Procedure examples

APT32 has used COM scriptlets to download Cobalt Strike beacons.

FIN6 has used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.

FIN7 used SQL scripts to help perform tasks on the victim's machine.

Mustang Panda has utilized meterpreter shellcode.

APT39 has utilized custom scripts to perform internal reconnaissance.

APT37 has used Ruby scripts to execute payloads.

OilRig has used various types of scripting for execution.

Windigo has used a Perl script for information gathering.

Malware used by Ke3chang can run commands on the command-line interface.

Saint Bear has used the Windows Script Host (wscript) to execute intermediate files written to victim machines.

Winter Vivern used XLM 4.0 macros for initial code execution for malicious document files.

FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.

Stealth Falcon malware uses WMI to script data collection and command execution on the victim.

Whitefly has used a simple remote shell tool that will call back to the C2 server and wait for commands.

Fox Kitten has used a Perl reverse shell to communicate with C2.

APT19 downloaded and launched code within a SCT file.

NICECURL has provided an arbitrary command execution interface.

Get2 has the ability to run executables with command-line arguments.

VersaMem was delivered as a Java Archive (JAR) that runs by attaching itself to the Apache Tomcat Java servlet and web server.

Zeus Panda can launch remote scripts on the victim’s machine.

Matryoshka is capable of providing Meterpreter shell access.

P.A.S. Webshell has the ability to create reverse shells with Perl scripts.

WINERACK can create a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands.

Bonadan can create bind and reverse shells on the infected system.

Raspberry Robin variants can be delivered via highly obfuscated Windows Script Files (WSF) for initial execution.

DarkComet can execute various types of scripts on the victim’s machine.

MuddyViper has launched a reverse shell using a provided command line.

Bandook can support commands to execute Java-based payloads.

gh0st RAT is able to open a remote shell to execute commands.

SpeakUp uses Perl scripts.

Kessel can create a reverse shell between the infected host and a specified system.

CHOPSTICK is capable of performing remote command execution.

SLIGHTPULSE contains functionality to execute arbitrary commands passed to it.

StarProxy has used the command line for execution of commands.

FIVEHANDS can receive a command line argument to limit file encryption to specified directories.

Empire uses a command-line interface to interact with systems.

Imminent Monitor has a CommandPromptPacket and ScriptPacket module(s) for creating a remote shell and executing scripts.

Donut can generate shellcode outputs that execute via Ruby.

ZeroCleare can receive command line arguments from an operator to corrupt the file system using the RawDisk driver.

During Operation Dream Job, Lazarus Group used PowerShell commands to explore the environment of compromised victims.

During SharePoint ToolShell Exploitation, threat actors used PowerShell to execute attacker-controlled encoded commands.

During Frankenstein, the threat actors used PowerShell to run a series of Base64-encoded commands that acted as a stager and enumerated hosts.

Mustang Panda used LNK files to execute PowerShell commands leading to eventual PlugX installation during RedDelta Modified PlugX Infection Chain Operations.

In the Triton Safety Instrumented System Attack, TEMP.Veles used a publicly available PowerShell-based tool, WMImplant.

During C0018, the threat actors used encoded PowerShell scripts for execution.

During C0021, the threat actors used obfuscated PowerShell to extract an encoded payload from within an .LNK file.

During Juicy Mix, OilRig used a PowerShell script to steal credentials.

During HomeLand Justice, threat actors used PowerShell cmdlets New-MailboxSearch and Get-Recipient for discovery.

During the C0032 campaign, TEMP.Veles used PowerShell to perform timestomping.

During the SolarWinds Compromise, APT29 used PowerShell to create new tasks on remote machines, identify configuration settings, exfiltrate data, and execute other commands.