menuPass has leveraged vulnerabilities in Pulse Secure VPNs to hijack sessions.(Citation: Securelist APT10 March 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

menuPass has used and modified open-source tools like

Impacket,

Mimikatz, and

pwdump.(Citation: PWC Cloud Hopper Technical Annex April 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1568.001|Fast Flux DNS|

menuPass has used dynamic DNS service providers to host malicious domains.(Citation: District Court of NY APT10 Indictment December 2018)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

menuPass has registered malicious domains for use in intrusion campaigns.(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

menuPass has searched compromised systems for folders of interest including those related to HR, audit and expense, and meeting memos.(Citation: Symantec Cicada November 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1106|Native API|

menuPass has used native APIs including

menuPass has used Ntdsutil to dump credentials.(Citation: Symantec Cicada November 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1210|Exploitation of Remote Services|

menuPass has used tools to exploit the ZeroLogon vulnerability (CVE-2020-1472).(Citation: Symantec Cicada November 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,IaaS,SaaS|T1119|Automated Collection|

menuPass has used the Csvde tool to collect Active Directory files and data.(Citation: Symantec Cicada November 2020)|
|mitre-attack|enterprise-attack|Windows|T1218.004|InstallUtil|

menuPass has used