Procedure examples

Moonstone Sleet has gathered information on victim systems.

Inception has used a reconnaissance module to gather information about the operating system and hardware on the infected host.

VOID MANTICORE has gathered system information and disseminated it back to C2.

Play has leveraged tools to enumerate system information.

HEXANE has collected the hostname of a compromised machine.

Daggerfly utilizes victim machine operating system information to create custom User Agent strings for subsequent command and control communication.

Magic Hound malware has used a PowerShell command to check the victim system architecture to determine if it is an x64 machine. Other malware has obtained the OS version, UUID, and computer/host name to send to the C2 server.

FIN8 has used PowerShell Scripts to check the architecture of a compromised machine before the selection of a 32-bit or 64-bit version of a malicious .NET loader.

FIN13 has collected local host information by utilizing Windows commands `systeminfo`, `fsutil`, and `fsinfo`. FIN13 has also utilized a compromised Symantex Altiris console and LanDesk account to retrieve host information.

APT19 collected system architecture information. APT19 used an HTTP malware variant and a Port 22 malware variant to gather the hostname and CPU information from the victim’s machine.

ShinyHunters has used the MeshCentral command-line utility meshctrl.js to collect hostnames and IDs of compromised systems.

APT38 have enumerated files and directories, or searched in specific locations within a compromised host.

APT3 has a tool that looks for files and directories on the local file system.

Kimsuky has the ability to enumerate all files and directories on an infected system. Kimsuky has used a custom script with a function called CreateFileList() that can scan all filesystem drives, prioritizing C:\Users, to locate files and file extensions of interest that ultimately generates a file called `FileList.txt` saved within the victims %TEMP% Directory that contains the findings and the respective pathways.

admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about files and directories: dir c:\ >> %temp%\download dir "c:\Documents and Settings" >> %temp%\download dir "c:\Program Files\" >> %temp%\download dir d:\ >> %temp%\download

Volt Typhoon has enumerated directories containing vulnerability testing and cyber related content and facilities data such as construction drawings.

A Patchwork payload has searched all fixed drives on the victim for files matching a specified list of extensions.

APT41 has executed file /bin/pwd on exploited victims, perhaps to return architecture related information.

Dragonfly has used a batch script to gather folder and file names from victim hosts.

menuPass has searched compromised systems for folders of interest including those related to HR, audit and expense, and meeting memos.

APT32's backdoor possesses the capability to list files and directories on a machine.

HAFNIUM has searched file contents on a compromised host.

MuddyWater has used malware that checked if the ProgramData folder had folders or files with the keywords "Kasper," "Panda," or "ESET."

Gamaredon Group macros can scan for Microsoft Word and Excel files to inject with additional malicious macros. Gamaredon Group has also used its backdoors to automatically list interesting files (such as Office documents) found on a system. Gamaredon Group has also identified directory trees, folders and files on the compromised host.

Leafminer used a tool called MailSniper to search for files on the desktop and another utility called Sobolsoft to extract attachments from EML files.

TeamTNT has used a script that checks `/proc/*/environ` for environment variables related to AWS.

Sandworm Team has enumerated files on a compromised host.

APT18 can list files information for specific directories.

Sidewinder has used malware to collect information on files and directories.

Mustang Panda has searched the entire target system for DOC, DOCX, PPT, PPTX, XLS, XLSX, and PDF files.

Scattered Spider Spider enumerates a target organization for files and directories of interest, including source code, user provisioning, MFA device registration, network diagrams, and shared credentials in documents or spreadsheets.

APT39 has used tools with the ability to search for files on a compromised host.

UNC3886 has used `vmtoolsd.exe` to enumerate files on guest machines.

Contagious Interview has conducted key word searches within files and directories on a compromised hosts to identify files for exfiltration.

Windigo has used a script to check for the presence of files created by OpenSSH backdoors.

Tropic Trooper has monitored files' modified time.

Aoqin Dragon has run scripts to identify file formats including Microsoft Word.

Ke3chang uses command-line interaction to search files and directories.

Confucius has used a file stealer that checks the Document, Downloads, Desktop, and Picture folders for documents and images with specific extensions.

Winter Vivern delivered malicious JavaScript payloads capable of listing folders and emails in exploited email servers.

Turla surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, the Program Files directory, and Recent. Turla RPC backdoors have also searched for files matching the lPH*.dll pattern.

RedCurl has searched for and collected files on local and network drives.

Lotus Blossom has used commands such as `dir` to examine the local filesystem of victim machines.

Dark Caracal collected file listings of all default Windows directories.

Chimera has utilized multiple commands to identify data of interest in file and directory listings.

MirrorFace has run commands to check the content of folders on compromised hosts and has specifically targeted files with .doc, .ppt, .xls, .jtd, .eml, .xps, and .pdf extensions.

Medusa Group has searched for files within the victim environment for encryption and exfiltration. Medusa Group has also identified files associated with remote management services.

BRONZE BUTLER has collected a list of files from the victim and uploaded it to its C2 server, and then created a new list of specific files to steal.

Darkhotel has used malware that searched for files with specific patterns.

ToddyCat has run scripts to enumerate recently modified documents having either a .pdf, .doc, .docx, .xls or .xlsx extension.