Procedure examples

APT33 has used a publicly available exploit for CVE-2017-0213 to escalate privileges on a local system.

FIN8 has exploited the CVE-2016-0167 local vulnerability.

Stuxnet used MS10-073 and an undisclosed Task Scheduler vulnerability to escalate privileges on local Windows machines.

CosmicDuke attempts to exploit privilege escalation vulnerabilities CVE-2010-0232 or CVE-2010-4398.

Hildegard has used the BOtB tool which exploits CVE-2019-5736.

BlackByte 2.0 Ransomware exploits a vulnerability in the RTCore64.sys driver (CVE-2019-16098) to enable privilege escalation and defense evasion when run as a service.

ProLock can use CVE-2019-0859 to escalate privileges on a compromised host.

InvisiMole has exploited CVE-2007-5633 vulnerability in the speedfan.sys driver to obtain kernel mode privileges.

Siloscape has leveraged a vulnerability in Windows containers to perform an Escape to Host.

Remsec has a plugin to drop and execute vulnerable Outpost Sandbox or avast! Virtualization drivers in order to gain kernel mode privileges.

Embargo has leveraged MS4Killer to deliver a vulnerable driver to the victim device, sometimes referred to as Bring Your Own Vulnerable Driver (BYOVD). Embargo has utilized the vulnerable driver probmon.sys version 3.0.0.4 which had a revoked certificated from “ITM System Co.,LTD.”

JHUHUGIT has exploited CVE-2015-1701 and CVE-2015-2387 to escalate privileges.

Pandora can use CVE-2017-15303 to bypass Windows Driver Signature Enforcement (DSE) protection and load its driver.

Cobalt Strike can exploit vulnerabilities such as MS14-058.

Wingbird exploits CVE-2016-4117 to allow an executable to gain escalated privileges.

Carberp has exploited multiple Windows vulnerabilities (CVE-2010-2743, CVE-2010-3338, CVE-2010-4398, CVE-2008-1084) and a .NET Runtime Optimization vulnerability for privilege escalation.

XCSSET has used a zero-day exploit in the ssh launchdaemon to elevate privileges and bypass SIP.

Zox has the ability to leverage local and remote exploits to escalate privileges.

Empire can exploit vulnerabilities such as MS16-032 and MS16-135.

PoshC2 contains modules for local privilege escalation exploits such as CVE-2016-9192 and CVE-2016-0099.

ZeroCleare has used a vulnerable signed VBoxDrv driver to bypass Microsoft Driver Signature Enforcement (DSE) protections and subsequently load the unsigned RawDisk driver.

During the SolarWinds Compromise, APT29 used the `Get-ManagementRoleAssignment` PowerShell cmdlet to enumerate Exchange management role assignments through an Exchange Management Shell.

APT3 has a tool that can enumerate the permissions associated with Windows groups.

Volt Typhoon has used commercial tools, LOTL utilities, and appliances already present on the system for group and user discovery.

APT41 used net group commands to enumerate various Windows user groups and permissions.

Scattered Spider has enumerated the vSphere Admins and ESX Admins groups in targeted environments.

TA505 has used TinyMet to enumerate members of privileged groups. TA505 has also run net group /domain.

FIN13 has enumerated all users and roles from a victim's main treasury system.

TrickBot can identify the groups the user on a compromised host belongs to.

MURKYTOP has the capability to retrieve information about groups.

Siloscape checks for Kubernetes node permissions.

IcedID has the ability to identify Workgroup membership.

Carbon uses the net group command.

ShimRatReporter gathered the local privileges for the infected host.

During Operation Digital Eye, threat actors used the local.exe tool to view group memberships.

During C0015, the threat actors used the command `net localgroup "adminstrator" ` to identify accounts with local administrator rights.

During Operation CuckooBees, the threat actors used the `net group` command as part of their advanced reconnaissance.

During Operation Wocao, threat actors used the command `net localgroup administrators` to list all administrators part of a local group.

admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: net localgroup administrator >> %temp%\download

Volt Typhoon has run `net localgroup administrators` in compromised environments to enumerate accounts.

OilRig has used net localgroup administrators to find local administrators on compromised systems.

Turla has used net localgroup and net localgroup Administrators to enumerate group information, including members of the local administrators group.

Chimera has used net localgroup administrators to identify accounts with local administrative rights.

Tonto Team has used the ShowLocalGroupDetails command to identify administrator, user, and guest accounts on a compromised host.

HEXANE has run `net localgroup` to enumerate local groups.

POWRUNER may collect local group information by running net localgroup administrators or a series of other commands on a victim.

Emissary has the capability to execute the command net localgroup administrators.

Gomir checks the effective group ID of its process when initially executed to determine if it is in group 0, denoting superuser privileges in Linux environments.

FlawedAmmyy enumerates the privilege level of the victim during the initial infection.

Kazuar gathers information about local groups and members.