Procedure examples

Tonto Team has used tools such as NBTscan to enumerate network shares.

INC Ransom has used Internet Explorer to view folders on other systems.

Sowbug listed remote shared drives that were accessible from a victim.

Wizard Spider has used the “net view” command to locate mapped network shares.

FIN13 has executed net view commands for enumeration of open shares on compromised machines.

Indrik Spider used wmic.exe to add a new user to the system.

Salt Typhoon has created Linux-level users on compromised network devices through modification of `/etc/shadow` and `/etc/passwd`.

Scattered Spider creates new user identities within the compromised organization.

Indrik Spider has created local system accounts and has added the accounts to privileged groups.

APT3 has been known to create or enable accounts, such as support_388945a0.

Kimsuky has created accounts with net user.

APT41 has created user accounts.

Dragonfly has created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target.

Leafminer used a tool called Imecab to set up a persistent remote access account on the victim machine.

TeamTNT has created local privileged users on victim machines.

APT39 has created accounts on multiple compromised hosts to perform actions within the network.

APT5 has created Local Administrator accounts to maintain access to systems with short-cycle credential rotation.

Fox Kitten has created a local user account with administrator privileges.

Wizard Spider has created local administrator accounts to maintain persistence in compromised networks.

Daggerfly created a local account on victim machines to maintain access.

Magic Hound has created local accounts named `help` and `DefaultAccount` on compromised machines.

FIN13 has created MS-SQL local accounts in a compromised network.

BlackByte created privileged domain accounts during intrusions.

GALLIUM created high-privileged domain user accounts to maintain access to victim networks.

HAFNIUM has created domain accounts.

Medusa Group has created a domain account within the victim environment.

Wizard Spider has created and used new accounts within a victim's Active Directory environment to maintain persistence.

APT29 can create new users through Azure AD.

LAPSUS$ has created global admin accounts in the targeted organization's cloud instances to gain persistence.

APT32 have replaced Microsoft Outlook's VbaProject.OTM file to install a backdoor macro for persistence.

Gamaredon Group has inserted malicious macros into existing documents, providing persistence when they are reopened. Gamaredon Group has loaded the group's previously delivered VBA project by relaunching Microsoft Outlook with the /altvba option, once the Application.Startup event is received.

MuddyWater has used a Word Template, Normal.dotm, for persistence.

APT28 has used the Office Test persistence mechanism within Microsoft Office by adding the Registry key HKCU\Software\Microsoft\Office test\Special\Perf to execute code.

OilRig has abused the Outlook Home Page feature for persistence. OilRig has also used CVE-2017-11774 to roll back the initial patch designed to protect against Home Page abuse.

Naikon has used the RoyalRoad exploit builder to drop a second stage loader, intel.wll, into the Word Startup folder on the compromised host.

APT38 has used the RC4 algorithm to decrypt configuration data.

BlackByte has encoded commands in base64-encoded sections concatenated together in PowerShell. BlackByte uses PowerShell commands to disable Windows Defender.

Kimsuky has decoded malicious VBScripts using Base64. Kimsuky has also decoded malicious PowerShell scripts using Base64. Kimsuky has decoded RC4 obfuscated files prior to downloading files from their infrastructure.

Volt Typhoon has used Base64-encoded data to transfer payloads and commands, including deobfuscation via certutil.

Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.

menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used certutil -decode to decode files on the victim’s machine when dropping UPPERCUT.

MuddyWater has decoded base64-encoded PowerShell, JavaScript, and VBScript.

Gamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded Base64-encoded source code of a downloader. Additionally, Gamaredon Group has decoded Telegram content to reveal the IP address for C2 communications.

Storm-1811 has distributed password-protected archives such as ZIP files during intrusions.

TeamTNT has used a script that decodes a Base64-encoded version of WeaveWorks Scope.

FIN7 has decoded a malicious PowerShell script using `certutil -decode hex` and has decoded an XOR-obfuscated block of data with the key `qawsed1q2w3e`, which led to the installation of Lizar.

Sandworm Team's VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder. The group also decrypted received information using the Triple DES algorithm and decompresses it using GZip.

Mustang Panda has the ability to decrypt its payload prior to execution. Mustang Panda has also utilized RC4 encryption for malicious payloads.

ZIRCONIUM has used the AES256 algorithm with a SHA1 derived key to decrypt exploit code.

Rocke has extracted tar.gz files after downloading them from a C2 server.