Procedure examples

QakBot can execute WMI queries to gather information.

jRAT uses WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.

INC Ransomware has the ability to use wmic.exe to spread to multiple endpoints within a compromised environment.

FIVEHANDS can use WMI to delete files on a target machine.

HermeticWizard can use WMI to create a new process on a remote machine via `C:\windows\system32\cmd.exe /c start C:\windows\system32\\regsvr32.exe /s /iC:\windows\<filename>.dll`.

Covenant can utilize WMI to install new Grunt listeners through XSL files or command one-liners.

SILENTTRINITY can use WMI for lateral movement.

PowerSploit's Invoke-WmiCommand CodeExecution module uses WMI to execute and retrieve the output from a PowerShell payload.

Impacket's `wmiexec` module can be used to execute commands through WMI.

Empire can use WMI to deliver a payload to a remote host.

PoshC2 has a number of modules that use WMI to execute tasks.

Brute Ratel C4 can use WMI to move laterally.

CrackMapExec can execute remote commands using Windows Management Instrumentation.

Koadic can use WMI to execute commands.

TeamTNT has sent locally staged files with collected credentials to C2 servers using cURL.

Play has used WinSCP to exfiltrate data to actor-controlled accounts.

FrameworkPOS can use DNS tunneling for exfiltration of credit card data.

Hydraq connects to a predefined domain on port 443 to exfil gathered information.

Chaes has exfiltrated its collected data from the infected machine to the C2, sometimes using the MIME protocol.

Bundlore uses the curl -s -L -o command to exfiltrate archived data to a URL.

Kobalos can exfiltrate credentials over the network via UDP.

PoetRAT has used a .NET tool named dog.exe to exiltrate information over an e-mail account.

AADInternals can directly download cloud user data such as OneDrive files.

During the SolarWinds Compromise, APT29 exfiltrated collected data over a simple HTTPS request to a password-protected archive staged on a victim's OWA servers.

Storm-1811 has exfiltrated captured user credentials via Secure Copy Protocol (SCP).

CURIUM has used SMTPS to exfiltrate collected data from victims.

MirrorFace has used Secure File Transfer Protocol (SFTP) for file exfiltration.

APT28 has exfiltrated archives of collected data previously staged on a target's OWA server via HTTPS.

IcedID has exfiltrated collected data via HTTPS.

BRUSHFIRE has the ability to exfiltrate data on-demand through executing commands obtained via monitoring for specially crafted packets and sending output back in an embedded SSL response.

Rclone can exfiltrate data over SFTP or HTTPS via WebDAV.

During the 2025 Poland Wiper Attacks, the adversaries exfiltrated data to an actor-controlled infrastructure using HTTP POSTs.

During C0017, APT41 exfiltrated victim data via DNS lookups by encoding and prepending it as subdomains to the attacker-controlled domain.

Salt Typhoon has exfiltrated configuration files from exploited network devices over FTP and TFTP.

APT32's backdoor can exfiltrate data by encoding it in the subdomain field of DNS packets.

FIN6 has sent stolen payment card data to remote servers via HTTP POSTs.

Mustang Panda has used FTP to exfiltrate archive files.

Contagious Interview has exfiltrated victim information using FTP.

OilRig has exfiltrated data via Microsoft Exchange and over FTP separately from its primary C2 channel over DNS.

Lazarus Group malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims.

Thrip has used WinSCP to exfiltrate data from a targeted organization over FTP.

Wizard Spider has exfiltrated victim information using FTP.

APT33 has used FTP to exfiltrate files (separately from the C2 channel).

FIN8 has used FTP to exfiltrate collected data.

WindTail has the ability to automatically exfiltrate files using the macOS built-in utility /usr/bin/curl.

InvisibleFerret has used FTP to exfiltrate files and directories using the command `ssh_upload` which contains with six subcommands of `.sdira`, `sdir`, `sfile`, `sfinda`, `sfindr` and `sfind` that had varying functions. InvisibleFerret has exfiltrated stolen files and data to the C2 servers over ports 1224, 2245 and 8637.

Some Brave Prince variants have used South Korea's Daum email service to exfiltrate information, and later variants have posted the data to a web server via an HTTP post command.

CosmicDuke exfiltrates collected files over FTP or WebDAV. Exfiltration servers can be separately configured from C2 servers.

PUBLOAD has leveraged `curl` for data exfiltration over FTP by uploading RAR archives containing targeted files (.doc, .docx, .xls, .xlsx, .pdf, .ppt, .pptx) to an adversary-owned FTP site.

SocGholish can exfiltrate data directly to its C2 domain via HTTP.