Procedure examples

Winnti for Linux has used a modified copy of the open-source userland rootkit Azazel, named libxselinux.so, to hide the malware's operations and network activity.

Hikit is a Rootkit that has been used by Axiom.

Drovorub has used a kernel module rootkit to hide processes, files, executables, and network artifacts from user space view.

PoisonIvy starts a rootkit from a malicious file dropped to disk.

LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems.

Ramsay has included a rootkit to evade defenses.

Carberp has used user mode rootkit techniques to remain hidden on the system.

Ebury acts as a user land rootkit using the SSH service.

HIDEDRV is a rootkit that hides certain operating system artifacts.

HiddenWasp uses a rootkit to hook and implement functions on the system.

WarzoneRAT can include a rootkit to hide processes, files, and startup.

HTRAN can install a rootkit to hide network connections from the host OS.

TrickBot obtains the IP address, location, and other relevant network information from the victim’s machine.

cd00r can discover the IP for the network interface on the compromised device.

PowerDuke has a command to get the victim's domain and NetBIOS name.

EKANS can determine the domain of a compromised host.

BLINDINGCAN has collected the victim machine's local IP address information and MAC address.

Ninja can enumerate the IP address on compromised systems.

Pikabot gathers victim network information through commands such as ipconfig and ipconfig /all.

Amadey can identify the IP address of a victim machine.

Proxysvc collects the network adapter information and domain/username information based on current remote sessions.

Orz can gather victim proxy information.

Torisma can collect the local MAC address using `GetAdaptersInfo` as well as the system's IP address.

NOKKI can gather information on the victim IP address.

yty runs ipconfig /all and collects the domain name.

Backdoor.Oldrea collects information about the Internet adapter configuration.

Stuxnet collects the IP address of a compromised system.

POWRUNER may collect network configuration data by running ipconfig /all on a victim.

KOPILUWAK can use Arp to discover a target's network configuration setttings.

Sardonic has the ability to execute the `ipconfig` command.

Emissary has the capability to execute the command ipconfig /all.

KEYMARBLE gathers the MAC address of the victim’s machine.

RedLeaves can obtain information about network parameters.

Felismus collects the victim LAN IP address and sends it to the C2 server.

GeminiDuke collects information on network settings and Internet proxy settings from the victim.

Havoc has a module for network enumeration including determining IP addresses.

GravityRAT collects the victim IP address, MAC address, as well as the victim account domain name.

InvisibleFerret has collected the local IP address, and external IP.

StrongPity can identify the IP address of a compromised host.

xCaon has used the GetAdaptersInfo() API call to get the victim's MAC address.

PLAINTEE uses the ipconfig /all command to gather the victim’s IP address.

OceanSalt can collect the victim’s IP address.

Brave Prince gathers network configuration information as well as the ARP cache.

AppleSeed can identify the IP of a targeted system.

NETWIRE can collect the IP address of a compromised host.

J-magic can compare the host and remote IPs to check if a received packet is from the infected machine.

iKitten will look for the current IP address.

Gomir collects network information on infected systems such as listing interface names, MAC and IP addresses, and IPv6 addresses.

Aria-body has the ability to identify the location, public IP address, and domain name on a compromised host.

Olympic Destroyer uses API calls to enumerate the infected system's ARP table.