Procedure examples

schtasks is used to schedule tasks on a Windows system to run at a specific date and time.

QuasarRAT contains a .NET wrapper DLL for creating and managing scheduled tasks for maintaining persistence upon reboot.

Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.

Mini Shai-Hulud has obtained persistence on Linux devices by writing the `gh-token-monitor` daemon within `~/.config/systemd/user/gh-token-monitor.service` that polls GitHub every 60 seconds. Mini Shai-Hulud has also leveraged a daemon called “kitty-monitor.service” to maintain persistence within Linux hosts.

CanisterWorm has registered itself as a systemd service for persistence on targeted Kubernetes nodes.

TrickBot has used Nt* Native API functions to inject code into legitimate processes such as wermgr.exe.

Ninja has the ability to inject an agent module into a new process and arbitrary shellcode into running processes.

Wiarp creates a backdoor through which remote attackers can inject files into running processes.

Bumblebee can inject code into multiple processes on infected endpoints.

Backdoor.Oldrea injects itself into explorer.exe.

COATHANGER includes a binary labeled `authd` that can inject a library into a running process and then hook an existing function within that process with a new function from that library.

Smoke Loader injects into the Internet Explorer process.

AuditCred can inject code from files to other running processes.

NETWIRE can inject code into system processes including notepad.exe, svchost.exe, and vbc.exe.

DUSTTRAP compromises the `.text` section of a legitimate system DLL in `%windir%` to hold the contents of retrieved plug-ins.

BADHATCH can inject itself into an existing explorer.exe process by using `RtlCreateUserThread`.

Avenger has the ability to inject shellcode into svchost.exe.

Woody RAT can inject code into a targeted process by writing to the remote memory of an infected system and then create a remote thread.

BlackByte 2.0 Ransomware injects into a newly-created `svchost.exe` process prior to device encryption.

HOPLIGHT has injected into running processes.

GuLoader has the ability to inject shellcode into a donor processes that is started in a suspended state. GuLoader has previously used RegAsm as a donor process.

InvisiMole can inject itself into another process to avoid detection including use of a technique called ListPlanting that customizes the sorting algorithm in a ListView structure.

Mispadu's binary is injected into memory via `WriteProcessMemory`.

NavRAT copies itself into a running Internet Explorer process to evade detection.

CostaBricks can inject a payload into the memory of a compromised host.

HyperBro can run shellcode it injects into a newly created process.

ROKRAT can use `VirtualAlloc`, `WriteProcessMemory`, and then `CreateRemoteThread` to execute shellcode within the address space of `Notepad.exe`.

Dyre has the ability to directly inject its code into the web browser process.

NOOPLDR can inject decrypted payloads into processes including wuauclt.exe., rdrleakdiag.exe, and tabcal.exe.

Clambling can inject into the `svchost.exe` process for execution.

PureCrypter can inject its final stage into another process on the targeted system.

Gazer injects its communication module into an Internet accessible process through which it performs C2.

TSCookie has the ability to inject code into the svchost.exe, iexplorer.exe, explorer.exe, and default browser processes.

LODEINFO can inject shellcode into the memory of compromised hosts.

gh0st RAT can inject malicious code into process created by the “Command_Create&Inject” function.

JHUHUGIT performs code injection injecting its own functions to browser processes.

StoneDrill has relied on injecting its payload directly into the process memory of the victim's preferred browser.

Attor's dispatcher can inject itself into running processes to gain higher privileges and to evade detection.

Bazar can inject code through calling VirtualAllocExNuma.

HiddenFace can inject code directly into legitimate applications.

Ryuk has injected itself into remote processes to encrypt files using a combination of VirtualAlloc, WriteProcessMemory, and CreateRemoteThread.

ABK has the ability to inject shellcode into svchost.exe.

Pandora can start and inject code into a new `svchost` process.

Cobalt Strike can inject a variety of payloads into processes dynamically chosen by the adversary.

Wingbird performs multiple process injections to hijack system processes and execute malicious code.

REvil can inject itself into running processes on a compromised host.

Cardinal RAT injects into a newly spawned process created from a native Windows executable.

Egregor can inject its payload into iexplore.exe process.

ANDROMEDA can inject into the `wuauclt.exe` process to perform C2 actions.

JPIN can inject content into lsass.exe to load a module.