Procedure examples

Tonto Team has used keylogging tools in their operations.

Lazarus Group malware KiloAlfa contains keylogging functionality.

FIN4 has captured credentials via fake Outlook Web App (OWA) login pages and has also used a .NET based keylogger.

Sowbug has used keylogging tools.

HEXANE has used a PowerShell-based keylogger named `kl.ps1`.

PLATINUM has used several different keyloggers.

Magic Hound malware is capable of keylogging.

Ajax Security Team has used CWoolger and MPK, custom-developed malware, which recorded all keystrokes on an infected system.

Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers. Threat Group-3390 also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.

FIN13 has logged the keystrokes of victims to escalate privileges.

RedCurl prompts the user for credentials through a Microsoft Outlook pop-up.

FIN4 has presented victims with spoofed Windows Authentication prompts to collect their credentials.

Kimsuky has collected credentials from a fake Google account login page.

Winter Vivern registered and hosted domains to allow for creation of web pages mimicking legitimate government email logon sites to collect logon information.

PLATINUM is capable of using Windows hook interfaces for information gathering such as credential access.

APT38 leveraged Sysmon to understand the processes, services in the organization.

APT3 has a tool that can list out currently running processes.

Kimsuky can gather a list of all processes running on a victim's machine. Kimsuky has also obtained running processes on the victim device utilizing PowerShell cmdlet `Get-Process`.

Volt Typhoon has enumerated running processes on targeted systems including through the use of Tasklist.

HAFNIUM has used `tasklist` to enumerate processes.

MuddyWater has used malware to obtain a list of running processes on the system.

Gamaredon Group has used tools to enumerate processes on target hosts including Process Explorer.

TeamTNT has searched for rival malware and removes it if found. TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.

FIN7 has used the PowerShell script 3CF9.ps1 to perform process discovery by executing `tasklist /v`. Additionally, WsTaskLoad.exe executes `tasklist /v` to perform process discovery.

Andariel has used tasklist to enumerate processes and find a specific string.

Sidewinder has used tools to identify running processes on the victim's machine.

Mustang Panda has used tasklist /v to determine active process information. Mustang Panda has also used TONESHELL malware to check the process name and process path to ensure it matches the expected one prior to triggering a custom exception handler.

Rocke can detect a running process's PID on the infected machine.

UNC3886 has run scripts to list all running processes on a guest VM from an ESXi host.

APT37's Freenki malware lists running processes using the Microsoft Windows API.

OilRig has run tasklist on a victim's machine and used infostealers to capture processes.

Higaisa’s shellcode attempted to find the process ID of the current process.

Tropic Trooper is capable of enumerating the running processes on the system using pslist.

Ke3chang performs process discovery using tasklist commands.

APT1 gathered a list of running processes on the system using tasklist /v.

Turla surveys a system upon check-in to discover running processes using the tasklist /v command. Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.

Storm-0501 has discovered running processes through `tasklist.exe`.

After compromising a victim, Poseidon Group lists all running processes.

Stealth Falcon malware gathers a list of running processes.

Chimera has used tasklist to enumerate processes.

MirrorFace has used Tasklist on compromised hosts for discovery.

Medusa Group has utilized a hard-coded security tool process list that identifies and terminates using an undocumented IOCTL code 0x222094.

Darkhotel malware can collect a list of running processes on a system.

Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.

Windshift has used malware to enumerate active processes.

ToddyCat has run `cmd /c start /b tasklist` to enumerate processes.

An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.

APT5 has used Windows-based utilities to carry out tasks including tasklist.exe.

Winnti Group looked for a specific process running on infected servers.

Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.