PoetRAT has used a custom encryption scheme for communication between scripts and pyminifier to obfuscate scripts.


PoisonIvy hides any strings related to its own indicators of compromise.


PolyglotDuke can custom encrypt strings.


Pony attachments have been delivered via compressed archive files. Pony also obfuscates the memory flow by adding junk instructions when executing to make analysis more difficult.


PowerDuke uses steganography to hide backdoors in PNG files, which are also encrypted using the Tiny Encryption Algorithm (TEA).


PowerPunch can use Base64-encoded scripts.


PowerSploit contains a collection of ScriptModification modules that compress and encode scripts and payloads.


PowerStallion uses a XOR cipher to encrypt command output written to its OneDrive C2 server.


QUADAGENT was likely obfuscated using Invoke-Obfuscation.


QakBot can use obfuscated and encoded scripts; it has also hidden code within Excel spreadsheets by turning the font color to white and splitting it across multiple cells.


REvil has used encrypted strings and configuration files.


ROKRAT can encrypt data prior to exfiltration by using an RSA public key.


RTM strings, network data, configuration, and modules are encrypted with a modified RC4 algorithm. RTM has also been delivered to targets as various archive files including ZIP, 7-ZIP, and RAR.


Ramsay has base64-encoded its portable executable and hidden itself under a JPG header. Ramsay can also embed information within document footers.


Reaver encrypts some of its files with XOR.


RegDuke can use control-flow flattening or the commercially available .NET Reactor for obfuscation.


Remcos uses RC4 and base64 to obfuscate data, including Registry entries and file paths.


Rifdoor has encrypted strings with a single byte XOR algorithm.


Rocke has modified UPX headers after packing files to break unpackers.


SHARPSTATS has used base64 encoding and XOR to obfuscate PowerShell scripts.


SHOTPUT is obscured using XOR encoding and appended to a valid GIF file.


SQLRat has used a character insertion obfuscation technique, making the script appear to contain Chinese characters.


STARWHALE has been obfuscated with hex-encoded strings.


SUNSPOT encrypted log entries it collected with the stream cipher RC4 using a hard-coded key. It also uses AES128-CBC encrypted blobs for SUNBURST source code and data extracted from the SolarWinds Orion <MsBuild.exe" process.


SUPERNOVA contained Base64-encoded strings.


Sakula uses single-byte XOR obfuscation to obfuscate many of its files.


SamSam has been seen using AES or DES to encrypt payloads and payload components.


Sandworm Team has used Base64 encoding within malware variants. Sandworm Team has also used ROT13 encoding, AES encryption and compression with the zlib library for their Python-based backdoor.


ShadowPad has encrypted its payload, a virtual file system, and various files.


Shamoon contains base64-encoded strings.


Shark can use encrypted and encoded files for C2 configuration.


ShimRat has been delivered as a package that includes compressed DLL and shellcode payloads within a .dat file.


ShimRatReporter encrypted gathered information with a combination of shifting and XOR using a static key.


Sibot has obfuscated scripts used in execution.


Sidewinder has used base64 encoding and ECDH-P256 encryption for scripts and files.


Silence has used environment variable string substitution for obfuscation.


Siloscape itself is obfuscated and uses obfuscated API calls.


Skidmap has encrypted it's main payload using 3DES.


Sliver can encrypt strings at compile time.


Smoke Loader uses a simple one-byte XOR method to obfuscate values in the malware.


SodaMaster can use "stackstrings" for obfuscation.


SombRAT can encrypt strings with XOR-based routines and use a custom AES storage format for plugins, configuration, C2 domains, and harvested data.


Some Orz strings are base64 encoded, such as the embedded DLL known as MockDll.


Some data in Remsec is encrypted using RC5 in CBC mode, AES-CBC with a hardcoded key, RC4, or Salsa20. Some data is also base64-encoded.


Some resources in Prikormka are encrypted with a simple XOR operation or encoded with Base64.


Some strings in HOMEFRY are obfuscated with XOR x56.


SoreFang has the ability to encode and RC6 encrypt data sent to C2.


SpeakUp encodes its second-stage payload with Base64.


Squirrelwaffle has been obfuscated with a XOR-based algorithm.


StoneDrill has obfuscated its module with an alphabet-based table or XOR encryption.


StreamEx obfuscates some commands by using statically programmed fragments of strings when starting a DLL. It also uses a one-byte xor against 0x91 to encode configuration data.


Strings in Attor's components are encrypted with a XOR cipher, using a hardcoded key and the configuration data, log files and plugins are encrypted using a hybrid encryption scheme of Blowfish-OFB combined with RSA.


SynAck payloads are obfuscated prior to compilation to inhibit analysis and/or reverse engineering.


SysUpdate can encrypt and encode its configuration file.


TA505 has password-protected malicious Word documents and used base64 encoded PowerShell commands.


TEARDROP created and read from a file with a fake JPG header, and its payload was encrypted with a simple rotating XOR cipher.


Taidoor can use encrypted string blocks for obfuscation.


TeamTNT has encrypted its binaries via AES and encoded files using Base64.


The FIVEHANDS payload is encrypted with AES-128.


The Grandoreiro payload has been delivered encrypted with a custom XOR-based algorithm and also as a base64-encoded ZIP file.


The Helminth config file is encrypted with RC4.


ThreatNeedle has been compressed and obfuscated using RC4, AES, or XOR.


Torisma has been Base64 encoded and AES encrypted.


Trojan.Karagany can base64 encode and AES-128-CBC encrypt data prior to transmission.


Tropic Trooper has encrypted configuration files.


Turian can use VMProtect for obfuscation.


UBoatRAT encrypts instructions in the payload using a simple XOR cipher.


UNC2452 used encoded PowerShell commands.


Ursnif has used an XOR-based algorithm to encrypt Tor clients dropped to disk.	Ursnif droppers have also been delivered as password-protected zip files that execute base64 encoded PowerShell commands.


Valak has the ability to base64 encode and XOR encrypt strings.


Variants of Emissary encrypt payloads using various XOR ciphers, as well as a custom algorithm that uses the "srand" and "rand" functions.


Waterbear has used RC4 encrypted shellcode and encrypted functions.


WhisperGate can Base64 encode strings, store downloaded files in reverse byte order,  and use the Eazfuscator tool to obfuscate its third stage.


Whitefly has encrypted the payload used for C2.


WindTail can be delivered as a compressed, encrypted, and encoded payload.


Winnti for Linux can encode its configuration file with single-byte XOR encoding.


Winnti for Windows has the ability to encrypt and compress its payload.


Wizard Spider used Base64 encoding to obfuscate an Empire service and PowerShell commands.


ZeroT has encrypted its payload with RC4.


Zeus Panda encrypts strings with XOR and obfuscates the macro code from the initial payload. Zeus Panda also encrypts all configuration and settings in AES and RC4.


hides any strings related to its own indicators of compromise.


jRAT’s Java payload is encrypted with AES. Additionally, backdoor files are encrypted using DES as a stream cipher. Later variants of jRAT also incorporated AV evasion methods such as Java bytecode obfuscation via the commercial Allatori obfuscation tool.


njRAT has included a base64 encoded executable.


A version of XTunnel introduced in July 2015 inserted junk code into the binary in a likely attempt to obfuscate it and bypass security products.


APT29 has used large file sizes to avoid detection.


BRONZE BUTLER downloader code has included "0" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.


Before writing to disk, Kwampirs inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.


Bisonal has appended random binary data to the end of itself to generate a large binary.


CORESHELL contains unused machine instructions in a likely attempt to hinder analysis.


Comnie appends a total of 64MB of garbage data to a file to deter any security products in place that may be scanning files on disk.


CostaBricks has added the entire unobfuscated code of the legitimate open source application Blink to its code.


Ember Bear has added extra spaces between JavaScript code characters to increase the overall file size.


FatDuke has been packed with junk code and strings.


Gamaredon Group has obfuscated .NET executables by inserting junk code.


Gelsemium can use junk code to hide functions and evade detection.


Goopy has had null characters padded in its malicious DLL payload.


GrimAgent has the ability to add bytes to change the file hash.


Higaisa performed padding with null bytes before calculating its hash.


Javali can use large obfuscated libraries to hinder detection and analysis.


Leviathan has inserted garbage characters into code, presumably to avoid anti-virus detection.


Maze has inserted large blocks of junk code, including some components to decrypt strings and other important information for later in the encryption process.


Mustang Panda has used junk code within their DLL files to hinder analysis.


Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.


