Procedure examples

Mis-Type has used Windows API calls, including `NetUserAdd` and `NetUserDel`.

KillDisk has called the Windows API to retrieve the hard disk handle and shut down the machine.

Qilin can attempt to log on to the local computer via `LogonUserW` and use `GetLogicalDrives()` and `EnumResourceW()` for discovery.

Kevin can use the `ShowWindow` API to avoid detection.

StarProxy has used native windows API calls such as `GetLocalTime()` to retrieve system data.

BADNEWS has a command to download an .exe and execute it via CreateProcess API. It can also run with ShellExecute.

Goopy has the ability to enumerate the infected system's user name via GetUserNameW.

QakBot can use GetProcAddress to help delete malicious strings from memory.

DOWNIISSA can use the `URLDownloadToFileA()` API to download from remote resources.

Hancitor has used CallWindowProc and EnumResourceTypesA to interpret and execute shellcode.

Gelsemium has the ability to use various Windows API functions to perform tasks.

Dridex has used the OutputDebugStringW function to avoid malware analysis as part of its anti-debugging technique.

BBK has the ability to use the CreatePipe API to add a sub-process for execution via cmd.

Denis used the IsDebuggerPresent, OutputDebugString, and SetLastError APIs to avoid debugging. Denis used GetProcAddress and LoadLibrary to dynamically resolve APIs. Denis also used the Wow64SetThreadContext API as part of a process hollowing process.

INC Ransomware can use the API `DeviceIoControl` to resize the allocated space for and cause the deletion of volume shadow copy snapshots.

SplatCloak has utilized Native Windows API calls dynamically through `ZwQuerySystemInformation`.

Waterbear can leverage API functions for execution.

Lizar has used various Windows API functions on a victim's machine.

BitPaymer has used dynamic API resolution to avoid identifiable strings within the binary, including RegEnumKeyW.

ADVSTORESHELL is capable of starting a process using CreateProcess.

StrifeWater can use a variety of APIs for execution.

WarzoneRAT can use a variety of API calls on a compromised host.

HermeticWizard can connect to remote shares using `WNetAddConnection2W`.

BloodHound can use .NET API calls in the SharpHound ingestor component to pull Active Directory data.

ShimRatReporter used several Windows API functions to gather information from the infected system.

SILENTTRINITY has the ability to leverage API including `GetProcAddress` and `LoadLibrary`.

Empire contains a variety of enumeration modules that have an option to use API calls to carry out tasks.

PcShare has used a variety of Windows API functions.

AsyncRAT has the ability to use OS APIs including `CheckRemoteDebuggerPresent`.

Brute Ratel C4 can call multiple Windows APIs for execution, to share memory, and defense evasion.

Imminent Monitor has leveraged CreateProcessW() call to execute the debugger.

Donut code modules use various API functions to load and inject code.

ZeroCleare can call the `GetSystemDirectoryW` API to locate the system directory.

Chaos conducts brute force attacks against SSH services to gain initial access.

Caterpillar WebShell has a module to perform brute force attacks on a system.

Pysa has used brute force attempts against a central management console, as well as some Active Directory accounts.

Kinsing has attempted to brute force hosts over SSH.

QakBot can conduct brute force attacks to capture credentials.

PoshC2 has modules for brute forcing local administrator and AD user accounts.

CrackMapExec can brute force supplied user credentials across a network range.

Pony has used a small dictionary of common passwords against a collected list of local accounts.

Emotet has been observed using a hard coded list of passwords to brute force user accounts.

P.A.S. Webshell can use predefined users and passwords to execute brute force attacks against SSH, FTP, POP3, MySQL, MSSQL, and PostgreSQL services.

Lucifer has attempted to brute force TCP ports 135 (RPC) and 1433 (MSSQL) with the default username or list of usernames and passwords.

China Chopper's server component can perform brute force password guessing against authentication portals.

Xbash can obtain a list of weak passwords from the C2 server to use for brute forcing as well as attempt to brute force services with open ports.

SpeakUp can perform brute forcing using a pre-defined list of usernames and passwords in an attempt to log in to administrative panels.

HermeticWizard can use a list of hardcoded credentials in attempt to authenticate to SMB shares.

CrackMapExec can brute force passwords for a specified user on a single target system or across an entire network.

Net Crawler uses a list of known credentials gathered through credential dumping to guess passwords to accounts as it spreads throughout a network.