Procedure examples

Helminth creates folders to store output from batch scripts prior to sending the information to its C2 server.

Dtrack can save collected data to disk, different file formats, and network shares.

SLOWPULSE can write logged ACE credentials to `/home/perl/PAUS.pm` in append mode, using the format string `%s:%s\n`.

ADVSTORESHELL stores output from command execution in a .dat file in the %TEMP% directory.

TeamPCP Cloud Stealer has created a staging file in `/tmp` for collected data.

Modules can be pushed to and executed by Duqu that copy data to a staging area, compress it, and XOR encrypt it.

ccf32 has copied files to a remote machine infected with Chinoxy or another backdoor.

Linux Rabbit acquires valid SSH accounts through brute force.

Some SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials.

LP-Notes has used stolen Windows credentials to log in as the users.

Kinsing has used valid SSH credentials to access remote hosts.

Industroyer can use supplied user credentials to execute processes and stop services.

Dtrack used hard-coded credentials to gain access to a network share.

Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.

Stuxnet infected WinCC machines via a hardcoded database server password.

HyperStack can use default credentials to connect to IPC$ shares on remote machines.

Stuxnet attempts to access network resources with a domain account’s credentials.

If Shamoon cannot access shares using current privileges, it attempts access using hard coded, domain-specific credentials gathered earlier in the intrusion.

Ryuk can use stolen domain admin accounts to move laterally within a victim domain.

Cobalt Strike can use known credentials to run commands and spawn processes as a domain user account.

CreepySnail can use stolen credentials to authenticate on target networks.

Emotet can brute force a local admin password, then use it to facilitate lateral movement.

Umbreon creates valid local users to provide access to the system.

NotPetya can use valid credentials with PsExec or wmic to spread itself to remote systems.

LockBit 3.0 can use a compromised local account for lateral movement.

Cobalt Strike can use known credentials to run commands and spawn processes as a local user account.

Shai-Hulud has leveraged compromised accounts to log into cloud services to access cloud hosted repositories.

Pacu leverages valid cloud accounts to perform most of its operations.

ROADTools leverages valid cloud credentials to perform enumeration operations using the internal Azure AD Graph API.

TruffleHog has used stolen credentials to log into cloud services to access cloud hosted repositories and other cloud storage solutions to discover sensitive data to include API Keys, tokens and credentials.

Peirates can use stolen service account tokens to perform its operations.

Mini Shai-Hulud has used compromised accounts for Docker Hub and GitHub to publish malicious software packages.

Stuxnet infects remote servers via network shares and by infecting WinCC database views with malicious code.

Ursnif has copied itself to and infected files in network drives for propagation.

Miner-C copies itself into the public folder of Network Attached Storage (NAS) devices and infects new victims who open the file.

InvisiMole can replace legitimate software or documents in the compromised network with their trojanized versions, in an attempt to propagate itself within the network.

Conti can spread itself by infecting other remote machines via network shared drives.

Ramsay can spread itself by infecting other portable executable files on networks shared drives.

H1N1 has functionality to copy itself to network shares.

TrickBot gathers the OS version, machine name, CPU type, amount of RAM available, and UEFI/BIOS firmware information from the victim’s machine.

PowerDuke has commands to get information about the victim's name, build, version, serial number, and memory usage.

BLINDINGCAN has collected from a victim machine the system name, processor information, and OS version.

Ninja can obtain the computer name and information on the OS from targeted hosts.

Pikabot performs a variety of system checks and gathers system information, including commands such as whoami.

RCSession can gather system information from a compromised host.

Spark can collect the hostname, keyboard layout, and language from the system.

SynAck gathers computer names, OS version info, and also checks installed keyboard layouts to estimate if it has been launched from a certain list of countries.

Bumblebee can enumerate the OS version and domain on a targeted system.

MURKYTOP has the capability to retrieve information about the OS.

GRIFFON has used a reconnaissance module that can be used to retrieve information about a victim's computer, including the resolution of the workstation .