Procedure examples

Helminth can use DNS for C2.

Denis has used DNS tunneling for C2 communications.

Sliver can support C2 communications over DNS.

Brute Ratel C4 can use DNS over HTTPS for C2.

Mythic supports DNS-based C2 profiles.

GLOOXMAIL communicates to servers operated by Google using the Jabber/XMPP protocol for C2.

It is believed that a patch management system for an anti-virus product commonly installed among targeted companies was used to distribute the Wiper malware.

QUIETCANARY has the ability to stage data prior to exfiltration.

Shark has stored information in folders named `U1` and `U2` prior to exfiltration.

Kobalos can write captured SSH connection credentials to a file under the /var/run directory with a .pid extension for exfiltration.

Kevin can create directories to store logs and other collected data.

Exaramel for Windows specifies a path to store files scheduled for exfiltration.

NOKKI can collect data from the victim and stage it in LOCALAPPDATA%\MicroSoft Updatea\uplog.tmp.

KOPILUWAK has piped the results from executed C2 commands to `%TEMP%\result2.dat` on the local machine.

VersaMem staged captured credentials locally at `/tmp/.temp.data`.

PAKLOG has stored the captured data in a file located `C:\\Users\\Public\\Libraries\\record.txt`.

Ursnif has used tmp files to stage gathered information.

FrameworkPOS can identifiy payment card track data on the victim and copy it to a local file in a subdirectory of C:\Windows\.

InvisibleFerret has staged data in consolidated folders prior to exfiltration.

RainyDay can use a file exfiltration tool to copy files to C:\ProgramData\Adobe\temp prior to exfiltration.

AppleSeed can stage files in a central location prior to exfiltration.

NETWIRE has the ability to write collected data to a file created in the ./LOGS directory.

MirrorStealer has stored stolen credentials on the local machine in `%TEMP%\31558.txt`.

Turian can store copied files in a specific directory prior to exfiltration.

Machete stores files and logs in a folder on the local drive.

PowerLess can stage stolen browser data in `C:\\Windows\\Temp\\cup.tmp` and keylogger data in `C:\\Windows\\Temp\\Report.06E17A5A-7325-4325-8E5D-E172EBA7FC5BK`.

Prikormka creates a directory, %USERPROFILE%\AppData\Local\SKC\, which is used to store collected log files.

Mafalda can place retrieved files into a destination directory.

AuTo Stealer can store collected data from an infected host to a file named `Hostname_UserName.txt` prior to exfiltration.

SombRAT can store harvested data in a custom database under the %TEMP% directory.

FLASHFLOOD stages data it copies from the local system or removable drives in the "%WINDIR%\$NtUninstallKB885884$\" directory.

LoFiSe can save files to be evaluated for further exfiltration in the `C:\Programdata\Microsoft\` and `C:\windows\temp\` folders.

Cuckoo Stealer has staged collected application data from Safari, Notes, and Keychain to `/var/folder`.

InvisiMole determines a working directory where it stores all the gathered data about the compromised machine.

MarkiRAT can store collected data locally in a created .nfo file.

Kazuar stages command output and collected data in files before exfiltration.

NavRAT writes multiple outputs to a TMP file using the >> method.

CHIMNEYSWEEP can store captured screenshots to disk including to a covert store named `APPX.%x%x%x%x%x.tmp` where `%x` is a random value.

Chrommme can store captured system information locally prior to exfiltration.

ObliqueRAT can copy specific files, webcam captures, and screenshots to local directories.

SocGholish can send output from `whoami` to a local temp file using the naming convention `rad<5-hex-chars>.tmp`.

PUNCHBUGGY has saved information to a random temp file before exfil.

Pteranodon creates various subdirectories under %Temp%\reports\% and copies files to those subdirectories. It also creates a folder at C:\Users\<Username>\AppData\Roaming\Microsoft\store to store screenshot JPEG files.

BeaverTail has staged collected data to the system’s temporary directory.

DarkWatchman can stage local data in the Windows Registry.

Dyre has the ability to create files in a TEMP folder to act as a database to store information.

PACEMAKER has written extracted data to `tmp/dsserver-check.statementcounters`.

PlugX has collected and staged the victim’s computer files for exfiltration.

Lumma Stealer has configured a custom user data directory such as a folder within `%USERPROFILE%\AppData\Roaming` for staging data.

DustySky created folders in temp directories to host collected files before exfiltration.