IcedID has used "ZwQueueApcThread" to inject itself into remote processes.


InvisiMole can inject its code into a trusted process via the APC queue.


Pillowmint has used the NtQueueApcThread syscall to inject code into svchost.exe.


Saint Bot has written its payload into a newly-created `EhStorAuthn.exe` process using `ZwWriteVirtualMemory` and executed it using `NtQueueApcThread` and `ZwAlertResumeThread`.


TURNEDUP is capable of injecting code into the APC queue of a created Rundll32 process as part of an "Early Bird injection."


Epic has overwritten the function pointer in the extra window memory of Explorer's Shell_TrayWnd in order to execute malicious code in the context of the explorer.exe process.


Power Loader overwrites Explorer’s Shell_TrayWnd extra window memory to redirect execution to a NTDLL function that is abused to assemble and execute a return-oriented programming (ROP) chain and create a malicious thread within Explorer.exe.


A Threat Group-3390 tool can spawn svchost.exe and inject the payload into that process.


Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.


Azorult can decrypt the payload into memory, create a new suspended process of itself, then inject a decrypted payload to the new process and resume new process execution.


BBSRAT has been seen loaded into msiexec.exe through process hollowing to hide its execution.


Bandook has been launched by starting iexplore.exe and replacing it with Bandook's payload.


Bazar can inject into a target process including Svchost, Explorer, and cmd using process hollowing.


Clambling can execute binaries through process hollowing.


Cobalt Strike can use process hollowing for execution.


Denis performed process hollowing through the API calls CreateRemoteThread, ResumeThread, and Wow64SetThreadContext.


Duqu is capable of loading executable code via process hollowing.


Gorgon Group malware can use process hollowing to inject one of its trojans into another process.


ISMInjector hollows out a newly created process RegASM.exe and injects its payload into the hollowed process.


Kimsuky has used a file injector DLL to spawn a benign process on the victim's system and inject the malicious payload into it via process hollowing.


Lokibot has used process hollowing to inject itself into legitimate Windows process.


RCSession can launch itself from a hollowed svchost.exe process.


Smoke Loader spawns a new copy of c:\windows\syswow64\explorer.exe and then replaces the executable code in memory with malware.


Some Orz versions have an embedded DLL known as MockDll that uses process hollowing and Regsvr32 to execute another payload.


The NETWIRE payload has been injected into benign Microsoft executables via process hollowing.


The Saint Bot loader has used API calls to spawn `MSBuild.exe` in a suspended state before injecting the decrypted Saint Bot binary into it.


TrickBot injects into the svchost.exe process.


Ursnif has used process hollowing to inject into child processes.


WhisperGate has the ability to inject its fourth stage into a suspended process created by the legitimate Windows utility `InstallUtil.exe`.


Bazar can inject into a target process using process doppelgänging.


Leafminer has used Process Doppelgänging to evade security software while deploying tools on compromised systems.


SynAck abuses NTFS transactions to launch and conceal malicious processes.


InvisiMole has used ListPlanting to inject code into a trusted process.


APT39 has utilized tools to capture mouse movements.


APT28 has used tools to perform keylogging.


APT3 has used a keylogging tool that records keystrokes in encrypted files.


APT32 has abused the PasswordChangeNotify to monitor for and capture account password changes.


APT38 used a Trojan called KEYLIME to capture keystrokes from the victim’s machine.


APT39 has used tools for capturing keystrokes.


APT41 used a keylogger called GEARSHIFT on a target system.


Agent Tesla can log keystrokes on the victim’s machine.


Ajax Security Team has used CWoolger and MPK, custom-developed malware, which recorded all keystrokes on an infected system.


AppleSeed can use "GetKeyState" and "GetKeyboardState" to capture keystrokes on the victim’s machine.


Astaroth logs keystrokes from the victim's machine.


Bandook contains keylogging capabilities.


BlackEnergy has run a keylogger plug-in on a victim.


CHOPSTICK is capable of performing keylogging.


Carbanak logs key strokes for configured processes and sends them back to the C2 server.


Catchamas collects keystrokes from the victim’s machine.


Cobalt Strike can track key presses with a keylogger module.


Cobian RAT has a feature to perform keylogging on the victim’s machine.


Crimson can use a module to perform keylogging on compromised hosts.


Cuba logs keystrokes via polling by using "GetKeyState" and "VkKeyScan" functions.


DarkWatchman can track key presses with a keylogger module.


Dtrack’s dropper contains a keylogging executable.


Duqu can track key presses with a keylogger module.


ECCENTRICBANDWAGON can capture and store keystrokes.


EvilGrab has the capability to capture keystrokes.


FIN4 has captured credentials via fake Outlook Web App (OWA) login pages and has also used a .NET based keylogger.


FlawedAmmyy can collect keyboard events.


Grandoreiro can log keystrokes on the victim's machine.


GreyEnergy has a module to harvest pressed keystrokes.


HEXANE has used a PowerShell-based keylogger named `kl.ps1`.


HTTPBrowser is capable of capturing keystrokes on victims.


Imminent Monitor has a keylogging module.


KGH_SPY can perform keylogging by polling the "GetAsyncKeyState()" function.


KONNI has the capability to perform keylogging.


Kasidet has the ability to initiate keylogging.


KeyBoy installs a keylogger for intercepting credentials and keystrokes.


Kimsuky has used a PowerShell-based keylogger as well as a tool called MECHANICAL to log keystrokes.


Kivars has the ability to initiate keylogging on the infected host.


Lazarus Group malware KiloAlfa contains keylogging functionality.


Lokibot has the ability to capture input on the compromised host via keylogging.


MacMa can use Core Graphics Event Taps to intercept user keystrokes from any text input field and saves them to text files. Text input fields include Spotlight, Finder, Safari, Mail, Messages, and other apps that have text fields for passwords.


Metamorfo has a command to launch a keylogger and capture keystrokes on the victim’s machine.


NanoCore can perform keylogging on the victim’s machine.


NavRAT logs the keystrokes on the targeted system.


OilRig has used keylogging tools called KEYPUNCH and LONGWATCH.


Okrum was seen using a keylogger tool to capture keystrokes.


One of Attor's plugins can collect user credentials via capturing keystrokes and can capture keystrokes pressed within the window of the injected process.


Operation Wocao has obtained the password for the victim's password manager via a custom keylogger.


OwaAuth captures and DES-encrypts credentials before writing the username and password to a log file, "C:\log.txt".


PLATINUM has used several different keyloggers.


Peppy can log keystrokes on compromised hosts.


PlugX has a module for capturing keystrokes per process including window titles.


PoshC2 has modules for keystroke logging and capturing credentials from spoofed Outlook authentication messages.


PowerSploit's "Get-Keystrokes" Exfiltration module can log keystrokes.


Prikormka contains a keylogger module that collects keystrokes and the titles of foreground windows.


Pupy uses a keylogger to capture keystrokes it then sends back to the server after it is stopped.


QakBot can capture keystrokes on a compromised host.


ROKRAT can use  `SetWindowsHookEx` and `GetKeyNameText` to capture keystrokes.


RTM can record keystrokes from both the keyboard and virtual keyboard.


Remexi gathers and exfiltrates keystrokes from the machine.


RunningRAT captures keystrokes and sends them back to the C2 server.


SLOTHFULMEDIA has a keylogging capability.


SMOKEDHAM can continuously capture keystrokes.


Sandworm Team has used a keylogger to capture keystrokes by using the SetWindowsHookEx function.


SslMM creates a new thread implementing a keylogging facility using Windows Keyboard Accelerators.


Sykipot contains keylogging functionality to steal passwords.


TajMahal has the ability to capture keystrokes on an infected host.


The FunnyDream Keyrecord component can capture keystrokes.


The executable version of Helminth has a module to log keystrokes.


ThiefQuest uses the "CGEventTap" functions to perform keylogging.


Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers. Threat Group-3390 also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.


TinyZBot contains keylogger functionality.


Tonto Team has used keylogging tools in their operations.


Trojan.Karagany can capture keystrokes on a compromised host.


Unknown Logger is capable of recording keystrokes.


VERMIN collects keystrokes from the victim machine.


XAgentOSX contains keylogging functionality that will monitor for active application windows and write them to the log, it can handle special characters, and it will buffer by default 50 characters before sending them out over the C2 infrastructure.


Zeus Panda can perform keylogging on the victim’s machine by hooking the functions TranslateMessage and WM_KEYDOWN.


ZxShell has a feature to capture a remote computer's keystrokes using a keylogger.


jRAT has the capability to log keystrokes from the victim’s machine, both offline and online.


menuPass has used key loggers to steal usernames and passwords.


yty uses a keylogger plugin to gather keystrokes.


Calisto presents an input prompt asking for the user's login and password.


FIN4 has presented victims with spoofed Windows Authentication prompts to collect their credentials.


Keydnap prompts the users for credentials.


Metamorfo has displayed fake forms on top of banking sites to intercept credentials from victims.


XCSSET prompts the user to input credentials using a native macOS dialog box leveraging the system process "/Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment".


iKitten prompts the user for their credentials.


Empire contains some modules that leverage API hooking to carry out tasks, such as netripper.


NOKKI uses the Windows call SetWindowsHookEx and begins injecting it into every GUI process running on the victim's machine.


PLATINUM is capable of using Windows hook interfaces for information gathering such as credential access.


RDFSNIFFER hooks several Win32 API functions to hijack elements of the remote system management user-interface.


TrickBot has the ability to capture RDP credentials by capturing the "CredEnumerateA" API


Ursnif has hooked APIs to perform a wide variety of information theft, such as monitoring traffic from browsers.


Zebrocy installs an application-defined Windows hook to get notified when a network drive has been attached, so it can then use the hook to call its RecordToFile file stealing method.


ZxShell hooks several API functions to spawn system threads.


4H RAT has the capability to obtain a listing of running processes (including loaded modules).


APT1 gathered a list of running processes on the system using "tasklist /v".


APT29 has used multiple command-line utilities to enumerate running processes.


APT37's Freenki malware lists running processes using the Microsoft Windows API.


APT38 leveraged Sysmon to understand the processes, services in the organization.


After compromising a victim, Poseidon Group lists all running processes.


An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.


Andariel has used "tasklist" to enumerate processes and find a specific string.


Aria-body has the ability to enumerate loaded modules for a process..