TAINTEDSCRIBE can execute "FileRecvWriteRand" to append random bytes to the end of a file received from C2.


ZeroT has obfuscated DLLs and functions using dummy API calls inserted between real instructions.


A FinFisher variant uses a custom packer.


A Patchwork payload was packed with UPX.


A version of Daserf uses the MPRESS packer.


APT3 has been known to pack their tools.


APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium, to pack their implants.


APT39 has packed tools with UPX, and has repacked a modified version of Mimikatz to thwart anti-virus detection.


Aoqin Dragon has used the Themida packer to obfuscate malicious payloads.


Astaroth uses a software packer called Pe123\RPolyCryptor.


Bisonal has used the MPRESS packer and similar tools for obfuscation.


CSPY Downloader has been packed with UPX.


China Chopper's client component is packed with UPX.


Clop has been packed to help avoid detection.


CostaBricks can implement a custom-built virtual machine mechanism to obfuscate its code.


DRATzarus's dropper can be packed with UPX.


DarkComet has the option to compress its payload using UPX or MPRESS.


Dok is packed with an UPX executable packer.


During Night Dragon, threat actors used software packing in its tools.


Dyre has been delivered with encrypted resources and must be unpacked for execution.


Egregor's payloads are custom-packed, archived and encrypted to prevent analysis.


Elderwood has packed malware payloads before delivery to victims.


FYAnti has used ConfuserEx to pack its .NET module.


FatDuke has been regularly repacked by its operators to create large binaries and evade detection.


For Operation Dust Storm, the threat actors used UPX to pack some payloads.


For Operation Spalax, the threat actors used a variety of packers, including CyaX, to obfuscate malicious executables.


Hildegard has packed ELF files into other binaries.


HotCroissant has used the open source UPX executable packer.


HyperBro has the ability to pack its payload.


Lazarus Group has used Themida to pack malicious DLLs and other files.


LiteDuke has been packed with multiple layers of encryption.


Lokibot has used several packing methods for obfuscation.


Melcoz has been packed with VMProtect and Themida.


Metamorfo has used VMProtect to pack and protect files.


NETWIRE has used .NET packer tools to evade detection.


Night Dragon is known to use software packing in its tools.


OSX_OCEANLOTUS.D has a variant that is packed with UPX.


OopsIE uses the SmartAssembly obfuscator to pack an embedded .Net Framework assembly used for C2.


QakBot can encrypt and pack malicious payloads.


Raindrop used a custom packer for its Cobalt Strike payload, which was compressed using the LZMA algorithm.


Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.


SDBbot has used a packed installer file.


Saint Bot has been packed using a dark market crypter.


Sandworm Team used UPX to pack a copy of Mimikatz.


SeaDuke has been packed with the UPX packer.


ShimRat's loader has been packed with the compressed ShimRat core DLL and the legitimate DLL for it to hijack.


Some S-Type samples have been packed with UPX.


Some ZeroT DLL files have been packed with UPX.


Spark has been packed with Enigma Protector to obfuscate its contents.


Squirrelwaffle has been packed with a custom packer to hide payloads.


TA505 has used UPX to obscure malicious code.


The White Company has obfuscated their payloads through packing.


Threat Group-3390 has packed malware and tools.


Trojan.Karagany samples sometimes use common binary packers such as UPX and Aspack on top of a custom Delphi binary packer.


Zebrocy's Delphi variant was packed with UPX.


ABK can extract a malicious Portable Executable (PE) from a photo.


APT37 uses steganography to send images to users that are embedded with shellcode.


Andariel has hidden malicious executables within PNG files.


Avenger can extract backdoor malware from downloaded images.


BBK can extract a malicious Portable Executable (PE) from a photo.


BRONZE BUTLER has used steganography in multiple operations to conceal malicious payloads.


Bandook has used .PNG images within a zip file to build the executable.


Diavol has obfuscated its main code routines within bitmap images as part of its anti-analysis techniques.


Earth Lusca has used steganography to hide shellcode in a BMP image file.


For Operation Spalax, the threat actors used packers that read pixel data from images contained in PE files' resource sections and build the next layer of execution from the data.


IcedID has embedded binaries within RC4 encrypted .png files.


Invoke-PSImage can be used to embed a PowerShell script within the pixels of a PNG file.


Leviathan has used steganography to hide stolen data inside other files stored on Github.


LiteDuke has used image files to hide its loader component.


MuddyWater has stored obfuscated JavaScript code in an image file named temp.jpg.


ObliqueRAT can hide its payload in BMP images hosted on compromised websites.


ProLock can use .jpg and .bmp files to store its payload.


RDAT can also embed data within a BMP image prior to exfiltration.


Raindrop used steganography to locate the start of its encoded payload within legitimate 7-Zip code.


Ramsay has PE data embedded within JPEG files contained within Word documents.


RegDuke can hide data in images, including use of the Least Significant Bit (LSB).


build_downer can extract malware from a downloaded JPEG.


Cardinal RAT and its watchdog component are compiled and executed after being delivered to victims as embedded, uncompiled source code.


DarkWatchman has used the "csc.exe" tool to compile a C# executable.


Gamaredon Group has compiled the source code for a downloader directly on the infected system using the built-in "Microsoft.CSharp.CSharpCodeProvider" class.


Rocke has compiled malware, delivered to victims as .c files, with the GNU Compiler Collection (GCC).


njRAT has used AutoIt to compile the payload and main script into a single executable after delivery.


APT3 has been known to remove indicators of compromise from tools.


Analysis of Daserf has shown that it regularly undergoes technical improvements to evade anti-virus detection.


Cobalt Strike includes a capability to modify the "beacon" payload to eliminate known signatures or unpacking methods.


Deep Panda has updated and modified its malware, resulting in different hash values that evade detection.


During Operation Wocao, threat actors edited variable names within the Impacket suite to avoid automated detection.


GALLIUM ensured each payload had a unique hash, including by using different types of packers.


InvisiMole has undergone regular technical improvements in an attempt to evade detection.


OilRig has tested malware samples to determine AV detection and subsequently modified the samples to ensure AV evasion.


Penquin can remove strings from binaries.


PowerSploit's "Find-AVSignature" AntivirusBypass module can be used to locate single byte anti-virus signatures.


QakBot can make small changes to itself in order to change its checksum and hash value.


SUNBURST source code used generic variable names and pre-obfuscated strings, and was likely sanitized of developer comments before being added to SUNSPOT.


TEMP.Veles has modified files based on the open-source project cryptcat in an apparent attempt to decrease AV detection rates.


The author of GravityRAT submitted samples to VirusTotal for testing, showing that the author modified the code to try to hide the DDE object in a different part of the document.


Waterbear can scramble functions not to be executed again with random values.


APT29 has embedded an ISO file within an HTML attachment that contained JavaScript code to initiate malware execution.


EnvyScout contains JavaScript code that can extract an encoded blob from its HTML body and write it to disk.


Bazar can hash then resolve API calls at runtime.


Lazarus Group has used a custom hashing method to resolve APIs used in shellcode.


Pteranodon can use a dynamic Windows hashing algorithm to map API components.


macOS.OSAMiner has used run-only Applescripts, a compiled and stripped version of AppleScript, to remove human readable indicators to evade detection.


Invoke-PSImage can be used to embed payload data within a new image file.


macOS.OSAMiner has embedded Stripped Payloads within another run-only Stripped Payloads.


ADVSTORESHELL collects, compresses, encrypts, and exfiltrates data to the C2 server every 10 minutes.


Chrommme can set itself to sleep before requesting a new command from C2.


Cobalt Strike can set its Beacon payload to reach out to the C2 server on an arbitrary and random interval.


Flagpro has the ability to wait for a specified time interval between communicating with and executing commands from C2.


Higaisa sent the victim computer identifier in a User-Agent string back to the C2 server every 10 minutes.


LightNeuron can be configured to exfiltrate data during nighttime or working hours.


Machete sends stolen data to the C2 server every 10 minutes.


POWERSTATS can sleep for a given number of seconds.


ShadowPad has sent data back to C2 every 8 hours.


jRAT can be configured to reconnect at certain intervals.


APT28 has split archived exfiltration files into chunks smaller than 1MB.


AppleSeed has divided files if the size is 0x1000000 bytes or more.


Cobalt Strike will break large data sets into smaller chunks for exfiltration.


During C0015, the threat actors limited Rclone's bandwidth setting during exfiltration.


Helminth splits data into chunks up to 23 bytes and sends the data in DNS queries to its C2 server.


