Procedure examples

Patchwork developed a file stealer to search C:\ and collect files with certain extensions. Patchwork also executed a script to enumerate all drives, store them as a list, and upload generated files to the C2 server.

menuPass has used the Csvde tool to collect Active Directory files and data.

HAFNIUM has used MSGraph to exfiltrate data from email, OneDrive, and SharePoint.

FIN6 has used a script to iterate through a list of compromised PoS systems, copy and remove data to a log file, and to bind to events from the submit payment button.

Gamaredon Group has deployed scripts on compromised systems that automatically scan for interesting documents.

Sidewinder has used tools to automatically collect system and network configuration information.

Mustang Panda used custom batch scripts to collect files automatically from a targeted system.

OilRig has used automated collection.

Tropic Trooper has collected information automatically using the adversary's USBferry attack.

Ke3chang has performed frequent and scheduled data collection from victim networks.

APT1 used a batch script to perform a series of discovery techniques and saves it to a text file.

Confucius has used a file stealer to steal documents and images with the following extensions: txt, pdf, png, jpg, doc, xls, xlm, odp, ods, odt, rtf, ppt, xlsx, xlsm, docx, pptx, and jpeg.

Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.

RedCurl has used batch scripts to collect data.

FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.

Chimera has used custom DLLs for continuous retrieval of data from memory.

Ember Bear engages in mass collection from compromised systems during intrusions.

Agrius used a custom tool, sql.net4.exe, to query SQL databases and then identify and extract personally identifiable information.

APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.

VOID MANTICORE conducted large-scale data exfiltration in the Stryker operation, consistent with automated or scripted collection against enterprise systems.

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.