Procedure examples

Comnie attempts to detect several anti-virus products.

Lizar can search for processes associated with an anti-virus product from list.

SILENTTRINITY can determine if an anti-virus product is installed through the resolution of the service's virtual SID.

Pacu can enumerate AWS security services, including WAF rules and GuardDuty detectors.

Tasklist can be used to enumerate security software currently running on a system by process name of known products.

Empire can enumerate antivirus software on the target.

netsh can be used to discover system firewall settings.

Brute Ratel C4 can detect EDR userland hooks.

Flame identifies security software such as antivirus through the Security module.

Wizard Spider has utilized the PowerShell script `Get-DataInfo.ps1` to collect installed backup software information from a compromised machine.

Storm-0501 has discovered the victim environment’s protections to include Azure policies, resource locks, and Azure Storage immutability policies.

Pacu can enumerate AWS services, such as CloudTrail and CloudWatch.

AADInternals can enumerate information about a variety of cloud services, such as Office 365 and Sharepoint instances or OpenID Configurations.

ROADTools can enumerate Azure AD applications and service principals.

TruffleHog has the ability to scan code repositories and CI/CD platforms.

TeamPCP Cloud Stealer can search GitHub for Actions runner processes.

Leviathan abused access to compromised appliances to collect JSON Web Tokens (JWTs), used for creating virtual desktop sessions, during Leviathan Australian Intrusions.

APT29 uses stolen tokens to access victim accounts, without needing a password.

APT28 has used several malicious applications to steal user OAuth access tokens including applications masquerading as "Google Defender" "Google Email Protection," and "Google Scanner" for Gmail users. They also targeted Yahoo users with applications masquerading as "Delivery Service" and "McAfee Email Protection".

Shai-Hulud has stolen access tokens and API tokens from with CI/CD pipeline solutions and repositories.

AADInternals can steal users’ access tokens via phishing emails containing malicious links.

TruffleHog has gathered access tokens and API tokens from CI/CD pipeline solutions and repositories.

Peirates gathers Kubernetes service account tokens using a variety of techniques.

TeamPCP Cloud Stealer can read runner.worker process memory to extract plaintext tokens.

Mini Shai-Hulud has stolen application access tokens and other tokens to include those associated with CI/CD.

CanisterWorm has gathered cloud access tokens.

TeamPCP has used malware to steal access tokens from targeted cloud and developer environments.

ShinyHunters has stolen valid OAuth credentials from DevOps personnel or a company GitHub repository. Additionally, ShinyHunters has stolen application access tokens to access cloud services and to bypass authentication mechanisms.

Kali365 has obtained OAuth access and refresh tokens by deceiving victims into completing actor-initiated device authorization requests, and intercepting authentication sessions with legitimate identity providers through adversary-in-the-middle reverse proxy infrastructure.

During the 2025 Poland Wiper Attacks, the adversaries forced victim devices to reboot to finalize destruction of impacted systems.

APT38 has used a custom MBR wiper named BOOTWRECK, which will initiate a system reboot after wiping the victim's MBR.

APT37 has used malware that will issue the command shutdown /r /t 1 to reboot a system after wiping its MBR.

Medusa Group has manually turned off and encrypted virtual machines.

Lazarus Group has rebooted systems after destroying files and wiping the MBR on infected systems.

AcidRain reboots the target system once the various wiping processes are complete.

AvosLocker’s Linux variant has terminated ESXi virtual machines.

Olympic Destroyer will shut down the compromised system after it is done modifying system configuration settings.

DynoWiper has used the Microsoft Windows native `ExitWindowsEx()` function to log off the interactive user and shutdown the system.

ShrinkLocker can restart the victim system if it encounters an error during execution, and will forcibly shutdown the system following encryption to lock out victim users.

Apostle reboots the victim machine following wiping and related activity.

WhisperGate can shutdown a compromised host through execution of `ExitWindowsEx` with the `EXW_SHUTDOWN` flag.

AcidPour includes functionality to reboot the victim system following wiping actions, similar to AcidRain.

CHIMNEYSWEEP can reboot or shutdown the targeted system or logoff the current user.

DCSrv has a function to sleep for two hours before rebooting the system.

NotPetya will reboot the system one hour after infection.

LockerGoga has been observed shutting down infected systems.

MultiLayer Wiper reboots the infected system following wiping and related tasks to prevent system recovery.

DarkGate has used the `shutdown`command to shut down and/or restart the victim system.

Latrodectus has the ability to restart compromised hosts.

Shamoon will reboot the infected system once the wiping functionality has been completed.