Kessel can split the data to be exilftrated into chunks that will fit in subdomains of DNS queries.


Kevin can exfiltrate data to the C2 server in 27-character chunks.


Mythic supports custom chunk sizes used to upload/download files.


OopsIE exfiltrates command output and collected files to its C2 server in 1500-byte blocks.


POSHSPY uploads data in 2048-byte chunks.


The Rclone "chunker" overlay supports splitting large files in smaller chunks during upload to circumvent size limits.


A Gamaredon Group file stealer can gather the victim's username to send to a C2 server.


A Linux version of Derusbi checks if the victim user ID is anything other than zero (normally used for root), and the malware will not execute if it does not have root privileges. Derusbi also gathers the username of the victim.


A module in Prikormka collects information from the victim about the current user name.


APT32 collected the victim's username and executed the "whoami" command on the victim's machine. APT32 executed shellcode to collect the username on the victim's machine.


APT39 used Remexi to collect usernames from the system.


APT41 used the WMIEXEC utility to execute "whoami" commands on remote machines.


Action RAT has the ability to collect the username from an infected host.


Agent.btz obtains the victim username and saves it to a file.


Amadey has collected the user name from a compromised host using `GetUserNameA`.


An APT3 downloader uses the Windows command ""cmd.exe" /C whoami" to verify that it is running with the elevated privileges of “System.”


Aria-body has the ability to identify the username on a compromised host.


AuTo Stealer has the ability to collect the username from an infected host.


Azorult can collect the username from the victim’s machine.


BabyShark has executed the "whoami" command.


Backdoor.Oldrea collects the current username from the victim.


Bazar can identify the username of the infected user.


BloodHound can collect information on user sessions.


Bonadan has discovered the username of the user running the backdoor.


BoomBox can enumerate the username on a compromised host.


Cardinal RAT can collect the username from a victim machine.


Caterpillar WebShell can obtain a list of user accounts from a victim's machine.


Chaes has collected the username and UID from the infected machine.


Chimera has used the "quser" command to show currently logged on users.


Chrommme can retrieve the username from a targeted system.


Clambling can identify the username on a compromised host.


Crimson can identify the user on a targeted system.


DRATzarus can obtain a list of users from an infected machine.


DarkComet gathers the username from the victim’s machine.


Diavol can collect the username from a compromised host.


DnsSystem can use the Windows user name to create a unique identification for infected users and systems.


DownPaper collects the victim username and sends it to the C2 server.


Dragonfly 2.0 used the command "query user" on victim hosts.


Dragonfly used the command "query user" on victim hosts.


During Frankenstein, the threat actors used Empire to enumerate hosts and gather username, machine name, and administrative permissions information.


During Night Dragon, threat actors used password cracking and pass-the-hash tools to discover usernames and passwords.


During Operation CuckooBees, the threat actors used the `query user` and `whoami` commands as part of their advanced reconnaissance.


During Operation Wocao, threat actors enumerated sessions and users on a remote host, and identified privileged users logged into a targeted system.


Dyre has the ability to identify the users on a compromised host.


EVILNUM can obtain the username from the victim's machine.


Earth Lusca collected information on user accounts via the "whoami" command.


Egregor has used tools to gather information about users.


Empire can enumerate the username on targeted hosts.


Epic collects the user name from the victim’s machine.


FELIXROOT collects the username from the victim’s machine.


FIN10 has used Meterpreter to enumerate users on remote systems.


Felismus collects the current username and sends it to the C2 server.


Flagpro has been used to run the "whoami" command on the system.


FlawedAmmyy enumerates the current user during the initial infection.


FunnyDream has the ability to gather user information from the targeted system using `whoami/upn&whoami/fqdn&whoami/logonid&whoami/all`.


GALLIUM used "whoami" and "query user" to obtain information about the victim user.


Gelsemium has the ability to distinguish between a standard user and an administrator on a compromised host.


Get2 has the ability to identify the current username of an infected host.


Gold Dragon collects the endpoint victim's username and uses it as a basis for downloading additional components from the C2 server.


GravityRAT collects the victim username along with other account information (account type, description, full name, SID and status).


HAWKBALL can collect the user name of the system.


HotCroissant has the ability to collect the username on the infected host.


KONNI can collect the username from the victim’s machine.


Ke3chang has used implants capable of collecting the signed-in username.


Koadic can identify logged in users across the domain and views user sessions.


Kwampirs collects registered owner details by using the commands "systeminfo" and "net config workstation".


Linux Rabbit opens a socket on port 22 and if it receives a response it attempts to obtain the machine's hostname and Top-Level Domain.


LiteDuke can enumerate the account name on a targeted system.


Lizar can collect the username from the system.


MacMa can collect the username from the compromised machine.


MarkiRAT can retrieve the victim’s username.


Micropsia collects the username from the victim’s machine.


Milan can identify users registered to a targeted machine.


MirageFox can gather the username from the victim’s machine.


Mis-Type runs tests to determine the privilege level of the compromised user.


More_eggs has the capability to gather the username from the victim's machine.


Mosquito runs "whoami" on the victim’s machine.


NBTscan can list active users on the system.


NDiskMonitor obtains the victim username and encrypts the information to send over its C2 channel.


NOKKI can collect the username from the victim’s machine.


NanHaiShu collects the username from the victim.


Neoichor can collect the user name from a victim's machine.


ObliqueRAT can check for blocklisted usernames on infected endpoints.


Octopus can collect the username from the victim’s machine.


Operation Wocao has enumerated sessions and users on a remote host, and identified privileged users logged into a targeted system.


POWERSTATS has the ability to identify the username on the compromised host.


POWRUNER may collect information about the currently logged in user by running "whoami" on a victim.


Patchwork collected the victim username and whether it was running as admin, then sent the information to its C2 server.


PoetRAT sent username, computer name, and the previously generated UUID in reply to a "who" command from C2.


PowerShower has the ability to identify the current user on the infected host.


PyDCrypt has probed victim machines with "whoami" and has collected the username from the machine.


QakBot can identify the user name on a compromised system.


QuasarRAT can enumerate the username and account type.


RATANKBA runs the "whoami" and "query user" commands.


RCSession can gather system owner information, including user and administrator privileges.


RGDoor executes the "whoami" on the victim’s machine.


ROKRAT can collect the username from a compromised host.


RTM can obtain the victim username and permissions.


RedLeaves can obtain information about the logged on user both locally and for Remote Desktop sessions.


Remsec can obtain information about the current user.


Revenge RAT gathers the username from the system.


Rifdoor has the ability to identify the username on the compromised host.


Rising Sun can detect the username of the infected host.


SDBbot has the ability to identify the user on a compromised host.


SLOTHFULMEDIA has collected the username from a victim machine.


SMOKEDHAM has used "whoami" commands to identify system owners.


STARWHALE can gather the username from an infected host.


SUNBURST collected the username from a compromised host.


ServHelper will attempt to enumerate the username of the victim.


SideTwist can collect the username on a targeted system.


Small Sieve can obtain the id of a logged in user.


SodaMaster can identify the username on a compromised host.


SombRAT can execute "getinfo"  to identify the username on a compromised host.


Squirrelwaffle can collect the user name from a compromised host.


SslMM sends the logged-on username to its hard-coded C2.


Stealth Falcon malware gathers the registered user and primary owner name via WMI.


StrifeWater can collect the user name from the victim's machine.


SynAck gathers user names from infected hosts.


T9000 gathers and beacons the username of the logged in account during installation. It will also gather the username of running processes to determine if it is running as SYSTEM.


The OsInfo function in Komplex collects the current running username.


TrickBot can identify the user and groups the user belongs to on a compromised host.


Trojan.Karagany can gather information about the user on a compromised host.


UPPERCUT has the capability to collect the current logged on user’s username from a machine.


Valak can gather information regarding the user.


WINDSHIELD can gather the victim user name.


WINERACK can gather information on the victim username.


WellMail can identify the current username on the victim system.


WinMM uses NetUser-GetInfo to identify that it is running under an “Admin” account on the local system.


Wizard Spider has used "whoami" to identify the local user and their privileges.


XAgentOSX contains the getInfoOSX function to return the OS X version as well as the current user.


ZIRCONIUM has used a tool to capture the username on a compromised host in order to register it with C2.


Zebrocy gets the username from the system.


ZxxZ can collect the username from a compromised host.


njRAT enumerates the current user during the initial infection.


zwShell can obtain the name of the logged-in user on the victim.


APT28 has renamed the WinRAR utility to avoid detection.


AppleSeed can disguise JavaScript files as PDFs.


