Procedure examples

During APT28 Nearest Neighbor Campaign, APT28 staged captured credential information in the C:\ProgramData directory.

During the 2025 Poland Wiper Attacks, the adversaries compiled discovery data locally on the victim host in a file located within `C:\Windows\TEMP\outlog.txt`.

APT41 DUST involved exporting data from Oracle databases to local CSV files prior to exfiltration.

During Operation Wocao, threat actors staged archived files in a temporary directory prior to exfiltration.

Leviathan stored captured credential material on local log files on victim systems during Leviathan Australian Intrusions.

During C0017, APT41 copied the local `SAM` and `SYSTEM` Registry hives to a staging directory.

During the SolarWinds Compromise, APT29 staged data and files in password-protected archives on a victim's OWA server.

During Night Dragon, threat actors copied files to company web servers and subsequently downloaded them.

During RedPenguin, UNC3886 used legitimate credentials to gain priviliged access to Juniper routers.

During Operation MidnightEclipse, threat actors extracted sensitive credentials while moving laterally through compromised networks.

During the 2015 Ukraine Electric Power Attack, Sandworm Team used valid accounts on the corporate network to escalate privileges, move laterally, and establish persistence within the corporate network.

During 3CX Supply Chain Attack, AppleJeus has gained access to the 3CX corporate environment through legitimate VPN credentials.

During the Anthropic AI-orchestrated Campaign, the adversary used harvested credentials to authenticate against internal APIs, database systems, container registries, and logging infrastructure across targeted networks.

During HomeLand Justice, threat actors used a compromised Exchange account to search mailboxes and create new Exchange accounts.

During the C0032 campaign, TEMP.Veles used compromised VPN accounts.

During the SolarWinds Compromise, APT29 used different compromised credentials for remote access and to move laterally.

During Night Dragon, threat actors used compromised VPN accounts to gain access to victim systems.

During Operation Wocao, threat actors used valid VPN credentials to gain initial access.

Leviathan used captured, valid account information to log into victim web applications and appliances during Leviathan Australian Intrusions.

During HomeLand Justice, threat actors used the built-in administrator account to move laterally using RDP and Impacket.

During Operation MidnightEclipse, threat actors used a compromised domain admin account to move laterally.

During Cutting Edge, threat actors used compromised VPN accounts for lateral movement on targeted networks.

For Operation Ghost, APT29 used stolen administrator credentials for lateral movement on compromised networks.

During the SolarWinds Compromise, APT29 used domain administrators' accounts to help facilitate lateral movement on compromised networks.

During Operation CuckooBees, the threat actors used compromised domain administrator credentials as part of their lateral movement.

During Salesforce Data Exfiltration, threat actors used compromised credentials for lateral movement.

During the 2025 Poland Wiper Attacks, threat actors utilized privileged accounts to access the FortiGate VPN solution and subsequent subnets.

During Night Dragon, threat actors used domain accounts to gain further access to victim systems.

During Operation Wocao, threat actors used domain credentials, including domain admin, for lateral movement and privilege escalation.

Leviathan compromised domain credentials during Leviathan Australian Intrusions.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to test credentials harvested against discovered devices.

During the SolarWinds Compromise, APT29 used compromised local accounts to access victims' networks.

During Operation Wocao, threat actors used local account credentials found during the intrusion for lateral movement and privilege escalation.

Leviathan used captured local account information, such as service accounts, for actions during Leviathan Australian Intrusions.

During the SolarWinds Compromise, APT29 used a compromised O365 administrator account to create a new Service Principal.

During the 2025 Poland Wiper Attacks, the adversaries leveraged stolen credentials from on-premises environments to access cloud services.

During C0027, Scattered Spider leveraged compromised credentials from victim users to authenticate to Azure tenants.

KV Botnet Activity includes use of native system tools, such as uname, to obtain information about victim device architecture, as well as gathering other system information such as the victim's hosts file and CPU utilization.

During SharePoint ToolShell Exploitation, threat actors fingerprinted targeted SharePoint servers to identify OS version and running processes.

During Frankenstein, the threat actors used Empire to obtain the compromised machine's name.

Mustang Panda captured victim operating system type via User Agent analysis during RedDelta Modified PlugX Infection Chain Operations.

During Operation Honeybee, the threat actors collected the computer name, OS, and other system information using `cmd /c systeminfo > %temp%\ temp.ini`.

During Cutting Edge, threat actors used the ENUM4LINUX Perl script for discovery on Windows and Samba hosts.

During the Anthropic AI-orchestrated Campaign, the adversary tasked Claude Code to query databases and systems in order to identify proprietary information, including system configurations and database types.

During Juicy Mix, OilRig used a script to send the name of the compromised host via HTTP `POST` to register it with C2.

During Operation AkaiRyū, MirrorFace collected system information.

During FunnyDream, the threat actors used Systeminfo to collect information on targeted hosts.

During Operation CuckooBees, the threat actors used the `systeminfo` command to gather details about a compromised system.

ArcaneDoor included collection of victim device configuration information.

During Operation Wocao, threat actors discovered the OS versions of systems connected to a targeted network.