Procedure examples

TONESHELL has utilized a magic value in C2 communications and only executes in memory when response packets match specific values.

BUSHWALK can modify the `DSUserAgentCap.pm` Perl module on Ivanti Connect Secure VPNs and either activate or deactivate depending on the value of the user agent in incoming HTTP requests.

J-magic can monitor TCP traffic for packets containing one of five different predefined parameters and will spawn a reverse shell if one of the parameters and the proper response string to a subsequent challenge is received.

PUBLOAD has utilized a magic value in C2 communications and only executes in memory when response packets match specific values of 17 03 03. PUBLOAD has also used magic bytes consisting of 46 77 4d.

Umbreon provides additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet.

TRANSLATEXT has redirected clients to legitimate Gmail, Naver or Kakao pages if the clients connect with no parameters.

The REPTILE reverse shell component can listen for a specialized packet in TCP, UDP, or ICMP for activation.

Chaos provides a reverse shell is triggered upon receipt of a packet with a special string, sent to any port.

Uroburos can intercept the first client to server packet in the 3-way TCP handshake to determine if the packet contains the correct unique value for a specific Uroburos implant. If the value does not match, the packet and the rest of the TCP session are passed to the legitimate listening application.

SYNful Knock can be sent instructions via special packets to change its functionality. Code for new functionality can be included in these messages.

Winnti for Linux has used a passive listener, capable of identifying a specific magic value before executing tasking, as a secondary command and control (C2) mechanism.

Kobalos is triggered by an incoming TCP connection to a legitimate service from a specific source port.

Ryuk has used Wake-on-Lan to power on turned off systems for lateral movement.

Pandora can identify if incoming HTTP traffic contains a token and if so it will intercept the traffic and process the received command.

Penquin will connect to C2 only after sniffing a "magic packet" value in TCP or UDP packets matching specific conditions.

ZIPLINE can identify a specific string in intercepted network traffic, `SSH-2.0-OpenSSH_0.3xx.`, to trigger its command functionality.

BRUSHFIRE has monitored inbound VPN traffic to compromised appliances until specific inbound packets contain a specific magic string/pattern instead of external beaconing.

Mini Shai-Hulud has examined commit messages for a keyword followed by base64 encoded segments to validate communications and to execute subsequent actions to include exfiltration.