Procedure examples

Milan can use hardcoded domains as an input for domain generation algorithms.

CCBkdr can use a DGA for Fallback Channels if communications with the primary command and control server are lost.

CHOPSTICK can use a DGA for Fallback Channels, domains are generated by concatenating words from lists.

BONDUPDATER uses a DGA to communicate with command and control servers.

Ebury has used a DGA to generate a domain name for C2.

ShadowPad uses a DGA that is based on the day of the month for C2 servers.

Astaroth has used a DGA in C2 communications.

QakBot can use domain generation algorithms in C2 communication.

ngrok can provide DGA for C2 servers through the use of random URL strings that change every 12 hours.

AsyncRAT use a DGA to generate a C2 domains.

APT12 has used multiple variants of DNS Calculation including multiplying the first two octets of an IP address and adding the third octet to that value in order to get a resulting command and control port.

macOS.OSAMiner has used `launchctl` to restart the Launch Agent.

Cuckoo Stealer can use `launchctl` to load a LaunchAgent for persistence.

Calisto uses launchctl to enable screen sharing on the victim’s machine.

XCSSET loads a system level launchdaemon using the launchctl load -w command from /System/Librarby/LaunchDaemons/ssh.plist.

AppleJeus has loaded a plist file using the launchctl command.

LoudMiner launched the QEMU services in the /Library/LaunchDaemons/ folder using launchctl. It also uses launchctl to unload all Launch Daemons when updating to a newer version of LoudMiner.

During SharePoint ToolShell Exploitation, threat actors leveraged PsExec for command execution and used `services.exe` to disable Microsoft Defender via Registry keys.

During Operation Honeybee, threat actors ran sc start to start the COMSysApp as part of the service hijacking and sc stop to stop and reconfigure the COMSysApp.

During Operation Digital Eye, threat actors used the winsw tool to deploy a Visual Studio code executable as a Windows service.

APT41 DUST used Windows services to execute DUSTPAN.

During Operation Wocao, threat actors created services on remote systems for execution purposes.

APT38 has created new services or modified existing ones to run executables, commands, or scripts.

BlackByte created malicious services for ransomware execution.

APT41 used svchost.exe and Net to execute a system service installed to launch a Cobalt Strike BEACON loader.

APT32's backdoor has used Windows services as a way to execute its malicious payload.

FIN6 has created Windows services to execute encoded PowerShell commands.

FIN7 has started the SSH service by executing `sc start sshd`.

APT39 has used post-exploitation tools including RemCom and the Non-sucking Service Manager (NSSM) to execute processes.

Ke3chang has used a tool known as RemoteExec (similar to PsExec) to remotely execute batch scripts and binaries.

Blue Mockingbird has executed custom-compiled XMRIG miner DLLs by configuring them to execute via the "wercplsupport" service.

Chimera has used PsExec to deploy beacons on compromised systems.

Medusa Group has utilized PsExec to execute scripts and commands within victim environments. Medusa Group has also used the Windows service RoboCopy to search and copy data for exfiltration.

INC Ransom has run a file encryption executable via `Service Control Manager/7045;winupd,%SystemRoot%\winupd.exe,user mode service,demand start,LocalSystem`.

Silence has used Winexe to install a service on the remote system.

Wizard Spider has used `services.exe` to execute scripts and executables during lateral movement within a victim's network. Wizard Spider has also used batch scripts that leverage PsExec to execute a previously transferred ransomware payload on a victim's network.

Velvet Ant executed and installed PlugX as a Windows service.

Moonstone Sleet used intermediate loader malware such as YouieLoader and SplitLoader that create malicious services.

Proxysvc registers itself as a service on the victim’s machine to run as a standalone process.

StrongPity can install a service to execute itself as a service.

TinyTurla can install itself as a service on compromised machines.

Bad Rabbit drops a file named infpub.datinto the Windows directory and is executed through SCManager and rundll.exe.

Olympic Destroyer utilizes PsExec to help propagate itself across a network.

Mafalda can create a remote service, let it run once, and then delete it.

BlackByte 2.0 Ransomware executes as a service when deployed.

HOPLIGHT has used svchost.exe to execute a malicious DLL .

WastedLocker can execute itself as a service.

InvisiMole has used Windows services as a way to execute its malicious payload.

WhisperGate can download and execute AdvancedRun.exe via `sc.exe`.

Okrum's loader can create a new service named NtmsSvc to execute the payload.