Procedure examples

Uroburos can use custom communication methodologies that ride over common protocols including TCP, UDP, HTTP, SMTP, and DNS in order to blend with normal network traffic.

BADCALL uses a FakeTLS method during C2.

Cobalt Strike can leverage the HTTP protocol for C2 communication, while hiding the actual data in either an HTTP header, URI parameter, the transaction body, or appending it to the URI. Cobalt Strike has also added Host: ocsp.verisign.com to HTTP headers to mimic Online Certificate Status Protocol (OCSP) traffic.

SUNBURST masqueraded its network traffic as the Orion Improvement Program (OIP) protocol.

FakeM C2 traffic attempts to evade detection by resembling data generated by legitimate messenger applications, such as MSN and Yahoo! messengers. Additionally, some variants of FakeM use modified SSL code for communications back to C2 servers, making SSL decryption ineffective.

FRAMESTING uses a cookie named `DSID` to mimic the name of a cookie used by Ivanti Connect Secure appliances for maintaining VPN sessions.

HARDRAIN uses FakeTLS to communicate with its C2 server.

StarProxy has utilized TLS record headers in network packets to impersonate various versions of TLS protocols to blend in with legitimate network traffic. StarProxy used FakeTLS to communicate with its C2 server.

FALLCHILL uses fake Transport Layer Security (TLS) to communicate with its C2 server.

Carbanak obtains Windows logon password details.

MgBot includes modules for dumping and capturing credentials from process memory.

Revenge RAT has a plugin for credential harvesting.

PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated many sources such as WinInet Credential Cache, and Lightweight Directory Access Protocol (LDAP).

OnionDuke steals credentials from its victims.

HOMEFRY can perform credential dumping.

Trojan.Karagany can dump passwords and save them into \ProgramData\Mail\MailAg\pwds.txt.

Bad Rabbit has used Mimikatz to harvest credentials from the victim's machine.

GreyEnergy has a module for Mimikatz to collect Windows credentials from the victim’s machine.

Emotet has been observed dropping and executing password grabber modules including Mimikatz.

Olympic Destroyer contains a module that tries to obtain credentials from LSASS, similar to Mimikatz. These credentials are used with PsExec and Windows Management Instrumentation to help the malware propagate itself across a network.

Mafalda can dump password hashes from `LSASS.exe`.

Okrum was seen using MimikatzLite to perform credential dumping.

NotPetya contains a modified version of Mimikatz to help gather credentials that are later used for lateral movement.

Pysa can perform OS credential dumping using Mimikatz.

Cobalt Strike can spawn a job to inject into LSASS memory and dump password hashes.

Daserf leverages Mimikatz and Windows Credential Editor to steal credentials.

PoetRAT used voStro.exe, a compiled pypykatz (Python version of Mimikatz), to steal credentials.

Qilin can employ an embedded Mimikatz module to dump LSASS memory.

CozyCar has executed Mimikatz to harvest stored credentials from the victim and further victim penetration.

Lizar can run Mimikatz to harvest credentials.

Net Crawler uses credential dumpers such as Mimikatz and Windows Credential Editor to extract cached credentials from Windows systems.

Sliver has a built-in `procdump` command allowing for retrieval of memory from processes such as `lsass.exe` for credential harvesting.

SILENTTRINITY can create a memory dump of LSASS via the `MiniDumpWriteDump Win32` API call.

PowerSploit contains a collection of Exfiltration modules that can harvest credentials using Mimikatz.

Windows Credential Editor can dump credentials.

SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.

Lslsass can dump active logon session password hashes from the lsass process.

Empire contains an implementation of Mimikatz to gather credentials from memory.

PoshC2 contains an implementation of Mimikatz to gather credentials from memory.

Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSASS Memory.

LaZagne can perform credential dumping from memory to obtain account and password information.

Pupy can execute Lazagne as well as Mimikatz using PowerShell.

CosmicDuke collects Windows account hashes.

HOPLIGHT has the capability to harvest credentials and passwords from the SAM database.

Remsec can dump the SAM database.

Cobalt Strike can recover hashed passwords.

IceApple's Credential Dumper module can dump encrypted password hashes from SAM registry keys, including `HKLM\SAM\SAM\Domains\Account\F` and `HKLM\SAM\SAM\Domains\Account\Users\*\V`.

Password stealer and NTLM stealer modules in CozyCar harvest stored credentials from the victim, including credentials used as part of Windows NTLM user authentication.

POWERTON has the ability to dump password hashes.

Mivast has the capability to gather NTLM password information.