Procedure examples

Milan can upload files from a compromised host.

Milan can query `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid` to retrieve the machine GUID.

Milan can run `C:\Windows\system32\cmd.exe /c cmd /c ipconfig /all 2>&1` to discover network settings.

Milan can encode files containing information about the targeted system.

Milan can identify users registered to a targeted machine.

Milan has used an executable named `companycatalogue` to appear benign.

Milan has used an executable named `companycatalog.exe.config` to appear benign.

Milan can establish persistence on a targeted host with scheduled tasks.

Milan can use `cmd.exe` for discovery actions on a targeted system.

Milan can delete files via `C:\Windows\system32\cmd.exe /c ping 1.1.1.1 -n 1 -w 3000 > Nul & rmdir /s /q`.

Milan can use HTTPS for communication with C2.

Milan has the ability to use DNS for C2 communications.

Milan has saved files prior to upload from a compromised host to folders beginning with the characters `a9850d2f`.

Milan can enumerate the targeted machine's name and GUID.

Milan has run `C:\Windows\system32\cmd.exe /c cmd /c dir c:\users\ /s 2>&1` to discover local accounts.

Milan has received files from C2 and stored them in log folders beginning with the character sequence `a9850d2f`.

Milan can use the API `DnsQuery_A` for DNS resolution.

Milan can use a COM component to generate scheduled tasks.

Milan can use hardcoded domains as an input for domain generation algorithms.

Milan can use a custom protocol tunneled through DNS or HTTP.