Procedure examples

dsquery can be used to gather information on permission groups within a domain.

Brute Ratel C4 can use `net group` for discovery on targeted domains.

CrackMapExec can gather the user accounts within domain groups.

AdFind can enumerate domain groups.

During C0027, Scattered Spider accessed Azure AD to download bulk lists of group members and their Active Directory attributes.

Pacu can enumerate IAM permissions.

AADInternals can enumerate Azure AD groups.

ROADTools can enumerate Azure AD groups.

ShinyHunters has executed API calls to enumerate permissions for compromised AWS accounts.

During Cutting Edge, threat actors cleared logs to remove traces of their activity and restored compromised systems to a clean state to bypass manufacturer mitigations for CVE-2023-46805 and CVE-2024-21887.

During the SolarWinds Compromise, APT29 temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.

Mustang Panda has deleted registry keys that store data and maintained persistence.

APT42 has cleared Chrome browser history.

APT5 has used the THINBLOOD utility to clear SSL VPN log files located at `/home/runtime/logs`.

Lazarus Group has restored malicious KernelCallbackTable code to its original state after the process execution flow has been hijacked.

Orz can overwrite Registry settings to reduce its visibility on the victim.

Stuxnet can delete OLE Automation and SQL stored procedures used to store malicious payloads.

IronWind has used a .NET DLL named "exit-DN4-core.dll" to terminate malicious processes running on victim's systems.

Sardonic has the ability to delete created WMI objects to evade detections.

Bankshot deletes all artifacts associated with the malware from the infected machine.

DUSTTRAP restores the `.text` section of compromised DLLs after malicious code is loaded into memory and before the file is closed.

Neoichor can clear the browser history on a compromised host by changing the `ClearBrowsingHistoryOnExit` value to 1 in the `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy` Registry key.

BlackEnergy has removed the watermark associated with enabling the TESTSIGNING boot configuration option by removing the relevant strings in the user32.dll.mui of the system.

Rising Sun can clear a memory blog in the process by overwriting it with junk bytes.

Flagpro can close specific Windows Security and Internet Explorer dialog boxes to mask external connections.

DarkWatchman can uninstall malicious components from the Registry, stop processes, and clear the browser history.

MultiLayer Wiper uses a batch script to clear file system cache memory via the ProcessIdleTasks export in advapi32.dll as an anti-analysis and anti-forensics technique.

EVILNUM has a function called "DeleteLeftovers" to remove certain artifacts of the attack.

Metamorfo has a command to delete a Registry key it uses, \Software\Microsoft\Internet Explorer\notes.

BPFDoor clears the file location `/proc/<PID>/environ` removing all environment variables for the process.

SDBbot has the ability to clean up and remove data structures from a compromised host.

Sibot will delete an associated registry key if a certain server response is received.

HermeticWiper can disable pop-up information about folders and desktop items and delete Registry keys to hide malicious services.

SUNBURST removed HTTP proxy registry values to clean up traces of execution.

IPsec Helper can delete various registry keys related to its execution and use.

FunnyDream has the ability to clean traces of malware deployment.

Maze has used the “Wow64RevertWow64FsRedirection” function following attempts to delete the shadow volumes, in order to leave the system in the same state as it was prior to redirection.

ShadowPad has deleted arbitrary Registry values.

SILENTTRINITY can remove artifacts from the compromised host, including created Registry keys.

CSPY Downloader has the ability to remove values it writes to the Registry.

Remcos can clean saved cookies and logins from the web browser.

Donut can erase file references to payloads in-memory after being reflectively loaded and executed.

APT41 attempted to remove evidence of some of its activity by deleting Bash histories.

menuPass has used Wevtutil to remove PowerShell execution logs.

TeamTNT has cleared command history with history -c.

Aquatic Panda cleared command history in Linux environments to remove traces of activity after operations.

Medusa Group has cleared command history by running the PowerShell command `Remove-Item (Get-PSReadlineOption).HistorySavePath`.

APT5 has cleared the command history on targeted ESXi servers.

Lazarus Group has routinely deleted log files on a compromised router, including automatic log deletion through the use of the logrotate utility.

Magic Hound has removed mailbox export requests from compromised Exchange servers.