Procedure examples

APT38 have enumerated files and directories, or searched in specific locations within a compromised host.

APT3 has a tool that looks for files and directories on the local file system.

Kimsuky has the ability to enumerate all files and directories on an infected system. Kimsuky has used a custom script with a function called CreateFileList() that can scan all filesystem drives, prioritizing C:\Users, to locate files and file extensions of interest that ultimately generates a file called `FileList.txt` saved within the victims %TEMP% Directory that contains the findings and the respective pathways.

admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about files and directories: dir c:\ >> %temp%\download dir "c:\Documents and Settings" >> %temp%\download dir "c:\Program Files\" >> %temp%\download dir d:\ >> %temp%\download

Volt Typhoon has enumerated directories containing vulnerability testing and cyber related content and facilities data such as construction drawings.

A Patchwork payload has searched all fixed drives on the victim for files matching a specified list of extensions.

APT41 has executed file /bin/pwd on exploited victims, perhaps to return architecture related information.

Dragonfly has used a batch script to gather folder and file names from victim hosts.

menuPass has searched compromised systems for folders of interest including those related to HR, audit and expense, and meeting memos.

APT32's backdoor possesses the capability to list files and directories on a machine.

HAFNIUM has searched file contents on a compromised host.

MuddyWater has used malware that checked if the ProgramData folder had folders or files with the keywords "Kasper," "Panda," or "ESET."

Gamaredon Group macros can scan for Microsoft Word and Excel files to inject with additional malicious macros. Gamaredon Group has also used its backdoors to automatically list interesting files (such as Office documents) found on a system. Gamaredon Group has also identified directory trees, folders and files on the compromised host.

Leafminer used a tool called MailSniper to search for files on the desktop and another utility called Sobolsoft to extract attachments from EML files.

TeamTNT has used a script that checks `/proc/*/environ` for environment variables related to AWS.

Sandworm Team has enumerated files on a compromised host.

APT18 can list files information for specific directories.

Sidewinder has used malware to collect information on files and directories.

Mustang Panda has searched the entire target system for DOC, DOCX, PPT, PPTX, XLS, XLSX, and PDF files.

Scattered Spider Spider enumerates a target organization for files and directories of interest, including source code, user provisioning, MFA device registration, network diagrams, and shared credentials in documents or spreadsheets.

APT39 has used tools with the ability to search for files on a compromised host.

UNC3886 has used `vmtoolsd.exe` to enumerate files on guest machines.

Contagious Interview has conducted key word searches within files and directories on a compromised hosts to identify files for exfiltration.

Windigo has used a script to check for the presence of files created by OpenSSH backdoors.

Tropic Trooper has monitored files' modified time.

Aoqin Dragon has run scripts to identify file formats including Microsoft Word.

Ke3chang uses command-line interaction to search files and directories.

Confucius has used a file stealer that checks the Document, Downloads, Desktop, and Picture folders for documents and images with specific extensions.

Winter Vivern delivered malicious JavaScript payloads capable of listing folders and emails in exploited email servers.

Turla surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, the Program Files directory, and Recent. Turla RPC backdoors have also searched for files matching the lPH*.dll pattern.

RedCurl has searched for and collected files on local and network drives.

Lotus Blossom has used commands such as `dir` to examine the local filesystem of victim machines.

Dark Caracal collected file listings of all default Windows directories.

Chimera has utilized multiple commands to identify data of interest in file and directory listings.

MirrorFace has run commands to check the content of folders on compromised hosts and has specifically targeted files with .doc, .ppt, .xls, .jtd, .eml, .xps, and .pdf extensions.

Medusa Group has searched for files within the victim environment for encryption and exfiltration. Medusa Group has also identified files associated with remote management services.

BRONZE BUTLER has collected a list of files from the victim and uploaded it to its C2 server, and then created a new list of specific files to steal.

Darkhotel has used malware that searched for files with specific patterns.

ToddyCat has run scripts to enumerate recently modified documents having either a .pdf, .doc, .docx, .xls or .xlsx extension.

LuminousMoth has used malware that scans for files in the Documents, Desktop, and Download folders and in other drives.

APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection. The group also searched a compromised DCCC computer for specific terms.

APT5 has used the BLOODMINE utility to discover files with .css, .jpg, .png, .gif, .ico, .js, and .jsp extensions in Pulse Secure Connect logs.

Fox Kitten has used WizTree to obtain network files and directory listings.

Winnti Group has used a program named ff.exe to search for specific documents on compromised hosts.

Lazarus Group malware can use a common function to identify target files by their extension, and some also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives.

Sowbug identified and extracted all Word documents on a server by using a command containing * .doc and *.docx. The actors also searched for documents based on a specific date range and attempted to identify all installed software on a victim.

Velvet Ant has enumerated local files and folders on victim devices.

Inception used a file listing plugin to collect information about file and directories both on local and remote drives.

Play has used the Grixba information stealer to list security files and processes.

Magic Hound malware can list a victim's logical drives and the type, as well the total/free space of the fixed devices. Other malware can list a directory's contents.