Procedure examples

Wizard Spider has dumped the lsass.exe memory to harvest credentials with the use of open-source tool LaZagne.

Wizard Spider has acquired credentials from the SAM/SECURITY registry hives.

Wizard Spider has gained access to credentials via exported copies of the ntds.dit Active Directory database. Wizard Spider has also created a volume shadow copy and used a batch script file to collect NTDS.dit with the use of the Windows utility, ntdsutil.

Wizard Spider has collected data from a compromised host prior to exfiltration.

Wizard Spider has used ipconfig to identify the network configuration of a victim machine. Wizard Spider has also used the PowerShell cmdlet `Get-ADComputer` to collect IP address data from Active Directory.

Wizard Spider has used networkdll for network discovery and psfin specifically for financial and point of sale indicators. Wizard Spider has also used AdFind, nltest/dclist, and PowerShell script Get-DataInfo.ps1 to enumerate domain computers, including the domain controller.

Wizard Spider has used the WebDAV protocol to execute Ryuk payloads hosted on network file shares.

Wizard Spider has used RDP for lateral movement and to deploy ransomware interactively.

Wizard Spider has used SMB to drop Cobalt Strike Beacon on a domain controller for lateral movement.

Wizard Spider has used Window Remote Management to move laterally through a victim network.

Wizard Spider used Base64 encoding to obfuscate an Empire service and PowerShell commands.

Wizard Spider has used "whoami" to identify the local user and their privileges.

Wizard Spider has used scheduled tasks to install TrickBot, using task names to appear legitimate such as WinDotNet, GoogleTask, or Sysnetsf. It has also used common document file names for other malware binaries.

Wizard Spider has exfiltrated domain credentials and network enumeration information over command and control (C2) channels.

Wizard Spider has used WMI and LDAP queries for network discovery and to move laterally. Wizard Spider has also used batch scripts to leverage WMIC to deploy ransomware.

Wizard Spider has exfiltrated victim information using FTP.

Wizard Spider has used scheduled tasks to establish persistence for TrickBot and other malware.

Wizard Spider has used process injection to execute payloads to escalate privileges.

Wizard Spider has injected malicious DLLs into memory with read, write, and execute permissions.

Wizard Spider has used macros to execute PowerShell scripts to download malware on victim's machines. It has also used PowerShell to execute commands and move laterally through a victim network.

Wizard Spider has used `cmd.exe` to execute commands on a victim's machine.

Wizard Spider has used file deletion to remove some modules and configurations from an infected host after use.

Wizard Spider has used HTTP for network communications.

Wizard Spider has collected and staged credentials and network enumeration information, using the networkdll and psfin TrickBot modules.

Wizard Spider has staged ZIP files in local directories such as, `C:\PerfLogs\1\` and `C:\User\1\` prior to exfiltration.

Wizard Spider has used valid credentials for privileged accounts with the goal of accessing domain controllers.

Wizard Spider has used administrative accounts, including Domain Admin, to move laterally within a victim network.

Wizard Spider has used Systeminfo and similar commands to acquire detailed configuration information of a victim's machine. Wizard Spider has also utilized the PowerShell cmdlet `Get-ADComputer` to collect DNS hostnames, last logon dates, and operating system information from Active Directory.

Wizard Spider has identified domain admins through the use of `net group "Domain admins" /DOMAIN`. Wizard Spider has also leveraged the PowerShell cmdlet `Get-ADComputer` to collect account names from Active Directory data.

Wizard Spider can transfer malicious payloads such as ransomware to compromised machines.

Wizard Spider has modified the Registry key HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest by setting the UseLogonCredential registry value to 1 in order to force credentials to be stored in clear text in memory. Wizard Spider has also modified the WDigest registry key to allow plaintext credentials to be cached in memory.

Wizard Spider has accessed victim networks by using stolen credentials to access the corporate VPN infrastructure.

Wizard Spider has used the “net view” command to locate mapped network shares.

Wizard Spider has created local administrator accounts to maintain persistence in compromised networks.

Wizard Spider has created and used new accounts within a victim's Active Directory environment to maintain persistence.

Wizard Spider has used batch scripts that utilizes WMIC to execute a BITSAdmin transfer of a ransomware payload to each compromised machine.

Wizard Spider has lured victims into clicking a malicious link delivered through spearphishing.

Wizard Spider has lured victims to execute malware with spearphishing attachments containing macros to download either Emotet, Bokbot, TrickBot, or Bazar.

Wizard Spider has exploited or attempted to exploit Zerologon (CVE-2020-1472) and EternalBlue (MS17-010) vulnerabilities.

Wizard Spider has utilized `rundll32.exe` to deploy ransomware commands with the use of WebDAV.

Wizard Spider has used the icacls command to modify access control to backup servers, providing them with full control of all the system folders.

Wizard Spider has used taskkill.exe and net.exe to stop backup, catalog, cloud, and other services prior to network encryption.

Wizard Spider has used WMIC and vssadmin to manually delete volume shadow copies. Wizard Spider has also used Conti ransomware to delete volume shadow copies automatically with the use of vssadmin.

Wizard Spider has used WMI to identify anti-virus products installed on a victim's machine.

Wizard Spider has utilized the PowerShell script `Get-DataInfo.ps1` to collect installed backup software information from a compromised machine.

Wizard Spider has installed TrickBot as a service named ControlServiceA in order to establish persistence.

Wizard Spider has established persistence via the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and a shortcut within the startup folder.

Wizard Spider has established persistence using Userinit by adding the Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.

Wizard Spider has used the `Invoke-SMBExec` PowerShell cmdlet to execute the pass-the-hash technique and utilized stolen password hashes to move laterally.

Wizard Spider has used PowerShell cmdlets `Get-GPPPassword` and `Find-GPOPassword` to find unsecured credentials in a compromised network group policy.