Procedure examples

Chimera has used credential stuffing against victim's remote services to obtain valid accounts.

VOID MANTICORE has utilized credential stuffing attacks to obtain initial access to victim environments.

Kimsuky has used a proprietary tool to intercept one time passwords required for two-factor authentication.

Chimera has registered alternate phone numbers for compromised users to intercept 2FA codes sent via SMS.

APT42 has intercepted SMS-based one-time passwords and has set up two-factor authentication. Additionally, APT42 has used cloned or fake websites to capture MFA tokens.

LAPSUS$ has replayed stolen session token and passwords to trigger simple-approval MFA prompts in hope of the legitimate user will grant necessary approval.

APT38 uses a tool called CLEANTOAD that has the capability to modify Registry keys.

Indrik Spider has modified registry keys to prepare for ransomware execution and to disable common administrative utilities.

BlackByte performed Registry modifications to escalate privileges and disable security tools.

Kimsuky has modified Registry settings for default file associations to enable all macros and for persistence. Kimsuky has also modified the registry entry for `HKCU:\Software\Microsoft\Windows\CurrentVersion\Run` registry key for persistence with the name WindowsSecurityCheck.

Volt Typhoon has used `netsh` to create a PortProxy Registry modification on a compromised server running the Paessler Router Traffic Grapher (PRTG).

A Patchwork payload deletes Resiliency Registry keys created by Microsoft Office applications in an apparent effort to trick users into thinking there were no issues during application runs.

APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

Dragonfly has modified the Registry to perform multiple techniques through the use of Reg.

Gorgon Group malware can deactivate security mechanisms in Microsoft Office by editing several keys and values under HKCU\Software\Microsoft\Office\.

APT32's backdoor has modified the Windows Registry to store the backdoor's configuration.

Gamaredon Group has removed security settings for VBA macro execution by changing registry values HKCU\Software\Microsoft\Office\<version>\<product>\Security\VBAWarnings and HKCU\Software\Microsoft\Office\<version>\<product>\Security\AccessVBOM. Gamaredon Group has also modified Registry keys to hide folders and system files and to add the C2 address under `HKEY_CURRENT_USER\Console\WindowsUpdate`.

OilRig has used reg.exe to modify system configuration.

Aquatic Panda modified the victim registry to enable the `RestrictedAdmin` mode feature, allowing for pass the hash behaviors to function via RDP.

Saint Bear will leverage malicious Windows batch scripts to modify registry values associated with Windows Defender functionality.

Blue Mockingbird has used Windows Registry modifications to specify a DLL payload.

Turla has modified Registry values to store payloads.

TA505 has used malware to disable Windows Defender through modification of the Registry.

Lotus Blossom has installed tools such as Sagerunex by writing them to the Windows registry.

Medusa Group has modified Registry keys to elevate privileges, maintain persistence and allow remote access.

Ember Bear modifies registry values for anti-forensics and defense evasion purposes.

LuminousMoth has used malware that adds Registry keys for persistence.

APT42 has modified Registry keys to maintain persistence.

Earth Lusca modified the registry using the command reg add “HKEY_CURRENT_USER\Environment” /v UserInitMprLogonScript /t REG_SZ /d “[file path]” for persistence.

Silence can create, delete, or modify a specified Registry key or value.

Wizard Spider has modified the Registry key HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest by setting the UseLogonCredential registry value to 1 in order to force credentials to be stored in clear text in memory. Wizard Spider has also modified the WDigest registry key to allow plaintext credentials to be cached in memory.

Magic Hound has modified Registry settings for security tools.

A Threat Group-3390 tool has created new Registry keys under `HKEY_CURRENT_USER\Software\Classes\` and `HKLM\SYSTEM\CurrentControlSet\services`.

FIN8 has deleted Registry keys during post compromise cleanup activities.

APT19 uses a Port 22 malware variant to modify several Registry keys.

Kimsuky has captured browser screenshots using TRANSLATEXT. Kimsuky has also obtained screen captures with custom malware.

Volt Typhoon has obtained a screenshot of the victim's system using the gdi32.dll and gdiplus.dll libraries.

Dragonfly has performed screen captures of victims, including by using a tool, scr.exe (which matched the hash of ScreenUtil).

MuddyWater has used malware that can capture screenshots of the victim’s machine.

Gamaredon Group's malware can take screenshots of the compromised computer every minute.

FIN7 captured screenshots and desktop video recordings.

APT39 has used a screen capture utility to take screenshots on a compromised host.

OilRig has a tool called CANDYKING to capture a screenshot of user's desktop.

MoustachedBouncer has used plugins to take screenshots on targeted systems.

Malware used by Group5 is capable of watching the victim's screen.

Winter Vivern delivered PowerShell scripts capable of taking screenshots of victim machines.

Dark Caracal took screenshots using their Windows malware.

BRONZE BUTLER has used a tool to capture screenshots.

APT28 has used tools to take screenshots from victims.

APT42 has used malware, such as GHAMBAR and POWERPOST, to take screenshots.