Procedure examples

Lucifer can exploit multiple vulnerabilities including EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0144).

NotPetya can use two exploits in SMBv1, EternalBlue and EternalRomance, to spread itself to other remote systems on the network.

Conficker exploited the MS08-067 Windows vulnerability for remote code execution through a crafted RPC request.

WannaCry uses an exploit in SMBv1 to spread itself to other remote systems on a network.

QakBot can move laterally using worm-like functionality through exploitation of SMB.

Empire has a limited number of built-in modules for exploiting remote SMB, JBoss, and Jenkins servers.

PoshC2 contains a module for exploiting SMB via EternalBlue.

Flame can use MS10-061 to exploit a print spooler vulnerability in a remote system with a shared printer in order to move laterally.

Raccoon Stealer gathers information from repositories associated with cryptocurrency wallets and the Telegram messaging service.

Troll Stealer gathers information from the Government Public Key Infrastructure (GPKI) folder, associated with South Korean government public key infrastructure, on infected systems.

TruffleHog has collected credentials and data associated with Confluence.

spwebmember is used to enumerate and dump information from Microsoft SharePoint.

TruffleHog has searched SharePoint for data and credentials.

GlassWorm has gathered code repository authentication materials for NPM and GitHub. GlassWorm has collected details pertaining to the npm configuration data for `_authToken`.

Shai-Hulud has downloaded existing packages from code repositories and extracted data stored within them.

TruffleHog has gathered data and credentials from code repositories.

TeamPCP Cloud Stealer can target sensitive file paths in Git repos to extract credentials.

Mini Shai-Hulud has gathered and downloaded data stored on both compromised and publicly accessible code repositories.

TruffleHog has obtained data and credentials associated with messaging applications to include Slack.

P.A.S. Webshell has the ability to list and extract data from SQL databases.

GlassWorm has collected data from macOS devices through the gathering of Apple Notes related files by targeting `/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite`, `/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal`, and `/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-shm`.

MgBot includes a module capable of stealing content from the Tencent QQ database storing user QQ message history on infected devices.

TeamPCP Cloud Stealer can extract credentials from multiple database configuration files including ~/.pgpass, ~/.my.cnf, ~/.mongorc.js, and /etc/mysql/my.cnf.

Machete retrieves the user profile data (e.g., browsers) from Chrome and Firefox browsers.

PowerLess has a browser info stealer module that can read Chrome and Edge browser database files.

Mafalda can collect the contents of the `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\LocalState` file.

Cuckoo Stealer can collect bookmarks, cookies, and history from Safari.

MobileOrder has a command to upload to its C2 server victim browser bookmarks.

Mispadu can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.

To collect data on the host's Wi-Fi connection history, LightSpy reads the `/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist` file. It also utilizes Apple's `CWWiFiClient` API to scan for nearby Wi-Fi networks and obtain data on the SSID, security type, and RSSI (signal strength) values.

BeaverTail has searched the victim device for browser extensions including those commonly associated with cryptocurrency wallets.

DarkWatchman can retrieve browser history.

Lumma Stealer has identified and gathered information from two-factor authentication extensions for multiple browsers.

GlassWorm has searched browser data for cookies, history, login databases, and cryptocurrency wallets.

RedLine Stealer can collect information from browsers and browser extensions.

SUGARDUMP has collected browser bookmark and history information.

Calisto collects information on bookmarks from Google Chrome.

Troll Stealer collects information from Chromium-based browsers and Firefox such as cookies, history, downloads, and extensions.

Lizar can retrieve browser history and database files.

Dtrack can retrieve browser history.

Empire has the ability to gather browser data such as bookmarks and visited sites.

Astaroth uses ActiveX objects for file execution and manipulation.

InvisiMole can register itself for execution and persistence via the Control Panel.

Reaver drops and executes a malicious CPL file as its payload.

CHIMNEYSWEEP can use CMSTP.exe to install a malicious Microsoft Connection Manager Profile.

LockBit 3.0 can attempt a CMSTP UAC bypass if it does not have administrative privileges.

WhisperGate has used `InstallUtil.exe` as part of its process to disable Windows Defender.

Saint Bot had used `InstallUtil.exe` to download and deploy executables.

Chaes has used Installutill to download content.

Covenant can create launchers via an InstallUtil XML file to install new Grunt listeners.