Procedure examples

CreepySnail can connect to C2 for data exfiltration.

Troll Stealer exfiltrates collected information to its command and control infrastructure.

Ebury exfiltrates a list of outbound and inbound SSH sessions using OpenSSH's `known_host` files and `wtmp` records. Ebury can exfiltrate SSH credentials through custom DNS queries or use the command `Xcat` to send the process's ssh session's credentials to the C2 server.

njRAT has used C2 infrastructure to receive stolen information from the infected machine including screenshots and other system information.

Manjusaka data exfiltration takes place over HTTP channels.

IceApple's Multi File Exfiltrator module can exfiltrate multiple files from a compromised host as an HTTP response over C2.

Shai-Hulud has used POST to exfiltrate secrets from the victim environment to an attacker-controlled URL.

metaMain can upload collected files and data to its C2 server.

SideTwist has exfiltrated data over its C2 channel.

MechaFlounder has the ability to send the compromised user's account name and hostname within a URL to C2.

Psylo exfiltrates data to its C2 server over the same protocol as C2 communications.

Mis-Type has transmitted collected files and data to its C2 server.

XCSSET retrieves files that match the pattern defined in the INAME_QUERY variable within the user's home directory, such as `*test.txt`, and are below a specific size limit. It then archives the files and exfiltrates the data over its C2 channel.

Octopus has uploaded stolen files and data from a victim's machine over its C2 channel.

AppleJeus has exfiltrated collected host information to a C2 server.

STARWHALE can exfiltrate collected data to its C2 servers.

Industroyer sends information about hardware profiles and previously-received commands back to the C2 server in a POST-request.

Kevin can send data from the victim host through a DNS C2 channel.

Goopy has the ability to exfiltrate data over the Microsoft Outlook C2 channel.

Remexi performs exfiltration over BITSAdmin, which is also used for the C2 channel.

Astaroth exfiltrates collected information from its r1.log file to the external C2 server.

QakBot can send stolen information to C2 nodes including passwords, accounts, and emails.

Adversaries can direct BACKSPACE to upload files to the C2 Server.

ADVSTORESHELL exfiltrates data over the same channel used for C2.

StrifeWater can send data and files from a compromised host to its C2 server.

WarzoneRAT can send collected victim data to its C2 server.

SLOTHFULMEDIA has sent system information to a C2 server via HTTP and HTTPS POST requests.

XORIndex Loader has exfiltrated victim data using HTTPS POST requests to its C2 servers.

ShimRatReporter sent generated reports to the C2 via HTTP POST requests.

Sliver can exfiltrate files from the victim using the download command.

SILENTTRINITY can transfer files from an infected host to the C2 server.

Empire can send data gathered from a target through the command and control channel.

PcShare can upload files and information from a compromised host to its C2 servers.

Imminent Monitor has uploaded a file containing debugger logs, network information and system information to the C2.

Pupy can send screenshots files, keylogger data, files, and recorded audio back to the C2 server.

TeamPCP Cloud Stealer has exfiltrated collected data to typosquat C2 domains including scan.aquasecurtiy[.]org.

Mini Shai-Hulud has exfiltrated encrypted archives over C2 domains.

HDoor scans to identify open ports on the victim.

MURKYTOP has the capability to scan for open ports on hosts in a connected network.

Backdoor.Oldrea can use a network scanning module to identify ICS-related ports.

BADHATCH can check for open ports on a computer by establishing a TCP connection.

Hildegard has used masscan to look for kubelets in the internal Kubernetes network.

InvisiMole can scan the network for open ports and vulnerable instances of RDP and SMB protocols.

P.A.S. Webshell can scan networks for open ports and listening services.

Lucifer can scan for open ports including TCP ports 135 and 1433.

BlackEnergy has conducted port scans on a host.

Conficker scans for other machines to infect.

China Chopper's server component can spider authentication portals.

To collect data on the host's Wi-Fi connection history, LightSpy reads the `/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist file`.It also utilizes Apple's CWWiFiClient API to scan for nearby Wi-Fi networks and obtain data on the SSID, security type, and RSSI (signal strength) values.

Remsec has a plugin that can perform ARP scanning as well as port scanning.