Astaroth searches for different processes on the system.


Avaddon has collected information about running processes.


Avenger has the ability to use Tasklist to identify running processes.


Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot.


BACKSPACE may collect information about running processes.


BISCUIT has a command to enumerate running processes and identify their owners.


BLACKCOFFEE has the capability to discover processes.


BLUELIGHT can collect process filenames and SID authority level.


Babuk has the ability to check running processes on a targeted system.


BabyShark has executed the "tasklist" command.


Backdoor.Oldrea collects information about running processes.


Bad Rabbit can enumerate all running processes to compare hashes.


Bankshot identifies processes and collects the process ids.


Bazar can identity the current process on a compromised host.


Bisonal can obtain a list of running processes on the victim’s machine.


BlackEnergy has gathered a process list by using Tasklist.exe.


Brave Prince lists the running processes.


Bundlore has used the "ps" command to list processes.


Cannon can obtain a list of processes running on the system.


Carberp has collected a list of running processes.


Cardinal RAT contains watchdog functionality that ensures its process is always running, else spawns a new instance.


Caterpillar WebShell can gather a list of processes running on the machine.


ChChes collects its process identifier (PID) on the victim.


Chimera has used "tasklist" to enumerate processes.


Clambling can enumerate processes on a targeted system.


Clop can enumerate all processes on the victim's machine.


Cobalt Strike's "beacon" payload can collect information on process details.


Conti can enumerate through all open processes to search for any that have the string “sql” in their process name.


Crimson contains a command to list processes.


Cuba can enumerate processes running on a victim's machine.


DRATzarus can enumerate and examine running processes to determine if a debugger is present.


Dacls can collect data on running and parent processes.


Darkhotel malware can collect a list of running processes on a system.


Derusbi collects current and parent process IDs.


Doki has searched for the current process’s PID.


Donut includes subprojects that enumerate and identify information about Process Injection candidates.


Dtrack’s dropper can list all running processes.


During C0015, the threat actors used the `tasklist /s` command as well as `taskmanager` to obtain a list of running processes.


During Operation Honeybee, the threat actors obtained a list of running processes on a victim machine using `cmd /c tasklist > %temp%\temp.ini`.


During Operation Wocao, the threat actors used `tasklist` to collect a list of running processes on an infected system.


DustySky collects information about running processes from victims.


Elise enumerates processes via the "tasklist" command.


Epic uses the "tasklist /v" command to obtain a list of processes.


EvilBunny has used EnumProcesses() to identify how many process are running in the environment.


FELIXROOT collects a list of running processes.


Flagpro has been used to run the "tasklist" command on a compromised system.


FrameworkPOS can enumerate and exclude selected processes on a compromised host to speed execution of memory scraping.


Frankenstein has enumerated hosts, looking to obtain a list of all currently running processes.


FruitFly has the ability to list processes on the system.


FunnyDream has the ability to discover processes, including `Bka.exe` and `BkavUtil.exe`.


Fysbis can collect information about running processes.


Gamaredon Group has used tools to enumerate processes on target hosts including Process Explorer.


Gelsemium can enumerate running processes.


GeminiDuke collects information on running processes and environment variables from the victim.


Gold Dragon checks the running processes on the victim’s machine.


Goopy has checked for the Google Updater process to ensure Goopy was loaded properly.


Grandoreiro can identify installed security tools based on process names.


HALFBAKED can obtain information about running processes on the victim.


HELLOKITTY can search for specific processes to terminate.


HEXANE has enumerated processes on targeted systems.


Helminth has used Tasklist to get information on processes.


Heyoka Backdoor can gather process information.


Higaisa’s shellcode attempted to find the process ID of the current process.


Honeybee gathers a list of processes using the "tasklist" command and then is sent back to the control server.


Hydraq creates a backdoor through which remote attackers can monitor processes.


Inception has used a reconnaissance module to identify active processes and other associated loaded modules.


InvisiMole can obtain a list of running processes.


IronNetInjector can identify processes via C# methods such as "GetProcessesByName" and running Tasklist with the Python "os.popen" function.


JHUHUGIT obtains a list of running processes on the victim.


Javali can monitor processes for open browsers and custom banking applications.


KEYMARBLE can obtain a list of running processes on the system.


KONNI has used the command "cmd /c tasklist" to get a snapshot of the current processes on the target machine.


Kasidet has the ability to search for a given process name in processes currently running in the system.


Ke3chang performs process discovery using "tasklist" commands.


Kimsuky can gather a list of all processes running on a victim's machine.


Kwampirs collects a list of running services with the command "tasklist /v".


LoudMiner used the "ps" command to monitor the running processes on the system.


Lucifer can identify the process that owns remote connections.


Machete has a component to check for running processes to look for web browsers.


Magic Hound malware can list running processes.


MarkiRAT can search for different processes on a system.


Maze has gathered all of the running system processes.


Meteor can check if a specific process is running, such as Kaspersky's `avp.exe`.


MobileOrder has a command to upload information about all running processes to its C2 server.


Mosquito runs "tasklist" to obtain running processes.


MuddyWater has used malware to obtain a list of running processes on the system.


NavRAT uses "tasklist /v" to check running processes.


Nebulae can enumerate processes on a target system.


ObliqueRAT can check for blocklisted process names on a compromised host.


OceanSalt can collect the name and ID for every process running on the system.


OilRig has run "tasklist" on a victim's machine.


Orz can gather a process list from the victim.


OutSteel can identify running processes on a compromised host.


P8RAT can check for specific processes associated with virtual environments.


PLAINTEE performs the "tasklist" command to list running processes.


PLEAD has the ability to list processes on the compromised host.


POWERSTATS has used "get_tasklist" to discover processes on the compromised host.


POWRUNER may collect process information by running "tasklist" on a victim.


Pandora can monitor processes on a compromised host.


Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.


PcShare can obtain a list of running processes on a compromised host.


Pillowmint can iterate through running processes every six seconds collecting a list of processes to capture from later.


PipeMon can iterate over the running processes to find a suitable injection target.


PlugX has a module to list the processes running on a machine.


PoetRAT has the ability to list all running processes.


PowerDuke has a command to list the victim's processes.


PowerSploit's "Get-ProcessTokenPrivilege" Privesc-PowerUp module can enumerate privileges for a given process.


Proxysvc lists processes running on the system.


Pupy can list the running processes and get the process ID and parent process’s ID.


QakBot has the ability to check running processes.


ROKRAT can list the current running processes on the system.


RTM can obtain information about process integrity levels.


RainyDay can enumerate processes on a target system.


Ramsay can gather a list of running processes by using Tasklist.


Rising Sun can enumerate all running processes and process information on an infected machine.


Rocke can detect a running process's PID on the infected machine.


RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.


Ryuk has called "CreateToolhelp32Snapshot" to enumerate all running processes.


SDBbot can enumerate a list of running processes on a compromised machine.


SHOTPUT has a command to obtain a process listing.


SILENTTRINITY can enumerate processes, including properties to determine if they have the Common Language Runtime (CLR) loaded.


SLOTHFULMEDIA has enumerated processes by ID, name, or privileges.


SUNBURST collected a list of process names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.


SUNSPOT monitored running processes for instances of "MsBuild.exe" by hashing the name of each running process and comparing it to the corresponding value "0x53D525". It also extracted command-line arguments and individual arguments from the running "MsBuild.exe" process to identify the directory path of the Orion software Visual Studio solution.


SYSCON has the ability to use Tasklist to list running processes.


Saint Bot has enumerated running processes on a compromised host to determine if it is running under the process name `dfrgui.exe`.


Seasalt has a command to perform a process listing.


ShadowPad has collected the PID of a malicious process.


ShimRatReporter listed all running processes on the machine.


Sidewinder has used tools to identify running processes on the victim's machine.


Skidmap has monitored critical processes to ensure resiliency.


Socksbot can list all running processes.


SodaMaster can search a list of running processes.


SoreFang can enumerate processes on a victim machine through use of Tasklist.


StrongPity can determine if a user is logged in by checking to see if explorer.exe is running.


Sykipot may gather a list of running processes by running "tasklist /v".


TAINTEDSCRIBE can execute "ProcessList" for process discovery.


TSCookie has the ability to list processes on the infected host.


TajMahal has the ability to identify running processes and associated plugins on an infected host.


Tasklist can be used to discover processes running on a system.


TeamTNT has searched for rival malware and removes it if found. TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.


The OsInfo function in Komplex collects a running process list.


The discovery modules used with Duqu can collect information on process details.


ThiefQuest obtains a list of running processes using the function "kill_unwanted".


TrickBot uses module networkDll for process list discovery.


Trojan.Karagany can use Tasklist to collect a list of running tasks.


Tropic Trooper is capable of enumerating the running processes on the system using "pslist".


UBoatRAT can list running processes on the system.


UNC2452 used multiple command-line utilities to enumerate running processes.


USBferry can use "tasklist" to gather information about the process running on the infected system.


Ursnif has gathered information about running processes.


VERMIN can get a list of the processes and running tasks on the system.


WarzoneRAT can obtain a list of processes on a compromised host.


Windshift has used malware to enumerate active processes.


Winnti Group looked for a specific process running on infected servers.


Winnti for Windows can check if the explorer.exe process is responsible for calling its install function.


Zebrocy uses the "tasklist" and "wmic process get Capture, ExecutablePath" commands to gather the processes running on the system.


Zeus Panda checks for running processes on the victim’s machine.


ZxShell has a command, ps, to obtain a listing of processes on the system.


ZxxZ has created a snapshot of running processes using `CreateToolhelp32Snapshot`.


down_new has the ability to list running processes on a compromised host.


gh0st RAT has the capability to list processes.


macOS.OSAMiner has used `ps ax | grep <name> | grep -v grep | ...` and `ps ax | grep -E...` to conduct process discovery.


njRAT can search a list of running processes for Tr.exe.


yty gets an output of running processes using the "tasklist" command.


APT19 downloaded and launched code within a SCT file.


APT28 uses cmd.exe to execute commands and custom backdoors.


APT32 has used COM scriptlets to download Cobalt Strike beacons.


APT34 has used the command-line interface for execution.


APT37 has used Ruby scripts to execute payloads.


APT39 has utilized AutoIt and custom scripts to perform internal reconnaissance.


Astaroth spawns a CMD process to execute commands.