Bisonal dropped a decoy payload with a .jpg extension that contained a malicious Visual Basic script.


BoomBox has the ability to mask malicious data strings as PDF files.


Dragonfly 2.0 created accounts disguised as legitimate backup and service accounts as well as an email administration account.


Dragonfly has created accounts disguised as legitimate backup and service accounts as well as an email administration account.


EnvyScout has used folder icons for malicious files to lure victims into opening them.


Flagpro can download malicious files with a .tmp extension and append them with .exe prior to execution.


For Operation Dust Storm, the threat actors disguised some executables as JPG files.


Kimsuky has disguised its C2 addresses as the websites of shopping malls, governments, universities, and others.


Lazarus Group has disguised malicious template files as JPEG files to avoid detection.


LazyScripter has used several different security software icons to disguise executables.


Milan has used an executable named `companycatalogue` to appear benign.


Mustang Panda has used an additional filename extension to hide the true file type.


NativeZone has, upon execution, displayed a message box that appears to be related to a Ukrainian electronic document management system.


Nomadic Octopus attempted to make Octopus appear as a  Telegram Messenger with a Russian interface.


NotPetya drops PsExec with the filename dllhost.dat.


PLATINUM has renamed rar.exe to avoid detection.


PowGoop has disguised a PowerShell script as a .dat file (goopdate.dat).


QuasarRAT has dropped binaries as files named microsoft_network.exe and crome.exe.


RCSession has used a file named English.rtf to appear benign on victim hosts.


Raindrop was built to include a modified version of 7-Zip source code (including associated export names) and Far Manager source code.


Ryuk can create .dll files that actually contain a Rich Text File format document.


Saint Bot has renamed malicious binaries as `wallpaper.mp4` and `slideshow.mp4` to avoid detection.


SombRAT can use a legitimate process name to hide itself.


The QakBot payload has been disguised as a PNG file.


TrailBlazer has used filenames that match the name of the compromised system in attempt to avoid detection.


UNC2452 set the hostnames of its C2 infrastructure to match legitimate hostnames in the victim environment. They also primarily used IP addresses originating from the same country as the victim for their VPN infrastructure.


WhisperGate has been disguised as a JPG extension to avoid detection as a malicious PE file.


XCSSET builds a malicious application bundle to resemble Safari through using the Safari icon and "Info.plist".


menuPass has used esentutl to change file extensions to their true type that were masquerading as .txt files.


APT37 has signed its malware with an invalid digital certificates listed as “Tencent Technology (Shenzhen) Company Limited.”


BADNEWS is sometimes signed with an invalid Authenticode certificate in an apparent effort to make it look more legitimate.


Gelsemium has used unverified signatures on malicious DLLs.


PcShare has used an invalid certificate in attempt to appear legitimate.


WindTail has been incompletely signed with revoked certificates.


Windshift has used revoked certificates to sign malware.


BlackTech has used right-to-left-override to obfuscate the filenames of malicious e-mail attachments.


Ferocious Kitten has used right-to-left override to reverse executables’ names to make them appear to have different file extensions, rather than their real ones.


Ke3chang has used the right-to-left override character in spearphishing attachment names to trick targets into executing .scr and .exe files.


Scarlet Mimic has used the left-to-right override character in self-extracting RAR archive spearphishing attachment file names.


APT32 has moved and renamed pubprn.vbs to a .txt file to avoid detection.


Kevin has renamed an image of `cmd.exe` with a random name followed by a `.tmpl` extension.


Lazarus Group has renamed system utilities such as "wscript.exe" and "mshta.exe".


The CozyCar dropper has masqueraded a copy of the infected system's rundll32.exe executable that was moved to the malware's install directory and renamed according to a predefined configuration file.


A Lazarus Group custom backdoor implant included a custom PE loader named "Security Package" that was added into the lsass.exe process via registry key.


APT-C-36 has disguised its scheduled tasks as those used by Google.


APT29 named tasks "\Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager" in order to appear legitimate.


APT41 has created services to appear as benign system tools.


BITTER has disguised malware as a Windows Security update service.


Bazar can create a task named to appear benign.


CSPY Downloader has attempted to appear as a legitimate Windows service with a fake description claiming it is used to support packed applications.


Carbanak has copied legitimate service names to use for malicious services.


Catchamas adds a new service named NetAdapter in an apparent attempt to masquerade as a legitimate service.


ComRAT has used a task name associated with Windows SQM Consolidator.


Crutch has established persistence with a scheduled task impersonating the Outlook item finder.


DCSrv has masqueraded its service as a legitimate svchost.exe process.


Egregor has masqueraded the svchost.exe process to exfiltrate data.


FIN6 has renamed the "psexec" service name to "mstdc" to masquerade as a legitimate Windows service.


FIN7 has created a scheduled task named “AdobeFlashSync” to establish persistence.


FunnyDream has used a service named `WSearch` for execution.


Fysbis has masqueraded as the rsyncd and dbus-inotifier services.


GoldMax has impersonated systems management software to avoid detection.


Green Lambert has created a new executable named `Software Update Check` to appear legitimate.


Heyoka Backdoor has been named `srvdll.dll` to appear as a legitimate service.


Higaisa named a shellcode loader binary "svchast.exe" to spoof the legitimate "svchost.exe".


Hildegard has disguised itself as a known Linux process.


In one instance, menuPass added PlugX as a service with a display name of "Corel Writing Tools Utility."


IronNetInjector has been disguised as a legitimate service using the name PythonUpdateSrvc.


KillDisk registers as a service under the Plug-And-Play Support name.


Kimsuky has disguised services to appear as benign software or related to operating system functions.


Machete renamed task names to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python tasks.


Naikon renamed a malicious service "taskmgr" to appear to be a legitimate version of Task Manager.


Nebulae has created a service named "Windows Update Agent1" to appear legitimate.


OSX_OCEANLOTUS.D has disguised its app bundle by adding special characters to the filename and using the icon for legitimate Word documents.


Okrum can establish persistence by adding a new service NtmsSvc with the display name Removable Storage to masquerade as a legitimate Removable Storage Manager.


POWERSTATS has created a scheduled task named "MicrosoftEdge" to establish persistence.


PROMETHIUM has named services to appear legitimate.


PingPull can mimic the names and descriptions of legitimate services such as `iphlpsvc`, `IP Helper`,  and `Onedrive` to evade detection.


SUGARDUMP's scheduled task has been named `MicrosoftInternetExplorerCrashRepoeterTaskMachineUA` or `MicrosoftEdgeCrashRepoeterTaskMachineUA`, depending on the Windows OS version.


Seasalt has masqueraded as a service called "SaSaut" with a display name of "System Authorization Service" in an apparent attempt to masquerade as a legitimate service.


Shamoon creates a new service named “ntssrv” that attempts to appear legitimate; the service's display name is “Microsoft Network Realtime Inspection Service” and its description is “Helps guard against time change attempts targeting known and newly discovered vulnerabilities in network time protocols.” Newer versions create the "MaintenaceSrv" service, which misspells the word "maintenance."


ShimRat can impersonate Windows services and antivirus products to avoid detection on compromised systems.


Tarrask creates a scheduled task called “WinUpdate” to re-establish any dropped  C2 connections.


The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description “Windows Check AV” in an apparent attempt to masquerade as a legitimate service.


To establish persistence, Truvasys adds a Registry Run key with a value "TaskMgr" in an attempt to masquerade as the legitimate Windows Task Manager.


UNC2452 named tasks "\Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager" in order to appear legitimate.


Wizard Spider has used scheduled tasks to install TrickBot, using task names to appear legitimate such as WinDotNet, GoogleTask, or Sysnetsf. It has also used common document file names for other malware binaries.


ZIRCONIUM has created a run key named "Dropbox Update Setup" to mask a persistence mechanism for a malicious binary.


ZxxZ has been disguised as a Windows security update service.


build_downer has added itself to the Registry Run key as "NVIDIA" to appear legitimate.


A Winnti for Windows implant file was named ASPNET_FILTER.DLL, mimicking the legitimate ASP.NET ISAPI filter DLL with the same name.


APT28 has changed extensions on files containing exfiltrated data to make them appear benign, and renamed a web shell instance to appear as a legitimate OWA page.


APT29 renamed software and DLL's with legitimate names to appear benign.


APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update. APT32 has also renamed a Cobalt Strike beacon payload to install_flashplayers.exe.


AppleSeed has the ability to rename its payload to ESTCommon.dll to masquerade as a DLL belonging to ESTsecurity.


