Procedure examples

SLOTHFULMEDIA can enumerate open ports on a victim machine.

Commands such as net use and net session can be used in Net to gather information about network connections from a particular host.

ShimRatReporter used the Windows function GetExtendedUdpTable to detect connected UDP endpoints.

Sliver can collect network connection information.

Once inside a Virtual Private Cloud, Pacu can attempt to identify DirectConnect, VPN, or VPC Peering.

Empire can enumerate the current network connections of a host.

FRP can use a dashboard and U/I to display the status of connections from the FRP client and server.

netstat can be used to enumerate local network connections, including active TCP connections and other network statistics.

PoshC2 contains an implementation of netstat to enumerate TCP and UDP connections.

nbtstat can be used to discover current NetBIOS sessions.

CrackMapExec can discover active sessions for a targeted system.

Pupy has a built-in utility command for netstat, can do net session through PowerView, and has an interactive shell which can be used to discover additional information.

TeamPCP Cloud Stealer can search compromised systems for webhook URLs connecting to Slack and Discord.

The discovery modules used with Duqu can collect information on network connections.

Mustang Panda has used a customized PlugX variant which could exfiltrate documents from air-gapped networks.

Tropic Trooper has exfiltrated data using USB storage devices.

Machete has a feature to copy files from every drive onto a removable drive in a hidden folder.

Agent.btz creates a file named thumb.dd on all USB flash drives connected to the victim. This file contains information about the infected system and activity logs.

Remsec contains a module to move data from airgapped networks to Internet-connected systems by using a removable USB device.

SPACESHIP copies staged data to removable drives when they are inserted into the system.

USBStealer exfiltrates collected files via removable media from air-gapped victims.

During the 2025 Poland Wiper Attacks, the adversaries set FortiGate scheduled tasks to run the adversary generated CLI scripts weekly.

Lokibot's second stage DLL has set a timer using “timeSetEvent” to schedule its next execution.

APT18 actors used the native at Windows task scheduler tool to use scheduled tasks for execution on a victim network.

BRONZE BUTLER has used at to register a scheduled task to execute malware during lateral movement.

Threat Group-3390 actors use at to schedule tasks to run self-extracting RAR archives, which install HTTPBrowser or PlugX on other victims on a network.

MURKYTOP has the capability to schedule remote AT jobs.

at can be used to schedule a task on a system to be executed at a specific date or time.

CrackMapExec can set a scheduled task on the target system to execute commands remotely using at.

During Operation MidnightEclipse, threat actors configured cron jobs to retrieve payloads from actor-controlled infrastructure.

APT38 has used cron to create pre-scheduled and periodic background jobs on a Linux system.

Rocke installed a cron job that downloaded and executed files from the C2.

APT5 has made modifications to the crontab file including in `/var/cron/tabs/`.

Exaramel for Linux uses crontab for persistence if it does not have root privileges.

Janicab used a cron job for persistence on Mac devices.

NETWIRE can use crontabs to establish persistence.

Gomir will configure a crontab for process execution to start the backdoor on reboot if it is not initially running under group 0 privileges.

Skidmap has installed itself via crontab.

The GoldMax Linux variant has used a crontab entry with a @reboot line to gain persistence.

Anchor can install itself as a cron job.

Xbash can create a cronjob for persistence if it determines it is on a Linux system.

SpeakUp uses cron tasks to ensure persistence.

NKAbuse uses a Cron job to establish persistence when infecting Linux hosts.

Penquin can use Cron to create periodic and pre-scheduled background jobs.

Kinsing has used crontab to download and run shell scripts every minute to ensure persistence.

During Operation Dream Job, Lazarus Group created scheduled tasks to set a periodic execution of a remote XSL script.

During SharePoint ToolShell Exploitation, threat actors used scheduled tasks to help establish persistence.

During Frankenstein, the threat actors established persistence through a scheduled task using the command: `/Create /F /SC DAILY /ST 09:00 /TN WinUpdate /TR`, named "WinUpdate"

In the Triton Safety Instrumented System Attack, TEMP.Veles installed scheduled tasks defined in XML files.

During Juicy Mix, OilRig used VBS droppers to schedule tasks for persistence.