Procedure examples

Mispadu can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.

To collect data on the host's Wi-Fi connection history, LightSpy reads the `/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist` file. It also utilizes Apple's `CWWiFiClient` API to scan for nearby Wi-Fi networks and obtain data on the SSID, security type, and RSSI (signal strength) values.

BeaverTail has searched the victim device for browser extensions including those commonly associated with cryptocurrency wallets.

DarkWatchman can retrieve browser history.

Lumma Stealer has identified and gathered information from two-factor authentication extensions for multiple browsers.

GlassWorm has searched browser data for cookies, history, login databases, and cryptocurrency wallets.

RedLine Stealer can collect information from browsers and browser extensions.

SUGARDUMP has collected browser bookmark and history information.

Calisto collects information on bookmarks from Google Chrome.

Troll Stealer collects information from Chromium-based browsers and Firefox such as cookies, history, downloads, and extensions.

Lizar can retrieve browser history and database files.

Dtrack can retrieve browser history.

Empire has the ability to gather browser data such as bookmarks and visited sites.

Volt Typhoon has used native tools and processes including living off the land binaries or “LOLBins" to maintain and expand access to the victim networks.

Lazarus Group lnk files used for persistence have abused the Windows Update Client (wuauclt.exe) to execute a malicious DLL.

APT38 has used CHM files to move concealed payloads.

APT41 used compiled HTML (.chm) files for targeting.

OilRig has used a CHM payload to load and execute another malicious file once delivered to a victim.

Dark Caracal leveraged a compiled HTML file that contained a command to download and run an executable.

Silence has weaponized CHM files in their phishing campaigns.

Astaroth uses ActiveX objects for file execution and manipulation.

InvisiMole can register itself for execution and persistence via the Control Panel.

Reaver drops and executes a malicious CPL file as its payload.

MuddyWater has used CMSTP.exe and a malicious INF to execute its POWERSTATS payload.

Cobalt Group has used the command cmstp.exe /s /ns C:\Users\ADMINI~W\AppData\Local\Temp\XKNqbpzl.txt to bypass AppLocker and launch a malicious script.

CHIMNEYSWEEP can use CMSTP.exe to install a malicious Microsoft Connection Manager Profile.

LockBit 3.0 can attempt a CMSTP UAC bypass if it does not have administrative privileges.

menuPass has used InstallUtil.exe to execute malicious software.

Mustang Panda has used InstallUtil.exe to execute a malicious Beacon stager.

WhisperGate has used `InstallUtil.exe` as part of its process to disable Windows Defender.

Saint Bot had used `InstallUtil.exe` to download and deploy executables.

Chaes has used Installutill to download content.

Covenant can create launchers via an InstallUtil XML file to install new Grunt listeners.

During Operation Dust Storm, the threat actors executed JavaScript code via `mshta.exe`.

During C0015, the threat actors used `mshta` to execute DLLs.

APT38 has used a renamed version of `mshta.exe` to execute malicious HTML files.

SideCopy has utilized `mshta.exe` to execute a malicious hta file.

Kimsuky has used mshta.exe to run malicious scripts on the system.

APT32 has used mshta.exe for code execution.

MuddyWater has used mshta.exe to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution.

Gamaredon Group has used `mshta.exe` to execute malicious files.

FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.

Sidewinder has used mshta.exe to execute malicious payloads.

Mustang Panda has used mshta.exe to launch collection scripts.

TA2541 has used `mshta` to execute scripts including VBS.

Confucius has used mshta.exe to execute malicious VBScript.

APT29 has use `mshta` to execute malicious scripts on a compromised host.

TA551 has used mshta.exe to execute malicious payloads.

LazyScripter has used `mshta.exe` to execute Koadic stagers.

Lazarus Group has used mshta.exe to execute HTML pages downloaded by initial access documents.