BRONZE BUTLER uses the command-line interface.


Bonadan can create bind and reverse shells on the infected system.


CHOPSTICK is capable of performing remote command execution.


Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands.


Denis can launch a remote shell to execute arbitrary commands on the victim’s machine.


Donut can generate shellcode outputs that execute via Ruby.


Dragonfly has used the command line for execution.


Emotet has used cmd.exe to run a PowerShell script.


Empire uses a command-line interface to interact with systems.


Exaramel for Windows has a command to launch a remote shell and executes commands on the victim’s machine.


FIN6 has used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.


FIN7 used SQL scripts to help perform tasks on the victim's machine.


FIVEHANDS can receive a command line argument to limit file encryption to specified directories.


Fox Kitten has used a Perl reverse shell to communicate with C2.


Get2 has the ability to run executables with command-line arguments.


Imminent Monitor has a CommandPromptPacket and ScriptPacket module(s) for creating a remote shell and executing scripts.


Kessel can create a reverse shell between the infected host and a specified system.


Lazarus Group malware uses cmd.exe to execute commands on victims.


Malware used by Ke3chang can run commands on the command-line interface.


Matryoshka is capable of providing Meterpreter shell access.


Molerats used various implants, including those built on .NET, on target machines.


MoonWind can execute commands via an interactive command shell.


OSX_OCEANLOTUS.D can run commands through a terminal on the victim’s machine.


OilRig has used the command-line interface for execution.


OilRig has used various types of scripting for execution.


P.A.S. Webshell has the ability to create reverse shells with Perl scripts.


PoetRAT has executed a Lua script through a Lua interpreter for Windows.


Several commands are supported by the Honeybee's implant via the command-line interface and there’s also a utility to execute any custom command on an infected endpoint.


Stealth Falcon malware uses WMI to script data collection and command execution on the victim.


TYPEFRAME can execute commands using a shell.


WINERACK can create a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands.


Whitefly has used a simple remote shell tool that will call back to the C2 server and wait for commands.


creates a backdoor through which remote attackers can open a command-line interface.


gh0st RAT is able to open a remote shell to execute commands.


AADInternals is written and executed via PowerShell.


APT19 used PowerShell commands to execute payloads.


APT28 downloads and executes PowerShell scripts and performs PowerShell commands.


APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke. APT29 also used PowerShell to create new tasks on remote machines, identify configuration settings, evade defenses, exfiltrate data, and to execute other commands.


APT32 has used PowerShell-based tools, PowerShell one-liners, and shellcode loaders for execution.


APT33 has utilized PowerShell to download files from the C2 server and run various scripts.


APT38 has used PowerShell to execute commands and other operational tasks.


AppleSeed has the ability to execute its payload via PowerShell.


Aquatic Panda has downloaded additional scripts and executed Base64 encoded commands in PowerShell.


AutoIt backdoor downloads a PowerShell script that decodes to a typical shellcode loader.


BRONZE BUTLER has used PowerShell for execution.


Bandook has used PowerShell loaders as part of execution.


Bazar can execute a PowerShell script received from C2.


BloodHound can use PowerShell to pull Active Directory information from the target environment.


Blue Mockingbird has used PowerShell reverse TCP shells to issue interactive commands over a network connection.


Bumblebee can use PowerShell for execution.


CharmPower can use PowerShell for payload execution and C2 communication.


Chimera has used PowerShell scripts to execute malicious payloads and the DSInternals PowerShell module to make use of Active Directory features.


Cobalt Group has used powershell.exe to download and execute scripts.


ComRAT has used PowerShell to load itself every time a user logs in to the system. ComRAT can execute PowerShell scripts loaded into memory or from the file system.


ConnectWise can be used to execute PowerShell commands on target machines.


CrackMapExec can execute PowerShell commands via WMI.


CreepySnail can use PowerShell for execution, including the cmdlets `Invoke-WebRequst` and `Invoke-Expression`.


Cuba has been dropped onto systems and used for lateral movement via obfuscated PowerShell scripts.


DarkVishnya used PowerShell to create shellcode loaders.


DarkWatchman can execute PowerShell commands and has used PowerShell to execute a keylogger.


Denis has a version written in PowerShell.


DownPaper uses PowerShell for execution.


Dragonfly 2.0 used PowerShell scripts for execution.


Dragonfly has used PowerShell scripts for execution.


During Frankenstein, the threat actors used PowerShell to run a series of Base64-encoded commands that acted as a stager and enumerated hosts.


During Operation Wocao, threat actors used PowerShell on compromised systems.


Earth Lusca has used PowerShell to execute commands.


Egregor has used an encoded PowerShell command by a service created by Cobalt Strike for lateral movement.


Ember Bear has used PowerShell to download and execute malicious code.


Emotet has used Powershell to retrieve the malicious payload and download additional resources like Mimikatz.


Empire leverages PowerShell for the majority of its client-side agent tasks. Empire also contains the ability to conduct PowerShell remoting with the "Invoke-PSRemoting" module.


FIN10 uses PowerShell for execution as well as PowerShell Empire to establish persistence.


FIN6 has used PowerShell to gain access to merchant's networks, and a Metasploit PowerShell module to download and execute shellcode and to set up a local listener.


FIN7 used a PowerShell script to launch shellcode that retrieved an additional payload.


FIN8's malicious spearphishing payloads are executed as PowerShell. FIN8 has also used PowerShell for lateral movement and credential access.


Ferocious can use PowerShell scripts for execution.


Fox Kitten has used PowerShell scripts to access credential data.


Frankenstein has used PowerShell to run a series of base64-encoded commands, that acted as a stager and enumerated hosts.


GALLIUM used PowerShell for execution to assist in lateral movement as well as for dumping credentials stored on compromised machines.


GOLD SOUTHFIELD has staged and executed PowerShell scripts on compromised hosts.


Gamaredon Group has used obfuscated PowerShell scripts for staging.


HAFNIUM has used the Exchange Power Shell module "Set-OabVirtualDirectoryPowerShell" to export mailbox data.


HEXANE has used PowerShell-based tools and scripts for discovery and collection on compromised hosts.


Inception has used PowerShell to execute malicious commands and payloads.


Indrik Spider has used PowerShell Empire for execution of malware.


JCry has used PowerShell to execute payloads.


JSS Loader has the ability to download and execute PowerShell scripts.


KOCTOPUS has used PowerShell commands to download additional files.


KONNI used PowerShell to download and execute a specific 64-bit version of the malware.


KeyBoy uses PowerShell commands to download and execute payloads.


Kimsuky has executed a variety of PowerShell scripts.


Koadic has used PowerShell to establish persistence.


LazyScripter has used PowerShell scripts to execute malicious code.


Leviathan has used PowerShell for execution.


LitePower can use a PowerShell script to execute commands.


Lokibot has used PowerShell commands embedded inside batch scripts.


Magic Hound has used PowerShell for execution and privilege escalation.


Meteor can use PowerShell commands to disable the network adapters on a victim machines.


MuddyWater has used PowerShell for execution.


Mustang Panda has used malicious PowerShell scripts to enable execution.


Netwalker has been written in PowerShell and executed directly in memory, avoiding detection.


Nomadic Octopus has used PowerShell for execution.


OilRig has used PowerShell scripts for execution, including use of a macro to run a PowerShell command to decode file contents.


One version of Helminth uses a PowerShell script.


POSHSPY uses PowerShell to execute various commands, one to execute its payload.


POWERSTATS uses PowerShell for obfuscation and execution.


PowGoop has the ability to use PowerShell scripts to execute commands.


PowerLess is written in and executed via PowerShell without using powershell.exe.


PowerShower is a backdoor written in PowerShell.


PowerSploit modules are written in and executed via PowerShell.


PyDCrypt has attempted to execute with PowerShell.


Pysa has used Powershell scripts to deploy its ransomware.


QakBot can use PowerShell to download and execute payloads.


REvil has used PowerShell to delete volume shadow copies and download files.


RogueRobin uses a command prompt to run a PowerShell script from Excel. To assist in establishing persistence, RogueRobin creates "%APPDATA%\OneDrive.bat" and saves the following string to it:"powershell.exe -WindowStyle Hidden -exec bypass -File “%APPDATA%\OneDrive.ps1”".


SHARPSTATS has the ability to employ a custom PowerShell script.


SMOKEDHAM can execute Powershell commands sent from its C2 server.


SQLRat has used PowerShell to create a Meterpreter session.


SeaDuke uses a module to execute Mimikatz with PowerShell to perform Pass the Ticket.


ServHelper has the ability to execute a PowerShell script to get information from the infected host.


SharpStage can execute arbitrary commands with PowerShell.


Sidewinder has used PowerShell to drop and execute malware loaders.


Socksbot can write and execute PowerShell scripts.


Stealth Falcon malware uses PowerShell commands to perform various functions, including gathering system information via WMI and executing commands from its C2 server.


StrongPity can use PowerShell to add files to the Windows Defender exclusions list.


TA459 has used PowerShell for execution of a payload.


TEMP.Veles has used a publicly-available PowerShell-based tool, WMImplant. The group has also used PowerShell to perform Timestomping.


The Clambling dropper can use PowerShell to download the malware.


The NETWIRE binary has been executed via PowerShell script.


The Poseidon Group's Information Gathering Tool (IGT) includes PowerShell components.


There is a variant of RATANKBA that uses a PowerShell script instead of the traditional PE form.


Threat Group-3390 has used PowerShell for execution.


Thrip leveraged PowerShell to run commands to download payloads, traverse the compromised networks, and carry out reconnaissance.


Tonto Team has used PowerShell to download additional payloads.


TrickBot has been known to use PowerShell to download new payloads, open documents, and upload data to command and control servers.


UNC2452 used PowerShell to create new tasks on remote machines, identify configuration settings, exfiltrate data, and to execute other commands.


WIRTE has used PowerShell for script execution.


WarzoneRAT can use PowerShell to download files and execute commands.


WellMess can execute PowerShell scripts received from C2.


WhisperGate can use PowerShell to support multiple actions including execution and defense evasion.


Wizard Spider has used macros to execute PowerShell scripts to download malware on victim's machines. It has also used PowerShell to execute commands and move laterally through a victim network.


Xbash can use scripts to invoke PowerShell to download a malicious PE executable or PE DLL for execution.


