Procedure examples

APT41 has used DGAs to change their C2 servers monthly.

TA551 has used a DGA to generate URLs from executed macros.

APT12 has used multiple variants of DNS Calculation including multiplying the first two octets of an IP address and adding the third octet to that value in order to get a resulting command and control port.

APT38 has created new services or modified existing ones to run executables, commands, or scripts.

BlackByte created malicious services for ransomware execution.

APT41 used svchost.exe and Net to execute a system service installed to launch a Cobalt Strike BEACON loader.

APT32's backdoor has used Windows services as a way to execute its malicious payload.

FIN6 has created Windows services to execute encoded PowerShell commands.

FIN7 has started the SSH service by executing `sc start sshd`.

APT39 has used post-exploitation tools including RemCom and the Non-sucking Service Manager (NSSM) to execute processes.

Ke3chang has used a tool known as RemoteExec (similar to PsExec) to remotely execute batch scripts and binaries.

Blue Mockingbird has executed custom-compiled XMRIG miner DLLs by configuring them to execute via the "wercplsupport" service.

Chimera has used PsExec to deploy beacons on compromised systems.

Medusa Group has utilized PsExec to execute scripts and commands within victim environments. Medusa Group has also used the Windows service RoboCopy to search and copy data for exfiltration.

INC Ransom has run a file encryption executable via `Service Control Manager/7045;winupd,%SystemRoot%\winupd.exe,user mode service,demand start,LocalSystem`.

Silence has used Winexe to install a service on the remote system.

Wizard Spider has used `services.exe` to execute scripts and executables during lateral movement within a victim's network. Wizard Spider has also used batch scripts that leverage PsExec to execute a previously transferred ransomware payload on a victim's network.

Velvet Ant executed and installed PlugX as a Windows service.

Moonstone Sleet used intermediate loader malware such as YouieLoader and SplitLoader that create malicious services.

TeamTNT has created system services to execute cryptocurrency mining software.

BlackByte transfered tools such as Cobalt Strike and the AnyDesk remote access tool during operations using SMB shares.

GALLIUM has used PsExec to move laterally between hosts in the target network.

Volt Typhoon has copied web shells between servers in targeted environments.

APT41 uses remote shares to move and remotely execute payloads during lateral movemement.

APT32 has deployed tools after moving laterally using administrative accounts.

Storm-1811 has used the Impacket toolset to move and remotely execute payloads to other hosts in victim networks.

Sandworm Team has used `move` to transfer files to a network share and has copied payloads--such as Prestige ransomware--to an Active Directory Domain Controller and distributed via the Default Domain Group Policy Object. Additionally, Sandworm Team has transferred an ISO file into the OT network to gain initial access.

UNC3886 has utilzed Python scripts to transfer files between ESXi hosts and guest VMs.

Aoqin Dragon has spread malware in target networks by copying modules to folders masquerading as removable devices.

Turla RPC backdoors can be used to transfer files to/from victim machines on the local network.

Chimera has copied tools between compromised hosts using SMB.

Medusa Group has utilized legitimate software services such as PDQ Deploy to transfer malicious binaries and tools to other victimized hosts within the target environment.

Ember Bear retrieves follow-on payloads direct from adversary-owned infrastructure for deployment on compromised hosts.

Agrius downloaded some payloads for follow-on execution from legitimate filesharing services such as ufile.io and easyupload.io.

INC Ransom has used a rapid succession of copy commands to install a file encryption executable across multiple endpoints within compromised infrastructure.

Wizard Spider has used stolen credentials to copy tools into the %TEMP% directory of domain controllers.

Velvet Ant transferred files laterally within victim networks through the Impacket toolkit.

Magic Hound has copied tools within a compromised network using RDP.

FIN10 has deployed Meterpreter stagers and SplinterRAT instances in the victim network after moving laterally.

An APT32 backdoor can use HTTP over a non-standard TCP port (e.g 14146) which is specified in the backdoor configuration.

MuddyWater has used ports 8043 and 8848 for botnet C2 communication.

RedEcho has used non-standard ports such as TCP 8080 for HTTP communication.

Gamaredon Group has used port 6856 for C2 communications.

FIN7 has used port-protocol mismatches on ports such as 53, 80, 443, and 8080 during C2. FIN7 has used TCP ports 59999 and 9898 for firewall rules.

Sandworm Team has used port 6789 to accept connections on the group's SSH server.

Rocke's miner connects to a C2 server using port 51640.

Contagious Interview has used TCP port 1224 for C2.

DarkVishnya used ports 5190 and 7900 for shellcode listeners, and 4444, 4445, 31337 for shellcode C2.

Ember Bear has used various non-standard ports for C2 communication.

APT-C-36 has used port 4050 for C2 communications.