Procedure examples

Storm-0501 has stolen credentials contained in the password manager Keepass by utilizing Find-KeePassConfig.ps1.

Fox Kitten has used scripts to access credential information from the KeePass database.

LAPSUS$ has accessed local password managers and databases to obtain further credentials from a compromised network.

Threat Group-3390 obtained a KeePass database from a compromised host.

HAFNIUM has moved laterally from on-premises environments to steal passwords from Azure key vaults.

Storm-0501 has utilized Azure Key Vault to store the encryption key using the operation `Microsoft.KeyVault/Vaults/write`.

TeamPCP has used malware to exfiltrate cloud secrets from targeted environments including AWS, GCP, and Azure.

FIN13 has replaced legitimate KeePass binaries with trojanized versions to collect passwords from numerous applications.

Chimera's malware has altered the NTLM authentication program on domain controllers to allow Chimera to login without a valid credential.

Strider has registered its persistence module on domain controllers as a Windows LSA (Local System Authority) password filter to acquire credentials any time a domain, local user, or administrator logs in or changes a password.

OilRig has registered a password filter DLL in order to drop malware.

MirrorFace has used a tool named MRSAStealer as a password filter to collect credentials on password changes.

After compromising user accounts, Scattered Spider registers their own MFA tokens.

APT29 has edited the `Microsoft.IdentityServer.Servicehost.exe.config` file to load a malicious DLL into the AD FS process, thereby enabling persistent access to any service federated with AD FS for a user with a specified User Principal Name.

Scattered Spider has added additional trusted locations to Azure AD conditional access policies.

Storm-0501 has registered their own MFA method, and leveraged a victim hybrid joined server to circumvent Conditional Access Policies.

Kimsuky has used modified versions of PHProxy to examine web traffic between the victim and the accessed website.

Mustang Panda leveraged a captive portal hijack that redirected the victim to a webpage that prompted the victim to download a malicious payload.

Sea Turtle modified DNS records at service providers to redirect traffic from legitimate resources to Sea Turtle-controlled servers to enable adversary-in-the-middle attacks for credential capture.

Lazarus Group executed Responder using the command [Responder file path] -i [IP address] -rPv on a compromised host to harvest credentials and move laterally.

Wizard Spider has used the Invoke-Inveigh PowerShell cmdlets, likely for name service poisoning.

Cleaver has used custom tools to facilitate ARP cache poisoning.

LuminousMoth has used ARP spoofing to redirect a compromised machine to an actor-controlled website.

APT28 has used a Wi-Fi Pineapple to set up Evil Twin Wi-Fi Poisoning for the purposes of capturing victim credentials or planting espionage-oriented malware.

Akira have used scripts to dump Kerberos authentication credentials.

Ke3chang has used Mimikatz to generate Kerberos golden tickets.

Indrik Spider has conducted Kerberoasting attacks using a module from GitHub.

FIN7 has used Kerberoasting PowerShell commands such as, `Invoke-Kerberoast` for credential access and to enable lateral movement.

Wizard Spider has used Rubeus, MimiKatz Kerberos module, and the Invoke-Kerberoast cmdlet to steal AES hashes.

Kimsuky has leveraged Component Object Model (COM) to create scheduled tasks to include using naming conventions that mimic legitimate applications. Kimsuky has leveraged obfuscation VBScript to form a string in `WScript.Shell` which has downloaded a malicious payload to the victim environment.

MuddyWater has used malware that has the capability to execute malicious code via COM, DCOM, and Outlook.

Gamaredon Group malware can insert malicious macros into documents using a Microsoft.Office.Interop object.

Medusa Group has leveraged Component Object Model (COM) to bypass UAC.

Patchwork leveraged the DDE protocol to deliver their malware.

MuddyWater has used malware that can execute PowerShell scripts via DDE.

Gallmaker attempted to exploit Microsoft’s DDE protocol in order to gain access to victim machines and for execution.

FIN7 spear phishing campaigns have included malicious Word documents with DDE execution.

Sidewinder has used the ActiveXObject utility to create OLE objects to obtain execution through Internet Explorer.

APT37 has used Windows DDE for execution of commands and a malicious VBS.

Leviathan has utilized OLE as a method to insert malicious content inside various phishing documents.

TA505 has leveraged malicious Word documents that abused DDE.

BITTER has executed OLE objects using Microsoft Equation Editor to download and run malicious payloads.

APT28 has delivered JHUHUGIT and Koadic by executing PowerShell commands through DDE in Word documents.

Cobalt Group has sent malicious Word OLE compound documents to victims.

BlackByte compressed data collected from victim environments prior to exfiltration.

Patchwork encrypted the collected files' path with AES and then encoded them with base64.

Dragonfly has compressed data into .zip files prior to exfiltration.

menuPass has encrypted files and information before exfiltration.

APT32's backdoor has used LZMA compression and RC4 encryption before exfiltration.

Following data collection, FIN6 has compressed log files into a ZIP archive prior to staging and exfiltration.