Procedure examples

Carberp can start a remote VNC session by downloading a new plugin.

Proton uses VNC to connect into systems.

ZxShell supports functionality for VNC sessions.

WarzoneRAT has the ability of performing remote desktop access via a VNC console.

During Operation MidnightEclipse, threat actors used WinRM to move laterally in targeted networks.

During the SolarWinds Compromise, APT29 used WinRM via PowerShell to execute commands and payloads on remote hosts.

Storm-0501 has utilized the post-exploitation tool known as Evil-WinRM that uses PowerShell over Windows Remote Management (WinRM) for remote code execution.

Chimera has used WinRM for lateral movement.

Wizard Spider has used Window Remote Management to move laterally through a victim network.

Threat Group-3390 has used WinRM to enable remote execution.

FIN13 has leveraged `WMI` to move laterally within a compromised network via application servers and SQL servers.

Cobalt Strike can use WinRM to execute a payload on a remote host.

SILENTTRINITY tracks `TrustedHosts` and can move laterally to these targets via WinRM.

Brute Ratel C4 can use WinRM for pivoting.

During C0027, Scattered Spider used compromised Azure credentials for credential theft activity and lateral movement to on-premises systems.

Scattered Spider has also leveraged pre-existing AWS EC2 instances for lateral movement and data collection purposes.

Storm-0501 has used compromised Entra Connect Sync Server to move laterally within the victim environment.

APT29 has leveraged compromised high-privileged on-premises accounts synced to Office 365 to move laterally into a cloud environment, including through the use of Azure AD PowerShell.

Mini Shai-Hulud has accessed and propagated to AWS EC2 instances via SSM Send-Command.

A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.

OilRig has used Wireshark’s usbcapcmd utility to capture USB traffic.

Turla RPC backdoors can collect files from USB thumb drives.

An APT28 backdoor may collect the entire contents of an inserted USB device.

GravityRAT steals files based on an extension list if a USB drive is connected to the system.

AppleSeed can find and collect data from removable media devices.

CosmicDuke steals user files from removable media with file extensions and keywords that match a predefined list.

Aria-body has the ability to collect data from USB devices.

Crimson contains a module to collect data from removable drives.

Machete can find, encrypt, and upload files from fixed and removable drives.

Prikormka contains a module that collects documents with certain extensions from removable media or fixed drives connected via USB.

FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on removable media and copies them to a staging area. The default file types copied would include data copied to the drive by SPACESHIP.

InvisiMole can collect jpeg files from connected MTP devices.

ObliqueRAT has the ability to extract data from removable devices connected to the endpoint.

Remsec has a package that collects documents from any inserted USB sticks.

Explosive can scan all .exe files located in the USB drive.

Rover searches for files on attached removable drives based on a predefined list of file extensions every five seconds.

Crutch can monitor removable drives and exfiltrate files matching a given extension list.

MgBot includes modules capable of gathering information from USB thumb drives and CD-ROMs on the victim machine given a list of provided criteria.

Once a removable media device is inserted back into the first victim, USBStealer collects data from it that was exfiltrated from a second victim.

TajMahal has the ability to steal written CD images and files of interest from previously connected removable drives when they become available again.

Ramsay can collect data from removable media and stage it for exfiltration.

The FunnyDream FilePakMonitor component has the ability to collect files from removable devices.

BADNEWS copies files with certain extensions from USB devices to
a predefined directory.

During the 3CX Supply Chain Attack, AppleJeus payloads use AES-256 GCM cipher to encrypt data to include ICONICSTEALER and VEILEDSIGNAL.

During C0015, the threat actors used Base64-encoded strings.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used heavily obfuscated code with Industroyer in its Windows Notepad backdoor.

During C0017, APT41 broke malicious binaries, including DEADEYE and KEYPLUG, into multiple sections on disk to evade detection.

GALLIUM used a modified version of HTRAN in which they obfuscated strings such as debug messages in an apparent attempt to evade detection.

APT3 obfuscates files or information to help evade defensive measures.

Kimsuky has obfuscated binary strings including the use of XOR encryption and Base64 encoding. Kimsuky has also modified the first byte of DLL implants targeting victims to prevent recognition of the executable file format. Kimsuky has obfuscated strings using Single Instruction Multiple Data (SIMD) instructions that complicate static analysis.