BADNEWS attempts to hide its payloads using legitimate filenames.


BLINDINGCAN has attempted to hide its payload by using legitimate file names such as "iconcache.db".


BRONZE BUTLER has given malware the same name as an existing file on the file share server to cause users to unwittingly launch and install the malware on additional systems.


BackdoorDiplomacy has dropped implants in folders named for legitimate software.


Bad Rabbit has masqueraded as a Flash Player installer through the executable file "install_flash_player.exe".


Blue Mockingbird has masqueraded their XMRIG payload name by naming it wercplsupporte.dll after the legitimate wercplsupport.dll file.


Bumblebee has named component DLLs "RapportGP.dll" to match those used by the security company Trusteer.


Bundlore has disguised a malicious .app file as a Flash Player update.


Carbanak has named malware "svchost.exe," which is the name of the Windows shared service host program.


Carberp has masqueraded as Windows system file names, as well as "chkntfs.exe" and "syscron.exe".


ChChes copies itself to an .exe file with a filename that is likely intended to imitate Norton Antivirus but has several letters reversed (e.g. notron.exe).


Chaes has used an unsigned, crafted DLL module named "hha.dll" that was designed to look like a legitimate 32-bit Windows DLL.


Cuba has been disguised as legitimate 360 Total Security Antivirus and OpenVPN programs.


DRATzarus has been named `Flash.exe`, and its dropper has been named `IExplorer`.


DanBot files have been named `UltraVNC.exe` and `WINVNC.exe` to appear as legitimate VNC tools.


Darkhotel has used malware that is disguised as a Secure Shell (SSH) tool.


During Operation CuckooBees, the threat actors renamed a malicious executable to `rundll32.exe` to allow it to blend in with other Windows system files.


During Operation Honeybee, the threat actors used a legitimate Windows executable and secure directory for their payloads to bypass UAC.


During Operation Sharpshooter, threat actors installed Rising Sun in the Startup folder and disguised it as `mssync.exe`.


During Operation Wocao, the threat actors renamed some tools and executables to appear as legitimate programs.


Earth Lusca used the command `move [file path] c:\windows\system32\spool\prtprocs\x64\spool.dll` to move and register a malicious DLL name as a Windows print processor, which eventually was loaded by the Print Spooler service.


FIN7 has attempted to run Darkside ransomware with the filename sleep.exe.


Felismus has masqueraded as legitimate Adobe Content Management System files.


Ferocious Kitten has named malicious files "update.exe" and loaded them into the compromise host's “Public” folder.


FinFisher renames one of its .dll files to uxtheme.dll in an apparent attempt to masquerade as a legitimate file.


FoggyWeb can be disguised as a Visual Studio file such as `Windows.Data.TimeZones.zh-PH.pri` to evade detection. Also, FoggyWeb's loader can mimic a genuine `dll` file that carries out the same import functions as the legitimate Windows `version.dll` file.


Fox Kitten has named binaries and configuration files svhost and dllhost respectively to appear legitimate.


Fysbis has masqueraded as trusted software rsyncd and dbus-inotifier.


Gamaredon Group has used legitimate process names to hide malware including "svchosst".


Gelsemium has named malicious binaries `serv.exe`, `winprint.dll`, and `chrome_elf.dll` and has set its persistence in the Registry with the key value "Chrome Update" to appear legitimate.


GoldenSpy's setup file installs initial executables under the folder "%WinDir%\System32\PluginManager".


Goopy has impersonated the legitimate goopdate.dll, which was dropped on the target system with a legitimate GoogleUpdate.exe.


Grandoreiro has named malicious browser extensions and update files to appear legitimate.


Green Lambert has been disguised as a Growl help file.


HTTPBrowser's installer contains a malicious file named navlu.dll to decrypt and run the RAT. navlu.dll is also the name of a legitimate Symantec DLL.


HermeticWiper has used the name `postgressql.exe` to mask a malicious payload.


HermeticWizard has been named `exec_32.dll` to mimic a legitimate MS Outlook .dll.


IceApple .NET assemblies have used `App_Web_` in their file names to appear legitimate.


If installing itself as a service fails, Elise instead writes itself as a file named svchost.exe saved in %APPDATA%\Microsoft\Network.


Indrik Spider used fake updates for FlashPlayer plugin and Google Chrome as initial infection vectors.


InnaputRAT variants have attempted to appear legitimate by using the file names SafeApp.exe and NeutralApp.exe.


InvisiMole has disguised its droppers as legitimate software or documents, matching their original names and locations, and saved its files as mpr.dll in the Windows folder.


KGH_SPY has masqueraded as a legitimate Windows tool.


KONNI has created a shortcut called "Anti virus service.lnk" in an apparent attempt to masquerade as a legitimate file.


Ke3chang has dropped their malware into legitimate installed software paths including: `C:\ProgramFiles\Realtek\Audio\HDA\AERTSr.exe`, `C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitRdr64.exe`, `C:\Program Files (x86)\Adobe\Flash Player\AddIns\airappinstaller\airappinstall.exe`, and `C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd64.exe`.


Kimsuky has renamed malware to legitimate names such as "ESTCommon.dll" or "patch.dll".


Lazarus Group has renamed malicious code to disguise it as Microsoft's narrator and other legitimate files.


LookBack has a C2 proxy tool that masquerades as "GUP.exe", which is software used by Notepad++.


MCMD has been named Readme.txt to appear legitimate.


Machete renamed payloads to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python executables.


Machete's Machete MSI installer has masqueraded as a legitimate Adobe Acrobat Reader installer.


MarkiRAT can masquerade as "update.exe" and "svehost.exe"; it has also mimicked legitimate Telegram and Chrome files.


MechaFlounder has been downloaded as a file named lsass.exe, which matches the legitimate Windows file.


Metamorfo has disguised an MSI file as the Adobe Acrobat Reader Installer and has masqueraded payloads as OneDrive, WhatsApp, or Spotify, for example.


Misdat saves itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.


MuddyWater has disguised malicious executables and used filenames and Registry key names associated with Windows Defender.


Mustang Panda has used names like `adobeupdate.dat` and `PotPlayerDB.dat` to disguise PlugX, and a file named `OneDrive.exe` to load a Cobalt Strike payload.


Naikon has disguised malicious programs as Google Chrome, Adobe, and VMware executables.


Nebulae uses functions named "StartUserModeBrowserInjection" and "StopUserModeBrowserInjection" indicating that it's trying to imitate chrome_frame_helper.dll.


OLDBAIT installs itself in "%ALLUSERPROFILE%\\Application Data\Microsoft\MediaPlayer\updatewindws.exe"; the directory name is missing a space and the file name is missing the letter "o."


OSX/Shlayer can masquerade as a Flash Player update.


Octopus has been disguised as legitimate programs, such as Java and Telegram Messenger.


One of Dtrack can hide in replicas of legitimate programs like OllyDbg, 7-Zip, and FileZilla.


OwaAuth uses the filename owaauth.dll, which is a legitimate file that normally resides in "%ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\Auth\"; the malicious file by the same name is saved in "%ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\bin\".


PUNCHBUGGY mimics filenames from %SYSTEM%\System32 to hide DLLs in %WINDIR% and/or %TEMP%.


Patchwork installed its payload in the startup programs folder as "Baidu Software Update." The group also adds its second stage payload to the startup programs as “Net Monitor." They have also dropped QuasarRAT binaries as files named microsoft_network.exe and crome.exe.


PcShare has been named `wuauclt.exe` to appear as the legitimate Windows Update AutoUpdate Client.


Penquin has mimicked the Cron binary to hide itself on compromised systems.


PlugX has been disguised as legitimate Adobe and PotPlayer files.


Poseidon Group tools attempt to spoof anti-virus processes as a means of self-defense.


Pysa has executed a malicious executable by naming it svchost.exe.


QUADAGENT used the PowerShell filenames "Office365DCOMCheck.ps1" and "SystemDiskClean.ps1".


REvil can mimic the names of known executables.


Raindrop was installed under names that resembled legitimate Windows file and directory names.


RainyDay has used names to mimic legitimate software including "vmtoolsd.exe" to spoof Vmtools.


Rocke has used shell scripts which download mining executables and saves them with the filename "java".


Ryuk has constructed legitimate appearing installation folder paths by calling "GetWindowsDirectoryW" and then inserting a null byte at the fourth character of the path. For Windows Vista or higher, the path would appear as "C:\Users\Public".


S-Type may save itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.


SLOTHFULMEDIA has mimicked the names of known executables, such as mediaplayer.exe.


