Procedure examples

Proton uses VNC to connect into systems.

ZxShell supports functionality for VNC sessions.

WarzoneRAT has the ability of performing remote desktop access via a VNC console.

Cobalt Strike can use WinRM to execute a payload on a remote host.

SILENTTRINITY tracks `TrustedHosts` and can move laterally to these targets via WinRM.

Brute Ratel C4 can use WinRM for pivoting.

Mini Shai-Hulud has accessed and propagated to AWS EC2 instances via SSM Send-Command.

GravityRAT steals files based on an extension list if a USB drive is connected to the system.

AppleSeed can find and collect data from removable media devices.

CosmicDuke steals user files from removable media with file extensions and keywords that match a predefined list.

Aria-body has the ability to collect data from USB devices.

Crimson contains a module to collect data from removable drives.

Machete can find, encrypt, and upload files from fixed and removable drives.

Prikormka contains a module that collects documents with certain extensions from removable media or fixed drives connected via USB.

FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on removable media and copies them to a staging area. The default file types copied would include data copied to the drive by SPACESHIP.

InvisiMole can collect jpeg files from connected MTP devices.

ObliqueRAT has the ability to extract data from removable devices connected to the endpoint.

Remsec has a package that collects documents from any inserted USB sticks.

Explosive can scan all .exe files located in the USB drive.

Rover searches for files on attached removable drives based on a predefined list of file extensions every five seconds.

Crutch can monitor removable drives and exfiltrate files matching a given extension list.

MgBot includes modules capable of gathering information from USB thumb drives and CD-ROMs on the victim machine given a list of provided criteria.

Once a removable media device is inserted back into the first victim, USBStealer collects data from it that was exfiltrated from a second victim.

TajMahal has the ability to steal written CD images and files of interest from previously connected removable drives when they become available again.

Ramsay can collect data from removable media and stage it for exfiltration.

The FunnyDream FilePakMonitor component has the ability to collect files from removable devices.

BADNEWS copies files with certain extensions from USB devices to
a predefined directory.

TrickBot uses non-descriptive names to hide functionality.

EKANS uses encoded strings in its process kill list.

SynAck payloads are obfuscated prior to compilation to inhibit analysis and/or reverse engineering.

Bumblebee has been delivered as password-protected zipped ISO files and used control-flow-flattening to obfuscate the flow of functions.

BRICKSTORM has utilized Go libraries to include Garble to obfuscate code.

Amadey has obfuscated strings such as antivirus vendor names, domains, files, and others.

Some Orz strings are base64 encoded, such as the embedded DLL known as MockDll.

NOKKI uses Base64 encoding for strings.

AvosLocker has used XOR-encoded strings.

COATHANGER can store obfuscated configuration information in the last 56 bytes of the file `/date/.bd.key/preload.so`.

Sardonic can use certain ConfuserEx features for obfuscation and can be encoded in a base64 string.

Matryoshka obfuscates API function names using a substitute cipher combined with Base64 encoding.

Ecipekac can use XOR, AES, and DES to encrypt loader shellcode.

AppleSeed has the ability to Base64 encode its payload and custom encrypt API calls.

BUSHWALK can encrypt the resulting data generated from C2 commands with RC4.

NETWIRE has used a custom obfuscation algorithm to hide strings including Registry keys, APIs, and DLL names.

BOOKWORM has been delivered using self-extracting RAR archives.

OLDBAIT obfuscates internal strings and unpacks them at startup.

TEARDROP created and read from a file with a fake JPG header, and its payload was encrypted with a simple rotating XOR cipher.

Turian can use VMProtect for obfuscation.

Action RAT's commands, strings, and domains can be Base64 encoded within the payload.

PUBLOAD has obfuscated DLL names using the ror13AddHash32 algorithm.

The Gootloader first stage script is obfuscated using random alpha numeric strings.