Procedure examples

GOLD SOUTHFIELD has used the remote monitoring and management tool ConnectWise to obtain screen captures from victim's machines.

Silence can capture victim screen activity.

VOID MANTICORE has captured screen content during an active Zoom session.

Magic Hound malware can take a screenshot and upload the file to its C2 server.

Scattered Spider searched the victim’s Microsoft Exchange for emails about the intrusion and incident response.

Silent Librarian has exfiltrated entire mailboxes from compromised accounts.

Ember Bear attempts to collect mail from accessed systems and servers.

Magic Hound has compromised email credentials in order to steal sensitive data.

Sea Turtle collected email archives from victim environments.

APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. GETMAIL extracts emails from archived Outlook .pst files.

Winter Vivern delivered malicious JavaScript payloads capable of exfiltrating email messages from exploited email servers.

RedCurl has collected emails to use in future phishing campaigns.

Chimera has harvested data from victim's e-mail including through execution of wmic /node:<ip> process call create "cmd /c copy c:\Users\<username>\<path>\backup.pst c:\windows\temp\backup.pst" copy "i:\<path>\<username>\My Documents\<filename>.pst"
copy.

MirrorFace has exfiltrated stored emails from compromised hosts.

WIRTE has collected documents from victims' email accounts.

Magic Hound has collected .PST archives.

Kimsuky has used tools such as the MailFetch mail crawler to collect victim emails (excluding spam) from online services via IMAP.

Dragonfly has accessed email accounts using Outlook Web Access.

HAFNIUM has used web shells and MSGraph to export mailbox data.

Leafminer used a tool called MailSniper to search through the Exchange server mailboxes for keywords.

Ke3chang has used compromised credentials and a .NET tool to dump data from Microsoft Exchange mailboxes.

APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. MAPIGET steals email still on Exchange servers that has not yet been archived.

APT29 has collected emails from targeted mailboxes within a compromised Azure AD tenant and compromised Exchange servers, including via Exchange Web Services (EWS) API requests.

Chimera has harvested data from remote mailboxes including through execution of \\<hostname>\c$\Users\<username>\AppData\Local\Microsoft\Outlook*.ost.

Star Blizzard has remotely accessed victims' email accounts to steal messages and attachments.

APT28 has collected emails from victim Microsoft Exchange servers.

FIN4 has accessed and hijacked online email communications using stolen credentials.

VOID MANTICORE has gathered victim email-content from victim servers.

Magic Hound has exported emails from compromised Exchange servers including through use of the cmdlet `New-MailboxExportRequest.`

Kimsuky has set auto-forward rules on victim's e-mail accounts.

Scattered Spider has redirected emails notifying users of suspicious account activity.

Silent Librarian has set up auto forwarding rules on compromised e-mail accounts.

Star Blizzard has abused email forwarding rules to monitor the activities of a victim, steal information, and maintain persistent access after compromised credentials are reset.

LAPSUS$ has set an Office 365 tenant level mail transport rule to send all mail in and out of the targeted organization to the newly created account.

APT38 used a Trojan called KEYLIME to collect data from the clipboard.

Kimsuky has the ability to steal data from the clipboard.

APT39 has used tools capable of stealing contents of the clipboard.

OilRig has used infostealer tools to copy clipboard data.

Patchwork developed a file stealer to search C:\ and collect files with certain extensions. Patchwork also executed a script to enumerate all drives, store them as a list, and upload generated files to the C2 server.

menuPass has used the Csvde tool to collect Active Directory files and data.

HAFNIUM has used MSGraph to exfiltrate data from email, OneDrive, and SharePoint.

FIN6 has used a script to iterate through a list of compromised PoS systems, copy and remove data to a log file, and to bind to events from the submit payment button.

Gamaredon Group has deployed scripts on compromised systems that automatically scan for interesting documents.

Sidewinder has used tools to automatically collect system and network configuration information.

Mustang Panda used custom batch scripts to collect files automatically from a targeted system.

OilRig has used automated collection.

Tropic Trooper has collected information automatically using the adversary's USBferry attack.

Ke3chang has performed frequent and scheduled data collection from victim networks.

APT1 used a batch script to perform a series of discovery techniques and saves it to a text file.

Confucius has used a file stealer to steal documents and images with the following extensions: txt, pdf, png, jpg, doc, xls, xlm, odp, ods, odt, rtf, ppt, xlsx, xlsm, docx, pptx, and jpeg.