Procedure examples

QakBot can send stolen information to C2 nodes including passwords, accounts, and emails.

Adversaries can direct BACKSPACE to upload files to the C2 Server.

ADVSTORESHELL exfiltrates data over the same channel used for C2.

StrifeWater can send data and files from a compromised host to its C2 server.

WarzoneRAT can send collected victim data to its C2 server.

SLOTHFULMEDIA has sent system information to a C2 server via HTTP and HTTPS POST requests.

XORIndex Loader has exfiltrated victim data using HTTPS POST requests to its C2 servers.

ShimRatReporter sent generated reports to the C2 via HTTP POST requests.

Sliver can exfiltrate files from the victim using the download command.

SILENTTRINITY can transfer files from an infected host to the C2 server.

Empire can send data gathered from a target through the command and control channel.

PcShare can upload files and information from a compromised host to its C2 servers.

Imminent Monitor has uploaded a file containing debugger logs, network information and system information to the C2.

Pupy can send screenshots files, keylogger data, files, and recorded audio back to the C2 server.

TeamPCP Cloud Stealer has exfiltrated collected data to typosquat C2 domains including scan.aquasecurtiy[.]org.

Mini Shai-Hulud has exfiltrated encrypted archives over C2 domains.