Procedure examples

During the 2025 Poland Wiper Attacks, the adversaries utilized Ping, the Advanced Port Scanner and Advanced IP Scanner to enumerate network devices.

During Operation Wocao, threat actors scanned for open ports and used nbtscan to find NETBIOS nameservers.

During C0027, used RustScan to scan for open ports on targeted ESXi appliances.

During CostaRicto, the threat actors employed nmap and pscan to scan target environments.

During Operation Dream Job, Lazarus Group used WMIC to executed a remote XSL script.

During SharePoint ToolShell Exploitation, threat actors used WMI for execution.

During Frankenstein, the threat actors used WMI queries to check if various security applications were running as well as to determine the operating system version.

During C0018, the threat actors used WMIC to modify administrative settings on both a local and a remote host, likely as part of the first stages for their lateral movement; they also used WMI Provider Host (`wmiprvse.exe`) to execute a variety of encoded PowerShell scripts using the `DownloadString` method.

During C0015, the threat actors used `wmic` and `rundll32` to load Cobalt Strike onto a target host.

During HomeLand Justice, threat actors used WMI to modify Windows Defender settings.

During the SolarWinds Compromise, APT29 used WMI for the remote execution of files for lateral movement.

During Operation AkaiRyū, MirrorFace used WMI to proxy execution of UPPERCUT.

During FunnyDream, the threat actors used `wmiexec.vbs` to run remote commands.

During the 2016 Ukraine Electric Power Attack, WMI in scripts were used for remote execution and system surveys.

During Operation Wocao, threat actors has used WMI to execute commands.

During C0027, Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.

During the SolarWinds Compromise, APT29 exfiltrated collected data over a simple HTTPS request to a password-protected archive staged on a victim's OWA servers.

During the 2025 Poland Wiper Attacks, the adversaries exfiltrated data to an actor-controlled infrastructure using HTTP POSTs.

During C0017, APT41 exfiltrated victim data via DNS lookups by encoding and prepending it as subdomains to the attacker-controlled domain.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to map internal network architecture and access relationships.

During FunnyDream, the threat actors used netstat to discover network connections on remote systems.

During Operation CuckooBees, the threat actors used the `net session`, `net use`, and `netstat` commands as part of their advanced reconnaissance.

During the 2025 Poland Wiper Attacks, the adversaries identified network connections utilizing `netstat -nao` and `netstat -r`.

During Operation Wocao, threat actors collected a list of open connections on the infected system using `netstat` and checks whether it has an internet connection.

During the 2025 Poland Wiper Attacks, the adversaries set FortiGate scheduled tasks to run the adversary generated CLI scripts weekly.

During Operation MidnightEclipse, threat actors configured cron jobs to retrieve payloads from actor-controlled infrastructure.

During Operation Dream Job, Lazarus Group created scheduled tasks to set a periodic execution of a remote XSL script.

During SharePoint ToolShell Exploitation, threat actors used scheduled tasks to help establish persistence.

During Frankenstein, the threat actors established persistence through a scheduled task using the command: `/Create /F /SC DAILY /ST 09:00 /TN WinUpdate /TR`, named "WinUpdate"

In the Triton Safety Instrumented System Attack, TEMP.Veles installed scheduled tasks defined in XML files.

During Juicy Mix, OilRig used VBS droppers to schedule tasks for persistence.

During the C0032 campaign, TEMP.Veles used scheduled task XML triggers.

During the SolarWinds Compromise, APT29 used `scheduler` and `schtasks` to create new tasks on remote host as part of their lateral movement. They manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration. APT29 also created a scheduled task to maintain SUNSPOT persistence when the host booted.

During Operation CuckooBees, the threat actors used scheduled tasks to execute batch scripts for lateral movement with the following command: `SCHTASKS /Create /S <IP Address> /U <Username> /p <Password> /SC ONCE /TN test /TR <Path to a Batch File> /ST <Time> /RU SYSTEM.`

During Operation Wocao, threat actors used scheduled tasks to execute malicious PowerShell code on remote systems.

During C0017, APT41 used the following Windows scheduled tasks for DEADEYE dropper persistence on US state government networks: `\Microsoft\Windows\PLA\Server Manager Performance Monitor`, `\Microsoft\Windows\Ras\ManagerMobility`, `\Microsoft\Windows\WDI\SrvSetupResults`, and `\Microsoft\Windows\WDI\USOShared`.

During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.

During CostaRicto, the threat actors used scheduled tasks to download backdoor tools.

During RedPenguin, UNC3886 exploited CVE-2025-21590 to enable malicious code injection into the memory of legitimate processes.

During Operation Sharpshooter, threat actors leveraged embedded shellcode to inject a downloader into the memory of Word.

During the 2015 Ukraine Electric Power Attack, Sandworm Team loaded BlackEnergy into svchost.exe, which then launched iexplore.exe for their C2.

During the 3CX Supply Chain Attack, AppleJeus's VEILEDSIGNAL uses process injection to inject the C2 communication module code in the first found process instance of Chrome, Firefox, or Edge web browsers. It also monitors the established named pipe and re-injects the C2 communication module if necessary.

During Cutting Edge, threat actors used malicious SparkGateway plugins to inject shared objects into web process memory on compromised Ivanti Secure Connect VPNs to enable deployment of backdoors.

ArcaneDoor included injecting code into the AAA and Crash Dump processes on infected Cisco ASA devices.

During Operation Wocao, threat actors injected code into a selected process, which in turn launches a command as a child process of the original.

During C0015, the threat actors used a DLL named `D8B3.dll` that was injected into the Winlogon process.

During the 3CX Supply Chain Attack, AppleJeus uses the SigFlip tool to inject arbitrary code without affecting or breaking the file's signature.

KV Botnet Activity final payload installation includes mounting and binding to the \/proc\/ filepath on the victim system to enable subsequent operation in memory while also removing on-disk artifacts.

Versa Director Zero Day Exploitation intercepted and harvested credentials from user logins to compromised devices.

Leviathan captured submitted multfactor authentication codes and other technical artifacts related to remote access sessions during Leviathan Australian Intrusions.