Procedure examples

ZxShell has remote desktop functionality.

njRAT has a module for performing remote desktop access.

jRAT can support RDP control.

WarzoneRAT has the ability to control an infected PC using RDP.

Imminent Monitor has a module for performing remote desktop access.

Koadic can enable remote desktop on the victim's machine.

Pupy can enable/disable RDP connection and can start a remote desktop session using a browser web socket client.

QuasarRAT has a module for performing remote desktop access.

Stuxnet propagates to available network shares.

reGeorg has the ability to tunnel SMB sessions.

RansomHub can use credentials provided in its configuration to move laterally from the infected machine over SMBv2.

Emotet has leveraged the Admin$, C$, and IPC$ shares for lateral movement.

Olympic Destroyer uses PsExec to interact with the ADMIN$ network share to execute commands on remote systems.

The Regin malware platform can use Windows admin shares to move laterally.

Conti can spread via SMB and encrypts files on different hosts, potentially compromising an entire network.

Diavol can spread throughout a network via SMB prior to encryption.

Lucifer can infect victims by brute forcing SMB.

BlackEnergy has run a plug-in on a victim to spread through the local network by using PsExec and accessing admin shares.

zwShell has been copied over network shares to move laterally.

NotPetya can use PsExec, which interacts with the ADMIN$ network share to execute commands on remote systems.

Conficker variants spread through NetBIOS share propagation.

Anchor can support windows execution via SMB shares.

LockBit 3.0 can use SMB for lateral movement.

Royal can use SMB to connect to move laterally.

Shamoon accesses network share(s), enables share access to the target device, copies an executable payload to the target system, and uses a Scheduled Task/Job to execute the malware.

BlackByte Ransomware uses mapped shared folders to transfer ransomware payloads via SMB.

Ryuk has used the C$ network share for lateral movement.

LockBit 2.0 has the ability to move laterally via SMB.

Cobalt Strike can use Window admin shares (C$ and ADMIN$) for lateral movement.

Kwampirs copies itself over network shares to move laterally on a victim network.

Qilin can embed a copy of PsExec within its payload and place it in the %Temp% directory under a randomly generated filename.

Zox has the ability to use SMB for communication.

Net Crawler uses Windows admin shares to establish authenticated sessions to remote systems over SMB as part of lateral movement.

HermeticWizard can use a list of hardcoded credentials to to authenticate via NTLMSSP to the SMB shares on remote systems.

Lateral movement can be done with Net through net use commands to connect to the on remote systems.

Brute Ratel C4 has the ability to use SMB to pivot in compromised networks.

PsExec, a tool that has been used by adversaries, writes programs to the ADMIN$ network share to execute commands on remote systems.

Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.

Cobalt Strike can deliver Beacon payloads for lateral movement by leveraging remote COM execution.

SILENTTRINITY can use `System` namespace methods to execute lateral movement using DCOM.

Empire can utilize Invoke-DCOM to leverage remote COM execution for lateral movement.

reGeorg can communicate using SSH through an HTTP tunnel.

Cobalt Strike can SSH to a remote service.

Kinsing has used SSH for lateral movement.

Qilin can enable SSH access on ESXi hosts.

Empire contains modules for executing commands over SSH as well as in-memory VNC agent injection.

TrickBot has used a VNC module to monitor the victim and collect information to pivot to valuable systems on the network

Latrodectus has routed C2 traffic using Keyhole VNC.

DanBot can use VNC for remote access to targeted systems.

Carberp can start a remote VNC session by downloading a new plugin.