Zeus Panda uses PowerShell to download and execute the payload.


Bundlore can use AppleScript to inject malicious JavaScript into a browser.


ThiefQuest uses AppleScript's "osascript -e" command to launch ThiefQuest's persistence via Launch Agent and Launch Daemon.


macOS.OSAMiner has used `osascript` to call itself via the `do shell script` command in the Launch Agent `.plist` file.


4H RAT has the capability to create a remote shell.


ABK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.


ADVSTORESHELL can create a remote shell and run a given command.


APT18 uses cmd.exe to execute commands on the victim’s machine.


APT29 used "cmd.exe" to execute commands on remote machines.


APT37 has used the command-line interface.


APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine.


APT41 used "cmd.exe /c" to execute commands on remote machines.
APT41 used a batch file to install persistence for the Cobalt Strike BEACON loader.


Action RAT can use `cmd.exe` to execute commands on an infected host.


An APT28 loader Trojan uses a cmd.exe and batch script to run its payload. The group has also used macros to execute payloads.


Anchor has used cmd.exe to run its self deletion routine.


Aquatic Panda has attempted and failed to run Bash commands on a Windows host by passing them to "cmd /C".


AuTo Stealer can use `cmd.exe` to execute a created batch file.


BADNEWS is capable of executing commands via cmd.exe.


BISCUIT has a command to launch a command shell on the system.


BLACKCOFFEE has the capability to create a reverse shell.


BLINDINGCAN has executed commands via cmd.exe.


BONDUPDATER can read batch commands in a file sent from its C2 server and execute them with cmd.exe.


BRONZE BUTLER has used batch scripts and the command-line interface for execution.


Babuk has the ability to use the command line to control execution on compromised hosts.


BabyShark has used cmd.exe to execute commands.


BackConfig can download and run batch files to execute commands on a compromised host.


Bandook is capable of spawning a Windows command shell.


Bankshot uses the command-line interface to execute arbitrary commands.


Bazar can launch cmd.exe to perform reconnaissance commands.


BlackMould can run cmd.exe with parameters.


BoxCaon can execute arbitrary commands and utilize the "ComSpec" environment variable.


Bumblebee can use `cmd.exe` to drop and run files.


CALENDAR has a command to run cmd.exe to execute commands.


CARROTBAT has the ability to execute command line arguments on a compromised host.


Carbanak has a command to create a reverse shell.


China Chopper's server component is capable of opening a command terminal.


Clambling can use cmd.exe for command execution.


Clop can use cmd.exe to help execute commands on the system.


Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands. The group has used an exploit toolkit known as Threadkit that launches .bat files.


Cobalt Strike uses a command-line interface to interact with systems.


ComRAT has used "cmd.exe" to execute commands.


Conti can utilize command line options to allow an attacker control over how it scans and encrypts files.


Cuba has used "cmd.exe /c" and batch files for execution.


DanBot has the ability to execute arbitrary commands via `cmd.exe`.


Dark Caracal has used macros in Word documents that would download a second stage if executed.


DarkWatchman can use `cmd.exe` to execute commands.


Darkhotel has dropped an mspaint.lnk shortcut to disk which launches a shell script that downloads and executes a file.


DealersChoice makes modifications to open-source scripts from GitHub and executes them on the victim’s machine.


DnsSystem can use `cmd.exe` for execution.


Dragonfly 2.0 used various types of scripting to perform operations, including batch scripts.


Dragonfly has used various types of scripting to perform operations, including batch scripts.


Dtrack has used "cmd.exe" to add a persistent service.


During C0015, the threat actors used `cmd.exe` to execute commands and run malicious binaries.


During FunnyDream, the threat actors used `cmd.exe` to execute the wmiexec.vbs script.


During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and run command-line shells.


During Operation Honeybee, various implants used batch scripting and `cmd.exe` for execution.


During Operation Wocao, threat actors spawned a new `cmd.exe` process to execute commands.


Ember Bear had used `cmd.exe` and Windows Script Host (wscript) to execute malicious code.


Emissary has the capability to create a remote shell and execute specified commands.


Empire has modules for executing scripts.


EvilBunny has an integrated scripting engine to download and execute Lua scripts.


FIN10 has executed malicious .bat files containing PowerShell commands.


FIN6 has used "kill.bat" script to disable security tools.


FIN7 used the command prompt to launch commands on the victim’s machine.


FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities. FIN8 has also executed commands remotely via cmd.


Felismus uses command line for execution.


FlawedAmmyy has used `cmd` to execute commands on a compromised host.


Following exploitation with LOWBALL malware, admin@338 actors created a file containing a list of commands to be executed on the compromised computer.


Fox Kitten has used cmd.exe likely as a password changing mechanism.


Frankenstein has run a command script to set up persistence as a scheduled task named "WinUpdate", as well as other encoded commands from the command-line.


FunnyDream can use `cmd.exe` for execution on remote hosts.


GALLIUM used the Windows command shell to execute commands.


Gamaredon Group has used various batch scripts to establish C2 and download additional files. Gamaredon Group's backdoor malware has also been written to a batch file.


Gold Dragon uses cmd.exe to execute commands for discovery.


GoldMax can spawn a command shell, and execute native commands.


GoldenSpy can execute remote commands via the command-line interface.


Goopy has the ability to use cmd.exe to execute commands passed from an Outlook C2 channel.


Gorgon Group malware can use cmd.exe to download and execute payloads and to execute commands on the system.


GravityRAT executes commands remotely on the infected host.


H1N1 kills and disables services by using cmd.exe.


HAWKBALL has created a cmd.exe reverse shell, executed commands, and uploaded output via the command line.


HTTPBrowser is capable of spawning a reverse shell on a victim.


Helminth can provide a remote shell. One version of Helminth uses batch scripting.


HermeticWizard can use `cmd.exe` for execution on compromised hosts.


Hi-Zor has the ability to create a reverse shell.


HiddenWasp uses a script to automate tasks on the victim's machine and to assist in execution.


Hikit has the ability to create a remote shell and run given commands.


Indrik Spider has used batch scripts on victim's machines.


Ixeshe is capable of executing commands via cmd.


JHUHUGIT uses a .bat file to execute a .dll.


JPIN can use the command-line utility cacls.exe to change file permissions.


KEYMARBLE can execute shell commands using cmd.exe.


KGH_SPY has the ability to set a Registry key to run a cmd.exe command.


KOCTOPUS has used `cmd.exe` and batch files for execution.


KOMPROGO is capable of creating a reverse shell.


Kasidet can execute commands using cmd.exe.


Ke3chang has used batch scripts in its malware to install persistence mechanisms.


Kimsuky has executed Windows commands by using `cmd` and running batch scripts.


LazyScripter has used batch files to deploy open-source and multi-stage RATs.


Leviathan uses a backdoor known as BADFLICK that is is capable of generating a reverse shell, and has used multiple types of scripting for execution, including JavaScript and JavaScript Scriptlets in XML..


LightNeuron is capable of executing commands via cmd.exe.


Linfo creates a backdoor through which remote attackers can start a remote shell.


Lizar has a command to open the command-line on the infected system.


Lokibot has used "cmd /c" commands embedded within batch scripts.


LookBack executes the "cmd.exe" command.


LoudMiner used a batch script to run the Linux virtual machine as a service.


Lucifer can issue shell commands to download and execute additional payloads.


Machete has used batch files to initiate additional downloads of malicious files.


Magic Hound has used the command-line interface.


MechaFlounder has the ability to run commands on a compromised host.


MegaCortex has used ".cmd" scripts on the victim's system.


Meteor can run `set.bat`, `update.bat`, `cache.bat`, `bcd.bat`, `msrun.bat`, and similar scripts.


Micropsia creates a command-line shell using cmd.exe.


Milan can use `cmd.exe` for discovery actions on a targeted system.


MirageFox has the capability to execute commands using cmd.exe.


Mis-Type has used `cmd.exe` to run commands on a compromised host.


Misdat is capable of providing shell functionality to the attacker to execute commands.


Mivast has the capability to open a remote shell and run basic commands.


MoonWind can execute commands via an interactive command shell. MoonWind uses batch scripts for various purposes, including to restart and uninstall itself.


More_eggs has used cmd.exe for execution.


Mosquito executes cmd.exe and uses a pipe to read the results and send back the output to the C2 server.


Mustang Panda has executed HTA files via cmd.exe, and used batch scripts for collection.


NETWIRE can issue commands using cmd.exe.


NanoCore can open a remote command-line interface and execute commands. NanoCore uses JavaScript files.


Nebulae can use CMD to execute a process.


Nomadic Octopus used "cmd.exe /c" within a malicious macro.


OceanSalt can create a reverse shell on the infected endpoint using cmd.exe. OceanSalt has been executed via malicious macros.


OilRig has used macros to deliver malware such as QUADAGENT and OopsIE. OilRig has used batch scripts.


Okrum's backdoor has used cmd.exe to execute arbitrary commands as well as batch scripts to update itself to a newer version.


OopsIE uses the command prompt to execute commands on the victim's machine.


Operation Wocao has spawned a new "cmd.exe" process to execute commands.


Operators deploying Netwalker have used batch scripts to retrieve the Netwalker payload.


Orz can execute shell commands. Orz can execute commands with JavaScript.


Out1 can use native command line for execution.


OutSteel has used `cmd.exe` to scan a compromised host for specific file extensions.


PHOREAL is capable of creating reverse shell.


PLEAD has the ability to execute shell commands on the compromised host.


POWRUNER can execute commands from its C2 server.


Patchwork ran a reverse shell with Meterpreter. Patchwork used JavaScript code and .SCT files on victim machines.


PcShare can execute `cmd` commands on a compromised host.


Peppy has the ability to execute shell commands.


PlugX allows actors to spawn a reverse shell on a victim.


Proxysvc executes a binary on the system and logs the results into a temp file by using: "cmd.exe /c "<file_path> > %temp%\PM* .tmp 2>&1"".


Pteranodon can use `cmd.exe` for execution on victim systems.


PyDCrypt has used `cmd.exe` for execution.


QUADAGENT uses cmd.exe to execute scripts and commands on the victim’s machine.


QakBot can use cmd.exe to launch itself and to execute multiple C2 commands.


RATANKBA uses cmd.exe to execute commands.


RDAT has executed commands using "cmd.exe /c".


