Procedure examples

Dtrack can collect a variety of information from victim machines.

Zox has the ability to upload files from a targeted system.

UPPERCUT can upload files to the C2 from infected machines.

StrifeWater can collect data from a compromised host.

WarzoneRAT can collect data from a compromised host.

SLOTHFULMEDIA has uploaded files and information from victim machines.

NPPSPY records data entered from the local system logon at Winlogon to capture credentials in cleartext.

PowerSploit contains a collection of Exfiltration modules that can access data from local files, volumes, and processes.

PcShare can collect files and information from a compromised host.

Brute Ratel C4 has the ability to upload files from a compromised system.

TruffleHog has gathered data from home directories of the victim environment.

Out1 can copy files and Registry data from compromised hosts.

Forfiles can be used to act on (ex: copy, move, etc.) files/directories in a system during (ex: copy files into a staging area before).

MCMD has the ability to upload files from an infected device.

esentutl can be used to collect data from local file systems.

Koadic can download files off the target system to send back to the server.

QuasarRAT can retrieve files from compromised client machines.

Wevtutil can be used to export events from a specific log.

BADFLICK has uploaded files from victims' machines.