SUGARDUMP has been named `CrashReporter.exe` to appear as a legitimate Mozilla executable.


SUNBURST created VBScripts that were named after existing services or folders to blend into legitimate activities.


SUNSPOT was identified on disk with a filename of "taskhostsvc.exe" and it created an encrypted log file at "C:\Windows\Temp\vmware-vmdmp.log".


Saint Bot has been disguised as a legitimate executable, including as Windows SDK.


Sandworm Team has avoided detection by naming a malicious binary explorer.exe.


Shark binaries have been named `audioddg.pdb` and `Winlangdb.pdb` in order to appear legitimate.


ShimRatReporter spoofed itself as "AlphaZawgyl_font.exe", a specialized Unicode font.


Sidewinder has named malicious files "rekeywiz.exe" to match the name of a legitimate Windows executable.


Skidmap has created a fake "rm" binary to replace the legitimate Linux binary.


Sowbug named its tools to masquerade as Windows or Adobe Reader software, such as by using the file name adobecms.exe and the directory "CSIDL_APPDATA\microsoft\security".


StrongPity has been bundled with legitimate software installation files for disguise.


TEMP.Veles has renamed files to look like legitimate files, such as Windows update files or Schneider Electric application files.


TRITON disguised itself as the legitimate Triconex Trilog application.


Tarrask has masqueraded as executable files such as `winupdate.exe`, `date.exe`, or `win.exe`.


TeamTNT has replaced .dockerd and .dockerenv with their own scripts and cryptocurrency mining software.


The Bazar loader has named malicious shortcuts "adobe" and mimicked communications software.


The TAINTEDSCRIBE main executable has disguised itself as Microsoft’s Narrator.


The file name AcroRD32.exe, a legitimate process name for Adobe's Acrobat Reader, was used by APT1 as a name for malware.


ThiefQuest prepends a copy of itself to the beginning of an executable file while maintaining the name of the executable.


ThreatNeedle chooses its payload creation path from a randomly selected service name from netsvc.


TinyTurla has been deployed as `w64time.dll` to appear legitimate.


To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.


Tropic Trooper has hidden payloads in Flash directories and fake installer files.


USBStealer mimics a legitimate Russian program called USB Disk Security.


Ursnif has used strings from legitimate system files and existing folders for its file, folder, and Registry entry names.


WIRTE has named a first stage dropper `Kaspersky Update Agent` in order to appear legitimate.


ZLib mimics the resource version information of legitimate Realtek Semiconductor, Nvidia, or Synaptics modules.


admin@338 actors used the following command to rename one of their tools to a benign file name: "ren "%temp%\upload" audiodg.exe"


menuPass has been seen changing malicious files to appear legitimate.


Keydnap puts a space after a false .jpg extension so that execution actually goes through the Terminal.app program.


The Bazar loader has used dual-extension executable files such as PreviewReport.DOC.exe.


An APT28 loader Trojan adds the Registry key "HKCU\Environment\UserInitMprLogonScript" to establish persistence.


Attor's dispatcher can establish persistence via adding a Registry key with a logon script "HKEY_CURRENT_USER\Environment "UserInitMprLogonScript" ".


Cobalt Group has added persistence by registering the file name for the next stage malware under "HKCU\Environment\UserInitMprLogonScript".


KGH_SPY has the ability to set the "HKCU\Environment\UserInitMprLogonScript" Registry key to execute logon scripts.


Zebrocy performs persistence with a logon script via adding to the Registry key "HKCU\Environment\UserInitMprLogonScript".


Cyclops Blink has the ability to execute on device startup, using a modified RC script named S51armled.


Green Lambert can add "init.d" and "rc.d" files in the "/etc" folder to establish persistence.


jRAT can list and manage startup entries.


APT28 has collected files from network shared drives.


Chimera has collected data of interest from network shares.


CosmicDuke steals user files from network shared drives with file extensions and keywords that match a predefined list.


Egregor can collect any files found in the enumerated drivers before sending it to its C2 channel.


Fox Kitten has searched network shares to access sensitive documents.


Gamaredon Group malware has collected Microsoft Office documents from mapped network drives.


Ramsay can collect data from network drives and stage it for exfiltration.


Sowbug extracted Word documents from a file server on a victim network.


When it first starts, BADNEWS crawls the victim's mapped drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.


menuPass has collected data from remote systems by mounting network shares with "net use" and using Robocopy to transfer data.


APT28 deployed the open source tool Responder to conduct NetBIOS Name Service poisoning, which captured usernames and hashed passwords that allowed access to legitimate credentials. APT28 close-access teams have used Wi-Fi pineapples to intercept Wi-Fi signals and user credentials.


DarkVishnya used network sniffing to obtain login data.


Emotet has been observed to hook network APIs to monitor network traffic.


Empire can be used to conduct packet captures on target hosts.


FoggyWeb can configure custom listeners to passively monitor all incoming HTTP GET and POST requests sent to the AD FS server from the intranet/internet and intercept HTTP requests that match the custom URI patterns defined by the actor.


Impacket can be used to sniff network traffic via an interface or raw socket.


MESSAGETAP uses the libpcap library to listen to all traffic and parses network protocols starting with Ethernet and IP layers. It continues parsing protocol layers including SCTP, SCCP, and TCAP and finally extracts SMS message data and routing metadata.


NBTscan can dump and print whole packet content.


Penquin can sniff network traffic to look for packets matching specific conditions.


PoshC2 contains a module for taking packet captures on compromised hosts.


Responder captures hashes and credentials that are sent to the system after the name services have been poisoned.


Sandworm Team has used intercepter-NG to sniff passwords in network traffic.


A Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server.


APT3 has a tool that exfiltrates data over the C2 channel.


APT32's backdoor has exfiltrated data using the already opened channel with its C&C server.


APT39 has exfiltrated stolen victim data through C2 communications.


Adversaries can direct BACKSPACE to upload files to the C2 Server.


AppleJeus has exfiltrated collected host information to a C2 server.


Astaroth exfiltrates collected information from its r1.log file to the external C2 server.


Attor has exfiltrated data over the C2 channel.


AuTo Stealer can exfiltrate data over actor-controlled C2 servers via HTTP or TCP.


BLUELIGHT has exfiltrated data over its C2 channel.


Bandook can upload files from a victim's machine over the C2 channel.


Bankshot exfiltrates data over its C2 channel.


Bisonal has added the exfiltrated data to the URL over the C2 channel.


Bumblebee can send collected data in JSON format to C2.


CallMe exfiltrates data to its C2 server over the same protocol as C2 communications.


Cannon exfiltrates collected data over email via SMTP/S and POP3/S C2 channels.


Caterpillar WebShell can upload files over the C2 channel.


CharmPower can exfiltrate gathered data to a hardcoded C2 URL via HTTP POST.


Chimera has used Cobalt Strike C2 beacons for data exfiltration.


CreepySnail can connect to C2 for data exfiltration.


Crimson can exfiltrate stolen information over its C2.


Crutch can exfiltrate data over the primary C2 channel (Dropbox HTTP API).


Cyclops Blink has the ability to upload exfiltrated files to a C2 server.


Data exfiltration is done by Okrum using the already opened channel with the C2 server.


DnsSystem can exfiltrate collected data to its C2 server.


Doki has used Ngrok to establish C2 and exfiltrate data.


Drovorub can exfiltrate files over C2 infrastructure.


During Frankenstein, the threat actors collected information via Empire, which sent the data back to the adversary's C2.


During Operation Honeybee, the threat actors uploaded stolen files to their C2 servers.


DustySky has exfiltrated data to the C2 server.


Dyre has the ability to send information staged on a compromised host externally to C2.


Ebury can exfiltrate SSH credentials through custom DNS queries.


Emotet has been seen exfiltrating system information stored within cookies sent within an HTTP GET request back to its C2 servers.


Flagpro has exfiltrated data to the C2 server.


FlawedAmmyy has sent data collected from a compromised host to its C2 servers.


FoggyWeb can remotely exfiltrate sensitive information from a compromised AD FS server.


FunnyDream can execute commands, including gathering user information, and send the results to C2.


GALLIUM used Web shells and HTRAN for C2 and to exfiltrate data.


Grandoreiro can send data it retrieves to the C2 server.


GrimAgent has sent data related to a compromise host over its C2 channel.


HOPLIGHT has used its C2 channel to exfiltrate data.


Higaisa exfiltrated data over its C2 channel.


HotCroissant has the ability to download files from the infected host to the command and control (C2) server.


