Chimera has used Windows admin shares to move laterally.(Citation: Cycraft Chimera April 2020)(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1106|Native API|

Chimera has used direct Windows system calls by leveraging Dumpert.(Citation: Cycraft Chimera April 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

Chimera has used legitimate credentials to login to an external VPN, Citrix, SSH, and other remote services.(Citation: Cycraft Chimera April 2020)(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

Chimera has used scheduled tasks to invoke Cobalt Strike including through batch script

Chimera has used PowerShell scripts to execute malicious payloads and the DSInternals PowerShell module to make use of Active Directory features.(Citation: Cycraft Chimera April 2020)(Citation: NCC Group Chimera January 2021) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|

Chimera has encoded PowerShell commands.(Citation: Cycraft Chimera April 2020)   |
|mitre-attack|enterprise-attack|Windows|T1556.001|Domain Controller Authentication|

Chimera's malware has altered the NTLM authentication program on domain controllers to allow

Chimera to login without a valid credential.(Citation: Cycraft Chimera April 2020)    |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Chimera has renamed malware to GoogleUpdate.exe and WinRAR to jucheck.exe, RecordedTV.ms, teredo.tmp, update.exe, and msadcs1.exe.(Citation: Cycraft Chimera April 2020)|
|mitre-attack|enterprise-attack|Windows|T1003.003|NTDS|