Procedure examples

Green Lambert can collect data from a compromised host.

Green Lambert can obtain proxy information from a victim's machine using system environment variables.

Green Lambert has encrypted strings.

Green Lambert has created a new executable named `Software Update Check` to appear legitimate.

Green Lambert has been disguised as a Growl help file.

Green Lambert can add init.d and rc.d files in the /etc folder to establish persistence.

Green Lambert can use shell scripts for execution, such as /bin/sh -c.

Green Lambert can delete the original executable after initial installation in addition to unused functions.

Green Lambert can use DNS for C2 communications.

Green Lambert can use `uname` to identify the operating system name, version, and processor type.

Green Lambert can use proxies for C2 traffic.

Green Lambert can collect the date and time from a compromised host.

Green Lambert can use multiple custom routines to decrypt strings prior to execution.

Green Lambert can create a Launch Agent with the `RunAtLoad` key-value pair set to true, ensuring the `com.apple.GrowlHelper.plist` file runs every time a user logs in.

Green Lambert can add a plist file in the `Library/LaunchDaemons` to establish persistence.

Green Lambert can establish persistence on a compromised host through modifying the `profile`, `login`, and run command (rc) files associated with the `bash`, `csh`, and `tcsh` shells.

Green Lambert can add Login Items to establish persistence.

Green Lambert can use Keychain Services API functions to find and collect passwords, such as `SecKeychainFindInternetPassword` and `SecKeychainItemCopyAttributesAndData`.