Procedure examples

BADNEWS checks for new hard drives on the victim, such as USB devices, by listening for the WM_DEVICECHANGE window message.

QakBot can identify peripheral devices on targeted systems.

jRAT can map UPnP ports.

INC Ransomware can identify external USB and hard drives for encryption and printers to print ransom notes.

ADVSTORESHELL can list connected devices.

APT37 has used an audio capturing utility known as SOUNDWAVE that captures microphone input.

VOID MANTICORE has gathered audio during a Zoom session.

DOGCALL can capture microphone data from the victim's machine.

Janicab captured audio and sent it out to a C2 server.

EvilGrab has the capability to capture audio from a victim machine.

Crimson can perform audio surveillance using microphones.

Machete captures audio from the computer’s microphone.

InvisiMole can record sound using input audio devices.

VERMIN can perform audio capture.

DarkComet can listen in to victims' conversations through the system’s microphone.

LightSpy uses Apple's built-in AVFoundation Framework library to capture and manage audio recordings then transform them to JSON blobs for exfiltration.

ROKRAT has an audio capture and eavesdropping module.

Bandook has modules that are capable of capturing audio.

T9000 uses the Skype API to record audio and video calls. It writes encrypted data to %APPDATA%\Intel\Skype.

Micropsia can perform microphone recording.

Attor's has a plugin that is capable of recording audio using available input sound devices.

NightClub can load a module to leverage the LAME encoder and `mciSendStringW` to control and capture audio.

Derusbi is capable of performing audio captures.

MgBot can capture input and output audio streams from infected devices.

Cadelspy has the ability to record audio from the compromised host.

Cobian RAT has a feature to perform voice recording on the victim’s machine.

NanoCore can capture audio feeds from the system.

TajMahal has the ability to capture VoiceIP application audio on an infected host.

Revenge RAT has a plugin for microphone interception.

MacMa has the ability to record audio.

jRAT can capture microphone recordings.

MacSpy can record the sounds from microphones on a computer.

PowerSploit's Get-MicrophoneAudio Exfiltration module can record system microphone audio.

Remcos can capture data from the system’s microphone.

Imminent Monitor has a remote microphone monitoring capability.

Pupy can record sound with the microphone.

Flame can record audio using any existing hardware recording devices.

During C0015, the threat actors used the command `net view /all time` to gather the local time of a compromised network.

During Operation CuckooBees, the threat actors used the `net time` command as part of their advanced reconnaissance.

During Operation Wocao, threat actors used the `time` command to retrieve the current time of a compromised system.

Kimsuky has gathered the system time of the device using the PowerShell cmdlet `Get-Date`.

Volt Typhoon has obtained the victim's system timezone.

FIN7 has used the PowerShell script 3CF9.ps1 to execute `net time`.

CURIUM deployed mechanisms to check system time information following strategic website compromise attacks.

Sidewinder has used tools to obtain the current system time.

ZIRCONIUM has used a tool to capture the time on a compromised host in order to register it with C2.

UNC3886 has used installation scripts to collect the system time on targeted ESXi hosts.

Higaisa used a function to gather the current time.

The White Company has checked the current date on the victim system.

Turla surveys a system upon check-in to discover the system time by using the net time command.