Procedure examples

FoggyWeb can retrieve configuration data from a compromised AD FS server.

FoggyWeb can compile and execute source code sent to the compromised AD FS server via a specific HTTP POST.

FoggyWeb has been XOR-encoded.

FoggyWeb can masquerade the output of C2 commands as a fake, but legitimately formatted WebP file.

FoggyWeb can be disguised as a Visual Studio file such as `Windows.Data.TimeZones.zh-PH.pri` to evade detection. Also, FoggyWeb's loader can mimic a genuine `dll` file that carries out the same import functions as the legitimate Windows `version.dll` file.

FoggyWeb can configure custom listeners to passively monitor all incoming HTTP GET and POST requests sent to the AD FS server from the intranet/internet and intercept HTTP requests that match the custom URI patterns defined by the actor.

FoggyWeb can remotely exfiltrate sensitive information from a compromised AD FS server.

FoggyWeb's loader can enumerate all Common Language Runtimes (CLRs) and running Application Domains in the compromised AD FS server's Microsoft.IdentityServer.ServiceHost.exe process.

FoggyWeb has the ability to communicate with C2 servers over HTTP GET/POST requests.

FoggyWeb's loader can check for the FoggyWeb backdoor .pri file on a compromised AD FS server.

FoggyWeb can receive additional malicious components from an actor controlled C2 server and execute them on a compromised AD FS server.

FoggyWeb's loader can use API functions to load the FoggyWeb backdoor into the same Application Domain within which the legitimate AD FS managed code is executed.

FoggyWeb's loader can call the load() function to load the FoggyWeb dll into an Application Domain on a compromised AD FS server.

FoggyWeb can be decrypted in memory using a Lightweight Encryption Algorithm (LEA)-128 key and decoded using a XOR key.

FoggyWeb can allow abuse of a compromised AD FS server's SAML token.

FoggyWeb can retrieve token signing certificates and token decryption certificates from a compromised AD FS server.

FoggyWeb can invoke the `Common.Compress` method to compress data with the C# GZipStream compression class.

FoggyWeb can use a dynamic XOR key and a custom XOR methodology to encode data before exfiltration. Also, FoggyWeb can encode C2 command output within a legitimate WebP file.

FoggyWeb has used a dynamic XOR key and custom XOR methodology for C2 communications.

FoggyWeb's loader has used DLL Search Order Hijacking to load malicious code instead of the legitimate `version.dll` during the `Microsoft.IdentityServer.ServiceHost.exe` execution process.

FoggyWeb's loader has reflectively loaded .NET-based assembly/payloads into memory.