Chimera has gathered the SYSTEM registry and ntds.dit files from target systems.(Citation: Cycraft Chimera April 2020)

Chimera specifically has used the NtdsAudit tool to dump the password hashes of domain users via

Chimera has has used

Chimera has used WMIC to execute remote commands.(Citation: Cycraft Chimera April 2020)(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

Chimera has used a valid account to maintain persistence via scheduled task.(Citation: Cycraft Chimera April 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Chimera has remotely copied tools and malware onto targeted systems.(Citation: Cycraft Chimera April 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

Chimera has used gzip for Linux OS and a modified RAR software to archive data on Windows hosts.(Citation: Cycraft Chimera April 2020)(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

Chimera has used RDP to access targeted systems.(Citation: Cycraft Chimera April 2020)|