Procedure examples

Gelsemium can use multiple domains and protocols in C2.

Mythic can use a list of C2 URLs as fallback mechanisms in case one IP or domain gets blocked.

TeamPCP Cloud Stealer can compress and encrypt data and exfiltrate it via POST to an attacker-controlled domain. If that method fails it can use the victim's own GitHub account to create a public repository and uploads the encrypted data as a release asset.

Mini Shai-Hulud has established Fallback Channels to exfiltrate data to Github when other configured infrastructure is found to be unreachable.

PowerDuke has a command to get text of the current foreground window.

PAKLOG has used `GetForegroundWindow` to access the foreground window. PAKLOG has also captured text from the foreground windows.

TONESHELL has used `GetForegroundWindow` to detect virtualization or sandboxes by calling the API twice and comparing each window handle.

NETWIRE can discover and close windows on controlled systems.

Aria-body has the ability to identify the titles of running windows on a compromised host.

DUSTTRAP can enumerate running application windows.

Machete saves the window names.

InvisiMole can enumerate windows and child windows on a compromised host.

WINERACK can enumerate active windows.

Kazuar gathers information about opened windows.

Flagpro can check the name of the window displayed on the system.

ROKRAT can use the `GetForegroundWindow` and `GetWindowText` APIs to discover where the user is typing.

DarkWatchman reports window names along with keylogger information to provide application context.

DarkGate will search for cryptocurrency wallets by examining application window names for specific strings. DarkGate extracts information collected via NirSoft tools from the hosting process's memory by first identifying the window through the FindWindow API function.

Metamorfo can enumerate all windows on the victim’s machine.

Trojan.Karagany can monitor the titles of open windows to identify specific keywords.

Catchamas obtains application windows titles and then determines which windows to perform Screen Capture on.

Attor can obtain application window titles and then determines which windows to perform Screen Capture on.

NightClub can use `GetForegroundWindow` to enumerate the active window.

Grandoreiro can identify installed security tools based on window names.

SOUNDBITE is capable of enumerating application windows.

Cadelspy has the ability to identify open windows on the compromised host.

HotCroissant has the ability to list the names of all open windows on the infected host.

PoisonIvy captures window titles.

PLEAD has the ability to list open windows on the compromised host.

FunnyDream has the ability to discover application windows via execution of `EnumWindows`.

NetTraveler reports window names along with keylogger information to provide application context.

njRAT gathers information about opened windows during the initial infection.

Remexi has a command to capture active windows on the machine and retrieve window titles.

QakBot has the ability to enumerate windows on a compromised host.

SILENTTRINITY can enumerate the active Window during keylogging through execution of `GetActiveWindowTitle`.

Remcos can list all windows on victim systems.

APT-C-36 used a customized version of QuasarRAT to monitor browser windows for strings relating to specific Colombian financial institutions.

The discovery modules used with Duqu can collect information on open windows.

Flame has a module named BeetleJuice that contains Bluetooth functionality that may be used in different ways, including transmitting encoded information from the infected system over the Bluetooth protocol, acting as a Bluetooth beacon, and identifying other Bluetooth devices in the vicinity.

SynAck enumerates Registry keys associated with event logs.

Bumblebee can check the Registry for specific keys.

Proxysvc gathers product names from the Registry key: HKLM\Software\Microsoft\Windows NT\CurrentVersion ProductName and the processor description from the Registry key HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessorNameString.

Stuxnet searches the Registry for indicators of security programs.

POWRUNER may query the Registry by running reg query on a victim.

Ursnif has used Reg to query the Registry for installed programs.

POWERSOURCE queries Registry keys in preparation for setting Run keys to achieve persistence.

Zeus Panda checks for the existence of a Registry key and if it contains certain values.

Bankshot searches for certain Registry keys to be configured before executing the payload.

Brave Prince gathers information about the Registry.

TinyTurla can query the Registry for its configuration information.