Procedure examples

Crimson contains commands to list files and directories, as well as search for files matching certain extensions from a defined list.

DUSTTRAP can enumerate files and directories.

DynoWiper has used the Microsoft Windows native `FindFirstFile()` and `FindNextFile()` to recursively enumerate directories and files on the system.

Turian can search for specific files and list directories.

Machete produces file listings in order to search for files to be exfiltrated.

Action RAT has the ability to collect drive and file information on an infected machine.

Avenger has the ability to browse files in directories such as Program Files and the Desktop.

A module in Prikormka collects information about the paths, size, and creation time of files with specific file extensions, but not the actual content of the file.

PingPull can enumerate storage volumes and folder contents of a compromised host.

Dacls can scan directories on a compromised host.

DropBook can collect the names of all files and folders in the Program Files directories.

Woody RAT can list all files and their associated attributes, including filename, type, owner, creation time, last access time, last write time, size, and permissions.

Mafalda can search for files and directories.

ELMER is capable of performing directory listings.

SombRAT can execute enum to enumerate files in storage on a compromised system.

ODAgent can identify the current working directory.

FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system and removable media.

FYAnti can search the C:\Windows\Microsoft.NET\ directory for files of a specified size.

LoFiSe can monitor the file system to identify files less than 6.4 MB in size with file extensions including .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pdf, .rtf, .tif, .odt, .ods, .odp, .eml, and .msg.

HOPLIGHT has been observed enumerating system drives and partitions.

Cuckoo Stealer can search for files associated with specific applications.

MobileOrder has a command to upload to its C2 server information about files on the victim mobile device, including SD card size, installed app list, SMS content, contacts, and calling history.

WastedLocker can enumerate files and directories just prior to encryption.

InvisiMole can list information about files in a directory and recently opened or used documents. InvisiMole can also search for specific files by supplied file mask.

P.A.S. Webshell has the ability to list files and file characteristics including extension, size, ownership, and permissions.

Volgmer can list directories on a victim.

WINERACK can enumerate files and directories.

WhisperGate can locate files based on hardcoded file extensions.

FruitFly looks for specific files and file types.

AcidPour can identify specific files and directories within the Linux operating system corresponding with storage devices for follow-on wiping activity, similar to AcidRain.

Skidmap has checked for the existence of specific files including /usr/sbin/setenforce and /etc/selinux/config. It also has the ability to monitor the cryptocurrency miner file and process.

Okrum has used DriveLetterView to enumerate drive information.

Conti can discover files on a local system.

SameCoin can list all system files and can avoid wiping specific directories such as Program Files, Windows, and Users.

Raspberry Robin will check to see if the initial executing script is located on the user's Desktop as an anti-analysis check.

Mispadu searches for various filesystem paths to determine what banking applications are installed on the victim’s machine.

Megazord can ignore specified directories for encryption.

Diavol has a command to traverse the files and directories in a given path.

Doki has resolved the path of a process PID to use as a script argument.

Siloscape searches for the Kubernetes config file and other related files using a regular expression.

BlackCat can enumerate files for encryption.

Fysbis has the ability to search for files.

MarkiRAT can look for files carrying specific extensions such as: .rtf, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pps, .ppsx, .txt, .gpg, .pkr, .kdbx, .key, and .jpb.

Kazuar finds a specified directory, lists the files and metadata about those files.

NETEAGLE allows adversaries to enumerate and modify the infected host's file system. It supports searching for directories, creating directories, listing directory contents, reading and writing to files, retrieving file attributes, and retrieving volume information.

POORAIM can conduct file browsing.

CHIMNEYSWEEP has the ability to enumerate directories for files that match a set list.

FatDuke can enumerate directories on target machines.

BlackEnergy gathers a list of installed apps from the uninstall program Registry. It also gathers registered mail, browser, and instant messaging clients from the Registry. BlackEnergy has searched for given file types.

zwShell can browse the file system.