Procedure examples

BackdoorDiplomacy has copied files of interest to the main drive's recycle bin.

Agrius has used the folder, C:\\windows\\temp\\s\\, to stage data for exfiltration.

APT28 has stored captured credential information in a file named pi.log.

APT5 has staged data on compromised systems prior to exfiltration often in `C:\Users\Public`.

Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.

Wizard Spider has staged ZIP files in local directories such as, `C:\PerfLogs\1\` and `C:\User\1\` prior to exfiltration.

WIRTE has staged collected documents of interest in `C:\Users\Public folder`.

Threat Group-3390 has locally staged encrypted archives for later exfiltration efforts.

FIN13 has utilized the following temporary folders on compromised Windows and Linux systems for their operations prior to exfiltration: `C:\Windows\Temp` and `/tmp`.

Exaramel for Windows specifies a path to store files scheduled for exfiltration.

NOKKI can collect data from the victim and stage it in LOCALAPPDATA%\MicroSoft Updatea\uplog.tmp.

KOPILUWAK has piped the results from executed C2 commands to `%TEMP%\result2.dat` on the local machine.

VersaMem staged captured credentials locally at `/tmp/.temp.data`.

PAKLOG has stored the captured data in a file located `C:\\Users\\Public\\Libraries\\record.txt`.

Ursnif has used tmp files to stage gathered information.

FrameworkPOS can identifiy payment card track data on the victim and copy it to a local file in a subdirectory of C:\Windows\.

InvisibleFerret has staged data in consolidated folders prior to exfiltration.

RainyDay can use a file exfiltration tool to copy files to C:\ProgramData\Adobe\temp prior to exfiltration.

AppleSeed can stage files in a central location prior to exfiltration.

NETWIRE has the ability to write collected data to a file created in the ./LOGS directory.

MirrorStealer has stored stolen credentials on the local machine in `%TEMP%\31558.txt`.

Turian can store copied files in a specific directory prior to exfiltration.

Machete stores files and logs in a folder on the local drive.

PowerLess can stage stolen browser data in `C:\\Windows\\Temp\\cup.tmp` and keylogger data in `C:\\Windows\\Temp\\Report.06E17A5A-7325-4325-8E5D-E172EBA7FC5BK`.

Prikormka creates a directory, %USERPROFILE%\AppData\Local\SKC\, which is used to store collected log files.

Mafalda can place retrieved files into a destination directory.

AuTo Stealer can store collected data from an infected host to a file named `Hostname_UserName.txt` prior to exfiltration.

SombRAT can store harvested data in a custom database under the %TEMP% directory.

FLASHFLOOD stages data it copies from the local system or removable drives in the "%WINDIR%\$NtUninstallKB885884$\" directory.

LoFiSe can save files to be evaluated for further exfiltration in the `C:\Programdata\Microsoft\` and `C:\windows\temp\` folders.

Cuckoo Stealer has staged collected application data from Safari, Notes, and Keychain to `/var/folder`.

InvisiMole determines a working directory where it stores all the gathered data about the compromised machine.

MarkiRAT can store collected data locally in a created .nfo file.

Kazuar stages command output and collected data in files before exfiltration.

NavRAT writes multiple outputs to a TMP file using the >> method.

CHIMNEYSWEEP can store captured screenshots to disk including to a covert store named `APPX.%x%x%x%x%x.tmp` where `%x` is a random value.

Chrommme can store captured system information locally prior to exfiltration.

ObliqueRAT can copy specific files, webcam captures, and screenshots to local directories.

SocGholish can send output from `whoami` to a local temp file using the naming convention `rad<5-hex-chars>.tmp`.

PUNCHBUGGY has saved information to a random temp file before exfil.

Pteranodon creates various subdirectories under %Temp%\reports\% and copies files to those subdirectories. It also creates a folder at C:\Users\<Username>\AppData\Roaming\Microsoft\store to store screenshot JPEG files.

BeaverTail has staged collected data to the system’s temporary directory.

DarkWatchman can stage local data in the Windows Registry.

Dyre has the ability to create files in a TEMP folder to act as a database to store information.

PACEMAKER has written extracted data to `tmp/dsserver-check.statementcounters`.

PlugX has collected and staged the victim’s computer files for exfiltration.

Lumma Stealer has configured a custom user data directory such as a folder within `%USERPROFILE%\AppData\Roaming` for staging data.

DustySky created folders in temp directories to host collected files before exfiltration.

Rover copies files from removable drives to C:\system.

LightNeuron can store email data in files and directories specified in its configuration, such as C:\Windows\ServiceProfiles\NetworkService\appdata\Local\Temp\.