Procedure examples

Ember Bear deploys web shells following initial access for either follow-on command execution or protocol tunneling. Example web shells used by Ember Bear include P0wnyshell, reGeorg, P.A.S. Webshell, and custom variants of publicly-available web shell examples.

Volatile Cedar can inject web shell code into a server.

Agrius typically deploys a variant of the ASPXSpy web shell following initial access via exploitation.

APT28 has used a modified and obfuscated version of the reGeorg web shell to maintain persistence on a target's Outlook Web Access (OWA) server.

APT5 has installed multiple web shells on compromised servers including on Pulse Secure VPN appliances.

Fox Kitten has installed web shells on compromised hosts to maintain access.

Tonto Team has used a first stage web shell after compromising a vulnerable Exchange server.

Magic Hound has used multiple web shells to gain execution.

Threat Group-3390 has used a variety of Web shells.

FIN13 has utilized obfuscated and open-source web shells such as JspSpy, reGeorg, MiniWebCmdShell, and Vonloesch Jsp File Browser 1.2 to enable remote code execution and to execute commands on compromised web server.

UNC3886 has used vSphere Installation Bundles (VIBs) to install malware and establish persistence across ESXi hypervisors.

SideCopy has collected browser information from a compromised host.

Volt Typhoon has queried the Registry on compromised systems for information on installed software.

MuddyWater has used a PowerShell backdoor to check for Skype connectivity on the target machine.

Sidewinder has used tools to enumerate software installed on an infected host.

Mustang Panda has searched the victim system for the InstallUtil.exe program and its version.

Windigo has used a script to detect installed software on targeted systems.

Tropic Trooper's backdoor could list the infected system's installed software.

BRONZE BUTLER has used tools to enumerate software installed on an infected host.

Windshift has used malware to identify installed software.

Inception has enumerated installed software on compromised systems.

HEXANE has enumerated programs installed on an infected machine.

APT38 has identified security software, configurations, defensive tools, and sensors installed on a compromised system.

BlackByte enumerated installed security products during operations.

SideCopy uses a loader DLL file to collect AV product names from an infected host.

Kimsuky has checked for the presence of antivirus software with powershell Get-CimInstance -Namespace root/securityCenter2 – classname antivirusproduct. Kimsuky has also obtained details on antivirus software through WMI queries using `Win32_OperatingSystem` and `SecurityCenter2.AntiVirusProduct`. Kimsuky has also checked the status of Windows Defender through the use `cmd /s sc query WinDefend`.

Patchwork scanned the “Program Files” directories for a directory with the string “Total Security” (the installation path of the “360 Total Security” antivirus tool).

MuddyWater has used malware to check running processes against a hard-coded list of security tools often used by malware researchers.

Naikon uses commands such as netsh advfirewall firewall to discover local firewall settings.

Gamaredon Group has used PowerShell scripts to identify security software on the victim machine.

TeamTNT has searched for security products on infected machines.

Sidewinder has used the Windows service winmgmts:\\.\root\SecurityCenter2 to check installed antivirus products.

Rocke used scripts which detected and uninstalled antivirus software.

TA2541 has used tools to search victim systems for security products such as antivirus and firewall software.

Tropic Trooper can search for anti-virus software running on the system.

Aquatic Panda has attempted to discover third party endpoint detection and response (EDR) tools on compromised systems.

The White Company has checked for specific antivirus products on the target’s computer, including Kaspersky, Quick Heal, AVG, BitDefender, Avira, Sophos, Avast!, and ESET.

Turla has obtained information on security software, including security logging information that may indicate whether their malware has been detected.

Storm-0501 has detected endpoint security solutions using `sc query sense` and `sc query windefend`.

Medusa Group has detected security solutions for termination or deletion within the victim device using hard-coded lists of strings containing security product executables.

Darkhotel has searched for anti-malware strings and anti-virus processes running on the system.

Windshift has used malware to identify installed AV and commonly used forensic and malware analysis tools.

ToddyCat can determine is Kaspersky software is running on an endpoint by running `cmd /c wmic process where name="avp.exe"`.

Malteiro collects the installed antivirus on the victim machine.

APT42 has used Windows Management Instrumentation (WMI) to check for anti-virus products.

Cobalt Group used a JavaScript backdoor that is capable of collecting a list of the security solutions installed on the victim's machine.

Wizard Spider has used WMI to identify anti-virus products installed on a victim's machine.

Play has used the information-stealing tool Grixba to scan for anti-virus software.

FIN8 has used Registry keys to detect and avoid executing in potential sandboxes.

Wizard Spider has utilized the PowerShell script `Get-DataInfo.ps1` to collect installed backup software information from a compromised machine.