Procedure examples

During Operation Dream Job, Lazarus Group used `regsvr32` to execute malware.

During C0015, the threat actors employed code that used `regsvr32` for execution.

During Operation Dream Job, Lazarus Group executed malware with `C:\\windows\system32\rundll32.exe "C:\ProgramData\ThumbNail\thumbnail.db"`, `CtrlPanel S-6-81-3811-75432205-060098-6872 0 0 905`.

During the 2015 Ukraine Electric Power Attack, Sandworm Team used a backdoor which could execute a supplied DLL using `rundll32.exe`.

During Operation Spalax, the threat actors used `rundll32.exe` to execute malicious installers.

During C0018, the threat actors used `rundll32` to run Mimikatz.

Water Curupira Pikabot Distribution utilizes rundll32.exe to execute the final Pikabot payload, using the named exports `Crash` or `Limit` depending on the variant.

During C0021, the threat actors used `rundll32.exe` to execute the Cobalt Strike Beacon loader DLL.

During C0015, the threat actors loaded DLLs via `rundll32` using the `svchost` process.

During the SolarWinds Compromise, APT29 used `Rundll32.exe` to execute payloads.

Mustang Panda used Microsoft Management Console Snap-In Control files, or MSC files, executed via MMC to run follow-on PowerShell commands during RedDelta Modified PlugX Infection Chain Operations.

During the 3CX Supply Chain Attack, AppleJeus leveraged the 3CX application's electron framework to execute its malicious libraries under the official 3CX electron application.

During Operation AkaiRyū, MirrorFace used remote access tools including PuTTY.

During Night Dragon, threat actors used several remote administration tools as persistent infiltration channels.

During Operation Digital Eye, threat actors created Visual Studio Code dev tunnels to access targeted endpoints through the browser-based version of Visual Studio Code.

During Operation AkaiRyū, MirrorFace abused Visual Studio Code (VS Code) remote tunnels to gain access and execute code on compromised machines.

During C0018, the threat actors used AnyDesk to transfer tools between systems.

During C0015, the threat actors installed the AnyDesk remote desktop application onto the compromised network.

During C0027, Scattered Spider directed victims to run remote monitoring and management (RMM) tools.

During Operation Dream Job, Lazarus Group used a remote XSL script to download a Base64-encoded DLL custom downloader.

During Operation Dream Job, Lazarus Group used DOCX files to retrieve a malicious document template/DOTM file.

During Frankenstein, the threat actors used trojanized documents that retrieved remote templates from an adversary-controlled website.

KV Botnet Activity altered permissions on downloaded tools and payloads to enable execution on victim machines.

Mustang Panda included the use of Cloudflare geofencing mechanisms to limit payload download activity during RedDelta Modified PlugX Infection Chain Operations.

During C0015, the threat actors used the command `nltest /domain_trusts /all_trusts` to enumerate domain trusts.

During the SolarWinds Compromise, APT29 used the `Get-AcceptedDomain` PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell. They also used AdFind to enumerate domains and to discover trust between federated domains.

Leviathan performed Active Directory enumeration of victim environments during Leviathan Australian Intrusions.

During SharePoint ToolShell Exploitation, threat actors, including Storm-2603, modified group policy to enable ransomware distribution.

During the 2025 Poland Wiper Attacks, the adversaries had leveraged Group Policy Objects to distribute wiper malware to victim devices through a network share.

During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Group Policy Objects (GPOs) to deploy and execute malware.

During the SolarWinds Compromise, APT29 changed domain federation trust settings using Azure AD administrative permissions to configure the domain to accept authorization tokens signed by their own SAML signing certificate.

During the 2025 Poland Wiper Attacks, the adversaries utilized wiper malware to overwrite files using a 16-byte buffer that fully overwrites files 16 bytes or smaller or partially overwrites files greater than 16 bytes to speed up the process.

During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed CaddyWiper on the victim’s IT environment systems to wipe files related to the OT capabilities, along with mapped drives, and physical drive partitions.

During SharePoint ToolShell Exploitation, threat actors deployed ransomware including 4L4MD4R and Warlock.

During C0018, the threat actors used AvosLocker ransomware to encrypt files on the compromised network.

During C0015, the threat actors used Conti ransomware to encrypt a compromised network.

During HomeLand Justice, threat actors used ROADSWEEP ransomware to encrypt files on targeted systems.

During the 2025 Poland Wiper Attacks, the adversaries deleted Windows Volume Shadow Copies using `vssadmin delete shadows`.

During the 2025 Poland Wiper Attacks, adversaries performed a factory-reset on compromised devices that hampered forensic investigations.

During ShadowRay, threat actors leveraged graphics processing units (GPU) on compromised nodes for cryptocurrency mining.

During Operation Spalax, the threat actors used droppers that would run anti-analysis checks before executing malware on a compromised host.

During Operation Dream Job, Lazarus Group used tools that conducted a variety of system checks to detect sandboxes or VMware services.

During Frankenstein, the threat actors used a script that ran WMI queries to check if a VM or sandbox was running, including VMWare and Virtualbox. The script would also call WMI to determine the number of cores allocated to the system; if less than two the script would stop execution.

During Operation Dream Job, Lazarus Group used tools that collected `GetTickCount` and `GetSystemTimeAsFileTime` data to detect sandbox or VMware services.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used various MS-SQL stored procedures.

FrostyGoop Incident deployed a ReGeorg variant web shell to impacted systems following initial access for persistence.

During SharePoint ToolShell Exploitation, threat actors followed exploitation of SharePoint servers with installation of a malicious .aspx web shell (spinstall0.aspx) that was written to the `_layouts/15/` directory, granting persistent HTTP-based access.

During Cutting Edge, threat actors used multiple web shells to maintain presence on compromised Connect Secure appliances such as WIREFIRE, GLASSTOKEN, BUSHWALK, LIGHTWIRE, and FRAMESTING.

During Operation Digital Eye, threat actors deployed a PHP-based webshell to maintain persistent access.

For HomeLand Justice, threat actors used .aspx webshells named pickers.aspx, error4.aspx, and ClientBin.aspx, to maintain persistence.