Procedure examples

During the 2025 Poland Wiper Attacks, the adversaries leveraged the native CLI of the targeted FortiGate device.

Line Dancer can execute native commands in networking device command line interfaces.

PHASEJAM has leveraged native commands associated with the compromised network appliance to execute code.

DRYHOOK has the ability to interact with Ivanti Connect Secure environments and to modify system components.

TeamTNT has leveraged AWS CLI to enumerate cloud environments with compromised credentials.

Storm-0501 has leveraged Cloud CLI to execute commands and exfiltrate data from compromised environments.

APT29 has leveraged the Microsoft Graph API to perform various actions across Azure and M365 environments. They have also utilized AADInternals PowerShell Modules to access the API

Pacu leverages the AWS CLI for its operations.

TruffleHog has leveraged Cloud CLI in order to enumerate and gather credentials.

ShinyHunters has used the AWS Command Line Interface (CLI) for operations to include a variety of API calls, such as `ListBuckets`, `CreateBucket` and `DeleteBucket`.

APT39 has utilized AutoIt malware scripts embedded in Microsoft Office documents or malicious links.

Lumma Stealer has utilized AutoIt malware scripts and AutoIt executables.

DarkGate uses AutoIt scripts dropped to a hidden directory during initial installation phases, such as `test.au3`.

XLoader can use an AutoIT script to decrypt a payload file, load it into victim memory, then execute it on the victim machine.

OutSteel was developed using the AutoIT scripting language.

Melcoz has been distributed through an AutoIt loader script.

Line Runner utilizes Lua scripts for command execution.

Remsec can use modules written in Lua for execution.

RedLine Stealer malware has leveraged Lua bytecode to perform malicious behavior.

EvilBunny has used Lua scripts to execute payloads.

PoetRAT has executed a Lua script through a Lua interpreter for Windows.

UNC3886 has used the esxcli command line utility to modify firewall rules, install malware, and for artifact removal.

Cheerscrypt has leveraged `esxcli` in order to terminate running virtual machines.

VIRTUALPIE is capable of command line execution on compromised ESXi servers.

Royal ransomware uses `esxcli` to gather a list of running VMs and terminate them.

TeamTNT targeted misconfigured containers and used container CLI tools.

Mini Shai-Hulud has utilized the Docker command-line tool to gather details of the victim environment and collect credentials.

TeamPCP has queried the Kubernetes API for local service account tokens and has used `kubectl` for lateral movement.

During ShadowRay, threat actors downloaded a privilege escalation payload to gain root access.

Leviathan exploited software vulnerabilities in victim environments to escalate privileges during Leviathan Australian Intrusions.

BlackByte has exploited CVE-2024-37085 in VMWare ESXi software for authentication bypass and subsequent privilege escalation.

Volt Typhoon has gained initial access by exploiting privilege escalation vulnerabilities in the operating system or network services.

APT32 has used CVE-2016-7255 to escalate privileges.

HAFNIUM has targeted unpatched applications to elevate access in targeted organizations.

FIN6 has used tools to exploit Windows vulnerabilities in order to escalate privileges. The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.

ZIRCONIUM has exploited CVE-2017-0005 for local privilege escalation.

Scattered Spider has deployed a malicious kernel driver through exploitation of CVE-2015-2291 in the Intel Ethernet diagnostics driver for Windows (iqvw64.sys).

UNC3886 has exploited zero-day vulnerability CVE-2023-20867 to enable execution of privileged commands across Windows, Linux, and PhotonOS (vCenter) guest VMs.

OilRig has exploited the Windows Kernel Elevation of Privilege vulnerability, CVE-2024-30088.

MoustachedBouncer has exploited CVE-2021-1732 to execute malware components with elevated rights.

Turla has exploited vulnerabilities in the VBoxDrv.sys driver to obtain kernel mode privileges.

BITTER has exploited CVE-2021-1732 for privilege escalation.

APT29 has exploited CVE-2021-36934 to escalate privileges on a compromised host.

Whitefly has used an open-source tool to exploit a known Windows privilege escalation vulnerability (CVE-2016-0051) on unpatched computers.

APT28 has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263, and CVE-2022-38028 to escalate privileges.

Tonto Team has exploited CVE-2019-0803 and MS16-032 to escalate privileges.

LAPSUS$ has exploited unpatched vulnerabilities on internally accessible servers including JIRA, GitLab, and Confluence for privilege escalation.

Cobalt Group has used exploits to increase their levels of rights and privileges.

PLATINUM has leveraged a zero-day vulnerability to escalate privileges.

Threat Group-3390 has used CVE-2014-6324 and CVE-2017-0213 to escalate privileges.