Procedure examples

Kimsuky has used modified versions of PHProxy to examine web traffic between the victim and the accessed website.

Mustang Panda leveraged a captive portal hijack that redirected the victim to a webpage that prompted the victim to download a malicious payload.

Sea Turtle modified DNS records at service providers to redirect traffic from legitimate resources to Sea Turtle-controlled servers to enable adversary-in-the-middle attacks for credential capture.

Line Runner intercepts HTTP requests to the victim Cisco ASA, looking for a request with a 32-character, victim dependent parameter. If that parameter matches a value in the malware, a contained payload is then written to a Lua script and executed.

Dok proxies web traffic to potentially monitor and alter victim HTTP(S) traffic.

NPPSPY opens a new network listener for the mpnotify.exe process that is typically contacted by the Winlogon process in Windows. A new, alternative RPC channel is set up with a malicious DLL recording plaintext credentials entered into Winlogon, effectively intercepting and redirecting the logon information.

evilginx2 has the ability to act as an adversary-in-the-middle (AiTM) relay between a legitimate website and a phished user to capture all transmitted data including usernames, passwords, authentication tokens, and session cookies and tokens.

Kali365 has created obfuscated phishing landing pages that act as an adversary in the middle infrastructure that intercepts communications between the victim host and legitimate services to steal credentials and user sessions.

Lazarus Group executed Responder using the command [Responder file path] -i [IP address] -rPv on a compromised host to harvest credentials and move laterally.

Wizard Spider has used the Invoke-Inveigh PowerShell cmdlets, likely for name service poisoning.

Impacket modules like ntlmrelayx and smbrelayx can be used in conjunction with Network Sniffing and Name Resolution Poisoning and SMB Relay to gather NetNTLM credentials for Brute Force or relay attacks that can gain code execution.

Empire can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks.

PoshC2 can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks.

Responder is used to poison name services to gather hashes and credentials from systems within a local network.

Pupy can sniff plaintext network credentials and use NBNS Spoofing to poison name services.

Cleaver has used custom tools to facilitate ARP cache poisoning.

LuminousMoth has used ARP spoofing to redirect a compromised machine to an actor-controlled website.

APT28 has used a Wi-Fi Pineapple to set up Evil Twin Wi-Fi Poisoning for the purposes of capturing victim credentials or planting espionage-oriented malware.

During the 2025 Poland Wiper Attacks, the adversaries used the Rubeus tool to forge a Diamond Ticket that is a modified legitimate Kerberos ticket.

Akira have used scripts to dump Kerberos authentication credentials.

Ke3chang has used Mimikatz to generate Kerberos golden tickets.

Sliver incorporates the Rubeus framework to allow for Kerberos ticket manipulation, specifically for forging Kerberos Golden Tickets.

Empire can leverage its implementation of Mimikatz to obtain and use golden tickets.

Mimikatz's kerberos module can create golden tickets.

Rubeus can forge a ticket-granting ticket.

AADInternals can be used to forge Kerberos tickets using the password hash of the AZUREADSSOACC account.

Empire can leverage its implementation of Mimikatz to obtain and use silver tickets.

Mimikatz's kerberos module can create silver tickets.

Rubeus can create silver tickets.

During the SolarWinds Compromise, APT29 obtained Ticket Granting Service (TGS) tickets for Active Directory Service Principle Names to crack offline.

During Operation Wocao, threat actors used PowerSploit's `Invoke-Kerberoast` module to request encrypted service tickets and bruteforce the passwords of Windows service accounts offline.

Leviathan used Kerberoasting techniques during Leviathan Australian Intrusions.

Indrik Spider has conducted Kerberoasting attacks using a module from GitHub.

FIN7 has used Kerberoasting PowerShell commands such as, `Invoke-Kerberoast` for credential access and to enable lateral movement.

Wizard Spider has used Rubeus, MimiKatz Kerberos module, and the Invoke-Kerberoast cmdlet to steal AES hashes.

SILENTTRINITY contains a module to conduct Kerberoasting.

PowerSploit's Invoke-Kerberoast module can request service tickets and return crackable ticket hashes.

Impacket modules like GetUserSPNs can be used to get Service Principal Names (SPNs) for user accounts. The output is formatted to be compatible with cracking tools like John the Ripper and Hashcat.

Empire uses PowerSploit's Invoke-Kerberoast to request service tickets and return crackable ticket hashes.

Brute Ratel C4 can decode Kerberos 5 tickets and convert it to hashcat format for subsequent cracking.

Rubeus can use the `KerberosRequestorSecurityToken.GetRequest` method to request kerberoastable service tickets.

Rubeus can reveal the credentials of accounts that have Kerberos pre-authentication disabled through AS-REP roasting.

Impacket tools – such as getST.py or ticketer.py – can be used to steal or forge Kerberos tickets using ccache files given a password, hash, aesKey, or TGT.

During Operation MidnightEclipse, threat actors wrote output to stdout then piped it to bash for execution.

During the 3CX Supply Chain Attack, AppleJeus's VEILEDSIGNAL creates and listens on a Windows named pipe to exchange messages between modules.

Ninja can use pipes to redirect the standard input and the standard output.

When executing with non-root permissions, RotaJakiro uses the the `shmget API` to create shared memory between other known RotaJakiro processes. This allows processes to communicate with each other and share their PID.

The Havoc SMB demon can use named pipes for communication through a parent demon.

TONESHELL has facilitated inter-process communication between DLL components via the use of pipes. TONESHELL has also created a reverse shell using two anonymous pipes to write data to stdin and read data from stdout and stderr.

Medusa Ransomware has leveraged the `CreatePipe` API to enable inter-process communication.