Procedure examples

Xbash can perform port scanning of TCP and UDP ports.

XTunnel is capable of probing the network for open ports.

Caterpillar WebShell has a module to use a port scanner on a system.

Royal can scan the network interfaces of targeted systems.

BlackByte Ransomware identifies remote systems via active directory queries for hostnames prior to launching remote ransomware payloads.

Pysa can perform network reconnaissance using the Advanced Port Scanner tool.

MgBot includes modules for performing HTTP and server service scans.

SpeakUp checks for availability of specific ports on servers.

Cobalt Strike can perform port scans from an infected host.

Ramsay can scan for systems that are vulnerable to the EternalBlue exploit.

ZxShell can launch port scans.

Industroyer uses a custom port scanner to map out a network.

HermeticWizard has the ability to scan ports on a compromised network.

SILENTTRINITY can scan for open ports on a compromised machine.

Empire can perform port scans from an infected host.

As part of load balancing FRP can set `healthCheck.type = "tcp"` or `healthCheck.type = "http"` to check service status on specific hosts with TCPing or an HTTP request.

PoshC2 can perform port scans from an infected host.

Brute Ratel C4 can conduct port scanning against targeted systems.

Peirates can initiate a port scan against a given IP address.

NBTscan can be used to scan IP networks.

Koadic can scan for open TCP ports on the target network.

Pupy has a built-in module for port scanning.

EKANS can use Windows Mangement Instrumentation (WMI) calls to execute operations.

Bumblebee can use WMI to gather system information and to spawn processes for code injection.

Stuxnet used WMI with an explorer.exe token to execute on a remote share.

POWRUNER may use WMI when collecting information about a victim.

SharpStage can use WMI for execution.

Sardonic can use WMI to execute PowerShell commands on a compromised machine.

HALFBAKED can use WMI queries to gather system information.

TAMECAT has used Windows Management Instrumentation (WMI) to query anti-virus products.

Ursnif droppers have used WMI classes to execute PowerShell commands.

GravityRAT collects various information via WMI requests, including CPU information in the Win32_Processor entry (Processor ID, Name, Manufacturer and the clock speed).

ROAMINGHOUSE can use WMI to launch a legitimate executable later used to enable DLL sideloading.

TONESHELL has used WMI queries to gather information from the system.

PyDCrypt has attempted to execute with WMIC.

IMAPLoader uses WMI queries to query system information on victim hosts.

Emotet has used WMI to execute powershell.exe.

Olympic Destroyer uses WMI to help propagate itself across a network.

BADHATCH can utilize WMI to collect system information, create new processes, and run malicious PowerShell scripts on a compromised machine.

Action RAT can use WMI to gather AV products installed on an infected host.

PUBLOAD has used `wmic` to gather information from the victim device.

ShrinkLocker uses WMI to query information about the victim operating system.

FlawedAmmyy leverages WMI to enumerate anti-virus on the victim.

Snip3 can query the WMI class `Win32_ComputerSystem` to gather information.

HOPLIGHT has used WMI to recompile the Managed Object Format (MOF) files in the WMI repository.

ProLock can use WMIC to execute scripts on targeted hosts.

Raspberry Robin can execute via LNK containing a command to run a legitimate executable, such as wmic.exe, to download a malicious Windows Installer (MSI) package.

BlackCat can use `wmic.exe` to delete shadow copies on compromised networks.

IcedID has used WMI to execute binaries.

Kazuar obtains a list of running processes through WMI querying.