REvil can use the Windows command line to delete volume shadow copies and disable recovery.


RGDoor uses cmd.exe to execute commands on the victim’s machine.


RTM uses the command line and rundll32.exe to execute.


Ragnar Locker has used cmd.exe and batch scripts to execute commands.


RainyDay can use the Windows Command Shell for execution.


Rancor has used cmd.exe to execute commmands.


RedLeaves can receive and execute commands with cmd.exe. It can also provide a reverse shell.


Revenge RAT uses cmd.exe to execute commands and run scripts on the victim's machine.


RobbinHood uses cmd.exe on the victim's computer.


RunningRAT uses a batch file to kill a security program task and then attempts to remove itself.


Ryuk has used "cmd.exe" to create a Registry entry to establish persistence.


S-Type has provided the ability to execute shell commands on a compromised host.


SDBbot has the ability to use the command shell to execute commands on a compromised host.


SEASHARPEE can execute commands on victims.


SNUGRIDE is capable of executing commands and spawning a reverse shell.


STARWHALE has the ability to execute commands via `cmd.exe`.


SYSCON has the ability to execute commands through cmd on a compromised host.


Saint Bot has used `cmd.exe` and `.bat` scripts for execution.


Sakula calls cmd.exe to run various DLL files via rundll32 and also to perform file cleanup. Sakula also has the capability to invoke a reverse shell.


SamSam uses custom batch scripts to execute some of its components.


Sandworm Team has run the  "xp_cmdshell" command in MS-SQL.


SeaDuke is capable of executing commands.


Seasalt uses cmd.exe to create a reverse shell on the infected endpoint.


Seth-Locker can execute commands via the command line shell.


Several tools used by Suckfly have been command-line driven.


Shark has the ability to use `CMD` to execute commands.


SharpStage can execute arbitrary commands with the command line.


ShimRat can be issued a command shell function from the C2.


SideTwist can execute shell commands on a compromised host.


Small Sieve can use `cmd.exe` to execute commands on a victim's system.


StreamEx has the ability to remotely execute commands.


TA505 has executed commands using "cmd.exe".


TA551 has used "cmd.exe" to execute commands.


TAINTEDSCRIBE can enable Windows CLI access and execute files.


TDTESS provides a reverse shell on the victim.


TEXTMATE executes cmd.exe to provide a reverse shell to adversaries.


TYPEFRAME can uninstall malware components using a batch script. TYPEFRAME can execute commands using a shell.


Taidoor can copy cmd.exe into the system temp folder.


Tarrask may abuse the Windows schtasks command-line tool to create "hidden" scheduled tasks.


TeamTNT has used batch scripts to download tools and executing cryptocurrency miners.


The C# implementation of  the CharmPower command execution module can use "cmd".


The Maze encryption process has used batch scripts with various commands.


Threat Group-1314 actors spawned shells on remote systems on a victim network to execute commands.


Threat Group-3390 has used command-line interfaces for execution.


TinyTurla has been installed using a .bat file.


TrickBot has used macros in Excel documents to download and deploy the malware on the user’s machine.


Trojan.Karagany can perform reconnaissance commands on a victim machine via a cmd.exe process.


Tropic Trooper has used Windows command scripts.


Turian can create a remote shell and execute commands using cmd.


UNC2452 used "cmd.exe" to execute commands on remote machines.


UPPERCUT uses cmd.exe to execute commands on the victim’s machine.


USBferry can execute various Windows commands.


Umbreon provides access using both standard facilities like SSH and additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet


Volgmer can execute commands on the victim's machine.


WEBC2 can open an interactive command shell.


WarzoneRAT can use `cmd.exe` to execute malicious code.


WellMess can execute command line scripts received from C2.


Wiarp creates a backdoor through which remote attackers can open a command line interface.


XTunnel has been used to execute remote commands.


Zebrocy uses cmd.exe to execute commands on the system.


ZxShell can launch a reverse command shell.


ccf32 has used `cmd.exe` for archiving data and deleting files.


cmd is used to execute programs and other actions at the command-line interface.


hcdLoader provides command-line access to the compromised system.


menuPass executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands. menuPass has used malicious macros embedded inside Office documents to execute files.


njRAT can launch a command shell interface for executing commands.


xCaon has a command to start an interactive shell.


Anchor can execute payloads via shell scripting.


Bundlore has leveraged /bin/sh and /bin/bash to execute commands on the victim machine.


CallMe has the capability to create a reverse shell on victims.


Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.


CookieMiner has used a Unix shell script to run a series of commands targeting macOS.


Drovorub can execute arbitrary commands as root on a compromised system.


Exaramel for Linux has a command to execute a shell command on the system.


Fysbis has the ability to create and execute commands in a remote shell for CLI.


Kinsing has used Unix shell scripts to execute commands in the victim environment.


Kobalos can spawn a new pseudo-terminal and execute arbitrary commands at the command prompt.


LoudMiner used shell scripts to launch various services and to start/stop the QEMU virtualization.


MacMa can execute supplied shell commands and uses bash scripts to perform additional actions.


NETWIRE has the ability to use "/bin/bash" and "/bin/sh" to execute commands.


OSX/Shlayer can use bash scripts to check the macOS version, download payloads, and extract bytes from files. OSX/Shlayer uses the command "sh -c tail -c +1381..." to extract bytes at an offset from a specified file. OSX/Shlayer uses the "curl -fsL "$url" >$tmp_path" command to download malicious payloads into a temporary directory.


Penquin can execute remote commands using bash scripts.


Proton uses macOS' .command file type to script actions.


Rocke used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware.


Skidmap has used "pm.sh" to download and install its main payload.


TeamTNT has used shell scripts for execution.


XCSSET uses a shell script to execute Mach-o files and "osacompile" commands such as, "osacompile -x -o xcode.app main.applescript".


APT29 has written malware variants in Visual Basic.


APT33 has used VBScript to initiate the delivery of payloads.


APT37 executes shellcode and a VBA script to decode Base64 strings.


APT38 has used VBScript to execute commands and other operational tasks.


APT39 has utilized malicious VBS scripts in malware.


Astaroth has used malicious VBS e-mail attachments for execution.


BRONZE BUTLER has used VBS and VBE scripts for execution.


BackConfig has used VBS to install its downloader component and malicious documents with VBA macro code.


Bisonal's dropper creates VBS scripts on the victim’s machine.


Bumblebee can create a Visual Basic script to enable persistence.


Chaes has used VBscript to execute malicious code.


Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution.


Cobalt Strike can use VBA to perform execution.


Confucius has used VBScript to execute malicious code.


DanBot can use a VBA macro embedded in an Excel file to drop the payload.


Donut can generate shellcode outputs that execute via VBScript.


During C0015, the threat actors used a malicious HTA file that contained a mix of HTML and JavaScript/VBScript code.


During Frankenstein, the threat actors used Word documents that prompted the victim to enable macros and run a Visual Basic script.


During Operation CuckooBees, the threat actors executed an encoded VBScript file using `wscript` and wrote the decoded output to a text file.


During Operation Dust Storm, the threat actors used Visual Basic scripts.


During Operation Sharpshooter, the threat actors used a VBA macro to execute a simple downloader that installed Rising Sun.


Emotet has sent Microsoft Word documents with embedded macros that will invoke scripts to download additional payloads.


FIN4 has used VBA macros to display a dialog box and collect victim credentials.


Ferocious has the ability to use Visual Basic scripts for execution.


Flagpro can execute malicious VBA macros embedded in .xlsm files.


For Operation Honeybee, the threat actors used a Visual Basic script embedded within a Word document to download an implant.


Gamaredon Group has embedded malicious macros in document templates, which executed VBScript. Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros.


Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.


Grandoreiro can use VBScript to execute malicious code.


Honeybee embeds a Visual Basic script within a malicious Word document as part of initial access; the script is executed when the Word document is opened.


IcedID has used obfuscated VBA string expressions.


Inception has used VBScript to execute malicious commands and payloads.


JSS Loader can download and execute VBScript files.


Javali has used embedded VBScript to download malicious payloads from C2.


KOCTOPUS has used VBScript to call wscript to execute a PowerShell command.


Kimsuky has used Visual Basic to download malicious payloads. Kimsuky has also used malicious VBA macros within maldocs disguised as forms that trigger when a victim types any content into the lure.


Koadic performs most of its operations using Windows Script Host (VBScript) and runs arbitrary shellcode .


Lazarus Group has used VBA and embedded macros in Word documents to execute malicious code.


Lazarus Group has used VBScript to gather information about a victim machine.


Lokibot has used VBS scripts and XLS macros for execution.


LookBack has used VBA macros in Microsoft Word attachments to drop additional files to the host.


Machete has embedded malicious macros within spearphishing attachments to download additional files.


Magic Hound malware has used VBS scripts for execution.


Melcoz can use VBS scripts to execute malicious DLLs.


Metamorfo has used VBS code on victims’ systems.


MuddyWater has used VBScript files to execute its POWERSTATS payload, as well as macros.


NETWIRE has been executed through use of VBScripts.


NanHaiShu executes additional VBScript code on the victim's machine.


OSX_OCEANLOTUS.D uses Word macros for execution.


OilRig has used VBSscipt macros for execution on compromised hosts.


One version of Helminth consists of VBScript scripts.


OopsIE creates and uses a VBScript as part of its persistent execution.


Operation Wocao has used a VBScript to conduct reconnaissance on targeted systems.


POWERSTATS can use VBScript (VBE) code for execution.


Patchwork used Visual Basic Scripts (VBS) on victim machines.


Pteranodon can use a malicious VBS file for execution.


REvil has used obfuscated VBA macros for execution.


Ramsay has included embedded Visual Basic scripts in malicious documents.


Rancor has used VBS scripts as well as embedded macros for execution.


Remexi uses AutoIt and VBS scripts throughout its execution process.


SUNBURST used VBScripts to initiate the execution of payloads.


Saint Bot has used `.vbs` scripts for execution.


Sidewinder has used VBScript to drop and execute malware loaders.


Smoke Loader adds a Visual Basic script in the Startup folder to deploy the payload.


StoneDrill has several VBS scripts used throughout the malware's lifecycle.


TYPEFRAME has used a malicious Word document for delivery with VBA macros for execution.


Transparent Tribe has crafted VBS-based malicious documents.


Turla has used VBS scripts throughout its operations.


