Procedure examples

TeamPCP Cloud Stealer has the ability to check over 50 file paths for credentials stored in files across CI/CD, cloud, container, and other environments.

Mini Shai-Hulud has collected credentials stored within configuration files. Mini Shai-Hulud has also gathered credentials from files stored in common credential file paths to include targeting git-credentials, azureProfile.json, and application_default_credentials.json.

Kali365 has searched compromised mailboxes for credential material such as seed phrases and API keys.

TrickBot has retrieved PuTTY credentials by querying the Software\SimonTatham\Putty\Sessions registry key

StrelaStealer enumerates the registry key `HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\` to identify the values for "IMAP User," "IMAP Server," and "IMAP Password" associated with the Outlook email application.

Valak can use the clientgrabber module to steal e-mail credentials from the Registry.

IceApple can harvest credentials from local and remote host registries.

Agent Tesla has the ability to extract credentials from the Registry.

PowerSploit has several modules that search the Windows Registry for stored credentials: Get-UnattendedInstallFile, Get-Webconfig, Get-ApplicationHost, Get-SiteListPassword, Get-CachedGPPPassword, and Get-RegistryAutoLogon.

Reg may be used to find credentials in the Windows Registry.

Kinsing has searched bash_history for credentials.

TeamPCP Cloud Stealer can target credentials in shell history on self-hosted runners.

Machete has scanned and looked for cryptographic keys and certificate file extensions.

Mafalda can collect a Chrome encryption key used to protect browser cookies.

Hildegard has searched for private keys in .ssh.

FoggyWeb can retrieve token signing certificates and token decryption certificates from a compromised AD FS server.

Troll Stealer collects all data in victim `.ssh` folders by creating a compressed copy that is subsequently exfiltrated to command and control infrastructure. Troll Stealer also collects key information associated with the Government Public Key Infrastructure (GPKI) service for South Korean government information systems.

Ebury has intercepted unencrypted private keys as well as private key pass-phrases.

Kinsing has searched for private keys.

jRAT can steal keys for VPNs and cryptocurrency wallets.

AADInternals can gather encryption keys from Azure AD services such as ADSync and Active Directory Federated Services servers.

Empire can use modules like Invoke-SessionGopher to extract private key and session information.

Mimikatz's CRYPTO::Extract module can extract keys by interacting with Windows cryptographic application programming interface (API) functions.

TeamPCP Cloud Stealer has searched victim hosts for TLS and SSH keys.

Mini Shai-Hulud has gathered unsecured credentials to include SSH private keys within .ssh.

CanisterWorm has gathered SSH private keys from the .ssh file.

Hildegard has queried the Cloud Instance Metadata API for cloud credentials.

Shai-Hulud has queried the AWS and GCP metadata endpoints for instances and service credentials.

TruffleHog can query the AWS and GCP metadata endpoints for instances and service credentials.

Peirates can query the query AWS and GCP metadata APIs for secrets.

Mini Shai-Hulud has gathered credentials and secrets from AWS, Google Cloud Platform (GCP) and Azure metadata API.

MirrorStealer can target Group Policy Preferences for credentials.

SILENTTRINITY has a module that can extract cached GPP passwords.

PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Group Policy Preferences.

Peirates can query the Kubernetes API for secrets.

TeamPCP Cloud Stealer can query the Kubernetes API for credentials.

Mini Shai-Hulud has gathered unsecured API keys stored in container orchestrators.

Shai-Hulud has suppressed victim NPM warnings using `process[“exit’](0x0);` which results in having all errors exit with code 0.

Cuckoo Stealer can use `xattr -d com.apple.quarantine` to remove the quarantine flag attribute.

OSX_OCEANLOTUS.D uses the command xattr -d com.apple.quarantine to remove the quarantine file attribute used by Gatekeeper.

MacMa has removed the `com.apple.quarantineattribute` from the dropped file, `$TMPDIR/airportpaird`.

CoinTicker downloads the EggShell mach-o binary using curl, which does not set the quarantine flag.

XCSSET has dropped a malicious applet into an app's `.../Contents/MacOS/` folder of a previously launched app to bypass Gatekeeper's security checks on first launch apps (prior to macOS 13).

If running with elevated privileges, OSX/Shlayer has used the spctl command to disable Gatekeeper protection for a downloaded file. OSX/Shlayer can also leverage system links pointing to bash scripts in the downloaded DMG file to bypass Gatekeeper, a flaw patched in macOS 11.3 and later versions. OSX/Shlayer has been Notarized by Apple, resulting in successful passing of additional Gatekeeper checks.

TrickBot has come with a signed downloader component.

BLINDINGCAN has been signed with code-signing certificates such as CodeRipper.

Stuxnet used a digitally signed driver with a compromised Realtek certificate.

PAKLOG has used legitimate signed binaries such as PACLOUD.exe for follow-on execution of malicious DLLs through DLL Side-Loading.

StrongPity has been signed with self-signed certificates.

Janicab used a valid AppleDeveloperID to sign the code to get past security restrictions.