Procedure examples

During Operation Wocao, threat actors encrypted IP addresses used for "Agent" proxy hops with RC4.

During Operation Ghost, APT29 used steganography to hide the communications between the implants and their C&C servers.

During C0017, APT41 frequently configured the URL endpoints of their stealthy passive backdoor LOWKEY.PASSIVE to masquerade as normal web application traffic on an infected server.

During SharePoint ToolShell Exploitation, threat actors used Mimikatz to dump LSASS memory.

In the Triton Safety Instrumented System Attack, TEMP.Veles used Mimikatz.

During Cutting Edge, threat actors used Task Manager to dump LSASS memory from Windows devices to disk.

During Operation Digital Eye, threat actors targeted memory from the LSASS process to extract credentials.

During HomeLand Justice, threat actors dumped LSASS memory on compromised hosts.

During the C0032 campaign, TEMP.Veles used Mimikatz and a custom tool, SecHack, to harvest credentials.

During the 2025 Poland Wiper Attacks, the adversaries attempted to dump credentials utilizing LSASS.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used Mimikatz to capture and use legitimate credentials.

During Operation Wocao, threat actors used ProcDump to dump credentials from memory.

During FrostyGoop Incident, the adversary retrieved the contents of the Security Account Manager (SAM) hive in the victim environment for credential capture.

During Operation Digital Eye, threat actors used `reg save` to retrieve credentials from the Security Account Manager (SAM) database.

During Operation CuckooBees, the threat actors leveraged a custom tool to dump OS credentials and used following commands: `reg save HKLM\\SYSTEM system.hiv`, `reg save HKLM\\SAM sam.hiv`, and `reg save HKLM\\SECURITY security.hiv`, to dump SAM, SYSTEM and SECURITY hives.

During APT28 Nearest Neighbor Campaign, APT28 used the following commands to dump SAM, SYSTEM, and SECURITY hives: reg save hklm\sam, reg save hklm\system, and reg save hklm\security.

During the 2025 Poland Wiper Attacks, the adversaries had stolen Security Account Manager (SAM) and SYSTEM registry hives.

During Night Dragon, threat actors dumped account hashes using gsecdump.

During C0017, APT41 copied the `SAM` and `SYSTEM` Registry hives for credential harvesting.

During Operation MidnightEclipse, threat actors obtained active directory credentials via the NTDS.DIT file.

During Cutting Edge, threat actors accessed and mounted virtual hard disk backups to extract
ntds.dit.

During APT28 Nearest Neighbor Campaign, APT28 dumped NTDS.dit through creating volume shadow copies via vssadmin.

During the 2025 Poland Wiper Attacks, the adversaries dumped the entire Active Directory database by extracting the contents of the ntds.dit file.

During C0027, Scattered Spider performed domain replication.

During Operation Wocao, threat actors used Mimikatz's DCSync to dump credentials from the memory of the targeted system.

During the SolarWinds Compromise, APT29 used privileged accounts to replicate directory service data with domain controllers.

During ShadowRay, threat actors used `cat /etc/shadow` to steal password hashes.

During Operation Dream Job, Lazarus Group used malicious Trojans and DLL files to exfiltrate data from an infected host.

During SharePoint ToolShell Exploitation, threat actors extracted information from the compromised systems.

During Frankenstein, the threat actors used Empire to gather various local system information.

During Operation Honeybee, the threat actors collected data from compromised hosts.

During Operation MidnightEclipse, threat actors stole saved cookies and login data from targeted systems.

During Cutting Edge, threat actors stole the running configuration and cache data from targeted Ivanti Connect Secure VPNs.

During the Anthropic AI-orchestrated Campaign, the adversary tasked Claude Code to automatically gather sensitive data stored within the local system to include credentials, system configurations and sensitive operational data.

During C0015, the threat actors obtained files and data from the compromised network.

During the SolarWinds Compromise, APT29 extracted files from compromised networks.

During Operation CuckooBees, the threat actors collected data, files, and other information from compromised networks.

During Night Dragon, the threat actors collected files and other data from compromised systems.

During Operation Wocao, threat actors exfiltrated files and directories of interest from the targeted system.

During C0017, APT41 collected information related to compromised machines as well as Personal Identifiable Information (PII) from victim networks.

During C0026, the threat actors collected documents from compromised hosts.

During CostaRicto, the threat actors collected data and files from compromised networks.

During APT28 Nearest Neighbor Campaign, APT28 accessed volume shadow copies through executing vssadmin in order to dump the NTDS.dit file.

During the 2025 Poland Wiper Attacks, the adversaries copied volume shadow copies through executing `vssadmin` in order to dump the `NTDS.dit` file.

During Operation CuckooBees, the threat actors used the `net start` command as part of their initial reconnaissance.

During Operation Wocao, threat actors used the `tasklist` command to search for one of its backdoors.

During Night Dragon, threat actors used company extranet servers as secondary C2 servers.

During Operation Wocao, the threat actors executed `/c cd /d c:\windows\temp\ & reg query HKEY_CURRENT_USER\Software\<username>\PuTTY\Sessions\` to detect recent PuTTY sessions, likely to further lateral movement.

During RedPenguin, UNC3886 used rootkits such as REPTILE and MEDUSA.

ArcaneDoor included hooking the `processHostScanReply()` function on victim Cisco ASA devices.