Procedure examples

Elise executes net start after initial communication is made to the remote server.

Embargo has obtained active services running on the victim’s system through the functions `OpenSCManagerW()` and `EnumServicesStatusExW()`.

Ixeshe can list running services.

Black Basta can check whether the service name `FAX` is present.

RATANKBA uses tasklist /svc to display running tasks.

Cobalt Strike can enumerate services on compromised hosts.

SUNBURST collected a list of service names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.

HotCroissant has the ability to retrieve a list of services on the infected host.

REvil can enumerate active services.

SysUpdate can collect a list of services on a victim machine.

Kwampirs collects a list of running services with the command tasklist /svc.

LAMEHUG can gather service information on targeted systems.

LookBack can enumerate services on the victim machine.

ZxShell can check the services on the system.

JPIN can list running services.

Heyoka Backdoor can check if it is running as a service on a compromised host.

Qilin can identify specific services for termination or to be left running at execution.

jRAT can list local services.

Comnie runs the command: net start >> %TEMP%\info.dat on a victim.

BitPaymer can enumerate existing Windows services on the host that are configured to run as LocalSystem.

SLOTHFULMEDIA has the capability to enumerate services.

The net start command can be used in Net to find information about Windows services.

SILENTTRINITY can search for modifiable services that could be used for privilege escalation.

Tasklist can be used to discover services running on a system.

PoshC2 can enumerate service and service permission information.

During Night Dragon, threat actors used company extranet servers as secondary C2 servers.

APT41 used the Steam community page as a fallback mechanism for C2.

FIN7's Harpy backdoor malware can use DNS as a backup channel for C2 if HTTP fails.

UNC3886 has employed layers of redundancy to maintain access to compromised environments including network devices, hypervisors, and virtual machines.

OilRig malware ISMAgent falls back to its DNS tunneling mechanism if it is unable to reach the C2 server over HTTP.

Lazarus Group malware SierraAlfa sends data to one of the hard-coded C2 servers chosen at random, and if the transmission fails, chooses a new C2 server to attempt the transmission again.

TrickBot can use secondary C2 servers for communication after establishing connectivity and relaying victim information to primary C2 servers.

Bumblebee can use backup C2 servers if the primary server fails.

Stuxnet has the ability to generate new C2 domains.

Exaramel for Linux can attempt to find a new C2 server if it receives an error.

WinMM is usually configured with primary and backup domains for C2 communications.

RainyDay has the ability to switch between TCP and HTTP for C2 if one method is not working.

AppleSeed can use a second channel for C2 when the primary channel is in upload mode.

TinyTurla can go through a list of C2 server IPs and will try to register with each until one responds.

SslMM has a hard-coded primary and backup C2 string.

Machete has sent data over HTTP if FTP failed, and has also used a fallback server.

HOPLIGHT has multiple C2 channels in place in case one fails.

InvisiMole has been configured with several servers available for alternate C2 communications.

QUIETEXIT can attempt to connect to a second hard-coded C2 if the first hard-coded C2 address fails.

RDAT has used HTTP if DNS C2 communications were not functioning.

Kazuar can accept multiple URLs for C2 servers.

NETEAGLE will attempt to detect if the infected host is configured to a proxy. If so, NETEAGLE will send beacons via an HTTP POST request; otherwise it will send beacons via UDP/6000.

FatDuke has used several C2 servers per targeted organization.

BlackEnergy has the capability to communicate over a backup channel via plus.google.com.

ShimRat has used a secondary C2 location if the first was unavailable.