Procedure examples

STARWHALE has relied on victims opening a malicious Excel file for execution.

Agent Tesla has been executed through malicious e-mail attachments

Astaroth has used malicious files including VBS, LNK, and HTML for execution.

QakBot has gained execution through users opening malicious attachments.

SYSCON has been executed by luring victims to open malicious e-mail attachments.

Hancitor has used malicious Microsoft Word documents, sent via email, which prompted the victim to enable macros.

Dridex has relied upon users clicking on a malicious attachment delivered through spearphishing.

OSX/Shlayer has relied on users mounting and executing a malicious DMG file.

JSS Loader has been executed through malicious attachments contained in spearphishing emails.

WarzoneRAT has relied on a victim to open a malicious attachment within an email for execution.

CSPY Downloader has been delivered via malicious documents with embedded macros.

CARROTBALL has been executed through users being lured into opening malicious e-mail attachments.

AsyncRAT has been executed through victims opening malicious file attachments.

Brute Ratel C4 has gained execution through users opening malicious documents.

Remcos has been executed by luring victims into opening malicious email attachments including Excel files.

BADFLICK has relied upon users clicking on a malicious attachment delivered through spearphishing.

The Havoc infection chain has been initiated via ClickFix lures in phishing emails.

Kali365 has dynamically generated legitimate device codes that displays on the victims screen alongside instructions to copy and paste the device code to initiate and complete a successful authentication process.

TONESHELL has utilized a magic value in C2 communications and only executes in memory when response packets match specific values.

BUSHWALK can modify the `DSUserAgentCap.pm` Perl module on Ivanti Connect Secure VPNs and either activate or deactivate depending on the value of the user agent in incoming HTTP requests.

J-magic can monitor TCP traffic for packets containing one of five different predefined parameters and will spawn a reverse shell if one of the parameters and the proper response string to a subsequent challenge is received.

PUBLOAD has utilized a magic value in C2 communications and only executes in memory when response packets match specific values of 17 03 03. PUBLOAD has also used magic bytes consisting of 46 77 4d.

Umbreon provides additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet.

TRANSLATEXT has redirected clients to legitimate Gmail, Naver or Kakao pages if the clients connect with no parameters.

The REPTILE reverse shell component can listen for a specialized packet in TCP, UDP, or ICMP for activation.

Chaos provides a reverse shell is triggered upon receipt of a packet with a special string, sent to any port.

Uroburos can intercept the first client to server packet in the 3-way TCP handshake to determine if the packet contains the correct unique value for a specific Uroburos implant. If the value does not match, the packet and the rest of the TCP session are passed to the legitimate listening application.

SYNful Knock can be sent instructions via special packets to change its functionality. Code for new functionality can be included in these messages.

Winnti for Linux has used a passive listener, capable of identifying a specific magic value before executing tasking, as a secondary command and control (C2) mechanism.

Kobalos is triggered by an incoming TCP connection to a legitimate service from a specific source port.

Ryuk has used Wake-on-Lan to power on turned off systems for lateral movement.

Pandora can identify if incoming HTTP traffic contains a token and if so it will intercept the traffic and process the received command.

Penquin will connect to C2 only after sniffing a "magic packet" value in TCP or UDP packets matching specific conditions.

ZIPLINE can identify a specific string in intercepted network traffic, `SSH-2.0-OpenSSH_0.3xx.`, to trigger its command functionality.

BRUSHFIRE has monitored inbound VPN traffic to compromised appliances until specific inbound packets contain a specific magic string/pattern instead of external beaconing.

Mini Shai-Hulud has examined commit messages for a keyword followed by base64 encoded segments to validate communications and to execute subsequent actions to include exfiltration.

cd00r can monitor for a single TCP-SYN packet to be sent in series to a configurable set of ports (200, 80, 22, 53 and 3 in the original code) before opening a port for communication.

Mafalda can use port-knocking to authenticate itself to another implant called Cryshell to establish an indirect connection to the C2 server.

REPTILE has the ability to control compromised endpoints via port knocking.

metaMain has authenticated itself to a different implant, Cryshell, through a port knocking and handshake procedure.

CASTLETAP can listen for a specialized ICMP packet for activation on compromised network devices.

BPFDoor uses BPF bytecode to attach a filter to a network socket to view ICMP, UDP, or TCP packets coming through ports 22 (ssh), 80 (http), and 443 (https). When BPFDoor finds a packet containing its “magic” bytes, it parses out two fields and forks itself. The parent process continues to monitor filtered traffic while the child process executes the instructions from the parsed fields.

Penquin installs a `TCP` and `UDP` filter on the `eth0` interface.

PITSTOP can listen and evaluate incoming commands on the domain socket, created by PITHOOK malware, located at `/data/runtime/cockpit/wd.fd` for a predefined magic byte sequence. PITSTOP can then duplicate the socket for further communication over TLS.

Mimikatz’s LSADUMP::DCShadow module can be used to make AD updates by temporarily setting a computer to be a DC.

TrickBot utilizes EternalBlue and EternalRomance exploits for lateral movement in the modules wormwinDll, wormDll, mwormDll, nwormDll, tabDll.

Stuxnet propagates using the MS10-061 Print Spooler and MS08-067 Windows Server Service vulnerabilities.

Bad Rabbit used the EternalRomance SMB exploit to spread through victim networks.

Emotet has been seen exploiting SMB via a vulnerability exploit like EternalBlue (MS17-010) to achieve lateral movement and propagation.

InvisiMole can spread within a network via the BlueKeep (CVE-2019-0708) and EternalBlue (CVE-2017-0144) vulnerabilities in RDP and SMB respectively.