Procedure examples

PHOREAL communicates via ICMP for C2.

Lizar has used a raw TCP connection to communicate with the C2 server.

HiddenWasp communicates with a simple network protocol over TCP.

WarzoneRAT can communicate with its C2 server via TCP over port 5200.

FRP can communicate over TCP, TCP stream multiplexing, KERN Communications Protocol (KCP), QUIC, and UDP.

Brute Ratel C4 has the ability to use TCP for external C2.

Mythic supports WebSocket and TCP-based C2 profiles.

QuasarRAT can use TCP for C2 communication.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the `sp_addlinkedsrvlogin` command in MS-SQL to create a link between a created account and other servers in the network.

HAFNIUM has granted privileges to domain accounts and reset the password for default admin accounts.

Scattered Spider has added accounts to the ESX Admins group to grant them full admin rights in vSphere.

Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.

VOID MANTICORE has leveraged access to administrative control systems to achieve disruptive effects, consistent with administrative account abuse or privilege escalation within existing access.

Calisto adds permissions and remote logins to all users.

Shai-Hulud has modified GitHub account settings for private repositories and changed them to public.

The Mimikatz credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The LSADUMP::ChangeNTLM and LSADUMP::SetNTLM modules can also manipulate the password hash of an account without knowing the clear text value.

TeamPCP has modified settings to publish private Aqua Security repositories to GitHub as public.

During the SolarWinds Compromise, APT29 added credentials to OAuth Applications and Service Principals.

During C0027, Scattered Spider used aws_consoler to create temporary federated credentials for fake users in order to obfuscate which AWS credential is compromised and enable pivoting from the AWS CLI to console sessions without MFA.

Storm-0501 has reset the password of identified administrator accounts that lack MFA and registered their own MFA method.

Pacu can generate SSH and API keys for AWS infrastructure and additional API keys for other IAM users.

During HomeLand Justice, threat actors added the `ApplicationImpersonation` management role to accounts under their control to impersonate users and take ownership of targeted mailboxes.

During the SolarWinds Compromise, APT29 added their own devices as allowed IDs for active sync using `Set-CASMailbox`, allowing it to obtain copies of victim mailboxes. It also added additional permissions (such as Mail.Read and Mail.ReadWrite) to compromised Application or Service Principals.

APT29 has used a compromised global administrator account in Azure AD to backdoor a service principal with `ApplicationImpersonation` rights to start collecting emails from targeted mailboxes; APT29 has also used compromised accounts holding `ApplicationImpersonation` rights in Exchange to collect emails.

APT28 has used a Powershell cmdlet to grant the ApplicationImpersonation role to a compromised account.

Magic Hound granted compromised email accounts read access to the email boxes of additional targeted accounts. The group then was able to authenticate to the intended victim's OWA (Outlook Web Access) portal and read hundreds of email communications for information on Middle East organizations.

During the SolarWinds Compromise, APT29 granted `company administrator` privileges to a newly created service principle.

During C0027, Scattered Spider used IAM manipulation to gain persistence and to assume or elevate privileges.

Scattered Spider has assigned user access admin roles in order to gain Tenant Root Group management permissions in Azure.

Storm-0501 has elevated their access to Azure resources using `Microsoft.Authorization/elevateAccess/action` and `Microsoft.Authorization/roleAssignments/write` operations to gain User Access Administrator and Owner Azure roles over the victims’ Azure subscriptions.

LAPSUS$ has added the global admin role to accounts they have created in the targeted organization's cloud instances.

During Operation Digital Eye, threat actors used SSH access enabled by authorized_keys files for remote execution.

Salt Typhoon has added SSH authorized_keys under root or other users at the Linux level on compromised network devices.

TeamTNT has added RSA keys in authorized_keys.

Earth Lusca has dropped an SSH-authorized key in the `/root/.ssh` folder in order to access a compromised server with SSH.

Skidmap has the ability to add the public key of its handlers to the authorized_keys file to maintain persistence on an infected host.

Bundlore creates a new key pair with ssh-keygen and drops the newly created user key in authorized_keys to enable remote login.

XCSSET will create an ssh key if necessary with the ssh-keygen -t rsa -f $HOME/.ssh/id_rsa -P command. XCSSET will upload a private key file to the server to remotely access the host without a password.

During the SolarWinds Compromise, APT29 registered devices in order to enable mailbox syncing via the `Set-CASMailbox` command.

During C0027, Scattered Spider registered devices for MFA to maintain persistence through victims' VPN.

APT29 has enrolled their own devices into compromised cloud tenants, including enrolling a device in MFA to an Azure AD environment following a successful password guessing attack against a dormant account.

AADInternals can register a device to Azure AD.

APT3 has been known to add created accounts to local admin groups to maintain elevated access.

Kimsuky has added accounts to specific groups with net localgroup.

APT41 has added user accounts to the User and Admin groups.

Dragonfly has added newly created accounts to the administrators group to maintain elevated access.

APT5 has created their own accounts with Local Administrator privileges to maintain access to systems with short-cycle credential rotation.

Magic Hound has added a user named DefaultAccount to the Administrators and Remote Desktop Users groups.

FIN13 has assigned newly created accounts the sysadmin role to maintain persistence.

DarkGate elevates accounts created through the malware to the local administration group during execution.