Procedure examples

KOCTOPUS has obfuscated scripts with the BatchEncryption tool.

KOCTOPUS has been disguised as legitimate software programs associated with the travel and airline industries.

KOCTOPUS has used PowerShell commands to download additional files.

KOCTOPUS has used `cmd.exe` and batch files for execution.

KOCTOPUS has used VBScript to call wscript to execute a PowerShell command.

KOCTOPUS can delete created registry keys used for persistence as part of its cleanup procedure.

KOCTOPUS has checked the OS version using `wmic.exe` and the `find` command.

KOCTOPUS has deployed a modified version of Invoke-Ngrok to expose open local ports to the Internet.

KOCTOPUS has executed a PowerShell command to download a file to the system.

KOCTOPUS can use the `LoadResource` and `CreateProcessW` APIs for execution.

KOCTOPUS has added and deleted keys from the Registry.

KOCTOPUS has deobfuscated itself before executing its commands.

KOCTOPUS has relied on victims clicking on a malicious link delivered via email.

KOCTOPUS has relied on victims clicking a malicious document for execution.

KOCTOPUS can set the AutoRun Registry key with a PowerShell command.

KOCTOPUS will perform UAC bypass either through fodhelper.exe or eventvwr.exe.

KOCTOPUS has used -WindowsStyle Hidden to hide the command window.

KOCTOPUS has been distributed via spearphishing emails with malicious attachments.

KOCTOPUS has been distributed as a malicious link within an email.

KOCTOPUS will attempt to delete or disable all Registry keys and scheduled tasks related to Microsoft Security Defender and Security Essentials.