APT19 used an HTTP malware variant and a Port 22 malware variant to collect the MAC address and IP address from the victim’s machine.(Citation: Unit 42 C0d0so0 Jan 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network,Office 365,Azure AD,IaaS,Google Workspace|T1059|Command and Scripting Interpreter|

APT19 downloaded and launched code within a SCT file.(Citation: FireEye APT19)|
|mitre-attack|enterprise-attack|Windows|T1218.010|Regsvr32|

APT19 used Regsvr32 to bypass application control techniques.(Citation: FireEye APT19)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1132.001|Standard Encoding|An

APT19 HTTP malware variant used Base64 to encode communications to the C2 server.(Citation: Unit 42 C0d0so0 Jan 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

APT19 used Base64 to obfuscate payloads.(Citation: FireEye APT19)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

APT19 performed a watering hole attack on forbes.com in 2014 to compromise targets.(Citation: Unit 42 C0d0so0 Jan 2016)|
|mitre-attack|enterprise-attack|Windows|T1218.011|Rundll32|

APT19 configured its payload to inject into the rundll32.exe.(Citation: FireEye APT19)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|

APT19 uses a Port 22 malware variant to modify several Registry keys.(Citation: Unit 42 C0d0so0 Jan 2016)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|An