Procedure examples

FIN8 has deleted tmp and prefetch files during post compromise cleanup activities. FIN8 has also deleted PowerShell scripts to evade detection on compromised machines.

Threat Group-3390 has detached network shares after exfiltrating files, likely to evade detection.

APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.

Kimsuky has manipulated timestamps for creation or compilation dates to defeat anti-forensics.

APT32 has used scheduled task raw XML with a backdated timestamp of June 2, 2016. The group has also set the creation time of the files dropped by the second stage of the exploit to match the creation time of kernel32.dll. Additionally, APT32 has used a random value to modify the timestamp of the file storing the clientID.

Mustang Panda has modified file timestamps from the export address table (EAT) in malware to make it difficult to identify creation times.

Rocke has changed the time stamp of certain files.

UNC3886 has used scripts to timestomp ESXi hosts prior to installing malicious vSphere Installation Bundles (VIBs).

APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory.

Chimera has used a Windows version of the Linux touch command to modify the date and time stamp on DLLs.

APT28 has performed timestomping on victim files.

APT5 has modified file timestamps.

Several Lazarus Group malware families use timestomping, including modifying the last write timestamp of a specified Registry key to a random date, as well as copying the timestamp for legitimate .exe files (such as calc.exe or mspaint.exe) to its dropped files.

Volt Typhoon has inspected server logs to remove their IPs.

UNC3886 has cleared specific events that contained the threat actor’s IP address from multiple log sources.

Scattered Spider has manually deleted emails notifying users of suspicious account activity.

APT42 has deleted login notification emails and has cleared the Sent folder to cover their tracks.

TeamTNT has used an IRC bot for C2 communications.

Rocke issued wget requests from infected systems to the C2.

INC Ransom has used valid accounts over RDP to connect to targeted systems.

Velvet Ant has used reverse SSH tunnels to communicate to victim devices.

Magic Hound malware has used IRC for C2.

APT38 used a backdoor, QUICKRIDE, to communicate to the C2 server over HTTP and HTTPS.

BlackByte collected victim device information then transmitted this via HTTP POST to command and control infrastructure.

Kimsuky has used HTTP GET and POST requests for C2.

APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits.

APT32 has used JavaScript that communicates over HTTP or HTTPS to attacker controlled domains to download additional frameworks. The group has also used downloaded encrypted payloads over HTTP.

HAFNIUM has used open-source C2 frameworks, including Covenant.

MuddyWater has used HTTP for C2 communications.

RedEcho network activity is associated with SSL traffic via TCP 443 and proxied HTTP traffic over non-standard ports.

Gamaredon Group has used HTTP and HTTPS for C2 communications.

TeamTNT has the `curl` command to send credentials over HTTP and the `curl` and `wget` commands to download new software. TeamTNT has also used a custom user agent HTTP header in shell scripts.

Sandworm Team's BCS-server tool connects to the designated C2 server via HTTP.

APT18 uses HTTP for C2 communications.

Sidewinder has used HTTP in C2 communications.

Mustang Panda has communicated with its C2 via HTTP POST requests.

Rocke has executed wget and curl commands to Pastebin over the HTTPS protocol.

APT39 has used HTTP in communications with C2.

APT37 uses HTTPS to conceal C2 communications.

OilRig has used HTTP for C2.

Higaisa used HTTP and HTTPS to send data back to its C2 server.

Tropic Trooper has used HTTP in communication with the C2.

Orangeworm has used HTTP for C2.

Sea Turtle connected over TCP using HTTP to establish command and control channels.

Ke3chang malware including RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer (IE) by using the COM interface IWebBrowser2.

Confucius has used HTTP for C2 communications.

Winter Vivern uses HTTP and HTTPS protocols for exfiltration and command and control activity.

SilverTerrier uses HTTP for C2 communications.

Turla has used HTTP and HTTPS for C2 communications.

TA505 has used HTTP to communicate with C2 nodes.