Procedure examples

Ke3chang has dumped credentials, including by using gsecdump.

APT29 has used the `reg save` command to extract LSA secrets offline.

Ember Bear has used frameworks such as Impacket to dump LSA secrets for credential capture.

Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.

MuddyWater has performed credential dumping with LaZagne.

Leafminer used several tools for retrieving login and password information, including LaZagne.

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.

Earth Lusca has used a DCSync command with Mimikatz to retrieve credentials from an exploited controller.

Mustang Panda has leveraged Mimikatz DCSync feature to obtain user credentials.

Storm-0501 has utilized DCSync to extract credentials from victims.

LAPSUS$ has used DCSync attacks to gather credentials for privilege escalation routines.

APT38 has collected data from a compromised host.

GALLIUM collected data from the victim's local system, including password hashes from the SAM hive in the Registry.

APT3 will identify Microsoft Office documents on the victim's computer.

Kimsuky has collected Office, PDF, and HWP documents from its victims. Kimsuky has also harvested victim files through the use of the `RecentFiles()` function that collects paths of recently accessed files by parsing .lnk shortcuts from `%APPDATA%\Microsoft\Windows\Recent`.

Volt Typhoon has stolen files from a sensitive file server and the Active Directory database from targeted environments, and used Wevtutil to extract event log information.

Patchwork collected and exfiltrated files from the infected system.

APT41 has uploaded files and data from a compromised host.

Dragonfly has collected data from local victim systems.

menuPass has collected various files from the compromised computers.

HAFNIUM has collected data and files from a compromised machine.

FIN6 has collected and exfiltrated payment card data from compromised systems.

Gamaredon Group has collected files from infected systems and uploaded them to a C2 server.

FIN7 has collected files and other sensitive information from a compromised network.

Sandworm Team has exfiltrated internal documents, files, and other data from compromised hosts.

Andariel has collected large numbers of files from compromised network systems for later extraction.

CURIUM has exfiltrated data from a compromised machine.

APT39 has used various tools to steal files from the compromised host.

APT37 has collected data from victims' local systems.

OilRig has used PowerShell to upload files from compromised systems.

Windigo has used a script to gather credentials in files left on disk by OpenSSH backdoors.

Aquatic Panda captured local Windows security event log data from victim machines using the wevtutil utility to extract contents to an evtx output file.

Ke3chang gathered information and files from local directories for exfiltration.

APT1 has collected files from a local victim.

Turla RPC backdoors can upload files from victim machines.

RedCurl has collected data from the local disk of compromised hosts.

Stealth Falcon malware gathers data from the local victim system.

APT29 has stolen data from compromised hosts.

Dark Caracal collected complete contents of the 'Pictures' folder from compromised Windows systems.

MirrorFace gathered data and files of interest from victim's systems.

BRONZE BUTLER has exfiltrated files stolen from local systems.

Axiom has collected data from a compromised network.

Ember Bear gathers victim system information such as enumerating the volume of a given device or extracting system and security event logs for analysis.

ToddyCat has run scripts to collect documents from targeted hosts.

LuminousMoth has collected files and data from compromised machines.

Agrius gathered data from database and other critical servers in victim environments, then used wiping mechanisms as an anti-analysis and anti-forensics mechanism.

APT28 has retrieved internal documents from machines inside victim environments, including by using Forfiles to stage documents before exfiltration.

Fox Kitten has searched local system resources to access sensitive documents.