Procedure examples

QakBot can identify remote systems through the net view command.

Comnie runs the net view command

OSInfo performs a connection test to discover remote systems in the network

BitPaymer can use net view to discover remote systems.

HermeticWizard can find machines on the local network by gathering known local IP addresses through `DNSGetCacheDataTable`, `GetIpNetTable`,`WNetOpenEnumW(RESOURCE_GLOBALNET, RESOURCETYPE_ANY)`,`NetServerEnum`,`GetTcpTable`, and `GetAdaptersAddresses.`

Commands such as net view can be used in Net to gather information about available remote systems.

BloodHound can enumerate and collect the properties of domain computers, including domain controllers.

SILENTTRINITY can enumerate and collect the properties of domain computers.

Arp can be used to display a host's ARP cache, which may include address resolutions for remote systems.

ROADTools can enumerate Azure AD systems and devices.

Nltest may be used to enumerate remote domain controllers using options such as /dclist and /dsgetdc.

NBTscan can list NetBIOS computer names.

Ping can be used to identify remote systems within a network.

CrackMapExec can discover active IP addresses, along with the machine name, within a targeted network.

AdFind has the ability to query Active Directory for computers.

CanisterWorm has scanned the local /24 subnet for new targets.

StrongPity can automatically exfiltrate collected documents to the C2 server.

Hannotog can upload encyrpted data for exfiltration.

CosmicDuke exfiltrates collected files automatically over FTP to remote servers.

Machete’s collected files are exfiltrated automatically to remote servers.

Doki has used a script that gathers information from a hardcoded list of IP addresses and uploads to an Ngrok URL.

Rover automatically searches for files on local drives based on a predefined list of file extensions and sends them to the command and control server every 60 minutes. Rover also automatically sends keylogger files and screenshots to the C2 server on a regular timeframe.

LightNeuron can be configured to automatically exfiltrate files under a specified directory.

Peppy has the ability to automatically exfiltrate files and keylogs.

When a document is found matching one of the extensions in the configuration, TINYTYPHON uploads it to the C2 server.

Attor has a file uploader plugin that automatically exfiltrates the collected data and log files to the C2 server.

Crutch has automatically exfiltrated stolen files to Dropbox.

StrelaStealer automatically sends gathered email credentials following collection to command and control servers via HTTP POST.

USBStealer automatically exfiltrates collected files via removable media when an infected device connects to an air-gapped victim machine after initially being connected to an internet-enabled victim machine.

TajMahal has the ability to manage an automated queue of egress files and commands sent to its C2.

Raccoon Stealer will automatically collect and exfiltrate data identified in received configuration files from command and control nodes.

Solar can automatically exfitrate files from compromised systems.

OutSteel can automatically upload collected files to its C2 server.

If credentials are not collected for two weeks, Ebury encrypts the credentials using a public key and sends them via UDP to an IP address located in the DNS TXT record.

ShimRatReporter sent collected system and network information compiled into a report to an adversary-controlled C2.

Empire has the ability to automatically send collected data back to the threat actors' C2.

TeamPCP Cloud Stealer can compress and encrypt data and exfiltrate it via POST to scan.aquasecurtiy[.]org. If that method fails it attempts to use a stolen GITHUB_TOKEN to create a repo and exfiltrate the data there.

Stuxnet can propagate via peer-to-peer communication and updates using RPC.

Kivars has the ability to remotely trigger keyboard input and mouse clicks.

MacMa can manage remote screen sessions.

Brute Ratel C4 has the ability to use RPC for lateral movement.

reGeorg can be used to tunnel RDP connections.

DarkComet can open an active screen of the victim’s machine and take control of the mouse and keyboard.

zwShell has used RDP for lateral movement.

Carbanak enables concurrent Remote Desktop Protocol (RDP) sessions.

SDBbot has the ability to use RDP to connect to victim's machines.

Pysa has laterally moved using RDP connections.

Cobalt Strike can start a VNC-based remote desktop server and tunnel the connection through the already established C2 channel.

ServHelper has commands for adding a remote desktop user and sending RDP traffic to the attacker through a reverse SSH tunnel.

Revenge RAT has a plugin to perform RDP access.