Procedure examples

Astaroth uses WMIC to execute payloads.

QakBot can execute WMI queries to gather information.

jRAT uses WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.

INC Ransomware has the ability to use wmic.exe to spread to multiple endpoints within a compromised environment.

FIVEHANDS can use WMI to delete files on a target machine.

HermeticWizard can use WMI to create a new process on a remote machine via `C:\windows\system32\cmd.exe /c start C:\windows\system32\\regsvr32.exe /s /iC:\windows\<filename>.dll`.

Covenant can utilize WMI to install new Grunt listeners through XSL files or command one-liners.

SILENTTRINITY can use WMI for lateral movement.

PowerSploit's Invoke-WmiCommand CodeExecution module uses WMI to execute and retrieve the output from a PowerShell payload.

Impacket's `wmiexec` module can be used to execute commands through WMI.

Empire can use WMI to deliver a payload to a remote host.

PoshC2 has a number of modules that use WMI to execute tasks.

Brute Ratel C4 can use WMI to move laterally.

CrackMapExec can execute remote commands using Windows Management Instrumentation.

Koadic can use WMI to execute commands.

FrameworkPOS can use DNS tunneling for exfiltration of credit card data.

Hydraq connects to a predefined domain on port 443 to exfil gathered information.

Chaes has exfiltrated its collected data from the infected machine to the C2, sometimes using the MIME protocol.

Bundlore uses the curl -s -L -o command to exfiltrate archived data to a URL.

Kobalos can exfiltrate credentials over the network via UDP.

PoetRAT has used a .NET tool named dog.exe to exiltrate information over an e-mail account.

AADInternals can directly download cloud user data such as OneDrive files.

IcedID has exfiltrated collected data via HTTPS.

BRUSHFIRE has the ability to exfiltrate data on-demand through executing commands obtained via monitoring for specially crafted packets and sending output back in an embedded SSL response.

Rclone can exfiltrate data over SFTP or HTTPS via WebDAV.

WindTail has the ability to automatically exfiltrate files using the macOS built-in utility /usr/bin/curl.

InvisibleFerret has used FTP to exfiltrate files and directories using the command `ssh_upload` which contains with six subcommands of `.sdira`, `sdir`, `sfile`, `sfinda`, `sfindr` and `sfind` that had varying functions. InvisibleFerret has exfiltrated stolen files and data to the C2 servers over ports 1224, 2245 and 8637.

Some Brave Prince variants have used South Korea's Daum email service to exfiltrate information, and later variants have posted the data to a web server via an HTTP post command.

CosmicDuke exfiltrates collected files over FTP or WebDAV. Exfiltration servers can be separately configured from C2 servers.

PUBLOAD has leveraged `curl` for data exfiltration over FTP by uploading RAR archives containing targeted files (.doc, .docx, .xls, .xlsx, .pdf, .ppt, .pptx) to an adversary-owned FTP site.

SocGholish can exfiltrate data directly to its C2 domain via HTTP.

Remsec can exfiltrate data via a DNS tunnel or email, separately from its C2 channel.

CharmPower can send victim data via FTP with credentials hardcoded in the script.

KONNI has used FTP to exfiltrate reconnaissance data out.

CORALDECK has exfiltrated data in HTTP POST headers.

ccf32 can upload collected data and files to an FTP server.

WARPWIRE can send captured credentials to C2 via HTTP `GET` or `POST` requests.

Cherry Picker exfiltrates files over FTP.

Carbon uses HTTP to send data to the C2 server.

Kessel can exfiltrate credentials and other information via HTTP POST request, TCP, and DNS.

PoetRAT has used ftp for exfiltration.

Agent Tesla has routines for exfiltration over SMTP, FTP, and HTTP.

CookieMiner has used the curl --upload-file command to exfiltrate data over HTTP.

Dok exfiltrates logs of its execution stored in the /tmp folder over FTP using the curl command.

Rclone can exfiltrate data over FTP or HTTP, including HTTP via WebDAV.

BITSAdmin can be used to create BITS Jobs to upload files from a compromised host.

ftp may be used to exfiltrate data separate from the main command and control protocol.

Torisma can use `WTSEnumerateSessionsW` to monitor remote desktop connections.

POWRUNER may collect active network connections by running netstat -an on a victim.

KOPILUWAK can use netstat, Arp, and Net to discover current TCP connections.