Procedure examples

Leviathan performed host enumeration and data gathering operations on victim machines during Leviathan Australian Intrusions.

During Operation Dream Job, Lazarus Group conducted word searches within documents on a compromised host in search of security and financial matters.

KV Botnet Activity gathers a list of filenames from the following locations during execution of the final botnet stage: \/usr\/sbin\/, \/usr\/bin\/, \/sbin\/, \/pfrm2.0\/bin\/, \/usr\/local\/bin\/.

During SharePoint ToolShell Exploitation, threat actors leveraged commands to locate accessible file shares, backup paths, or SharePoint content.

During Operation Honeybee, the threat actors used a malicious DLL to search for files with specific keywords.

During the Anthropic AI-orchestrated Campaign, the adversary leveraged Claude Code to identify sensitive data within the victim environment for extraction.

During C0015, the threat actors conducted a file listing discovery against multiple hosts to ensure locker encryption was successful.

During the SolarWinds Compromise, APT29 obtained information about the configured Exchange virtual directory using `Get-WebServicesVirtualDirectory`.

During Operation AkaiRyū, MirrorFace enumerated file system details in compromised environments.

During Operation CuckooBees, the threat actors used `dir c:\\` to search for files.

During Salesforce Data Exfiltration, threat actors queried customers' Salesforce environments to identify sensitive information for exfiltration.

During the 2025 Poland Wiper Attacks, the adversaries obtained the contents of users’ directories using `dir /s /b C:\Users` command.

During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and browse the victim file system.

During Operation Wocao, threat actors gathered a recursive directory listing to find files and directories of interest.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to query internal database user account tables to enumerate accounts and identify high-privilege accounts within compromised environments.

During the SolarWinds Compromise, APT29 obtained a list of users and their roles from an Exchange server using `Get-ManagementRoleAssignment`.

During Operation Digital Eye, threat actors used the local.exe tool to view local account information.

During Operation CuckooBees, the threat actors used the `net user` command to gather account information.

During Operation Dream Job, Lazarus Group queried compromised victim's active directory servers to obtain the list of employees including administrator accounts.

During the SolarWinds Compromise, APT29 used PowerShell to discover domain accounts by exectuing `Get-ADUser` and `Get-ADGroupMember`.

During Operation CuckooBees, the threat actors used the `dsquery` and `dsget` commands to get domain environment information and to query users in administrative groups.

During Operation Wocao, threat actors used the `net` command to retrieve information about domain accounts.

During HomeLand Justice, threat actors used compromised Exchange accounts to search mailboxes for administrator accounts.

During C0027, Scattered Spider accessed Azure AD to identify email addresses.

During C0027, Scattered Spider accessed Azure AD to download bulk lists of group members and to identify privileged users, along with the email addresses and AD attributes.

During SharePoint ToolShell Exploitation, threat actors used Fast Reverse Proxy to communicate with C2.

Mustang Panda proxied communication through the Cloudflare CDN service during RedDelta Modified PlugX Infection Chain Operations.

During RedPenguin, UNC3886 used malware capable of establishing a SOCKS proxy connection to a specified IP and port.

For Operation Sharpshooter, the threat actors used the ExpressVPN service to hide their location.

During Operation MidnightEclipse, threat actors used the GO Simple Tunnel reverse proxy tool.

During Salesforce Data Exfiltration, threat actors used Mullvad VPN IPs to proxy voice phishing calls.

During the 2025 Poland Wiper Attacks, the adversaries utilized the rsocx tool identified as `r.exe` and `rsocx.exe` to tunnel within the internal infrastructure using a Reverse SOCKS Proxy.

During Operation Wocao, threat actors used a custom proxy tool called "Agent" which has support for multiple hops.

During C0017, APT41 used the Cloudflare CDN to proxy C2 traffic.

During C0027, Scattered Spider installed the open-source rsocx reverse proxy tool on a targeted ESXi appliance.

During the SolarWinds Compromise, APT29 used SSH port forwarding capabilities on public-facing systems, and configured at least one instance of Cobalt Strike to use a network pipe over SMB.

During APT28 Nearest Neighbor Campaign, APT28 used the built-in netsh portproxy command to create internal proxies on compromised systems.

During Operation Wocao, threat actors proxied traffic through multiple infected systems.

Quad7 Activity has initialized SOCKS5 proxies on compromised devices.

During RedPenguin, UNC3886 used infrastructure associated with operational relay box (ORB) networks.

SPACEHOP Activity has routed traffic through chains of compromised network devices to proxy C2 communications.

During Salesforce Data Exfiltration, threat actors used Tor IPs for voice calls and for the collection of stolen data.

During the 2025 Poland Wiper Attacks, the adversaries utilized Tor nodes for C2.

During Operation Wocao, threat actors executed commands through the installed web shell via Tor exit nodes.

Quad7 Activity has routed traffic through chains of compromised network devices for password spray attacks.

FLORAHOX Activity has routed traffic through a customized Tor relay network layer.

During CostaRicto, the threat actors used a layer of proxies to manage C2 communications.

KV Botnet Activity command and control traffic uses a non-standard, likely custom protocol for communication.

Mustang Panda communicated over TCP 5000 from adversary administrative servers to adversary command and control nodes during RedDelta Modified PlugX Infection Chain Operations.

During RedPenguin, UNC3886 leveraged malware that used UDP and TCP sockets for C2.