Procedure examples

Lazarus Group has collected data and files from compromised networks.

LAPSUS$ uploaded sensitive files, information, and credentials from a targeted organization for extortion or public release.

Wizard Spider has collected data from a compromised host prior to exfiltration.

Inception used a file hunting plugin to collect .txt, .pdf, .xls or .doc files from the infected host.

VOID MANTICORE has collected cached data and files from within the victim environment.

Magic Hound has used a web shell to exfiltrate a ZIP file containing a dump of LSASS memory on a compromised machine.

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.

FIN13 has gathered stolen credentials, sensitive data such as point-of-sale (POS), and ATM data from a compromised network before exfiltration.

TeamPCP has stolen source code from victim environments including Mistral AI.

Volt Typhoon has executed the Windows-native `vssadmin` command to create volume shadow copies.

Scattered Spider has created volume shadow copies of virtual domain controller disks to extract the `NTDS.dit` file.

Indrik Spider has used the win32_service WMI class to retrieve a list of services from the system.

Kimsuky has used an instrumentor script to gather the names of all services running on a victim's system.

admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to obtain information about services: net start >> %temp%\download

Volt Typhoon has used `net start` to list running services.

TeamTNT has searched for services such as Alibaba Cloud Security's aliyun service and BMC Helix Cloud Security's bmc-agent service in order to disable them.

OilRig has used sc query on a victim to gather information about services.

Aquatic Panda has attempted to discover services for third party EDR products.

Ke3chang performs service discovery using net start commands.

APT1 used the commands net start and tasklist to get a listing of the services on the system.

Turla surveys a system upon check-in to discover running services and associated processes using the tasklist /svc command.

After compromising a victim, Poseidon Group discovers all running services.

Chimera has used net start and net use for system service discovery.

MirrorFace has used Tasklist for discovery post compromise.

BRONZE BUTLER has used TROJ_GETVERSION to discover system services.

Earth Lusca has used Tasklist to obtain information from a compromised host.

APT41 used the Steam community page as a fallback mechanism for C2.

FIN7's Harpy backdoor malware can use DNS as a backup channel for C2 if HTTP fails.

UNC3886 has employed layers of redundancy to maintain access to compromised environments including network devices, hypervisors, and virtual machines.

OilRig malware ISMAgent falls back to its DNS tunneling mechanism if it is unable to reach the C2 server over HTTP.

Lazarus Group malware SierraAlfa sends data to one of the hard-coded C2 servers chosen at random, and if the transmission fails, chooses a new C2 server to attempt the transmission again.

Volt Typhoon has collected window title information from compromised systems.

Lazarus Group malware IndiaIndia obtains and sends to its C2 server the title of the window for each running process. The KilaAlfa keylogger also reports the title of the window in the foreground.

HEXANE has used a PowerShell-based keylogging tool to capture the window title.

Indrik Spider has used a service account to extract copies of the `Security` Registry hive.

BlackByte queried registry values to determine system language settings.

Kimsuky has obtained specific Registry keys and values on a compromised host.

Volt Typhoon has queried the Registry on compromised systems, `reg query hklm\software\`, for information on installed software including PuTTY.

APT41 queried registry values to determine items such as configured RDP ports and network configurations.

Dragonfly has queried the Registry to identify victim information.

APT32's backdoor can query the Windows Registry to gather system information.

Gamaredon Group has queried ` HKEY_CURRENT_USER\\Console\\WindowsUpdates` to obtain the C2 addresses. Gamaredon Group has queried ` HKEY_CURRENT_USER\\Console\\WindowsUpdates` to obtain the C2 addresses.

ZIRCONIUM has used a tool to query the Registry for proxy settings.

APT39 has used various strains of malware to query the Registry.

OilRig has used reg query “HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default” on a victim to query the Registry.

Turla surveys a system upon check-in to discover information in the Windows Registry with the reg query command. Turla has also retrieved PowerShell payloads hidden in Registry keys as well as checking keys associated with null session named pipes .

Lotus Blossom has run commands such as `reg query HKLM\SYSTEM\CurrentControlSet\Services\[service name]\Parameters` to verify if installed implants are running as a service.

Stealth Falcon malware attempts to determine the installed version of .NET by querying the Registry.

Chimera has queried Registry keys using reg query \\<host>\HKU\<SID>\SOFTWARE\Microsoft\Terminal Server Client\Servers and reg query \\<host>\HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Internet Settings.

Fox Kitten has accessed Registry hives ntuser.dat and UserClass.dat.