Procedure examples

APT38 installed a port monitoring tool, MAPMAKER, to print the active TCP connections on the local system.

GALLIUM used netstat -oan to obtain information about the victim network connections.

APT3 has a tool that can enumerate current network connections.

admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to display network connections: netstat -ano >> %temp%\download

Volt Typhoon has used `netstat -ano` on compromised hosts to enumerate network connections.

APT41 has enumerated IP addresses of network resources and used the netstat command as part of network reconnaissance. The group has also used a malware variant, HIGHNOON, to enumerate active RDP sessions.

menuPass has used net use to conduct connectivity checks to machines.

APT32 used the netstat -anpo tcp command to display TCP connections on the victim's machine.

MuddyWater has used a PowerShell backdoor to check for Skype connections on the target machine.

TeamTNT has run netstat -anp to search for rival malware connections. TeamTNT has also used `libprocesshider` to modify /etc/ld.so.preload.

Sandworm Team had gathered user, IP address, and server data related to RDP sessions on a compromised host. It has also accessed network diagram files useful for understanding how a host's network was configured.

Andariel has used the netstat -naop tcp command to display TCP connections on a victim's machine.

Mustang Panda has used netstat -ano to determine network connection information.

OilRig has used netstat -an on a victim to get a listing of network connections.

Tropic Trooper has tested if the localhost network is available and other connection capability on an infected system using command scripts.

Ke3chang performs local network connection discovery using netstat.

APT1 used the net use command to get a listing on network connections.

Turla surveys a system upon check-in to discover active local network connections using the netstat -an, net use, net file, and net session commands. Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the GetTcpTable2 API call.

Poseidon Group obtains and saves information about victim network interfaces and addresses.

Lotus Blossom has used commands such as `netstat` to identify system network connections.

Chimera has used netstat -ano | findstr EST to discover network connections.

BackdoorDiplomacy has used NetCat and PortQry to enumerate network connections and display the status of related TCP and UDP ports.

ToddyCat has used `netstat -anop tcp` to discover TCP connections to compromised hosts.

APT5 has used the BLOODMINE utility to collect data on web requests from Pulse Secure Connect logs.

Lazarus Group has used net use to identify and establish a network connection with a remote host.

INC Ransom has used RDP to test network connections.

Earth Lusca employed a PowerShell script called RDPConnectionParser to read and filter the Windows event log “Microsoft-Windows-TerminalServices-RDPClient/Operational”
(Event ID 1024) to obtain network information from RDP connections. Earth Lusca has also used netstat from a compromised system to obtain network connection information.

Velvet Ant has enumerated existing network connections on victim devices.

HEXANE has used netstat to monitor connections to specific ports.

Magic Hound has used quser.exe to identify existing RDP connections.

Threat Group-3390 has used `net use` and `netstat` to conduct internal discovery of systems. The group has also used `quser.exe` to identify existing RDP sessions on a victim.

FIN13 has used `netstat` and other net commands for network reconnaissance efforts.

Mustang Panda has used a customized PlugX variant which could exfiltrate documents from air-gapped networks.

Tropic Trooper has exfiltrated data using USB storage devices.

APT18 actors used the native at Windows task scheduler tool to use scheduled tasks for execution on a victim network.

BRONZE BUTLER has used at to register a scheduled task to execute malware during lateral movement.

Threat Group-3390 actors use at to schedule tasks to run self-extracting RAR archives, which install HTTPBrowser or PlugX on other victims on a network.

APT38 has used cron to create pre-scheduled and periodic background jobs on a Linux system.

Rocke installed a cron job that downloaded and executed files from the C2.

APT5 has made modifications to the crontab file including in `/var/cron/tabs/`.

APT38 has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence. Additionally, APT38 has used living-off-the-land scripts to execute a malicious script via a scheduled task.

BlackByte created scheduled tasks for payload execution.

GALLIUM established persistence for PoisonIvy by created a scheduled task.

An APT3 downloader creates persistence by creating the following scheduled task: schtasks /create /tn "mysc" /tr C:\Users\Public\test.exe /sc ONLOGON /ru "System".

Kimsuky has downloaded additional malware with scheduled tasks. Kimsuky has established persistence by creating a scheduled task named “ChromeUpdateTaskMachine” through the PowerShell cmdlet `Register-ScheduleTask` which was set to execute another PowerShell script once, then five minutes after its creation and periodically repeat every 30 minutes. Kimsuky has also set scheduled tasks that run periodically using the PT1M repetition pattern leveraging naming conventions of Anti-Virus software to include "AhnlabUpdate".

A Patchwork file stealer can run a TaskScheduler DLL to add persistence.

APT41 used a compromised account to create a scheduled task on a system.

Dragonfly has used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files.

menuPass has used a script (atexec.py) to execute a command on a target machine via Task Scheduler.

APT32 has used scheduled tasks to persist on victim systems.