Procedure examples

Indrik Spider used Cobalt Strike to carry out credential dumping using ProcDump.

Indrik Spider has used the win32_service WMI class to retrieve a list of services from the system.

Indrik Spider has used a service account to extract copies of the `Security` Registry hive.

Indrik Spider has used PowerView to enumerate all Windows Server, Windows Server 2003, and Windows 7 instances in the Active Directory database.

Indrik Spider has used RDP for lateral movement.

Indrik Spider has used SSH for lateral movement.

Indrik Spider used fake updates for FlashPlayer plugin and Google Chrome as initial infection vectors.

Indrik Spider has used WMIC to execute commands on remote computers.

Indrik Spider has used PowerShell Empire for execution of malware.

Indrik Spider has used batch scripts on victim's machines.

Indrik Spider has used malicious JavaScript files for several components of their attack.

Indrik Spider has stored collected data in a .tmp file.

Indrik Spider has used valid accounts for initial access and lateral movement. Indrik Spider has also maintained access to the victim environment through the VPN infrastructure.

Indrik Spider has collected credentials from infected systems, including domain accounts.

Indrik Spider has downloaded additional scripts, malware, and tools onto a compromised host.

Indrik Spider has modified registry keys to prepare for ransomware execution and to disable common administrative utilities.

Indrik Spider used wmic.exe to add a new user to the system.

Indrik Spider has created local system accounts and has added the accounts to privileged groups.

Indrik Spider has attempted to get users to click on a malicious zipped file.

Indrik Spider has used Group Policy Objects to deploy batch scripts.

Indrik Spider has encrypted domain-controlled systems using BitPaymer. Additionally, Indrik Spider used PsExec to execute a ransomware script.

Indrik Spider has used PsExec to stop services prior to the execution of ransomware.

Indrik Spider has searched files to obtain and exfiltrate credentials.

Indrik Spider has accessed and exported passwords from password managers.

Indrik Spider has conducted Kerberoasting attacks using a module from GitHub.

Indrik Spider has exfiltrated data using Rclone or MEGASync prior to deploying ransomware.

Indrik Spider has purchased access to victim VPNs to facilitate access to victim environments.

Indrik Spider has served fake updates via legitimate websites that have been compromised.

Indrik Spider has created email accounts to communicate with their ransomware victims, to include providing payment and decryption details.

Indrik Spider has developed malware for their operations, including ransomware such as BitPaymer and WastedLocker.

Indrik Spider has downloaded tools, such as the Advanced Port Scanner utility and Lansweeper, to conduct internal reconnaissance of the victim network. Indrik Spider has also accessed the victim’s VMware VCenter, which had information about host configuration, clusters, etc.

Indrik Spider used PsExec to leverage Windows Defender to disable scanning of all downloaded files and to restrict real-time monitoring. Indrik Spider has used `MpCmdRun` to revert the definitions in Microsoft Defender. Additionally, Indrik Spider has used WMI to stop or uninstall and reset anti-virus products and other defensive services.

Indrik Spider has used Cobalt Strike to empty log files. Additionally, Indrik Spider has cleared all event logs using `wevutil`.