Procedure examples

XORIndex Loader has collected the username from the victim host.

Small Sieve can obtain the id of a logged in user.

BloodHound can collect information on user sessions.

SILENTTRINITY can gather a list of logged on users.

Empire can enumerate the username on targeted hosts.

AsyncRAT can check if the current user of a compromised system is an administrator.

Remcos can enumerate the username on targeted hosts.

NBTscan can list active users on the system.

Koadic can identify logged in users across the domain and views user sessions.

Pupy can enumerate local information for Linux hosts and find currently logged on users for Windows hosts.

QuasarRAT can enumerate the username and account type.

TeamPCP Cloud Stealer can use `whoami` on self-hosted runners to identify the current user.

Mini Shai-Hulud has leveraged commands such as `whoami` to identify the system owner.

CanisterWorm has parsed the /var/log/auth.log and /var/log/secure files for usernames.

The TrickBot downloader has used an icon to appear as a Microsoft Word document.

RCSession has used a file named English.rtf to appear benign on victim hosts.

WindTail has used icons mimicking MS Office files to mask payloads.

Pony has used the Adobe Reader icon for the downloaded file to look more trustworthy.

UPSTYLE has masqueraded filenames using examples such as `update.py`.

AppleSeed can disguise JavaScript files as PDFs.

EnvyScout has used folder icons for malicious files to lure victims into opening them.

DynoWiper has been named after well-known files schtask.exe, schtask2.exe, and <redacted>_update.exe.

The Dacls Mach-O binary has been disguised as a .nib file.

SombRAT can use a legitimate process name to hide itself.

WhisperGate has been disguised as a JPG extension to avoid detection as a malicious PE file.

Raindrop was built to include a modified version of 7-Zip source code (including associated export names) and Far Manager source code.

NotPetya drops PsExec with the filename dllhost.dat.

Flagpro can download malicious files with a .tmp extension and append them with .exe prior to execution.

DarkTortilla's payload has been renamed `PowerShellInfo.exe`.

BeaverTail has masqueraded as MiroTalk installation packages: “MiroTalk.dmg” for macOS and “MiroTalk.msi” for Windows, and has included login GUIs with MiroTalk themes.

DarkWatchman has used an icon mimicking a text file to mask a malicious executable.

Bisonal dropped a decoy payload with a .jpg extension that contained a malicious Visual Basic script.

DarkGate can masquerade as pirated media content for initial delivery to victims.

FoggyWeb can masquerade the output of C2 commands as a fake, but legitimately formatted WebP file.

Saint Bot has renamed malicious binaries as `wallpaper.mp4` and `slideshow.mp4` to avoid detection.

GlassWorm has masqueraded as legitimate VSCode extensions. GlassWorm has also impersonated Github projects.

RedLine Stealer malware has masqueraded as legitimate software such as "PDF Converter Software" which has been distributed through poisoned search engine results often resembling legitimate software lures with the combination of typo squatted domains.

RTM has been delivered as archived Windows executable files masquerading as PDF documents.

StrelaStealer PE executable payloads have used uncommon but legitimate extensions such as `.com` instead of `.exe`.

Ryuk can create .dll files that actually contain a Rich Text File format document.

Milan has used an executable named `companycatalogue` to appear benign.

NativeZone has, upon execution, displayed a message box that appears to be related to a Ukrainian electronic document management system.

Ramsay has masqueraded as a JPG image file.

TrailBlazer has used filenames that match the name of the compromised system in attempt to avoid detection.

PowGoop has disguised a PowerShell script as a .dat file (goopdate.dat).

BoomBox has the ability to mask malicious data strings as PDF files.

XCSSET installs malicious application bundles that mimic native macOS apps, such as Safari, by using the legitimate app’s icon and customizing the `Info.plist` to match expected metadata.

WindTail has been incompletely signed with revoked certificates.

The NETWIRE client has been signed by fake and invalid digital certificates.

Regin stage 1 modules for 64-bit systems have been found to be signed with fake certificates masquerading as originating from Microsoft Corporation and Broadcom Corporation.