Procedure examples

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the `xp_cmdshell` command in MS-SQL.

During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and run command-line shells.

During Operation Wocao, threat actors spawned a new `cmd.exe` process to execute commands.

During C0017, APT41 used `cmd.exe` to execute reconnaissance commands.

KV Botnet Activity utilizes multiple Bash scripts during botnet installation stages, and the final botnet payload allows for running commands in the Bash shell.

During RedPenguin, UNC3886 used malware capable of launching an interactive shell.

During Operation MidnightEclipse, threat actors piped output from stdout to bash for execution.

During the 2025 Poland Wiper Attacks, the adversaries utilized the Linux `dd` command to overwrite portions of the disks with random data.

Quad7 Activity has enabled the creation of an access-controlled command shell /bin/sh on compromised routers.

FLORAHOX Activity has executed multiple Bash controller scripts to provide command line inputs for FLORAHOX traversal configurations.

During Operation Dream Job, Lazarus Group executed a VBA written malicious macro after victims download malicious DOTM files; Lazarus Group also used Visual Basic macro code to extract a double Base64 encoded DLL implant.

During Frankenstein, the threat actors used Word documents that prompted the victim to enable macros and run a Visual Basic script.

During Operation Sharpshooter, the threat actors used a VBA macro to execute a simple downloader that installed Rising Sun.

For Operation Honeybee, the threat actors used a Visual Basic script embedded within a Word document to download an implant.

During Operation Dust Storm, the threat actors used Visual Basic scripts.

During the 2015 Ukraine Electric Power Attack, Sandworm Team installed a VBA script called `vba_macro.exe`. This macro dropped `FONTCACHE.DAT`, the primary BlackEnergy implant; `rundll32.exe`, for executing the malware; `NTUSER.log`, an empty file; and desktop.ini, the default file used to determine folder displays on Windows machines.

During C0015, the threat actors used a malicious HTA file that contained a mix of HTML and JavaScript/VBScript code.

During Juicy Mix, OilRig used VBS droppers to deliver and establish persistence for the Mango backdoor.

For the SolarWinds Compromise, APT29 wrote malware such as Sibot in Visual Basic.

During Operation AkaiRyū, MirrorFace used Word templates containing VBA code for malware execution.

During FunnyDream, the threat actors used a Visual Basic script to run remote commands.

During Operation CuckooBees, the threat actors executed an encoded VBScript file using `wscript` and wrote the decoded output to a text file.

During Outer Space, OilRig used VBS droppers to deploy malware.

During the 2016 Ukraine Electric Power Attack, Sandworm Team created VBScripts to run on an SSH server.

During Operation Wocao, threat actors used VBScript to conduct reconnaissance on targeted systems.

For C0011, Transparent Tribe used malicious VBA macros within a lure document as part of the Crimson malware installation process onto a compromised host.

During Cutting Edge, threat actors used a Python reverse shell and the PySoxy SOCKS5 proxy tool.

During ShadowRay, threat actors used the Python `pty` module to open reverse shells.

During Salesforce Data Exfiltration, threat actors used custom applications developed in python.

During Operation Wocao, threat actors' backdoors were written in Python and compiled with py2exe.

During Operation Dust Storm, the threat actors used JavaScript code.

Water Curupira Pikabot Distribution initial delivery included obfuscated JavaScript objects stored in password-protected ZIP archives.

During C0015, the threat actors used a malicious HTA file that contained a mix of encoded HTML and JavaScript/VBScript code.

Pikabot Distribution February 2024 utilized obfuscated JavaScript files for initial Pikabot payload download.

During C0017, APT41 deployed JScript web shells on compromised systems.

During RedPenguin, UNC3886 accessed the Junos OS CLI on targeted devices.

During the 2025 Poland Wiper Attacks, the adversaries leveraged the native CLI of the targeted FortiGate device.

During ShadowRay, threat actors downloaded a privilege escalation payload to gain root access.

Leviathan exploited software vulnerabilities in victim environments to escalate privileges during Leviathan Australian Intrusions.

During the SolarWinds Compromise, APT29 used the `Get-ManagementRoleAssignment` PowerShell cmdlet to enumerate Exchange management role assignments through an Exchange Management Shell.

During Operation Digital Eye, threat actors used the local.exe tool to view group memberships.

During C0015, the threat actors used the command `net localgroup "adminstrator" ` to identify accounts with local administrator rights.

During Operation CuckooBees, the threat actors used the `net group` command as part of their advanced reconnaissance.

During Operation Wocao, threat actors used the command `net localgroup administrators` to list all administrators part of a local group.

During C0015, the threat actors use the command `net group "domain admins" /dom` to enumerate domain groups.

During the SolarWinds Compromise, APT29 used AdFind to enumerate domain groups.

During C0027, Scattered Spider accessed Azure AD to download bulk lists of group members and their Active Directory attributes.

During Cutting Edge, threat actors cleared logs to remove traces of their activity and restored compromised systems to a clean state to bypass manufacturer mitigations for CVE-2023-46805 and CVE-2024-21887.

During the SolarWinds Compromise, APT29 temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.

During Operation Dream Job, Lazarus Group removed all previously delivered files from a compromised computer.