Procedure examples

Latrodectus can identify domain groups through `cmd.exe /c net group "Domain Admins" /domain`.

Cobalt Strike can identify targets by querying account groups on a domain contoller.

REvil can identify the domain membership of a compromised host.

Kwampirs collects a list of domain groups with the command net localgroup /domain.

LAMEHUG can use dsquery to gather domain group information.

Egregor can conduct Active Directory reconnaissance using tools such as Sharphound or AdFind.

Qilin can run PowerShell cmdlets to discover domain groups.

SoreFang can enumerate domain groups by executing net.exe group /domain.

Helminth has checked for the domain admin group and Exchange Trusted Subsystem groups using the commands net group Exchange Trusted Subsystem /domain and net group domain admins /domain.

OSInfo specifically looks for Domain Admins and power users within the domain.

Commands such as net group /domain can be used in Net to gather information about and manipulate groups.

BloodHound can collect information about domain groups and members.

SILENTTRINITY can use `System.DirectoryServices` namespace to retrieve domain group information.

dsquery can be used to gather information on permission groups within a domain.

Brute Ratel C4 can use `net group` for discovery on targeted domains.

CrackMapExec can gather the user accounts within domain groups.

AdFind can enumerate domain groups.

Pacu can enumerate IAM permissions.

AADInternals can enumerate Azure AD groups.

ROADTools can enumerate Azure AD groups.

Orz can overwrite Registry settings to reduce its visibility on the victim.

Stuxnet can delete OLE Automation and SQL stored procedures used to store malicious payloads.

IronWind has used a .NET DLL named "exit-DN4-core.dll" to terminate malicious processes running on victim's systems.

Sardonic has the ability to delete created WMI objects to evade detections.

Bankshot deletes all artifacts associated with the malware from the infected machine.

DUSTTRAP restores the `.text` section of compromised DLLs after malicious code is loaded into memory and before the file is closed.

Neoichor can clear the browser history on a compromised host by changing the `ClearBrowsingHistoryOnExit` value to 1 in the `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy` Registry key.

BlackEnergy has removed the watermark associated with enabling the TESTSIGNING boot configuration option by removing the relevant strings in the user32.dll.mui of the system.

Rising Sun can clear a memory blog in the process by overwriting it with junk bytes.

Flagpro can close specific Windows Security and Internet Explorer dialog boxes to mask external connections.

DarkWatchman can uninstall malicious components from the Registry, stop processes, and clear the browser history.

MultiLayer Wiper uses a batch script to clear file system cache memory via the ProcessIdleTasks export in advapi32.dll as an anti-analysis and anti-forensics technique.

EVILNUM has a function called "DeleteLeftovers" to remove certain artifacts of the attack.

Metamorfo has a command to delete a Registry key it uses, \Software\Microsoft\Internet Explorer\notes.

BPFDoor clears the file location `/proc/<PID>/environ` removing all environment variables for the process.

SDBbot has the ability to clean up and remove data structures from a compromised host.

Sibot will delete an associated registry key if a certain server response is received.

HermeticWiper can disable pop-up information about folders and desktop items and delete Registry keys to hide malicious services.

SUNBURST removed HTTP proxy registry values to clean up traces of execution.

IPsec Helper can delete various registry keys related to its execution and use.

FunnyDream has the ability to clean traces of malware deployment.

Maze has used the “Wow64RevertWow64FsRedirection” function following attempts to delete the shadow volumes, in order to leave the system in the same state as it was prior to redirection.

ShadowPad has deleted arbitrary Registry values.

SILENTTRINITY can remove artifacts from the compromised host, including created Registry keys.

CSPY Downloader has the ability to remove values it writes to the Registry.

Remcos can clean saved cookies and logins from the web browser.

Donut can erase file references to payloads in-memory after being reflectively loaded and executed.

J-magic can overwrite previously executed command line arguments.

Hildegard has used history -c to clear script shell logs.

Kobalos can remove all command history on compromised hosts.