Cobalt Group used the Ammyy Admin tool as well as TeamViewer for remote access, including to preserve remote access if a Cobalt Strike module was lost.(Citation: PTSecurity Cobalt Group Aug 2017)(Citation: PTSecurity Cobalt Dec 2016)(Citation: Group IB Cobalt Aug 2017)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Cobalt Group has used Registry Run keys for persistence. The group has also set a Startup path to launch the PowerShell shell command and download Cobalt Strike.(Citation: Group IB Cobalt Aug 2017)|
|mitre-attack|enterprise-attack|Windows|T1218.003|CMSTP|

Cobalt Group has used the command

Cobalt Group has used public sites such as github.com and sendspace.com to upload files and then download them to victim computers.(Citation: PTSecurity Cobalt Group Aug 2017)(Citation: PTSecurity Cobalt Dec 2016) The group's JavaScript backdoor is also capable of downloading files.(Citation: Morphisec Cobalt Gang Oct 2018)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Cobalt Group has used powershell.exe to download and execute scripts.(Citation: Talos Cobalt Group July 2018)(Citation: PTSecurity Cobalt Group Aug 2017)(Citation: PTSecurity Cobalt Dec 2016)(Citation: Group IB Cobalt Aug 2017)(Citation: RiskIQ Cobalt Jan 2018)(Citation: TrendMicro Cobalt Group Nov 2017)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

Cobalt Group has used Remote Desktop Protocol to conduct lateral movement.(Citation: Group IB Cobalt Aug 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|