APT3 has been known to create or enable accounts, such as

APT3 replaces the Sticky Keys binary

APT3 has used tools to compress data before exfilling it.(Citation: aptsim)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

APT3 has a tool that can copy files to remote machines.(Citation: FireEye Clandestine Fox)|
|mitre-attack|enterprise-attack|Windows|T1021.002|SMB/Windows Admin Shares|

APT3 will copy files over to Windows Admin Shares (like ADMIN$) as part of lateral movement.(Citation: Symantec Buckeye)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

APT3 has a tool that looks for files and directories on the local file system.(Citation: FireEye Clandestine Fox)(Citation: evolution of pirpi)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

APT3 has a tool that can detect the existence of remote systems.(Citation: Symantec Buckeye)(Citation: FireEye Clandestine Fox)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

APT3 enables the Remote Desktop Protocol for persistence.(Citation: aptsim)

APT3 has also interacted with compromised systems to browse and copy files through RDP sessions.(Citation: Twitter Cglyer Status Update APT3 eml)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers|T1069|Permission Groups Discovery|

APT3 has a tool that can enumerate the permissions associated with Windows groups.(Citation: Symantec Buckeye)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|