Procedure examples

JPIN can enumerate drives and their types. It can also change file permissions using cacls.exe.

metaMain can recursively enumerate files in an operator-provided directory.

SideTwist has the ability to search for specific files.

Psylo has commands to enumerate all storage devices and to find all files that start with a particular string.

Heyoka Backdoor has the ability to search the compromised host for files.

HTTPBrowser is capable of listing files, folders, and drives on a victim.

LunarWeb has the ability to retrieve directory listings.

XCSSET has used `mdfind` to enumerate a list of apps known to grant screen sharing permissions and leverages a module to run the command `ls -la ~/Desktop`.

Octopus can collect information on the Windows directory and searches for compressed RAR files on the host.

KillDisk has used the FindNextFile command as part of its file deletion process.

Qilin can exclude specific directories and files from encryption.

SoreFang has the ability to list directories.

Industroyer’s data wiper component enumerates specific files on all the Windows drives.

LazyWiper can specifically target multiple files by extension including: .rar, .tar.gz, .zip, .7z, .json, .bcp, .bak, .gho, .erf, .edb, .onepkg, .pst, and .ldiff.

Pcexter has the ability to search for files in specified directories.

Pasam creates a backdoor through which remote attackers can retrieve lists of files.

BADNEWS identifies files with certain extensions from USB devices, then copies them to a predefined directory.

Linfo creates a backdoor through which remote attackers can list contents of drives and search for files.

Remexi searches for files on the system.

QakBot can identify whether it has been run previously on a host by checking for a specified folder.

CookieMiner has looked for files in the user's home directory with "wallet" in their name using find.

Gelsemium can retrieve data from specific Windows directories, as well as open random files as part of Virtualization/Sandbox Evasion.

jRAT can browse file systems.

OSX/Shlayer has used the command appDir="$(dirname $(dirname "$currentDir"))" and $(dirname "$(pwd -P)") to construct installation paths.

Denis has several commands to search directories for files.

INC Ransomware can receive command line arguments to encrypt specific files and directories.

SplatCloak has used Windows API to identify files associated with Windows Defender and Kaspersky.

FIVEHANDS has the ability to enumerate files on a compromised host in order to encrypt files with specific extensions.

AutoIt backdoor is capable of identifying documents on the victim with the following extensions: .doc; .pdf, .csv, .ppt, .docx, .pst, .xls, .xlsx, .pptx, and .jpeg.

Dtrack can list files on available disk volumes.

Azorult can recursively search for files in folders and collects files from the desktop with certain extensions.

BACKSPACE allows adversaries to search for files.

Zox can enumerate files on a compromised host.

UPPERCUT has the capability to gather the victim's current directory.

ADVSTORESHELL can list files and directories.

StrifeWater can enumerate files on a compromised host.

WarzoneRAT can enumerate directories on a compromise host.

SLOTHFULMEDIA can enumerate files and directories.

FALLCHILL can search files on a victim.

RemoteUtilities can enumerate files and directories on a target machine.

If executed with elevated privileges, Diskpart can list all volumes, including virtual disks.

Sliver can enumerate files on a target system.

SILENTTRINITY has several modules, such as `ls.py`, `pwd.py`, and `recentFiles.py`, to enumerate directories and files.

Empire includes various modules for finding files of interest on hosts and network shares.

PoshC2 can enumerate files on the local file system and includes a module for enumerating recently accessed files.

Rclone can list files and directories with the `ls`, `lsd`, and `lsl` commands.

TruffleHog has can browse and scan individual files and directories.

Remcos can search for files on the infected machine.

Imminent Monitor has a dynamic debugging feature to check whether it is located in the %TEMP% directory, otherwise it copies itself there.

Forfiles can be used to locate certain types of files/directories in a system.(ex: locate all files with a specific extension, name, and/or age)