Procedure examples

Akira has accessed and downloaded information stored in SharePoint instances as part of data gathering and exfiltration activity.

Ke3chang used a SharePoint enumeration and data dumping tool known as spwebmember.

Chimera has collected documents from the victim's SharePoint.

APT28 has collected information from Microsoft SharePoint services within target networks.

LAPSUS$ has searched a victim's network for collaboration platforms like SharePoint to discover further high-privilege account credentials.

VOID MANTICORE has accessed victim’s public facing SharePoint servers and exfiltrated data.

APT41 cloned victim user Git repositories during intrusions.

Scattered Spider enumerates data stored within victim code repositories, such as internal GitHub repositories.

LAPSUS$ has searched a victim's network for code repositories like GitLab and GitHub to discover further high-privilege account credentials.

ShinyHunters has gathered information from and has searched for vulnerabilities in the target company’s GitHub repository source code.

Scattered Spider threat actors search the victim’s Slack and Microsoft Teams for conversations about the intrusion and incident response.

Fox Kitten has accessed victim security and IT environments and Microsoft Teams to mine valuable information.

LAPSUS$ has searched a victim's network for organization collaboration channels like MS Teams or Slack to discover further high-privilege account credentials.

FIN6 has collected schemas and user accounts from systems running SQL Server.

Sandworm Team exfiltrates data of interest from enterprise databases using Adminer.

Sea Turtle used the tool Adminer to remotely logon to the MySQL service of victim machines.

Turla has used a custom .NET tool to collect documents from an organization's internal central database.

ShinyHunters has collected Salesforce datasets from victims in the airline and retail sectors.

APT32 has used PubPrn.vbs within execution scripts to execute malware, possibly bypassing defenses.

APT38 has collected browser bookmark information to learn more about compromised hosts, obtain personal information about users, and acquire details about internal network resources.

Kimsuky has collected sensitive browser data using the function `GetBrowserData()` to include login credentials, bookmarks, cookies, and encryption keys.

Volt Typhoon has targeted the browsing history of network administrators.

Scattered Spider retrieves browser histories via infostealer malware such as Raccoon Stealer.

Chimera has used type \\<hostname>\c$\Users\<username>\Favorites\Links\Bookmarks bar\Imported From IE\*citrix* for bookmark discovery.

Fox Kitten has used Google Chrome bookmarks to identify internal resources and assets.

Moonstone Sleet deployed malware such as YouieLoader capable of capturing victim system browser information.

Volt Typhoon has used native tools and processes including living off the land binaries or “LOLBins" to maintain and expand access to the victim networks.

Lazarus Group lnk files used for persistence have abused the Windows Update Client (wuauclt.exe) to execute a malicious DLL.

APT38 has used CHM files to move concealed payloads.

APT41 used compiled HTML (.chm) files for targeting.

OilRig has used a CHM payload to load and execute another malicious file once delivered to a victim.

Dark Caracal leveraged a compiled HTML file that contained a command to download and run an executable.

Silence has weaponized CHM files in their phishing campaigns.

MuddyWater has used CMSTP.exe and a malicious INF to execute its POWERSTATS payload.

Cobalt Group has used the command cmstp.exe /s /ns C:\Users\ADMINI~W\AppData\Local\Temp\XKNqbpzl.txt to bypass AppLocker and launch a malicious script.

menuPass has used InstallUtil.exe to execute malicious software.

Mustang Panda has used InstallUtil.exe to execute a malicious Beacon stager.

APT38 has used a renamed version of `mshta.exe` to execute malicious HTML files.

SideCopy has utilized `mshta.exe` to execute a malicious hta file.

Kimsuky has used mshta.exe to run malicious scripts on the system.

APT32 has used mshta.exe for code execution.

MuddyWater has used mshta.exe to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution.

Gamaredon Group has used `mshta.exe` to execute malicious files.

FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.

Sidewinder has used mshta.exe to execute malicious payloads.

Mustang Panda has used mshta.exe to launch collection scripts.

TA2541 has used `mshta` to execute scripts including VBS.

Confucius has used mshta.exe to execute malicious VBScript.

APT29 has use `mshta` to execute malicious scripts on a compromised host.

TA551 has used mshta.exe to execute malicious payloads.