APT3 has a tool that can obtain information about the local system.(Citation: Symantec Buckeye)(Citation: evolution of pirpi)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers|T1552.001|Credentials In Files|

APT3 has a tool that can locate credentials in files on the file system such as those from Firefox or Chrome.(Citation: Symantec Buckeye)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

APT3 will identify Microsoft Office documents on the victim's computer.(Citation: aptsim)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

APT3 has a tool that can delete files.(Citation: FireEye Clandestine Fox)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|

APT3 has a tool that exfiltrates data over the C2 channel.(Citation: FireEye Clandestine Fox)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|

APT3 has a tool that creates a new service for persistence.(Citation: FireEye Operation Double Tap)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

APT3 has a tool that can list out currently running processes.(Citation: FireEye Clandestine Fox)(Citation: evolution of pirpi)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

APT3 places scripts in the startup folder for persistence.(Citation: FireEye Operation Double Tap)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1136.001|Local Account|

APT3 has been known to create or enable accounts, such as

APT3 replaces the Sticky Keys binary