Imminent Monitor has uploaded a file containing debugger logs, network information and system information to the C2.


Industroyer sends information about hardware profiles and previously-received commands back to the C2 server in a POST-request.


KGH_SPY can exfiltrate collected information from the host to the C2 server.


KONNI has sent data and files to its C2 server.


Kessel has exfiltrated information gathered from the infected system to the C2 server.


Kimsuky has exfiltrated data over its C2 channel.


Leviathan has exfiltrated data over its C2 channel.


LightNeuron exfiltrates data over its email C2 channel.


LitePower can send collected data, including screenshots, over its C2 channel.


MacMa exfiltrates data from a supplied path over its C2 channel.


Machete's collected data is exfiltrated over the same channel used for C2.


MarkiRAT can exfiltrate locally stored data via its C2.


MechaFlounder has the ability to send the compromised user's account name and hostname within a URL to C2.


Metamorfo can send the data it collects to the C2 server.


Misdat has uploaded files and data to its C2 servers.


Mongall can upload files and information from a compromised host to its C2 server.


MuddyWater has used C2 infrastructure to receive exfiltrated data.


Octopus has uploaded stolen files and data from a victim's machine over its C2 channel.


OopsIE can upload files from the victim's machine to its C2 server.


Operation Wocao has used the Xserver backdoor to exfiltrate data.


OutSteel can upload files from a compromised host over its C2 channel.


PcShare can upload files and information from a compromised host to its C2 servers.


PoetRAT has exfiltrated data over the C2 channel.


Proxysvc performs data exfiltration over the control server channel using a custom protocol.


Psylo exfiltrates data to its C2 server over the same protocol as C2 communications.


Pteranodon exfiltrates screenshot files to its C2 server.


Pupy can send screenshots files, keylogger data, files, and recorded audio back to the C2 server.


QakBot can send stolen information to C2 nodes including passwords, accounts, and emails.


Remexi performs exfiltration over BITSAdmin, which is also used for the C2 channel.


S-Type has uploaded data and files from a compromised host to its C2 servers.


SDBbot has sent collected data from a compromised host to its C2 servers.


SILENTTRINITY can transfer files from an infected host to the C2 server.


SMOKEDHAM has exfiltrated data to its C2 server.


STARWHALE can exfiltrate collected data to its C2 servers.


Sandworm Team has sent system information to its C2 server using HTTP.


Shark has the ability to upload files from the compromised host over a DNS or HTTP C2 channel.


ShimRatReporter sent generated reports to the C2 via HTTP POST requests.


SideTwist has exfiltrated data over its C2 channel.


Sliver can exfiltrate files from the victim using the "download" command.


SombRAT has uploaded collected data and files from a compromised host to its C2 server.


StrifeWater can send data and files from a compromised host to its C2 server.


StrongPity can exfiltrate collected documents through C2 channels.


Stuxnet sends compromised victim information via HTTP.


TajMahal has the ability to send collected files over its C2.


Tomiris can upload files matching a hardcoded set of extensions, such as .doc, .docx, .pdf, and .rar, to its C2 server.


Torisma can send victim data to an actor-controlled C2 server.


TrickBot can send information about the compromised host and upload data to a hardcoded C2 server.


Ursnif has used HTTP POSTs to exfil gathered information.


Valak has the ability to exfiltrate data over the C2 channel.


XCSSET exfiltrates data stolen from a system over its C2 channel.


ZLib has sent data and files from a compromised host to its C2 servers.


njRAT has used HTTP to receive stolen information from the infected machine.


APT32 performed network scanning on the network to search for open ports, services, OS finger-printing, and other vulnerabilities.


APT34 has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.


APT39 has used CrackMapExec and a custom port scanner known as BLUETORCH for network scanning.


Backdoor.Oldrea can use a network scanning module to identify ICS-related ports.


BlackEnergy has conducted port scans on a host.


BlackTech has used the SNScan tool to find other potential targets on victim networks.


China Chopper's server component can spider authentication portals.


Cobalt Group leveraged an open-source tool called SoftPerfect Network Scanner to perform network scanning.


Conficker scans for other machines to infect.


CostaRicto employed nmap and pscan to scan target environments.


During CostaRicto, the threat actors employed nmap and pscan to scan target environments.


During Operation Wocao, threat actors scanned for open ports and used nbtscan to find NETBIOS nameservers.


HDoor scans to identify open ports on the victim.


HermeticWizard has the ability to scan ports on a compromised network.


Industroyer uses a custom port scanner to map out a network.


InvisiMole can scan the network for open ports and vulnerable instances of RDP and SMB protocols.


Koadic can scan for open TCP ports on the target network.


Lucifer can scan for open ports including TCP ports 135 and 1433.


NBTscan can be used to scan IP networks.


OilRig has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.


Operation Wocao has scanned for open ports and used nbtscan to find NETBIOS nameservers.


Peirates can initiate a port scan against a given IP address.


PoshC2 can perform port scans from an infected host.


Pupy has a built-in module for port scanning.


Pysa can perform network reconnaissance using the Advanced Port Scanner tool.


Rocke conducted scanning for exposed TCP port 7001 as well as SSH and Redis servers.


SILENTTRINITY can scan for open ports on a compromised machine.


SpeakUp checks for availability of specific ports on servers.


Suckfly the victim's internal network for hosts with ports 8080, 5900, and 40 open.


TeamTNT has used masscan to search for open Docker API ports and Kubernetes clusters. TeamTNT has also used malware that utilizes zmap and zgrab to search for vulnerable services in cloud environments.


menuPass has used tcping.exe, similar to Ping, to probe port status on systems of interest.


A BlackEnergy 2 plug-in uses WMI to gather victim host details.


A Threat Group-3390 tool can use WMI to execute a binary.


APT29 used WMI to steal credentials and execute backdoors at a future time. They have also used WMI for the remote execution of files for lateral movement.


APT32 used WMI to deploy their tools on remote machines and to gather information about the Outlook process.


APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit.


Agent Tesla has used wmi queries to gather information from the system.


Blue Mockingbird has used wmic.exe to set environment variables.


Bumblebee can use WMI to gather system information and to spawn processes for code injection.


CharmPower can use `wmic` to gather information from a system.


Chimera has used WMIC to execute remote commands.


CrackMapExec can execute remote commands using Windows Management Instrumentation.


DarkWatchman can use WMI to execute commands.


During C0015, the threat actors used `wmic` and `rundll32` to load Cobalt Strike onto a target host.


During Frankenstein, the threat actors used WMI queries to check if various security applications were running as well as to determine the operating system version.


EKANS can use Windows Mangement Instrumentation (WMI) calls to execute operations.


EVILNUM has used the Windows Management Instrumentation (WMI) tool to enumerate infected machines.


Earth Lusca used a VBA script to execute WMI.


Emotet has used WMI to execute powershell.exe.


Empire can use WMI to deliver a payload to a remote host.


EvilBunny has used WMI to gather information about the system.


FELIXROOT uses WMI to query the Windows Registry.


FIN6 has used WMI to automate the remote execution of PowerShell scripts.


FIN7 has used WMI to install malware on targeted systems.


FIN8's malicious spearphishing payloads use WMI to launch malware and spawn cmd.exe execution. FIN8 has also used WMIC for lateral movement as well as during and post compromise cleanup activities.


FlawedAmmyy leverages WMI to enumerate anti-virus on the victim.


Frankenstein has used WMI queries to check if various security applications were running, as well as the operating system version.


FunnyDream can use WMI to open a Windows command shell on a remote machine.


GALLIUM used WMI for execution to assist in lateral movement as well as for installing tools across multiple assets.


Gamaredon Group has used WMI to execute scripts used for discovery.


GravityRAT collects various information via WMI requests, including CPU information in the Win32_Processor entry (Processor ID, Name, Manufacturer and the clock speed).


HALFBAKED can use WMI queries to gather system information.


HELLOKITTY can use WMI to delete volume shadow copies.


HOPLIGHT has used WMI to recompile the Managed Object Format (MOF) files in the WMI repository.


HermeticWizard can use WMI to create a new process on a remote machine via `C:\windows\system32\cmd.exe /c start C:\windows\system32\\regsvr32.exe /s /iC:\windows\<filename>.dll`.


IcedID has used WMI to execute binaries.


Impacket's wmiexec module can be used to execute commands through WMI.


Lazarus Group has used WMIC for discovery as well as to execute payloads for persistence and lateral movement.


Lucifer can use WMI to log into remote machines for propagation.


Magic Hound has used a tool to run `cmd /c wmic computersystem get domain` for discovery.