Ursnif droppers have used VBA macros to download and execute the malware's full executable payload.


WIRTE has used VBScript  in its operations.


WhisperGate can use a Visual Basic script to exclude the `C:\` drive from Windows Defender.


Windshift has used Visual Basic 6 (VB6) payloads.


jRAT has been distributed as HTA files with VBScript.


APT29 has developed malware variants written in Python.


APT37 has used Python scripts to execute payloads.


APT39 has used a command line utility and a network scanner written in python.


BRONZE BUTLER has made use of Python-based remote access tools.


Bundlore has used Python scripts to execute payloads.


Cobalt Strike can use Python to perform execution.


CoinTicker executes a Python script to download its second stage.


CookieMiner has used python scripts on the user’s system, as well as the Python variant of the Empire agent, EmPyre.


Dragonfly 2.0 used various types of scripting to perform operations, including Python scripts. The group was observed installing Python 2.7 on a victim.


Dragonfly has used various types of scripting to perform operations, including Python scripts. The group was observed installing Python 2.7 on a victim.


DropBook is a Python-based backdoor compiled with PyInstaller.


During Operation Wocao, threat actors' backdoors were written in Python and compiled with py2exe.


IronNetInjector can use IronPython scripts to load payloads with the help of a .NET injector.


KeyBoy uses Python scripts for installing files and performing execution.


Keydnap uses Python for scripting to execute additional commands.


Machete used multiple compiled Python scripts on the victim’s system. Machete's main backdoor Machete is also written in Python.


MechaFlounder uses a python-based payload.


MuddyWater has used developed tools in Python including Out1.


Operation Wocao's backdoors have been written in Python and compiled with py2exe.


Pupy can use an add on feature when creating payloads that allows you to create custom Python scripts (“scriptlets”) to perform tasks offline (without requiring a session) such as sandbox detection, adding persistence, etc.


PyDCrypt, along with its functions, is written in Python.


Pysa has used Python scripts to deploy ransomware.


Rocke has used Python-based malware to install and spread their coinminer.


Small Sieve can use Python scripts to execute commands.


TRITON was run as trilog.exe, a Py2EXE compiled python script that accepts a single IP address as a flag.


Turian has the ability to use Python to spawn a Unix shell.


Turla has used IronPython scripts as part of the IronNetInjector toolchain to drop payloads.


ZIRCONIUM has used Python-based implants to interact with compromised hosts.


APT32 has used JavaScript for drive-by downloads and C2 communications.


AppleSeed has the ability to use JavaScript to execute PowerShell.


Astaroth uses JavaScript to perform its core functionalities.


Bundlore can execute JavaScript by injecting it into the victim's browser.


Chaes has used JavaScript and Node.Js information stealer script that exfiltrates data using the node process.


Cobalt Group has executed JavaScript scriptlets on the victim's machine.


During C0015, the threat actors used a malicious HTA file that contained a mix of encoded HTML and JavaScript/VBScript code.


During Operation Dust Storm, the threat actors used JavaScript code.


Earth Lusca has manipulated legitimate websites to inject malicious JavaScript code as part of their watering hole operations.


Ember Bear has used JavaScript to execute malicious code on a victim's machine.


EnvyScout can write files to disk with JavaScript using a modified version of the open-source tool FileSaver.


Evilnum has used malicious JavaScript files on the victim's machine.


FIN6 has used malicious JavaScript to steal payment card data from e-commerce sites.


Indrik Spider has used malicious JavaScript files for several components of their attack.


JSS Loader can download and execute JavaScript files.


KONNI has executed malicious JavaScript code.


LazyScripter has used JavaScript in its attacks.


Leafminer infected victims using JavaScript code.


Metamorfo includes payloads written in JavaScript.


Molerats used various implants, including those built with JS, on target machines.


MuddyWater has used JavaScript files to execute its POWERSTATS payload.


NanHaiShu executes additional Jscript code on the victim's machine.


POWERSTATS can use JavaScript code for execution.


Sidewinder has used JavaScript to drop and execute malware loaders.


SpicyOmelette has the ability to execute arbitrary JavaScript code on a compromised host.


The Cobalt Strike System Profiler can use JavaScript to perform reconnaissance actions.


The QakBot web inject module can inject Java Script into web banking pages visited by the victim.


Turla has used various JavaScript-based backdoors.


Valak can execute JavaScript containing configuration data for establishing persistence.


Xbash can execute malicious JavaScript payloads on the victim’s machine.


jRAT has been distributed as HTA files with JScript.


APT28 has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263 to escalate privileges.


APT29 has exploited CVE-2021-36934 to escalate privileges on a compromised host.


APT32 has used CVE-2016-7255 to escalate privileges.


Carberp has exploited multiple Windows vulnerabilities (CVE-2010-2743, CVE-2010-3338, CVE-2010-4398, CVE-2008-1084) and a .NET Runtime Optimization vulnerability for privilege escalation.


Empire can exploit vulnerabilities such as MS16-032 and MS16-135.


Hildegard has used the BOtB tool which exploits CVE-2019-5736.


InvisiMole has exploited CVE-2007-5633 vulnerability in the speedfan.sys driver to obtain kernel mode privileges.


JHUHUGIT has exploited CVE-2015-1701 and CVE-2015-2387 to escalate privileges.


LAPSUS$ has exploited unpatched vulnerabilities on internally accessible servers including JIRA, GitLab, and Confluence for privilege escalation.


PLATINUM has leveraged a zero-day vulnerability to escalate privileges.


Pandora can use CVE-2017-15303 to bypass Windows Driver Signature Enforcement (DSE) protection and load its driver.


PoshC2 contains modules for local privilege escalation exploits such as CVE-2016-9192 and CVE-2016-0099.


Siloscape has leveraged a vulnerability in Windows containers to perform an Escape to Host.


Tonto Team has exploited CVE-2019-0803 and MS16-032 to escalate privileges.


Whitefly has used an open-source tool to exploit a known Windows privilege escalation vulnerability (CVE-2016-0051) on unpatched computers.


Wingbird exploits CVE-2016-4117 to allow an executable to gain escalated privileges.


ZIRCONIUM has exploited CVE-2017-0005 for local privilege escalation.


Zox has the ability to leverage local and remote exploits to escalate privileges.


APT29 used the "Get-ManagementRoleAssignment" PowerShell cmdlet to enumerate Exchange management role assignments through an Exchange Management Shell.


APT3 has a tool that can enumerate the permissions associated with Windows groups.


IcedID has the ability to identify Workgroup membership.


MURKYTOP has the capability to retrieve information about groups.


PUNCHBUGGY can gather domain and workgroup information.


TA505 has used TinyMet to enumerate members of privileged groups. TA505 has also run "net group /domain".


UNC2452 used the "Get-ManagementRoleAssignment" PowerShell cmdlet to enumerate Exchange management role assignments through an Exchange Management Shell.


Chimera has used "net localgroup administrators" to identify  accounts with local administrative rights.


Cobalt Strike can use "net localgroup" to list local groups on a system.


Commands such as "net group" and "net localgroup" can be used in Net to gather information about and manipulate groups.


During C0015, the threat actors used the command `net localgroup "adminstrator" ` to identify accounts with local administrator rights.


During Operation CuckooBees, the threat actors used the `net group` command as part of their advanced reconnaissance.


During Operation Wocao, threat actors used the command `net localgroup administrators` to list all administrators part of a local group.


Emissary has the capability to execute the command "net localgroup administrators".


Epic gathers information on local group names.


Flagpro has been used to execute the "net localgroup administrators" command on a targeted system.


Helminth has checked the local administrators group.


JPIN can obtain the permissions of the victim user.


Kazuar gathers information about local groups and members.


Kwampirs collects a list of users belonging to the local users and administrators groups with the commands "net localgroup administrators" and "net localgroup users".


OSInfo has enumerated the local administrators group.


OilRig has used "net localgroup administrators" to find local administrators on compromised systems.


POWRUNER may collect local group information by running "net localgroup administrators" or a series of other commands on a victim.


PoshC2 contains modules, such as "Get-LocAdm" for enumerating permission groups.


QakBot can use "net localgroup" to enable discovery of local groups.


Tonto Team has used the "ShowLocalGroupDetails" command to identify administrator, user, and guest accounts on a compromised host.


Turla has used "net localgroup" and "net localgroup Administrators" to enumerate group information, including members of the local administrators group.


admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: "net localgroup administrator >> %temp%\download"


APT29 has used AdFind to enumerate domain groups.


BloodHound can collect information about domain groups and members.


Cobalt Strike can identify targets by querying account groups on a domain contoller.


Commands such as "net group /domain" can be used in Net to gather information about and manipulate groups.


CrackMapExec can gather the user accounts within domain groups.


Dragonfly 2.0 used batch scripts to enumerate administrators and users in the domain.


During C0015, the threat actors use the command `net group "domain admins" /dom` to enumerate domain groups.


Helminth has checked for the domain admin group and Exchange Trusted Subsystem groups using the commands "net group Exchange Trusted Subsystem /domain" and "net group domain admins /domain".


Inception has used specific malware modules to gather domain membership.


Ke3chang performs discovery of permission groups "net group /domain".


Kwampirs collects a list of domain groups with the command "net localgroup /domain".


LAPSUS$ has used the AD Explorer tool to enumerate groups on a victim's network.


OSInfo specifically looks for Domain Admins and power users within the domain.


REvil can identify the domain membership of a compromised host.


SoreFang can enumerate domain groups by executing "net.exe group /domain".


Turla has used "net group "Domain Admins" /domain" to identify domain administrators.


WellMess can identify domain group membership for the current user.


Wizard Spider has used "AdFind.exe" to collect information about Active Directory groups and accounts.


dsquery can be used to gather information on permission groups within a domain.


AADInternals can enumerate Azure AD groups.


ROADTools can enumerate Azure AD groups.


APT29 temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.


APT29 used SDelete to remove artifacts from victims.


Bankshot deletes all artifacts associated with the malware from the infected machine.


Bazar's loader can delete scheduled tasks created by a previous instance of the malware.


BlackEnergy has removed the watermark associated with enabling the "TESTSIGNING" boot configuration option by removing the relevant strings in the "user32.dll.mui" of the system.


Donut can erase file references to payloads in-memory after being reflectively loaded and executed.


