APT38 has collected data from a compromised host.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1569.002|Service Execution|

APT38 has created new services or modified existing ones to run executables, commands, or scripts.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1106|Native API|

APT38 has used the Windows API to execute code within a victim's system.(Citation: CISA AA20-239A BeagleBoyz August 2020) |
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

APT38 has used VBScript to execute commands and other operational tasks.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1053.005|Scheduled Task|

APT38 has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.001|PowerShell|

APT38 has used PowerShell to execute commands and other operational tasks.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1218.011|Rundll32|

APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1204.002|Malicious File|