Axiom has used previously compromised administrative accounts to escalate privileges.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|PRE|T1584.005|Botnet|

Axiom has used large groups of compromised machines for use as proxy nodes.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1553|Subvert Trust Controls|

Axiom has used digital certificates to deliver malware.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

Axiom has used watering hole attacks to gain access.(Citation: Cisco Group 72)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,SaaS,Office 365,Google Workspace|T1566|Phishing|

Axiom has used spear phishing to initially compromise victims.(Citation: Cisco Group 72)(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

Axiom has used exploits for multiple vulnerabilities including CVE-2014-0322, CVE-2012-4792, CVE-2012-1889, and CVE-2013-3893.(Citation: Cisco Group 72)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1001.002|Steganography|

Axiom has used steganography to hide its C2 communications.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

Axiom has been observed using SQL injection to gain access to systems.(Citation: Novetta-Axiom)(Citation: Cisco Group 72)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1003|OS Credential Dumping|