Dragonfly deleted system, security, terminal services, remote services, and audit logs from a victim.


EVILNUM has a function called "DeleteLeftovers" to remove certain artifacts of the attack.


Flagpro can close specific Windows Security and Internet Explorer dialog boxes to mask external connections.


Goopy has the ability to delete emails used for C2 once the content has been copied.


GrimAgent can delete previously created tasks on a compromised host.


HermeticWiper can disable pop-up information about folders and desktop items and delete Registry keys to hide malicious services.


KOCTOPUS can delete created registry keys as part of its cleanup procedure.


Lazarus Group has restored malicious KernelCallbackTable code to its original state after the process execution flow has been hijacked.


Maze has used the “Wow64RevertWow64FsRedirection” function following attempts to delete the shadow volumes, in order to leave the system in the same state as it was prior to redirection.


Metamorfo has a command to delete a Registry key it uses, "\Software\Microsoft\Internet Explorer\notes".


Misdat is capable of deleting Registry keys used for persistence.


Neoichor can clear the browser history on a compromised host by changing the `ClearBrowsingHistoryOnExit` value to 1 in the `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy` Registry key.


Orz can overwrite Registry settings to reduce its visibility on the victim.


Pillowmint can uninstall the malicious service from an infected machine.


RTM has the ability to remove Registry entries that it created during execution.


Rising Sun can clear a memory blog in the process by overwriting it with junk bytes.


S-Type has deleted accounts it has created.


SDBbot has the ability to clean up and remove data structures from a compromised host.


SILENTTRINITY can remove artifacts from the compromised host, including created Registry keys.


ShadowPad has deleted arbitrary Registry values.


Sibot will delete an associated registry key if a certain server response is received.


UNC2452 removed evidence of email export requests using "Remove-MailboxExportRequest". They temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.


njRAT is capable of manipulating and deleting registry keys.


APT28 has cleared event logs, including by using the commands "wevtutil cl System" and "wevtutil cl Security".


APT32 has cleared select event log entries.


APT38 clears Window Event logs and Sysmon logs from the system.


APT41 attempted to remove evidence of some of its activity by clearing Windows security and system events.


Dragonfly 2.0 cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.


Dragonfly has cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.


During Operation Wocao, the threat actors deleted all Windows system and security event logs using `/Q /c wevtutil cl system` and `/Q /c wevtutil cl security`.


FIN5 has cleared event logs from victims.


FIN8 has cleared logs during post compromise cleanup activities.


FinFisher clears the system event logs using " OpenEventLog/ClearEventLog APIs ".


HermeticWizard has the ability to use `wevtutil cl system` to clear event logs.


Hydraq creates a backdoor through which remote attackers can clear all system event logs.


Indrik Spider has used Cobalt Strike to empty log files.


KillDisk deletes Application, Security, Setup, and System Windows Event Logs.


Lucifer can clear and remove event logs.


Meteor can use Wevtutil to remove Security, System and Application Event Viewer logs.


NotPetya uses "wevtutil" to clear the Windows event logs.


Olympic Destroyer will attempt to clear the System and Security event logs using "wevtutil".


Operation Wocao has deleted Windows Event Logs to hinder forensic investigation.


Pupy has a module to clear event logs with PowerShell.


RunningRAT contains code to clear event logs.


The BlackEnergy component KillDisk is capable of deleting Windows Event Logs.


ZxShell has a command to clear system event logs.


MacMa can clear possible malware traces such as application logs.


Proton removes logs from "/var/logs" and "/Library/logs".


TeamTNT has removed system logs from "/var/log/syslog".


APT41 attempted to remove evidence of some of its activity by deleting Bash histories.


Hildegard has used history -c to clear script shell logs.


Kobalos can remove all command history on compromised hosts.


Lazarus Group has routinely deleted log files on a compromised router, including automatic log deletion through the use of the logrotate utility.


Magic Hound has removed mailbox export requests from compromised Exchange servers.


TeamTNT has cleared command history with "history -c".


A menuPass macro deletes files after it has decoded and decompressed them.


ADVSTORESHELL can delete files and directories.


APT18 actors deleted tools and batch files from victim systems.


APT28 has intentionally deleted computer files to cover their tracks, including with use of the program CCleaner.


APT29 routinely removed their tools, including custom backdoors, once remote access was achieved. APT29 has also used SDelete to remove artifacts from victims.


APT32's macOS backdoor can receive a “delete” command.


APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system. They have also removed malware, tools, or other non-native files used during the intrusion to reduce their footprint or as part of the post-intrusion cleanup process.


APT39 has used malware to delete files after they are deployed on a compromised host.


After encrypting its own log files, the log encryption module in Prikormka deletes the original, unencrypted files from the host.


Anchor can self delete its dropper after the malware is successfully deployed.


AppleJeus has deleted the MSI file after installation.


Aquatic Panda has deleted malicious executables from compromised machines.


Aria-body has the ability to delete files and directories on compromised hosts.


AuditCred can delete files from the system.


Azorult can delete files from victim machines.


BBSRAT can delete files and directories.


BLINDINGCAN has deleted itself and associated artifacts from victim machines.


BabyShark has cleaned up all files associated with the secondary payload execution.


Backdoor.Oldrea contains a cleanup module that removes traces of itself from the victim.


Bankshot marks files to be deleted upon the next system reboot and uninstalls and removes itself from the system.


Bumblebee can uninstall its loader through the use of a `Sdl` command.


CARROTBAT has the ability to delete downloaded files from a compromised host.


CSPY Downloader has the ability to self delete.


Calisto has the capability to use "rm -rf" to remove folders and files from the victim's machine.


Cardinal RAT can uninstall itself, including deleting its executable.


CharmPower can delete created files from a compromised system.


Chimera has performed file deletion to evade detection.


Crimson has the ability to delete files from a compromised host.


Cuba can use the command "cmd.exe /c del" to delete its artifacts from the system.


DanBot can delete its configuration file after installation.


DarkWatchman has been observed deleting its original launcher after installation.


Dragonfly 2.0 deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots.


Dragonfly has deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots.


Drovorub can delete specific files from a compromised host.


Dtrack can remove its persistence and delete itself.


During Operation Honeybee, the threat actors used batch files that reduced their fingerprint on a compromised system by deleting malware-related files.


During Operation Wocao, the threat actors consistently removed traces of their activity by first overwriting a file using `/c cd /d c:\windows\temp\ & copy \\<IP ADDRESS>\c$\windows\system32\devmgr.dll \\<IP ADDRESS>\c$\windows\temp\LMAKSW.ps1 /y` and then deleting the overwritten file using `/c cd /d c:\windows\temp\ & del \\<IP ADDRESS>\c$\windows\temp\LMAKSW.ps1`.


DustySky can delete files it creates from the infected system.


ECCENTRICBANDWAGON can delete log files generated from the malware stored at "C:\windows\temp\tmp0207".


EvilBunny has deleted the initial dropper after running through the environment checks.


Evilnum has deleted files used during infection.


Exaramel for Linux can uninstall its persistence mechanism and delete its configuration file.


FELIXROOT deletes the .LNK file from the startup directory as well as the dropper components.


FIN10 has used batch scripts and scheduled tasks to delete critical system files.


FIN5 uses SDelete to clean up the environment and attempt to prevent detection.


FIN6 has removed files from victim machines.


FIN8 has deleted tmp and prefetch files during post compromise cleanup activities.


Ferocious can delete files from a compromised host.


FlawedAmmyy can execute batch scripts to delete files.


FruitFly will delete files on the system.


Gamaredon Group tools can delete files used during an operation.


Gazer has commands to delete files and persistence mechanisms from the victim.


Gelsemium can delete its dropper component from the targeted system.


Gold Dragon deletes one of its files, 2.hwp, from the endpoint after establishing persistence.


Green Lambert can delete the original executable after initial installation in addition to unused functions.


GreyEnergy can securely delete a file by hooking into the DeleteFileA and DeleteFileW functions in the Windows API.


GrimAgent can delete old binaries on a compromised host.


HAWKBALL has the ability to delete files.


Hancitor has deleted files using the VBA "kill" function.


HermeticWiper has the ability to overwrite its own file with random bites.


Hi-Zor deletes its RAT installer file as it executes its DLL payload file.


Hildegard has deleted scripts after execution.


HotCroissant has the ability to clean up installed files, delete files, and delete itself from the victim’s machine.


Hydraq creates a backdoor through which remote attackers can delete files.


HyperBro has the ability to delete a specified file.


IceApple can delete files and directories from targeted systems.


Imminent Monitor has deleted files related to its dynamic debugger feature.


InnaputRAT has a command to delete files.


InvisiMole has deleted files and directories including XML and files successfully uploaded to C2 servers.


Ixeshe has a command to delete a file from the machine.


JPIN's installer/uninstaller component deletes itself if it encounters a version of Windows earlier than Windows XP or identifies security-related processes running.


Kevin can delete files created on the victim's machine.


KillDisk has the ability to quit and delete itself.


Kimsuky has deleted the exfiltrated data on disk after transmission. Kimsuky has also used an instrumentor script to terminate browser processes running on an infected system and then delete the cookie files on disk.


LightNeuron has a function to delete files.


Linfo creates a backdoor through which remote attackers can delete files.


LiteDuke can securely delete files by first writing random data to the file.


LockerGoga has been observed deleting its original launcher after execution.


LookBack removes itself after execution and can delete files on the system.


MURKYTOP has the capability to delete local files.


MacMa can delete itself from the compromised computer.


MacSpy deletes any temporary files it creates


Metamorfo has deleted itself from the system after execution.


Meteor will delete the folder containing malicious scripts if it detects the hostname as `PIS-APP`, `PIS-MOB`, `WSUSPROXY`, or `PIS-DB`.


Milan can delete files via `C:\Windows\system32\cmd.exe /c ping 1.1.1.1 -n 1 -w 3000 > Nul & rmdir /s /q`.


Misdat is capable of deleting the backdoor file.


MoonWind can delete itself or specified files.


Mosquito deletes files using DeleteFileW API call.


Mustang Panda will delete their tools and files, and kill processes after their objectives are reached.


Nebulae has the ability to delete files and directories.


OSX_OCEANLOTUS.D has a command to delete a file from the system. OSX_OCEANLOTUS.D deletes the app bundle and dropper after execution.


OceanSalt can delete files from the system.


