Tool: esentutl

Description

[esentutl](https://attack.mitre.org/software/S0404) is a command-line tool that provides database utilities for the Windows Extensible Storage Engine.(Citation: Microsoft Esentutl)

External References

• mitre-attack
• Microsoft Esentutl

Techniques Used by This Tool

• T1003.003 — NTDS
• T1005 — Data from Local System
• T1006 — Direct Volume Access
• T1105 — Ingress Tool Transfer
• T1564.004 — NTFS File Attributes
• T1570 — Lateral Tool Transfer

APT Groups Using This Tool

• Chimera
• menuPass
• INC Ransom