Procedure examples

Brute Ratel C4 has used reflective loading to execute malicious DLLs.

Donut can generate code modules that enable in-memory execution of VBScript, JScript, EXE, DLL, and dotNET payloads.

During C0027, Scattered Spider attempted to gain access by continuously sending MFA messages to the victim until they accept the MFA push challenge.

Scattered Spider has used multifactor authentication (MFA) fatigue by sending repeated MFA authentication requests to targets.

APT29 has used repeated MFA requests to gain access to victim accounts.

LAPSUS$ has spammed target users with MFA prompts in the hope that the legitimate user will grant necessary approval.

During Operation Dream Job, Lazarus Group used tools that used the `IsDebuggerPresent` call to detect debuggers.

Mustang Panda has embedded debug strings with messages to distract analysts. Mustang Panda has also made calls to Windows API `CheckRemoteDebuggerPresent` and exits if it detects a debugger.

Pikabot features several methods to evade debugging by analysts, including checks for active debuggers, the use of breakpoints during execution, and checking various system information items such as system memory and the number of processors.

Bumblebee can search for tools used in static analysis.

TONESHELL has leveraged custom exception handlers to hide code flow and stop execution of a debugger.

PUBLOAD has embedded debug strings with messages to distract analysts. PUBLOAD has leveraged `OutputDebugStringW` and `OutputDebugStringA` functions.

Mafalda can search for debugging tools on a compromised host.

Raspberry Robin leverages anti-debugging mechanisms through the use of ThreadHideFromDebugger.

RustyWater has registered a Vectored Exception Handler (VEH) to catch debugging efforts.

DRATzarus can use `IsDebuggerPresent` to detect whether a debugger is present on a victim.

DarkTortilla can detect debuggers by using functions such as `DebuggerIsAttached` and `DebuggerIsLogging`. DarkTortilla can also detect profilers by verifying the `COR_ENABLE_PROFILING` environment variable is present and active.

ROKRAT can check for debugging tools.

PlugX has made calls to Windows API `CheckRemoteDebuggerPresent` and exits if it detects a debugger.

Lumma Stealer has checked for debugger strings by invoking `GetForegroundWindow` and looks for strings containing “x32dbg”, “x64dbg”, “windbg”, “ollydbg”, “dnspy”, “immunity debugger”, “hyperdbg”, “debug”, “debugger”, “cheat engine”, “cheatengine” and “ida”.

PureCrypter has the ability to call `CheckRemoteDebuggerPresent`.

DarkGate checks the BeingDebugged flag in the PEB structure during execution to identify if the malware is being debugged.

LockBit 3.0 can check heap memory parameters for indications of a debugger and stop the flow of events to the attached debugger in order to hinder dynamic analysis.

ThiefQuest uses a function named is_debugging to perform anti-debugging logic. The function invokes sysctl checking the returned value of P_TRACED. ThiefQuest also calls ptrace with the PTRACE_DENY_ATTACH flag to prevent debugging.

Latrodectus has the ability to check for the presence of debuggers.

Saint Bot has used `is_debugger_present` as part of its environmental checks.

The Black Basta dropper can check system flags, CPU registers, CPU instructions, process timing, system libraries, and APIs to determine if a debugger is present.

StrelaStealer variants include functionality to identify and evade debuggers.

XLoader uses anti-debugging mechanisms such as calling `NtQueryInformationProcess` with `InfoClass=7`, referencing `ProcessDebugPort`, to determine if it is being analyzed.

ANELLDR can call `ZwSetInformationThread` with the second argument set to `ThreadHideFromDebugger (0x11)` to evade being debugged.

StealBit can detect it is being run in the context of a debugger.

AsyncRAT can use the `CheckRemoteDebuggerPresent` function to detect the presence of a debugger.

Cuckoo Stealer can create and populate property list (plist) files to enable execution.

In older versions, XCSSET uses the plutil command to modify the LSUIElement, DFBundleDisplayName, and CFBundleIdentifier keys in the /Contents/Info.plist file to change how XCSSET is visible on the system. In later versions, XCSSET leverages a third-party notarized `dockutil` tool to modify the `.plist` file responsible for presenting applications to the user in the Dock and LaunchPad to point to a malicious application.

Pacu can create malicious Lambda functions.

APT29 has abused misconfigured AD CS certificate templates to impersonate admin users and create additional authentication certificates.

AADInternals can create and export various authentication certificates, including those associated with Azure AD joined/registered devices.

Mimikatz's `CRYPTO` module can create and export various types of authentication certificates.

Mini Shai-Hulud has collected victim client certificates to assist in signed authentication assertion with Azure environments.

Medusa Group has purchased user credentials and other sensitive data from Initial Access Brokers (IABs).

APT29 has used Azure Run Command and Azure Admin-on-Behalf-of (AOBO) to execute code on virtual machines.

VOID MANTICORE has abused built-in remote wipe or factory reset commands to wipe devices managed within an organization’s Cloud management solution impacting laptops, servers, and mobile devices.

Pacu can run commands on EC2 instances using AWS Systems Manager Run Command.

AADInternals can execute commands on Azure virtual machines using the VM agent.

Medusa Group has queried drivers on the victim device through the command `driverquery`.

HOPLIGHT can enumerate device drivers located in the registry at `HKLM\Software\WBEM\WDM`.

Remsec has a plugin to detect active drivers of some security products.

INC Ransomware can verify the presence of specific drivers on compromised hosts including Microsoft Print to PDF and Microsoft XPS Document Writer.

ArcaneDoor involved exploitation of CVE-2024-20353 to force a victim Cisco ASA to reboot, triggering the automated unzipping and execution of the Line Runner implant.

Line Dancer can modify the crash dump process on infected machines to skip crash dump generation and proceed directly to device reboot for both persistence and forensic evasion purposes.