Procedure examples

AADInternals can create and export various authentication certificates, including those associated with Azure AD joined/registered devices.

Mimikatz's `CRYPTO` module can create and export various types of authentication certificates.

Mini Shai-Hulud has collected victim client certificates to assist in signed authentication assertion with Azure environments.

Pacu can run commands on EC2 instances using AWS Systems Manager Run Command.

AADInternals can execute commands on Azure virtual machines using the VM agent.

HOPLIGHT can enumerate device drivers located in the registry at `HKLM\Software\WBEM\WDM`.

Remsec has a plugin to detect active drivers of some security products.

INC Ransomware can verify the presence of specific drivers on compromised hosts including Microsoft Print to PDF and Microsoft XPS Document Writer.

Line Dancer can modify the crash dump process on infected machines to skip crash dump generation and proceed directly to device reboot for both persistence and forensic evasion purposes.

Line Runner used CVE-2024-20353 to trigger victim devices to reboot, in the process unzipping and installing the Line Dancer payload.

DUSTTRAP can identify infected system log information.

Megazord has the ability to print the trace, debug, error, info, and warning logs.

BeaverTail has identified .ldb and .log files stored in browser extension directories for collection and exfiltration.

Akira _v2 can enumerate the trace, debug, error, info, and warning logs on targeted systems.

Pacu can collect CloudTrail event histories and CloudWatch logs.

InvisibleFerret has searched the victim device credentials and files commonly associated with cryptocurrency wallets.

BeaverTail has searched the victim device for browser extensions commonly associated with cryptocurrency wallets.

DarkGate can deploy payloads capable of capturing credentials related to cryptocurrency wallets.

GlassWorm has the ability to steal credentials for cryptocurrency wallets.

Embargo has been leveraged in double-extortion ransomware, exfiltrating files then encrypting them, to prompt victims to pay a ransom.

RedLine Stealer has collected data from cryptocurrency wallets and harvested credit cards details from browsers.

Crocodilus has stolen cryptocurrency wallet details from victim devices.

TeamPCP Cloud Stealer can search filesystems for cryptocurrency wallets such as Bitcoin, Litecoin, Dogecoin, Zcash, Dash, Ripple, and Monero.

Disco has achieved initial access and execution through content injection into DNS, HTTP, and SMB replies to targeted hosts that redirect them to download malicious files.

JumbledPath can use a chain of jump hosts to communicate with compromised devices to obscure actor infrastructure.

UPSTYLE attempts to retrieve a non-existent webpage from the command and control server resulting in hidden commands sent via resulting error messages.

DarkGate command and control includes hard-coded domains in the malware masquerading as legitimate services such as Akamai CDN or Amazon Web Services.

Cheerscrypt has leveraged `esxcli vm process list` in order to gather a list of running virtual machines to terminate them.

PureCrypter can identify virtual machines by querying the WMI object Win32_ComputerSystem for manufacturer and model and check it against the regular expression Microsoft|VMWare|Virtual.

VIRTUALPITA can target specific guest virtual machines for script execution.

Qilin can detect virtual machine environments including ESXi hosts, datacenters, and clusters within vCenter environments.

VIRTUALPITA can execute commands on guest virtual machines from compromised ESXi hypervisors.

Shai-Hulud has also leveraged GitHub actions from stolen accounts in order to create a malicious Github workflow within `.github/workflows/discussion.yaml`.

Mini Shai-Hulud has utilized Github Actions to propagate through the use of triggered workflows.

CanisterWorm has leveraged stolen tokens from Trivy users to publish itself across over 46 npm packages.

BRICKSTORM has embedded delayed-start logic that attempts to circumvent detection for long-term persistence. BRICKSTORM has been observed configured with a “delay” timer built-in that waited for a hard-coded date months in the future before beginning to beacon to the configured C2 domain.

TONESHELL has the ability to pause operations for a specified duration prior to follow-on execution of activities.

DynoWiper has utilized a five-second delay using `Sleep(5000)` between two of the three phases of the attack that involves file overwriting, file deletion, and system reboot.

SystemBC has leveraged the Sleep functions before and after commands to ensure execution using the hexadecimal values within commands to include `Sleep(0x2710u)` that waits 10 seconds, and `Sleep(0xEA60u)` for 60 seconds.

RustyWater has generated random sleep intervals between C2 communication.

PureCrypter has the ability to delay for a specified number of seconds before execution.

MuddyViper has the ability to sleep for a certain amount of time, with the default being one minute.

Fooder has used a custom delay function (`delayExecution(integer)`) and Sleep API calls (`Sleep(integer)`) to slow code execution.

GlassWorm has used a timeout function set to `9e5` which delays execution 900,000 milliseconds or 15 minutes to avoid detection.

AshTag can use a set sleep time to delay C2 beaconing.

PHASEJAM has used the `sleep` command within its code to generate a fake HTML upgrade progress bar that mimics a running process.

SPAWNCHIMERA has used delayed execution to pause for a defined interval before performing environment discovery, repeatedly checking for specific processes, such as the `dslogserver` process, prior to continuing execution.

HIUPAN has used a config file “$.ini” to store a sleep multiplier to execute at a set interval value prior to initiating a watcher function that checks for a specific running process, that checks for removable drives and installs itself and supporting files if one is available.

Shai-Hulud has delayed execution of its larger payloads by forking itself into background process.

Qilin has the ability to delay execution.