Procedure examples

Cyclops Blink can use a custom binary scheme to encode messages with specific commands and parameters to be executed.

Neo-reGeorg can use modified Base64 encoding to obfuscate communications.

PowGoop can use a modified Base64 encoding mechanism to send data to and from the C2 server.

ShadowPad has encoded data as readable Latin characters.

Lizar has used a complex XOR operation to obfuscate C2 communications.

Newer variants of BACKSPACE will encode C2 communications with a custom system.

Small Sieve can use a custom hex byte swapping encoding scheme to obfuscate tasking traffic.

Linux Rabbit attempts to gain access to the server via SSH.

Mafalda can establish an SSH connection from a compromised host to a server.

Hildegard was executed through an unsecure kubelet that allowed anonymous access to the victim environment.

Doki was executed through an open Docker daemon API port.

Kinsing was executed in an Ubuntu container deployed via an open Docker daemon API.

AppleSeed can gain system level privilege by passing SeDebugPrivilege to the AdjustTokenPrivilege API.

SslMM contains a feature to manipulate process privileges and tokens.

Mafalda can use `AdjustTokenPrivileges()` to elevate privileges.

BlackCat has the ability modify access tokens.

Cuba has used SeDebugPrivilege and AdjustTokenPrivileges to elevate privileges.

Hydraq creates a backdoor through which remote attackers can adjust token privileges.

Sagerunex finds the `explorer.exe` process after execution and uses it to change the token of its executing thread.

MegaCortex can enable SeDebugPrivilege and adjust token privileges.

Ryuk has attempted to adjust its token privileges to have the SeDebugPrivilege.

HermeticWiper can use `AdjustTokenPrivileges` to grant itself privileges for debugging with `SeDebugPrivilege`, creating backups with `SeBackupPrivilege`, loading drivers with `SeLoadDriverPrivilege`, and shutting down a local system with `SeShutdownPrivilege`.

SUNSPOT modified its security token to grants itself debugging privileges by adding SeDebugPrivilege.

KillDisk has attempted to get the access token of a process by calling OpenProcessToken. If KillDisk gets the access token, then it attempt to modify the token privileges with AdjustTokenPrivileges.

Qilin can use an embedded Mimikatz module for token manipulation.

Gelsemium can use token manipulation to bypass UAC on Windows7 systems.

Sliver has the ability to manipulate user tokens on targeted Windows systems.

PowerSploit's Invoke-TokenManipulation Exfiltration module can be used to manipulate tokens.

Empire can use PowerSploit's Invoke-TokenManipulation to manipulate access tokens.

PoshC2 can use Invoke-TokenManipulation for manipulating tokens.

Duqu examines running system processes for tokens that have specific system privileges. If it finds one, it will copy the token and store it for later use. Eventually it will start new processes with the stored token attached. It can also steal tokens to acquire administrative privileges.

Stuxnet attempts to impersonate an anonymous token to enumerate bindings in the service control manager.

Havoc has a module capable of token impersonation.

Aria-body has the ability to duplicate a token from ntprint.exe.

Emotet has the ability to duplicate the user’s token. For example, Emotet may use a variant of Google’s ProtoBuf to send messages that specify how code will be executed.

BADHATCH can impersonate a `lsass.exe` or `vmtoolsd.exe` token.

Okrum can impersonate a logged-on user's security context using a call to the ImpersonateLoggedOnUser API.

Siloscape impersonates the main thread of CExecSvc.exe by calling NtImpersonateThread.

Fooder has used the `DuplicateTokenEx` API to duplicate the token of a specified process, and `CreateProcessAsUserA` to execute its payload.

LP-Notes has impersonated the security context of the taskhostw.exe process via the `ImpersonateLoggedOnUser` API.

Shamoon can impersonate tokens using LogonUser, ImpersonateLoggedOnUser, and ImpersonateNamedPipeClient.

Tarrask leverages token theft to obtain `lsass.exe` security permissions.

FinFisher uses token manipulation with NtFilterToken as part of UAC bypass.

Cobalt Strike can steal access tokens from exiting processes.

REvil can obtain the token from the user that launched the explorer.exe process to avoid affecting the desktop of the SYSTEM user.

BitPaymer can use the tokens of users to create processes on infected systems.

SILENTTRINITY can find a process owned by a specific user and impersonate the associated token.

Pupy can obtain a list of SIDs and provide the option for selecting process tokens to impersonate.

Bankshot grabs a user token using WTSQueryUserToken and then creates a process by impersonating a logged-on user.

TONESHELL included functionality to create sub-processes with a specific user’s token.