Procedure examples

Cobalt Strike can use sudo to run a command.

Proton modifies the tty_tickets line in the sudoers file.

Shai-Hulud has attempted to gain root access by leveraging `sudo` and `/etc/sudoers.d`.

Dok adds admin ALL=(ALL) NOPASSWD: ALL to the /etc/sudoers file.

TeamPCP Cloud Stealer can use `sudo` for code execution.

CanisterWorm has checked if the current user is root. If it is, CanisterWorm will wipe the system using `rm –rf / --no-preserve-root`. If it is not, CanisterWorm will try passwordless sudo and will run the same command.

OSX/Shlayer can escalate privileges to root by asking the user for credentials.

For several modules, XCSSET attempts to access or list the contents of user folders such as Desktop, Downloads, and Documents. If the folder does not exist or access is denied, it enters a loop where it resets the TCC database and retries access.

FoggyWeb can allow abuse of a compromised AD FS server's SAML token.

CreepyDrive can use legitimate OAuth refresh tokens to authenticate with OneDrive.

Shai-Hulud has leveraged captured valid NPM tokens to enumerate and update packages on compromised accounts. Shai-Hulud has also utilized stolen GitHub access tokens to access compromised accounts.

Peirates can use stolen service account tokens to perform its operations. It also enables adversaries to switch between valid service accounts.

Mini Shai-Hulud has the ability to authenticate using stolen application access tokens.

CanisterWorm has leveraged stolen npm tokens to automate compromise by enumerating all publishable packages in a namespace, bumping versions, and publishing itself across the entire scope.

Kali365 has utilized an Exchange Admin module that captured admin tokens to create rogue mailbox connectors and change mail-flow rules.

BADHATCH can perform pass the hash on compromised machines with x64 versions.

HOPLIGHT has been observed loading several APIs associated with Pass the Hash.

Cobalt Strike can perform pass the hash.

Empire can perform pass the hash attacks.

PoshC2 has a number of modules that leverage pass the hash for lateral movement.

Pass-The-Hash Toolkit can perform pass the hash.

Mimikatz's SEKURLSA::Pth module can impersonate a user, with only a password hash, to execute arbitrary commands.

CrackMapExec can pass the hash to authenticate via SMB.

Some SeaDuke samples have a module to use pass the ticket with Kerberos for authentication.

Mimikatz’s LSADUMP::DCSync and KERBEROS::PTT modules implement the three steps required to extract the krbtgt account hash and create/use Kerberos tickets.

Pupy can also perform pass-the-ticket.

DarkGate uses NirSoft tools to steal user credentials from the infected machine. NirSoft tools are executed via process hollowing in a newly-created instance of vbc.exe or regasm.exe.

Astaroth uses an external software known as NetPass to recover passwords.

NPPSPY captures credentials by recording them through an alternative network listener registered to the mpnotify.exe process, allowing for cleartext recording of logon information.

Pacu can search for sensitive data: for example, in Code Build environment variables, EC2 user data, and Cloud Formation templates.

TrickBot can obtain passwords stored in files from several applications such as Outlook, Filezilla, OpenSSH, OpenVPN and WinSCP. Additionally, it searches for the ".vnc.lnk" affix to steal VNC credentials.

Smoke Loader searches for files named logins.json to parse for credentials.

Emotet has been observed leveraging a module that retrieves passwords stored on a system for the current logged-on user.

Hildegard has searched for SSH keys, Docker credentials, and Kubernetes service tokens.

BlackEnergy has used a plug-in to gather credentials stored in files on the host by various software programs, including The Bat! email client, Outlook, and Windows Credential Store.

XTunnel is capable of accessing locally stored passwords on victims.

If an initial connectivity check fails, pngdowner attempts to extract proxy details and credentials from Windows Protected Storage and from the IE Credentials Store. This allows the adversary to use the proxy credentials for subsequent requests if they enable outbound HTTP access.

StrelaStealer searches for and if found collects the contents of files such as `logins.json` and `key4.db` in the `$APPDATA%\Thunderbird\Profiles\` directory, associated with the Thunderbird email application.

Pysa has extracted credentials from the password database before encrypting the files.

Shai-Hulud has gathered sensitive data stored in the Node.JS file `process.env` to include credentials and API keys. Shai-Hulud has harvested credentials stored in config files and credential files in victim environments to include `~/.aws/credentials`, `application_default_credentials.json`, and `azureProfile.json`. Shai-Hulud has also targeted credentials and tokens stored in NPM files `.npmrc` and GitHub config files.

Agent Tesla has the ability to extract credentials from configuration or support files.

jRAT can capture passwords from common chat applications such as MSN Messenger, AOL, Instant Messenger, and and Google Talk.

Azorult can steal credentials in files belonging to common software such as Skype, Telegram, and Steam.

AADInternals can gather unsecured credentials for Azure AD services, such as Azure AD Connect, from a local machine.

Empire can use various modules to search for files containing passwords.

PoshC2 contains modules for searching for passwords in local and remote files.

TruffleHog has obtained credentials stored in config files and credential files in victim environments.

LaZagne can obtain credentials from chats, databases, mail, and WiFi.

Pupy can use Lazagne for harvesting credentials.

QuasarRAT can obtain passwords from FTP clients.