Procedure examples

Kevin can generate a sequence of dummy HTTP C2 requests to obscure traffic.

Kevin can upload logs and other data from a compromised host.

Kevin can assign hard-coded fallback domains for C2.

Kevin can collect the MAC address and other information from a victim machine using `ipconfig/all`.

Kevin has Base64-encoded its configuration file.

Kevin can exfiltrate data to the C2 server in 27-character chunks.

Kevin has renamed an image of `cmd.exe` with a random name followed by a `.tmpl` extension.

Kevin can send data from the victim host through a DNS C2 channel.

Kevin can use a renamed image of `cmd.exe` for execution.

Kevin can delete files created on the victim's machine.

Variants of Kevin can communicate with C2 over HTTP.

Variants of Kevin can communicate over DNS through queries to the server for constructed domain names with embedded information.

Kevin can create directories to store logs and other collected data.

Kevin can enumerate the OS version and hostname of a targeted machine.

Kevin can download files to the compromised host.

Kevin can use the `ShowWindow` API to avoid detection.

Kevin can Base32 encode chunks of output files during exfiltration.

Kevin can sleep for a time interval between C2 communication attempts.

Kevin can compile randomly-generated MOF files into the WMI repository to persistently run malware.

Kevin can hide the current window from the targeted user via the `ShowWindow` API function.

Kevin can use a custom protocol tunneled through DNS or HTTP.