Procedure examples

During Operation Digital Eye, threat actors targeted memory from the LSASS process to extract credentials.

During Operation Digital Eye, threat actors used `reg save` to retrieve credentials from the Security Account Manager (SAM) database.

During Operation Digital Eye, threat actors used Ping for reconnaissance.

During Operation Digital Eye, threat actors moved laterally using RDP.

During Operation Digital Eye, threat actors used `GetUserInfo` to identify current user information.

During Operation Digital Eye, threat actors attempted to make filenames appear legitimate by tailoring them to the victim organization.

During Operation Digital Eye, threat actors used `cmd.exe` as a default method of execution for a custom version of Mimikatz named bK2o.exe.

During Operation Digital Eye, threat actors used the local.exe tool to view group memberships.

During Operation Digital Eye, threat actors deleted files delivered to compromised hosts, often named with the pattern do.* such as do.exe.

During Operation Digital Eye, threat actors used the local.exe tool to view local account information.

During Operation Digital Eye, threat actors used SSH access enabled by authorized_keys files for remote execution.

During Operation Digital Eye, threat actors used native API such as `GetUserInfo`.

During Operation Digital Eye, threat actors used SQL injection to compromise publicly exposed web and database servers.

During Operation Digital Eye, threat actors created Visual Studio Code dev tunnels to access targeted endpoints through the browser-based version of Visual Studio Code.

During Operation Digital Eye, threat actors deployed a PHP-based webshell to maintain persistent access.

During Operation Digital Eye, threat actors created a service named Visual Studio Code Service to run Visual Studio code.

During Operation Digital Eye, threat actors used a pass-the-hash capability to move laterally.

During Operation Digital Eye, threat actors used the winsw tool to deploy a Visual Studio code executable as a Windows service.

During Operation Digital Eye, threat actors used third party tools including custom implementations of Mimikatz.

During Operation Digital Eye, threat actors concealed malicious activity by using terms that aligned with the technological context of the targeted organization.

During Operation Digital Eye, threat actors used the local language of targeted organizations to disguise file system activity.

During Operation Digital Eye, threat actors used public Cloud infrastructure to mask malicious activity.