Procedure examples

UNC3886 maintained persistence on FortiGate Firewalls through ICMP port knocking.

PROMETHIUM has used a script that configures the knockd service and firewall to only accept C2 connections from systems that use a specified sequence of knock ports.

cd00r can monitor for a single TCP-SYN packet to be sent in series to a configurable set of ports (200, 80, 22, 53 and 3 in the original code) before opening a port for communication.

Mafalda can use port-knocking to authenticate itself to another implant called Cryshell to establish an indirect connection to the C2 server.

REPTILE has the ability to control compromised endpoints via port knocking.

metaMain has authenticated itself to a different implant, Cryshell, through a port knocking and handshake procedure.

CASTLETAP can listen for a specialized ICMP packet for activation on compromised network devices.

BPFDoor uses BPF bytecode to attach a filter to a network socket to view ICMP, UDP, or TCP packets coming through ports 22 (ssh), 80 (http), and 443 (https). When BPFDoor finds a packet containing its “magic” bytes, it parses out two fields and forks itself. The parent process continues to monitor filtered traffic while the child process executes the instructions from the parsed fields.

Penquin installs a `TCP` and `UDP` filter on the `eth0` interface.

PITSTOP can listen and evaluate incoming commands on the domain socket, created by PITHOOK malware, located at `/data/runtime/cockpit/wd.fd` for a predefined magic byte sequence. PITSTOP can then duplicate the socket for further communication over TLS.

Mimikatz’s LSADUMP::DCShadow module can be used to make AD updates by temporarily setting a computer to be a DC.

Dragonfly has exploited a Windows Netlogon vulnerability (CVE-2020-1472) to obtain access to Windows Active Directory servers.

menuPass has used tools to exploit the ZeroLogon vulnerability (CVE-2020-1472).

MuddyWater has exploited the Microsoft Netlogon vulnerability (CVE-2020-1472).

FIN7 has exploited ZeroLogon (CVE-2020-1472) against vulnerable domain controllers.

Ember Bear has used exploits for vulnerabilities such as MS17-010, also known as `Eternal Blue`, during operations.

APT28 exploited a Windows SMB Remote Code Execution Vulnerability to conduct lateral movement.

Fox Kitten has exploited known vulnerabilities in remote services including RDP.

Tonto Team has used EternalBlue exploits for lateral movement.

Earth Lusca has used Mimikatz to exploit a domain controller via the ZeroLogon exploit (CVE-2020-1472).

Wizard Spider has exploited or attempted to exploit Zerologon (CVE-2020-1472) and EternalBlue (MS17-010) vulnerabilities.

Threat Group-3390 has exploited MS17-010 to move laterally to other systems on the network.

TrickBot utilizes EternalBlue and EternalRomance exploits for lateral movement in the modules wormwinDll, wormDll, mwormDll, nwormDll, tabDll.

Stuxnet propagates using the MS10-061 Print Spooler and MS08-067 Windows Server Service vulnerabilities.

Bad Rabbit used the EternalRomance SMB exploit to spread through victim networks.

Emotet has been seen exploiting SMB via a vulnerability exploit like EternalBlue (MS17-010) to achieve lateral movement and propagation.

InvisiMole can spread within a network via the BlueKeep (CVE-2019-0708) and EternalBlue (CVE-2017-0144) vulnerabilities in RDP and SMB respectively.

Lucifer can exploit multiple vulnerabilities including EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0144).

NotPetya can use two exploits in SMBv1, EternalBlue and EternalRomance, to spread itself to other remote systems on the network.

Conficker exploited the MS08-067 Windows vulnerability for remote code execution through a crafted RPC request.

WannaCry uses an exploit in SMBv1 to spread itself to other remote systems on a network.

QakBot can move laterally using worm-like functionality through exploitation of SMB.

Empire has a limited number of built-in modules for exploiting remote SMB, JBoss, and Jenkins servers.

PoshC2 contains a module for exploiting SMB via EternalBlue.

ShinyHunters has exploited vulnerabilities in remote services for lateral movement.

Flame can use MS10-061 to exploit a print spooler vulnerability in a remote system with a shared printer in order to move laterally.

APT28 has used CVE-2015-4902 to bypass security features.

Velvet Ant exploited CVE-2024-20399 in Cisco Switches to which the threat actor was already able to authenticate in order to escape the NX-OS command line interface and gain access to the underlying operating system for arbitrary command execution.

Leviathan exploited vulnerable network appliances during Leviathan Australian Intrusions, leading to the collection and exfiltration of valid credentials.

UNC3886 exploited CVE-2022-22948 in VMware vCenter to obtain encrypted credentials from the vCenter postgresDB.

During the SolarWinds Compromise, APT29 accessed victims' internal knowledge repositories (wikis) to view sensitive corporate information on products, services, and internal business operations.

APT28 has collected files from various information repositories.

Raccoon Stealer gathers information from repositories associated with cryptocurrency wallets and the Telegram messaging service.

Troll Stealer gathers information from the Government Public Key Infrastructure (GPKI) folder, associated with South Korean government public key infrastructure, on infected systems.

LAPSUS$ has searched a victim's network for collaboration platforms like Confluence and JIRA to discover further high-privilege account credentials.

TruffleHog has collected credentials and data associated with Confluence.

During C0027, Scattered Spider accessed victim SharePoint environments to search for VPN and MFA enrollment information, help desk instructions, and new hire guides.

HAFNIUM has abused compromised credentials to exfiltrate data from SharePoint.

Akira has accessed and downloaded information stored in SharePoint instances as part of data gathering and exfiltration activity.

Ke3chang used a SharePoint enumeration and data dumping tool known as spwebmember.