Procedure examples

Umbreon hides from defenders by hooking libc function calls, hiding artifacts that would reveal its presence, such as the user account it creates to provide access and undermining strace, a tool often used to identify malware.

Hildegard has modified /etc/ld.so.preload to overwrite readdir() and readdir64().

Hacking Team UEFI Rootkit is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems.

Skidmap is a kernel-mode rootkit that has the ability to hook system calls to hide specific files and fake network and CPU-related statistics to make the CPU load of the infected machine always appear low.

Line Dancer can hook both the crash dump process and the Autehntication, Authorization, and Accounting (AAA) functions on compromised machines to evade forensic analysis and authentication mechanisms.

REPTILE has the ability to hook kernel functions and modify functions data to achieve rootkit functionality such as hiding processes and network connections.

Zeroaccess is a kernel-mode rootkit.

Caterpillar WebShell has a module to use a rootkit on a system.

Uroburos can use its kernel module to prevent its host components from being listed by the targeted system's OS and to mediate requests between user mode and concealed components.

Winnti for Linux has used a modified copy of the open-source userland rootkit Azazel, named libxselinux.so, to hide the malware's operations and network activity.

Hikit is a Rootkit that has been used by Axiom.

Drovorub has used a kernel module rootkit to hide processes, files, executables, and network artifacts from user space view.

PoisonIvy starts a rootkit from a malicious file dropped to disk.

LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems.

Ramsay has included a rootkit to evade defenses.

Carberp has used user mode rootkit techniques to remain hidden on the system.

Ebury acts as a user land rootkit using the SSH service.

HIDEDRV is a rootkit that hides certain operating system artifacts.

HiddenWasp uses a rootkit to hook and implement functions on the system.

WarzoneRAT can include a rootkit to hide processes, files, and startup.

HTRAN can install a rootkit to hide network connections from the host OS.

KV Botnet Activity gathers victim IP information during initial installation stages.

During Frankenstein, the threat actors used Empire to find the public IP address of a compromised system.

During RedPenguin, UNC3886 leveraged JunoOS CLI queries to obtain the interface index which contains system and network details.

During C0018, the threat actors ran `nslookup` and Advanced IP Scanner on the target network.

During ShadowRay, threat actors invoked DNS queries from targeted machines to identify their IP addresses.

During the Anthropic AI-orchestrated Campaign, the adversary configured Claude Code to identify and gather system configurations of discovered devices.

During C0015, the threat actors used code to obtain the external public-facing IPv4 address of the compromised host.

During Operation AkaiRyū, MirrorFace used Arp and `dir` for discovery in compromised environments.

During FunnyDream, the threat actors used ipconfig for discovery on remote systems.

During Operation CuckooBees, the threat actors used `ipconfig`, `nbtstat`, `tracert`, `route print`, and `cat /etc/hosts` commands.

During the 2025 Poland Wiper Attacks, the adversaries gathered network configuration details utilizing `arp -a` and `nslookup` commands.

During Operation Wocao, threat actors discovered the local network configuration with `ipconfig`.

During C0017, APT41 used `cmd.exe /c ping %userdomain%` for discovery.

BlackByte used tools such as Arp to pull system network information and identify connected devices.

SideCopy has identified the IP address of a compromised host.

GALLIUM used ipconfig /all to obtain information about the victim network configuration. The group also ran a modified version of NBTscan to identify available NetBIOS name servers.

A keylogging tool used by APT3 gathers network information from the victim, including the MAC address, IP address, WINS, DHCP server, and gateway.

Kimsuky has used `ipconfig/all` and web beacons sent via email to gather network configuration information. Kimsuky has also identified Host IP addresses leveraging the WMI class `Win32_NetworkAdapterConfiguration`.

admin@338 actors used the following command after exploiting a machine with LOWBALL malware to acquire information about local networks: ipconfig /all >> %temp%\download

Volt Typhoon has executed multiple commands to enumerate network topology and settings including `ipconfig`, `netsh interface firewall show all`, and `netsh interface portproxy show all`.

APT41 collected MAC addresses from victim machines.

Dragonfly has used batch scripts to enumerate network information, including information about trusts, zones, and the domain.

menuPass has used several tools to scan for open NetBIOS nameservers and enumerate NetBIOS sessions.

APT32 used the ipconfig /all command to gather the IP address from the system.

HAFNIUM has collected IP information via IPInfo.

MuddyWater has used malware to collect the victim’s IP address and domain name.

Naikon uses commands such as netsh interface show to discover network interface settings.

TeamTNT has enumerated the host machine’s IP address.

Sidewinder has used malware to collect information on network interfaces, including the MAC address.