Procedure examples

FRP can use a dashboard and U/I to display the status of connections from the FRP client and server.

netstat can be used to enumerate local network connections, including active TCP connections and other network statistics.

PoshC2 contains an implementation of netstat to enumerate TCP and UDP connections.

nbtstat can be used to discover current NetBIOS sessions.

CrackMapExec can discover active sessions for a targeted system.

Pupy has a built-in utility command for netstat, can do net session through PowerView, and has an interactive shell which can be used to discover additional information.

TeamPCP Cloud Stealer can search compromised systems for webhook URLs connecting to Slack and Discord.

The discovery modules used with Duqu can collect information on network connections.

Machete has a feature to copy files from every drive onto a removable drive in a hidden folder.

Agent.btz creates a file named thumb.dd on all USB flash drives connected to the victim. This file contains information about the infected system and activity logs.

Remsec contains a module to move data from airgapped networks to Internet-connected systems by using a removable USB device.

SPACESHIP copies staged data to removable drives when they are inserted into the system.

USBStealer exfiltrates collected files via removable media from air-gapped victims.

Lokibot's second stage DLL has set a timer using “timeSetEvent” to schedule its next execution.

MURKYTOP has the capability to schedule remote AT jobs.

at can be used to schedule a task on a system to be executed at a specific date or time.

CrackMapExec can set a scheduled task on the target system to execute commands remotely using at.

Exaramel for Linux uses crontab for persistence if it does not have root privileges.

Janicab used a cron job for persistence on Mac devices.

NETWIRE can use crontabs to establish persistence.

Gomir will configure a crontab for process execution to start the backdoor on reboot if it is not initially running under group 0 privileges.

Skidmap has installed itself via crontab.

The GoldMax Linux variant has used a crontab entry with a @reboot line to gain persistence.

Anchor can install itself as a cron job.

Xbash can create a cronjob for persistence if it determines it is on a Linux system.

SpeakUp uses cron tasks to ensure persistence.

NKAbuse uses a Cron job to establish persistence when infecting Linux hosts.

Penquin can use Cron to create periodic and pre-scheduled background jobs.

Kinsing has used crontab to download and run shell scripts every minute to ensure persistence.

TrickBot creates a scheduled task on the system that provides persistence.

Bumblebee can achieve persistence by copying its DLL to a subdirectory of %APPDATA% and creating a Visual Basic Script that will load the DLL via a scheduled task.

GRIFFON has used sctasks for persistence.

yty establishes persistence by creating a scheduled task with the command SchTasks /Create /SC DAILY /TN BigData /TR “ + path_file + “/ST 09:30“.

Stuxnet schedules a network job to execute two minutes after host infection.

POWRUNER persists through a scheduled task that executes it every minute.

SharpStage has a persistence component to write a scheduled task for the payload.

Smoke Loader launches a scheduled task.

Matryoshka can establish persistence by adding a Scheduled Task named "Microsoft Boost Kernel Optimization".

GravityRAT creates a scheduled task to ensure it is re-executed everyday.

Prestige has been executed on a target system through a scheduled task created by Sandworm Team using Impacket.

SharpDisco can create scheduled tasks to execute reverse shells that read and write data to and from specified SMB shares.

TONESHELL has created scheduled tasks to maintain persistence.

RainyDay can use scheduled tasks to achieve persistence.

NETWIRE can create a scheduled task to establish persistence.

Bad Rabbit’s infpub.dat file creates a scheduled task to launch a malicious executable.

CosmicDuke uses scheduled tasks typically named "Watchmon Service" for persistence.

IMAPLoader creates scheduled tasks for persistence based on the operating system version of the victim machine.

Emotet has maintained persistence through a scheduled task, e.g. though a .dll file in the Registry.

Tomiris has used `SCHTASKS /CREATE /SC DAILY /TN StartDVL /TR "[path to self]" /ST 10:00` to establish persistence.

BADHATCH can use `schtasks.exe` to gain persistence.