Procedure examples

REvil attempts to create a mutex using a hard-coded value to ensure that no other instances of itself are running on the host.

PoisonIvy creates a mutex using either a custom or default value.

SUNSPOT creates a mutex using the hard-coded value ` {12d61a41-4b74-7610-a4d8-3028d2f56395}` to ensure that only one instance of itself is running.

GrimAgent uses the last 64 bytes of the binary to compute a mutex name. If the generated name is invalid, it will default to the generic `mymutex`.

SPAWNCHIMERA has fixed a buffer overflow vulnerability (CVE-2025-0282) by hooking the strncpy function and limiting the size to 256 to prevent other actors from leveraging the exploit. SPAWNCHIMERA has converted its process name to hexadecimal and verifies an added value which is triggered when the first byte of the source copied to the fixed strncpy function matches `0x04050203`.

Troll Stealer creates a mutex during installation to prevent duplicate execution.

Qilin can create a mutex to ensure only one instance is running.

During C0015, the threat actors used the command `nltest /domain_trusts /all_trusts` to enumerate domain trusts.

During the SolarWinds Compromise, APT29 used the `Get-AcceptedDomain` PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell. They also used AdFind to enumerate domains and to discover trust between federated domains.

Leviathan performed Active Directory enumeration of victim environments during Leviathan Australian Intrusions.

BlackByte enumerated Active Directory information and trust relationships during operations.

Storm-1811 has enumerated domain accounts and access during intrusions.

Akira uses the built-in Nltest utility or tools such as AdFind to enumerate Active Directory trusts in victim environments.

Storm-0501 has used Windows native utility Nltest `nltest.exe` for discovery.

Lotus Blossom has used tools such as AdFind to make Active Directory queries.

Chimera has nltest /domain_trusts to identify domain trust relationships.

MirrorFace has run `nltest.exe /domain_trusts` on compromised systems to discover domain relationships.

Earth Lusca has used Nltest to obtain information about domain controllers.

Magic Hound has used a web shell to execute `nltest /trusted_domains` to identify trust relationships.

FIN8 has retrieved a list of trusted domains by using nltest.exe /domain_trusts.

TrickBot can gather information about domain trusts by utilizing Nltest.

Pikabot will gather information concerning the Windows Domain the victim machine is a member of during execution.

DUSTTRAP can identify Active Directory information and related items.

BADHATCH can use `nltest.exe /domain_trusts` to discover domain trust relationships on a compromised machine.

IcedID used Nltest during initial discovery.

SocGholish can profile compromised systems to identify domain trust relationships.

Latrodectus can run `C:\Windows\System32\cmd.exe /c nltest /domain_trusts` to discover domain trusts.

Bazar can use Nltest tools to obtain information about the domain.

MgBot includes modules for collecting information on local domain users and permissions.

LAMEHUG can gather Active Directory domain information.

QakBot can run nltest /domain_trusts /all_trusts for domain trust discovery.

BloodHound has the ability to map domain trusts and identify misconfigurations for potential abuse.

PowerSploit has modules such as Get-NetDomainTrust and Get-NetForestTrust to enumerate domain and forest trusts.

Empire has modules for enumerating domain trusts.

dsquery can be used to gather information on domain trusts with dsquery * -filter "(objectClass=trustedDomain)" -attr *.

PoshC2 has modules for enumerating domain trusts.

Brute Ratel C4 can use LDAP queries and `nltest /domain_trusts` for domain trust discovery.

Nltest may be used to enumerate trusted domains by using commands such as nltest /domain_trusts.

Rubeus can gather information about domain trusts.

AdFind can gather information about organizational units (OUs) and domain trusts from Active Directory.

During SharePoint ToolShell Exploitation, threat actors, including Storm-2603, modified group policy to enable ransomware distribution.

During the 2025 Poland Wiper Attacks, the adversaries had leveraged Group Policy Objects to distribute wiper malware to victim devices through a network share.

During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Group Policy Objects (GPOs) to deploy and execute malware.

Indrik Spider has used Group Policy Objects to deploy batch scripts.

APT41 used scheduled tasks created via Group Policy Objects (GPOs) to deploy ransomware.

Storm-0501 distributed Group Policy Objects to tamper with security products.

Cinnamon Tempest has used Group Policy to deploy batch scripts for ransomware deployment.

VOID MANTICORE had utilized Group Policy logon scripts to distribute the malicious payloads to victim devices through the execution of a batch file.

Prestige has been deployed using the Default Domain Group Policy Object from an Active Directory Domain Controller.

LockBit 3.0 can enable options for propogation through Group Policy Objects.