Procedure examples

menuPass has used native APIs including GetModuleFileName, lstrcat, CreateFile, and ReadFile.

Gamaredon Group malware has used CreateProcess to launch additional malicious components.

Sandworm Team uses Prestige to disable and restore file system redirection by using the following functions: `Wow64DisableWow64FsRedirection()` and `Wow64RevertWow64FsRedirection()`.

Mustang Panda has used various Windows API calls during execution and defense evasion.

APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.

Higaisa has called various native OS APIs.

Tropic Trooper has used multiple Windows APIs including HttpInitialize, HttpCreateHttpHandle, and HttpAddUrl.

BlackTech has used built-in API functions.

Turla and its RPC backdoors have used APIs calls for various tasks related to subverting AMSI and accessing then executing commands through RPC and/or named pipes.

TA505 has deployed payloads that use Windows API calls on a compromised host.

Chimera has used direct Windows system calls by leveraging Dumpert.

Medusa Group has leveraged Windows Native API functions to execute payloads.

ToddyCat has used `WinExec` to execute commands received from C2 on compromised hosts.

Lazarus Group has used the Windows API ObtainUserAgentString to obtain the User-Agent from a compromised host to connect to a C2 server. Lazarus Group has also used various, often lesser known, functions to perform various types of Discovery and Process Injection.

Silence has leveraged the Windows API, including using CreateProcess() or ShellExecute(), to perform a variety of tasks.

WIRTE has used the `RtlIpv4StringToAddressA` to convert IP-formatted string to a byte array.

APT38 has used brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable.

APT41 performed password brute-force attacks on the local admin account.

Dragonfly has attempted to brute force credentials to gain access.

APT39 has used Ncrack to reveal credentials.

OilRig has used brute force techniques to obtain credentials.

Turla may attempt to connect to systems within a victim's network using net use commands and a predefined list or collection of passwords.

Storm-0501 has leveraged brute force attacks to obtain credentials.

DarkVishnya used brute-force attack to obtain login data.

FIN5 has has used the tool GET2 Penetrator to look for remote login and hard-coded credentials.

Ember Bear used the `su-bruteforce` tool to brute force specific users using the `su` command.

Agrius engaged in various brute forcing activities via SMB in victim environments.

APT28 can perform brute force attacks to obtain credentials.

Fox Kitten has brute forced RDP credentials.

VOID MANTICORE has conducted brute-force attempts against organizational VPN infrastructure.

HEXANE has used brute force attacks to compromise valid credentials.

ShinyHunters has performed brute force attacks against edge devices, such as VPNs or firewall solutions.

APT29 has successfully conducted password guessing attacks against a list of mailboxes.

APT28 has used a brute-force/password-spray tooling that operated in two modes: in brute-force mode it typically sent over 300 authentication attempts per hour per targeted account over the course of several hours or days. APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password guessing attacks.

VOID MANTICORE has conducted password guessing to gain initial access.

APT3 has been known to brute force password hashes to be able to leverage plain text credentials.

Salt Typhoon has cracked passwords for accounts with weak encryption obtained from the configuration files of compromised network devices.

Dragonfly has dropped and executed tools used for password cracking, including Hydra and CrackMapExec.

FIN6 has extracted password hashes from ntds.dit to crack offline.

HAFNIUM has gained initial access through password spray attacks.

Leafminer used a tool called Total SMB BruteForcer to perform internal password spraying.

APT29 has conducted brute force password spray attacks.

Chimera has used multiple password spraying attacks against victim's remote services to obtain valid user and administrator accounts.

Silent Librarian has used collected lists of names and e-mail accounts to use in password spraying attacks against private sector targets.

Ember Bear has conducted password spraying against Outlook Web Access (OWA) infrastructure to identify valid user names and passwords.

Agrius engaged in password spraying via SMB in victim environments.

APT28 has used a brute-force/password-spray tooling that operated in two modes: in password-spraying mode it conducted approximately four authentication attempts per hour per targeted account over the course of several days or weeks. APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password spray attacks.

Lazarus Group malware attempts to connect to Windows shares for lateral movement by using a generated list of usernames, which center around permutations of the username Administrator, and weak passwords.

HEXANE has used password spraying attacks to obtain valid credentials.

APT33 has used password spraying to gain access to target systems.