Procedure examples

certutil can be used to install browser root certificates as a precursor to performing Adversary-in-the-Middle between connections to banking websites. Example command: certutil -addstore -f -user ROOT ProgramData\cert512121.der.

evilginx2 has obtained a valid SSL/TLS certificate from LetsEncrypt to provide responses to Automatic Certificate Management Environment (ACME) challenges.

Amadey has modified the `:Zone.Identifier` in the ADS area to zero.

QakBot has been packaged in ISO files in order to bypass Mark of the Web (MOTW) security measures.

BlackEnergy has enabled the TESTSIGNING boot configuration option to facilitate loading of a driver component.

Hikit has attempted to disable driver signing verification by tampering with several Registry keys prior to the loading of a rootkit driver component.

Pandora can use CVE-2017-15303 to disable Windows Driver Signature Enforcement (DSE) protection and load its driver.

LITTLELAMB.WOOLTEA can append malicious components to the `tmp/tmpmnt/bin/samba_upgrade.tar` archive inside the factory reset partition in attempt to persist post reset.

BUSHWALK can embed into the legitimate `querymanifest.cgi` file on compromised Ivanti Connect Secure VPNs.

BOLDMOVE contains a watchdog-like feature that monitors a particular file for modification. If modification is detected, the legitimate file is backed up and replaced with a trojanized file to allow for persistence through likely system upgrades.

Bonadan has maliciously altered the OpenSSH binary on targeted systems to create a backdoor.

LIGHTWIRE can imbed itself into the legitimate `compcheckresult.cgi` component of Ivanti Connect Secure VPNs to enable command execution.

ThiefQuest searches through the /Users/ folder looking for executable files. For each executable, ThiefQuest prepends a copy of itself to the beginning of the file. When the file is executed, the ThiefQuest code is executed first. ThiefQuest creates a hidden file, copies the original target executable to the file, then executes the new hidden file to maintain the appearance of normal behavior.

GlassWorm can modify hardware wallet applications.

Kobalos replaced the SSH client with a trojanized SSH client to steal credentials on compromised systems.

WARPWIRE can embed itself into a legitimate file on compromised Ivanti Connect Secure VPNs.

FRAMESTING can embed itself in the CAV Python package of an Ivanti Connect Secure VPN located in `/home/venv3/lib/python3.6/site-packages/cav-0.1-py3.6.egg/cav/api/resources/category.py.`

WIREFIRE can modify the `visits.py` component of Ivanti Connect Secure VPNs for file download and arbitrary command execution.

Kessel has maliciously altered the OpenSSH binary on targeted systems to create a backdoor.

PHASEJAM has modified legitimate components to enable persistence and execution, including inserting a web shell into `getComponent.cgi` and `restAuth.cgi`, modifying `DSUpgrade.pm` to block system upgrades, and overwriting `remotedebug` to execute arbitrary commands when specific parameters are provided.

BFG Agonizer uses DLL unhooking to remove user mode inline hooks that security solutions often implement. BFG Agonizer also uses IAT unhooking to remove user-mode IAT hooks that security solutions also use.

Ebury modifies the `keyutils` library to add malicious behavior to the OpenSSH client and the curl library.

XCSSET uses a malicious browser application to replace the legitimate browser in order to continuously capture credentials, monitor web traffic, and download additional modules.

Industroyer has used a Trojanized version of the Windows Notepad application for an additional backdoor persistence mechanism.

SLOWPULSE is applied in compromised environments through modifications to legitimate Pulse Secure files.

Mini Shai-Hulud has established persistence through modifying software binaries to include AI coding agents’ configuration or setting files that act as hooks, tasks or execution triggers.

Matryoshka is capable of stealing Outlook passwords.

NETWIRE can retrieve passwords from messaging and mail client applications.

OLDBAIT collects credentials from several email clients.

CosmicDuke collects user credentials, including passwords, for various programs including popular instant messaging applications and email clients as well as WLAN keys.

MirrorStealer has the ability to steal credentials from email clients.

A module in Prikormka collects passwords stored in applications installed on the victim.

Mispadu has obtained credentials from mail clients via NirSoft MailPassView.

BeaverTail has collected keys stored for Solana stored in `.config/solana/id.json` and other login details associated with macOS within `/Library/Keychains/login.keychain` or for Linux within `/.local/share/keyrings`.

DarkGate use Nirsoft Network Password Recovery or NetPass tools to steal stored RDP credentials in some malware versions.

KGH_SPY can collect credentials from WINSCP.

RedLine Stealer has obtained credentials from VPN services, FTP clients and Instant Messenger (IM)/Chat clients.

XLoader can collect credentials stored in email clients.

MgBot includes modules for stealing stored credentials from Outlook and Foxmail email client software.

PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated with many sources such as The Bat!, Yahoo!, Mail.ru, Passport.Net, Google Talk, and Microsoft Outlook.

PLEAD has the ability to steal saved passwords from Microsoft Outlook.

Carberp's passw.plug plugin can gather account information from multiple instant messaging, email, and social media services, as well as FTP, VNC, and VPN clients.

Lokibot has stolen credentials from multiple applications and data sources including Windows OS credentials, email clients, FTP, and SFTP clients.

Manjusaka extracts credentials from the Windows Registry associated with Premiumsoft Navicat, a utility used to facilitate access to various database types.

Agent Tesla has the ability to steal credentials from FTP clients and wireless profiles.

Astaroth uses an external software known as NetPass to recover passwords.

PoshC2 can decrypt passwords stored in the RDCMan configuration file.

Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the credential vault and DPAPI.

LaZagne can obtain credentials from databases, mail, and WiFi across multiple platforms.

Pupy can use Lazagne for harvesting credentials.