Procedure examples

BRONZE BUTLER has used various tools (such as Mimikatz and WCE) to perform credential dumping.

BRONZE BUTLER has exfiltrated files stolen from local systems.

BRONZE BUTLER has used TROJ_GETVERSION to discover system services.

BRONZE BUTLER typically use ping and Net to enumerate systems.

BRONZE BUTLER downloader code has included "0" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.

BRONZE BUTLER has used steganography in multiple operations to conceal malicious payloads.

BRONZE BUTLER has masked executables with document file icons including Word and Adobe PDF.

BRONZE BUTLER has used Right-to-Left Override to deceive victims into executing several strains of malware.

BRONZE BUTLER has given malware the same name as an existing file on the file share server to cause users to unwittingly launch and install the malware on additional systems.

BRONZE BUTLER has exfiltrated files stolen from file shares.

BRONZE BUTLER has used at to register a scheduled task to execute malware during lateral movement.

BRONZE BUTLER has used schtasks to register a scheduled task to execute malware during lateral movement.

BRONZE BUTLER has used PowerShell for execution.

BRONZE BUTLER has used batch scripts and the command-line interface for execution.

BRONZE BUTLER has used VBS and VBE scripts for execution.

BRONZE BUTLER has made use of Python-based remote access tools.

The BRONZE BUTLER uploader or malware the uploader uses command to delete the RAR archives after they have been exfiltrated.

BRONZE BUTLER malware has used HTTP for C2.

BRONZE BUTLER has placed malware on file shares and given it the same name as legitimate documents on the share.

BRONZE BUTLER has collected a list of files from the victim and uploaded it to its C2 server, and then created a new list of specific files to steal.

BRONZE BUTLER has used net user /domain to identify account information.

BRONZE BUTLER's MSGET downloader uses a dead drop resolver to access malicious payloads.

BRONZE BUTLER has used various tools to download files, including DGet (a similar tool to wget).

BRONZE BUTLER has used a tool to capture screenshots.

BRONZE BUTLER has used net time to check the local time on a target system.

Several BRONZE BUTLER tools encode data with base64 when posting it to a C2 server.

BRONZE BUTLER downloads encoded payloads and decodes them on the victim.

BRONZE BUTLER compromised three Japanese websites using a Flash exploit to perform watering hole attacks.

BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.

BRONZE BUTLER has attempted to get users to launch malicious Microsoft Word attachments delivered via spearphishing emails.

BRONZE BUTLER has used tools to enumerate software installed on an infected host.

BRONZE BUTLER has used a batch script that adds a Registry Run key to establish malware persistence.

BRONZE BUTLER has used a Windows 10 specific tool and xxmm to bypass UAC for privilege escalation.

BRONZE BUTLER has created forged Kerberos Ticket Granting Ticket (TGT) and Ticket Granting Service (TGS) tickets to maintain administrative access.

BRONZE BUTLER has compressed data into password-protected RAR archives prior to exfiltration.

BRONZE BUTLER used spearphishing emails with malicious Microsoft Word attachments to infect victims.

BRONZE BUTLER has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traffic. BRONZE BUTLER has also used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server.

BRONZE BUTLER has used legitimate applications to side-load malicious DLLs.

BRONZE BUTLER has obtained and used open-source tools such as Mimikatz, gsecdump, and Windows Credential Editor.

BRONZE BUTLER has incorporated code into several tools that attempts to terminate anti-virus processes.