Procedure examples

BlackByte masqueraded configuration files containing encryption keys as PNG files.

Volt Typhoon has appended copies of the ntds.dit database with a .gif file extension.

Mustang Panda has masqueraded malicious executables as legitimate files that download PlugX malware.

MirrorFace has crafted malware payloads to appear as Privacy-Enhanced Mail (PEM) files.

AvosLocker has been disguised as a .jpg file.

HeartCrypt can append a BMP header to encoded malicious payloads to masquerade them as BMP files.

STATICPLUGIN has masqueraded as a BMP file to hide its true MSI file extension.

Raspberry Robin has historically been delivered via infected USB drives containing a malicious LNK object masquerading as a legitimate folder.

Lumma Stealer has used payloads that resemble benign file extensions such as .mp3, .accdb, and .pub, though the files contained malicious JavaScript content.

PureCrypter has used a .NET downloader named 63342221.BAT and has used .jpg, .png, and .log as false extensions for malicious files.

MagicRAT can download additional executable payloads that masquerade as GIF files.

StrelaStealer has been distributed as a DLL/HTML polyglot file.

Kapeka masquerades as a Microsoft Word Add-In file, with the extension `.wll`, but is a malicious DLL file.

OSX_OCEANLOTUS.D has disguised it's true file structure as an application bundle by adding special characters to the filename and using the icon for legitimate Word documents.

ANDROMEDA has been delivered through a LNK file disguised as a folder.

The QakBot payload has been disguised as a PNG file and hidden within LNK files using a Microsoft File Explorer icon.

Brute Ratel C4 has used Microsoft Word icons to hide malicious LNK files.

After initial execution, BPFDoor forks itself and runs the fork with the `--init` flag, which allows it to execute secondary clean up operations. The parent process terminates leaving the forked process to be inherited by the legitimate process init.

Shai-Hulud has augmented its installation process by having its original install process exit cleanly to provide the user with the illusion that the service is installed normally.

During the 2016 Ukraine Electric Power Attack, Sandworm Team created two new accounts, “admin” and “система” (System).

APT3 has been known to create or enable accounts, such as support_388945a0.

Dragonfly has created accounts disguised as legitimate backup and service accounts as well as an email administration account.

Storm-1811 has created Microsoft Teams accounts that spoof IT support and helpdesk members for use in application and voice phishing.

Magic Hound has created local accounts named `help` and `DefaultAccount` on compromised machines.

ServHelper has created a new user named `supportaccount`.

Flame can create backdoor accounts with login `HelpAssistant` on domain connected systems if appropriate rights are available.

BPFDoor overwrites the `argv[0]` value used by the Linux `/proc` filesystem to determine the command line and command name to display for each process. BPFDoor selects a name from 10 hardcoded names that resemble Linux system daemons, such as; `/sbin/udevd -d`, `dbus-daemon --system`, `avahi-daemon: chroot helper`, `/sbin/auditd -n`, and `/usr/lib/systemd/systemd-journald`.

FatDuke has attempted to mimic a compromised user's traffic by using the same user agent as the installed browser.

ArcaneDoor used malicious boot scripts to install the Line Runner backdoor on victim devices.

APT41 used a hidden shell script in `/etc/rc.d/init.d` to leverage the `ADORE.XSEC`backdoor and `Adore-NG` rootkit.

Rocke has installed an "init.d" startup script to maintain persistence.

UNC3886 has attempted to bypass digital signature verification checks at startup by adding a command to the startup config `/etc/init.d/localnet` within the rootfs.gz archive of both FortiManager and FortiAnalyzer devices.

APT29 has hijacked legitimate application-specific startup scripts to enable malware to execute on system startup.

Depending on the Linux distribution and when executing with root permissions, RotaJakiro may install persistence using a `.conf` file in the `/etc/init/` folder.

SPAWNCHIMERA has modified the boot process files within `/tmp/coreboot_fs/bin/init` to establish persistence.

VIRTUALPITA can persist as an init.d startup service on Linux vCenter systems.

An APT28 loader Trojan adds the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence.

Cobalt Group has added persistence by registering the file name for the next stage malware under HKCU\Environment\UserInitMprLogonScript.

JHUHUGIT has registered a Windows shell script under the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence.

KGH_SPY has the ability to set the HKCU\Environment\UserInitMprLogonScript Registry key to execute logon scripts.

Attor's dispatcher can establish persistence via adding a Registry key with a logon script HKEY_CURRENT_USER\Environment "UserInitMprLogonScript" .

Zebrocy performs persistence with a logon script via adding to the Registry key HKCU\Environment\UserInitMprLogonScript.

UNC3886 has placed a bash installation script into `/etc/rc.local.d/` to establish persistence.

APT29 has installed a run command on a compromised system to enable malware execution on system startup.

Velvet Ant used a modified `/etc/rc.local` file on compromised F5 BIG-IP devices to maintain persistence.

iKitten adds an entry to the rc.common file for persistence.

Green Lambert can add init.d and rc.d files in the /etc folder to establish persistence.

Cyclops Blink has the ability to execute on device startup, using a modified RC script named S51armled.

HiddenWasp installs reboot persistence by adding itself to /etc/rc.local.

jRAT can list and manage startup entries.