Procedure examples

CosmicDuke steals user files from network shared drives with file extensions and keywords that match a predefined list.

Ramsay can collect data from network drives and stage it for exfiltration.

Egregor can collect any files found in the enumerated drivers before sending it to its C2 channel.

When it first starts, BADNEWS crawls the victim's mapped drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.

cd00r can use the libpcap library to monitor captured packets for specifc sequences.

JumbledPath has the ability to perform packet capture on remote devices via actor-defined jump-hosts.

VersaMem hooked the Catalina application filter chain `doFilter` on compromised systems to monitor all inbound requests to the local Tomcat web server, inspecting them for parameters like passwords and follow-on Java modules.

CASTLETAP has the ability to create a raw promiscuous socket to sniff network traffic.

J-magic has a pcap listener function that can create an Extended Berkley Packet Filter (eBPF) on designated interfaces and ports.

Emotet has been observed to hook network APIs to monitor network traffic.

Regin appears to have functionality to sniff for credentials passed over HTTP, SMTP, and SMB.

Line Dancer can create and exfiltrate packet captures from compromised environments.

FoggyWeb can configure custom listeners to passively monitor all incoming HTTP GET and POST requests sent to the AD FS server from the intranet/internet and intercept HTTP requests that match the custom URI patterns defined by the actor.

MESSAGETAP uses the libpcap library to listen to all traffic and parses network protocols starting with Ethernet and IP layers. It continues parsing protocol layers including SCTP, SCCP, and TCAP and finally extracts SMS message data and routing metadata.

Penquin can sniff network traffic to look for packets matching specific conditions.

SPAWNCHIMERA has monitored and filtered network traffic on compromised edge devices, allowing legitimate traffic to pass while redirecting attacker-controlled traffic to infrastructure under adversary control.

Impacket can be used to sniff network traffic via an interface or raw socket.

Empire can be used to conduct packet captures on target hosts.

PoshC2 contains a module for taking packet captures on compromised hosts.

Responder captures hashes and credentials that are sent to the system after the name services have been poisoned.

NBTscan can dump and print whole packet content.

TrickBot can send information about the compromised host and upload data to a hardcoded C2 server.

BLINDINGCAN has sent user and system information to a C2 server via HTTP POST requests.

During the initial Pikabot command and control check-in, Pikabot will transmit collected system information encrypted using RC4.

Spark has exfiltrated data over the C2 channel.

Bumblebee can send collected data in JSON format to C2.

BRICKSTORM has uploaded files from the victim system to C2 servers.

Amadey has sent victim data to its C2 servers.

Proxysvc performs data exfiltration over the control server channel using a custom protocol.

Torisma can send victim data to an actor-controlled C2 server.

Stuxnet sends compromised victim information via HTTP.

RotaJakiro sends device and other collected data back to the C2 using the established C2 channels over TCP.

KOPILUWAK has exfiltrated collected data to its C2 via POST requests.

Misdat has uploaded files and data to its C2 servers.

HAWKBALL has sent system information and files over the C2 channel.

Ursnif has used HTTP POSTs to exfil gathered information.

ZLib has sent data and files from a compromised host to its C2 servers.

InvisibleFerret has used HTTP communications to the “/Uploads” URI for file exfiltration.

Bankshot exfiltrates data over its C2 channel.

SharpDisco can load a plugin to exfiltrate stolen files to SMB shares also used in C2.

StrongPity can exfiltrate collected documents through C2 channels.

AppleSeed can exfiltrate files via the C2 channel.

PowerExchange can exfiltrate files via its email C2 channel.

Emotet has exfiltrated data over its C2 channel.

Crimson can exfiltrate stolen information over its C2.

Tomiris can upload files matching a hardcoded set of extensions, such as .doc, .docx, .pdf, and .rar, to its C2 server.

DUSTTRAP can exfiltrate collected data over C2 channels.

BADHATCH can exfiltrate data over the C2 channel.

Machete's collected data is exfiltrated over the same channel used for C2.

PingPull has the ability to exfiltrate stolen victim data through its C2 channel.