OilRig has deleted files associated with their payload after execution.


Okrum's backdoor deletes files after they have been successfully uploaded to C2 servers.


Once a file is uploaded, Machete will delete it from the machine.


OutSteel can delete itself following the successful execution of a follow-on payload.


P.A.S. Webshell can delete scripts from a subdirectory of /tmp after they are run.


PLEAD has the ability to delete files on the compromised host.


PUNCHBUGGY can delete files written to disk.


Pasam creates a backdoor through which remote attackers can delete files.


Pay2Key can remove its log file from disk.


PcShare has deleted its files and components from a compromised host.


Penquin can delete downloaded executables after running them.


PoetRAT has the ability to overwrite scripts and delete itself if a sandbox environment is detected.


Pony has used scripts to delete itself after execution.


ProLock can remove files containing its payload after they are executed.


Pteranodon can delete files that may interfere with it executing. It also can delete temporary files and itself after the initial script executes.


PyDCrypt will remove all created artifacts such as dropped executables.


Pysa has deleted batch files after execution.


QUADAGENT has a command to delete its Registry key and scheduled task.


QakBot can delete folders and files including overwriting its executable with legitimate programs.


RCSession can remove files from a targeted system.


RDAT can issue SOAP requests to delete already processed C2 emails. RDAT can also delete itself from the infected system.


RDFSNIFFER has the capability of deleting local files.


REvil can mark its binary code for deletion after reboot.


RTM can delete all files created during its execution.


RainyDay has the ability to uninstall itself by deleting its service and files.


Reaver deletes the original dropped file from the victim.


Recent versions of Cherry Picker delete files and registry keys created by the malware.


Rising Sun can delete files and artifacts it creates.


Rocke has deleted files on infected machines.


RunningRAT contains code to delete files from the victim’s machine.


S-Type has deleted files it has created on a compromised host.


SDBbot has the ability to delete files from a compromised host.


SILENTTRINITY can remove files from the compromised host.


SLOTHFULMEDIA has deleted itself and the 'index.dat' file on a compromised machine to remove recent Internet history from the system.


SQLRat has used been observed deleting scripts once used.


Saint Bot can run a batch script named `del.bat` to remove any Saint Bot payload-linked files from a compromise system if anti-analysis or locale checks fail.


SamSam has been seen deleting its own files and payloads to make analysis of the attack more difficult.


Sandworm Team has used backdoors that can delete files used in an attack from an infected system.


SeaDuke can securely delete files, including deleting itself from the victim.


Seasalt has a command to delete a specified file.


ServHelper has a module to delete itself from the infected machine.


Shark can delete files downloaded to the compromised host.


ShimRat can uninstall itself from compromised hosts, as well create and modify directories, delete, move, copy, and rename files.


Silence has deleted artifacts, including scheduled tasks, communicates files from the C2 and other logs.


SombRAT has the ability to run "cancel" or "closeanddeletestorage" to remove all files from storage and delete the storage temp file on a compromised host.


Some Sakula samples use cmd.exe to delete temporary files.


SpeakUp deletes files to remove evidence on the machine.


StoneDrill has been observed deleting the temporary files once they fulfill their task.


StrifeWater can self delete to cover its tracks.


Stuxnet uses an RPC server that contains a routine for file deletion and also removes itself from the system through a DLL export by deleting specific files.


SysUpdate can delete its configuration file from the targeted system.


TAINTEDSCRIBE can delete files from a compromised host.


TDTESS creates then deletes log files during installation of itself as a service.


TEMP.Veles routinely deleted tools, logs, and other files after they were finished with them.


Taidoor can use "DeleteFileA" to remove files from infected hosts.


TeamTNT has used a payload that removes itself after running. TeamTNT also has deleted locally staged files for collecting credentials or scan results for local IP addresses after exfiltrating them.


The BRONZE BUTLER uploader or malware the uploader uses "command" to delete the RAR archives after they have been exfiltrated.


The JHUHUGIT dropper can delete itself from the victim. Another JHUHUGIT variant has the capability to delete specified files.


The Komplex trojan supports file deletion.


Threat Group-3390 has deleted existing logs and exfiltrated file archives from a victim.


Trojan.Karagany has used plugins with a self-delete capability.


Tropic Trooper has deleted dropper files on an infected system using command scripts.


UNC2452 routinely removed their tools, including custom backdoors, once remote access was achieved.


Ursnif has deleted data staged in tmp files after exfiltration.


VBShower has attempted to complicate forensic analysis by deleting all the files contained in "%APPDATA%\..\Local\Temporary Internet Files\Content.Word" and "%APPDATA%\..\Local Settings\Temporary Internet Files\Content.Word\".


VERMIN can delete files on the victim’s machine.


Volgmer can delete files and itself after infection to avoid analysis.


Wingbird deletes its payload along with the payload's parent process after it finishes copying files.


Winnti for Windows can delete the DLLs for its various components from a compromised host.


Wizard Spider has used file deletion to remove some modules and configurations from an infected host after use.


XAgentOSX contains the deletFileFromPath function to delete a specified file using the NSFileManager:removeFileAtPath method.


Zebrocy has a command to delete files and directories.


Zeus Panda has a command to delete a file. It also can uninstall scripts and delete files to cover its track.


ZxShell can delete files from the system.


ccf32 can delete files and folders from compromised machines.


cmd can be used to delete files from the file system.


gh0st RAT has the capability to to delete files.


pngdowner deletes content from C2 communications that was saved to the user's temporary directory.


zwShell has deleted itself after creating a service as well as deleted a temporary file when the system reboots.


InvisiMole can disconnect previously connected remote drives.


RobbinHood disconnects all network shares from the computer with the command "net use * /DELETE /Y".


The "net use \\system\share /delete" command can be used in Net to remove an established connection to a network share.


Threat Group-3390 has detached network shares after exfiltrating files, likely to evade detection.


3PARA RAT has a command to set certain attributes such as creation/modification timestamps on files.


APT29 modified timestamps of backdoors to match legitimate Windows files.


APT32 has used scheduled task raw XML with a backdated timestamp of June 2, 2016. The group has also set the creation time of the files dropped by the second stage of the exploit to match the creation time of kernel32.dll. Additionally, APT32 has used a random value to modify the timestamp of the file storing the clientID.


APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.


After creating a new service for persistence, TDTESS sets the file creation time for the service to the creation time of the victim's legitimate svchost.exe file.


Attor has manipulated the time of last access to files and registry keys after they have been created or modified.


BLINDINGCAN has modified file and directory timestamps.


Bankshot modifies the time of a file as specified by the control server.


BitPaymer can modify the timestamp of an executable so that it can be identified and restored by the decryption tool.


China Chopper's server component can change the timestamp of files.


Cobalt Strike can timestomp any files or payloads placed on a target machine to help them blend in.


Cobalt Strike will timestomp any files or payloads placed on a target machine to help them blend in.


Cyclops Blink has the ability to use the Linux API function `utime` to change the timestamps of modified firmware update images.


EVILNUM has changed the creation date of files.


Elise performs timestomping of a CAB file it creates.


Empire can timestomp any files or payloads placed on a target machine to help them blend in.


FALLCHILL can modify file or directory timestamps.


For early Gazer versions, the compilation timestamp was faked.


Gelsemium has the ability to perform timestomping of files on targeted systems.


InvisiMole samples were timestomped by the authors by setting the PE timestamps to all zero values. InvisiMole also has a built-in command to modify file times.


Kimsuky has manipulated timestamps for creation or compilation dates to defeat anti-forensics.


Kobalos can modify timestamps of replaced files, such as "ssh" with the added credential stealer or "sshd" used to deploy Kobalos.


MacMa has the capability to create and modify file timestamps.


Many Misdat samples were programmed using Borland Delphi, which will mangle the default PE compile timestamp of a file.


OSX_OCEANLOTUS.D can use the "touch -t" command to change timestamps.


OwaAuth has a command to timestop a file or directory.


POSHSPY modifies timestamps of all downloaded executables to match a randomly selected file created prior to 2013.


PowerStallion modifies the MAC times of its local log files to match that of the victim's desktop.ini file.


Psylo has a command to conduct timestomping by setting a specified file’s timestamps to match those of a system file in the System32 directory.


Rocke has changed the time stamp of certain files.


SEASHARPEE can timestomp files on victims using a Web shell.


Several Lazarus Group malware families use timestomping, including modifying the last write timestamp of a specified Registry key to a random date, as well as copying the timestamp for legitimate .exe files (such as calc.exe or mspaint.exe) to its dropped files.


Stuxnet extracts and writes driver files that match the times of other legitimate files.


TAINTEDSCRIBE can change the timestamp of specified filenames.


TEMP.Veles used timestomping to modify the $STANDARD_INFORMATION attribute on tools.


The Derusbi malware supports timestomping.


UNC2452 modified timestamps of backdoors to match legitimate Windows files.


Winnti for Windows can set the timestamps for its worker and service components to match that of cmd.exe.


APT29 removed evidence of email export requests using "Remove-MailboxExportRequest".


MCMD has the ability to remove set Registry Keys, including those used for persistence.


RTM has the ability to remove Registry entries that it created for persistence.


SUNBURST removed IFEO registry values to clean up traces of persistence.


njRAT is capable of manipulating and deleting registry keys, including those used for persistence.


APT34 malware often uses HTTP and DNS for C2. The group has also used the Plink utility and other tools to create tunnels to C2 servers.


Adversaries can also use NETEAGLE to establish an RDP connection with a controller over TCP/7519.


Cobalt Strike conducts peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.


Duqu uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.


Exaramel uses HTTPS for C2 communications.


Lucifer can use the Stratum protocol on port 10001 for communication between the cryptojacking bot and the mining server.


Magic Hound malware has used IRC for C2.


Siloscape connects to an IRC server for C2.


The Regin malware platform supports many standard protocols, including SMB.


4H RAT uses HTTP for command and control.


A SUGARDUMP variant has used HTTP for C2.


ABK has the ability to use HTTP in communications with C2.


ADVSTORESHELL connects to port 80 of a C2 server using Wininet API. Data is exchanged via HTTP POSTs.


APT12 has used RIPTIDE, a RAT that uses HTTP to communicate.


APT19 used HTTP for C2 communications. APT19 also used an HTTP malware variant to communicate over HTTP for C2.