Procedure examples

Inception used a file hunting plugin to collect .txt, .pdf, .xls or .doc files from the infected host.

Inception has encrypted malware payloads dropped on victim machines with AES and RC4 encryption.

Inception has used a reconnaissance module to identify active processes and other associated loaded modules.

Inception has used PowerShell to execute malicious commands and payloads.

Inception has used VBScript to execute malicious commands and payloads.

Inception has used specific malware modules to gather domain membership.

Inception has used HTTP, HTTPS, and WebDav in network communications.

Inception has used a reconnaissance module to gather information about the operating system and hardware on the infected host.

Inception used a file listing plugin to collect information about file and directories both on local and remote drives.

Inception used chains of compromised routers to proxy C2 communications between them and cloud service providers.

Inception has incorporated at least five different cloud service providers into their C2 infrastructure including CloudMe.

Inception has exploited CVE-2012-0158, CVE-2014-1761, CVE-2017-11882 and CVE-2018-0802 for execution.

Inception lured victims into clicking malicious files for machine reconnaissance and to execute malware.

Inception has used malicious HTA files to drop and execute malware.

Inception has ensured persistence at system boot by setting the value regsvr32 %path%\ctfmonrn.dll /s.

Inception has used decoy documents to load malicious remote payloads via HTTP.

Inception has enumerated installed software on compromised systems.

Inception has maintained persistence by modifying Registry run key value
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\.

Inception used a browser plugin to steal passwords and sessions from Internet Explorer, Chrome, Opera, Firefox, Torch, and Yandex.

Inception has used weaponized documents attached to spearphishing emails for reconnaissance and initial compromise.

Inception has encrypted network communications with AES.

Inception has obtained and used open-source tools such as LaZagne.