machine.(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows,Office 365,IaaS,Linux,macOS,Containers,Network|T1562|Impair Defenses|

Magic Hound has disabled LSA protection on compromised hosts using

Magic Hound has used

Magic Hound has used scheduled tasks to establish persistence and execution.(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|