Maze has used WMI to attempt to delete the shadow volumes on a machine, and to connect a virtual machine to the network domain of the victim organization's network.


Meteor can use `wmic.exe` as part of its effort to delete shadow copies.


Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI.


Mosquito's installer uses WMI to search for antivirus display names.


MuddyWater has used malware that leveraged WMI for execution and querying host information.


Naikon has used WMIC.exe for lateral movement.


Netwalker can use WMI to delete Shadow Volumes.


NotPetya can use "wmic" to help propagate itself across a network.


Octopus has used wmic.exe for local discovery information.


OopsIE uses WMI to perform discovery techniques.


POWERSTATS can use WMI queries to retrieve data from compromised hosts.


POWRUNER may use WMI when collecting information about a victim.


ProLock can use WMIC to execute scripts on targeted hosts.


PyDCrypt has attempted to execute with WMIC.


RATANKBA uses WMI to perform process monitoring.


REvil can use WMI to monitor for and kill specific processes listed in its configuration file.


Remexi executes received commands with wmic.exe (for WMI commands).


RogueRobin uses various WMI queries to check if the sample is running in a sandbox.


SILENTTRINITY can use WMI for lateral movement.


SUNBURST used the WMI query "Select * From Win32_SystemDriver" to retrieve a driver listing.


Sandworm Team has used VBScript to run WMI queries.


Stuxnet used WMI with an "explorer.exe" token to execute on a remote share.


SysUpdate can use WMI for execution on a compromised host.


UNC2452 used WMI for the remote execution of files for lateral movement.


Ursnif droppers have used WMI classes to execute PowerShell commands.


Valak can use "wmic process call create" in a scheduled task to launch plugins and for execution.


WannaCry utilizes "wmic" to delete shadow copies.


Windshift has used WMI to collect information about target machines.


Wizard Spider has used WMI and LDAP queries for network discovery and to move laterally.


jRAT uses WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.


Bundlore uses the "curl -s -L -o" command to exfiltrate archived data to a URL.


FrameworkPOS can use DNS tunneling for exfiltration of credit card data.


Hydraq connects to a predefined domain on port 443 to exfil gathered information.


Kobalos can exfiltrate credentials over the network via UDP.


PoetRAT has used a .NET tool named dog.exe to exiltrate information over an e-mail account.


APT28 has exfiltrated archives of collected data previously staged on a target's OWA server via HTTPS.


APT29 has exfiltrated collected data over a simple HTTPS request to a password-protected archive staged on a victim's OWA servers.


UNC2452 exfiltrated collected data over a simple HTTPS request to a password-protected archive staged on a victim's OWA servers.


APT32's backdoor can exfiltrate data by encoding it in the subdomain field of DNS packets.


Agent Tesla has routines for exfiltration over SMTP, FTP, and HTTP.


BITSAdmin can be used to create BITS Jobs to upload files from a compromised host.


CORALDECK has exfiltrated data in HTTP POST headers.


Carbon uses HTTP to send data to the C2 server.


CharmPower can send victim data via FTP with credentials hardcoded in the script.


Cherry Picker exfiltrates files over FTP.


CookieMiner has used the "curl --upload-file" command to exfiltrate data over HTTP.


CosmicDuke exfiltrates collected files over FTP or WebDAV. Exfiltration servers can be separately configured from C2 servers.


Dok exfiltrates logs of its execution stored in the "/tmp" folder over FTP using the "curl" command.


FIN8 has used FTP to exfiltrate collected data.


Kessel can exfiltrate credentials and other information via HTTP POST request, TCP, and DNS.


Lazarus Group malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims.


Remsec can exfiltrate data via a DNS tunnel or email, separately from its C2 channel.


Some Brave Prince variants have used South  Korea's Daum email service to exfiltrate information, and later variants have posted the data to a web server via an HTTP post command.


Thrip has used WinSCP to exfiltrate data from a targeted organization over FTP.


WindTail has the ability to automatically exfiltrate files using the macOS built-in utility /usr/bin/curl.


Wizard Spider has exfiltrated victim information using FTP.


ccf32 can upload collected data and files to an FTP server.


ftp may be used to exfiltrate data separate from the main command and control protocol.


APT32 used the "netstat -anpo tcp" command to display TCP connections on the victim's machine.


APT38 installed a port monitoring tool, MAPMAKER, to print the active TCP connections on the local system.


Andariel has used the "netstat -naop tcp" command to display TCP connections on a victim's machine.


Aria-body has the ability to gather TCP and UDP table status listings.


Babuk can use “WNetOpenEnumW” and “WNetEnumResourceW” to enumerate files in network resources for encryption.


BackdoorDiplomacy has used NetCat and PortQry  to enumerate network connections and display the status of related TCP and UDP ports.


BlackEnergy has gathered information about local network connections using netstat.


Carbon uses the "netstat -r" and "netstat -an" commands.


Chimera has used "netstat -ano | findstr EST" to discover network connections.


Cobalt Strike can produce a sessions report from compromised hosts.


Commands such as "net use" and "net session" can be used in Net to gather information about network connections from a particular host.


Comnie executes the "netstat -ano" command.


Conti can enumerate routine network connections from a compromised host.


Cuba can use the function "GetIpNetTable" to recover the last connections to the victim's machine.


Dtrack can collect network and active connection information.


During FunnyDream, the threat actors used netstat to discover network connections on remote systems.


During Operation Wocao, threat actors collected a list of open connections on the infected system using `netstat` and checks whether it has an internet connection.


Egregor can enumerate all connected drives.


Empire can enumerate the current network connections of a host.


Epic uses the "net use", "net session", and "netstat" commands to gather information on network connections.


GravityRAT uses the "netstat" command to find open ports on the victim’s machine.


KONNI has used "net session" on the victim's machine.


Ke3chang performs local network connection discovery using "netstat".


Kwampirs collects a list of active and listening connections by using the command "netstat -nao" as well as a list of available network mappings with "net use".


Lazarus Group has used "net use" to identify and establish a network connection with a remote host.


Lucifer can identify the IP and port numbers for all remote connections from the compromised host.


Machete uses the "netsh wlan show networks mode=bssid" and "netsh wlan show interfaces" commands to list all nearby WiFi networks and connected interfaces.


Magic Hound has used quser.exe to identify existing RDP connections.


Maze has used the "WNetOpenEnumW", "WNetEnumResourceW”, “WNetCloseEnum” and “WNetAddConnection2W” functions to enumerate the network resources on the infected machine.


NETWIRE can capture session logon details from a compromised host.


OilRig has used "netstat -an" on a victim to get a listing of network connections.


Okrum was seen using NetSess to discover NetBIOS sessions.


PlugX has a module for enumerating TCP and UDP network connections and associated processes using the "netstat" command.


Poseidon Group obtains and saves information about victim network interfaces and addresses.


PoshC2 contains an implementation of netstat to enumerate TCP and UDP connections.


Pupy has a built-in utility command for "netstat", can do net session through PowerView, and has an interactive shell which can be used to discover additional information.


PyDCrypt has used netsh to find RPC connections on remote machines.


QakBot can use "netstat" to enumerate current network connections.


RATANKBA uses "netstat -ano" to search for specific IP address ranges.


Ramsay can use "netstat" to enumerate network connections.


RedLeaves can enumerate drives and Remote Desktop sessions.


SHOTPUT uses netstat to list TCP connection status.


SLOTHFULMEDIA can enumerate open ports on a victim machine.


Sandworm Team had gathered user, IP address, and server data related to RDP sessions on a compromised host. It has also accessed network diagram files useful for understanding how a host's network was configured.


ShimRatReporter used the Windows function "GetExtendedUdpTable" to detect connected UDP endpoints.


Sibot has retrieved a GUID associated with a present LAN connection on a compromised machine.


Sliver can collect network connection information.


Sykipot may use "netstat -ano" to display active network connections.


TeamTNT has run "netstat -anp" to search for rival malware connections. TeamTNT has also used `libprocesshider` to modify "/etc/ld.so.preload".


The discovery modules used with Duqu can collect information on network connections.


Threat Group-3390 has used `net use` and `netstat` to conduct internal discovery of systems. The group has also used `quser.exe` to identify existing RDP sessions on a victim.


Tropic Trooper has tested if the localhost network is available and other connection capability on an infected system using command scripts.


USBferry can use "netstat" and "nbtstat" to detect active network connections.


Volgmer can gather information about TCP connection state.


Waterbear can use API hooks on `GetExtendedTcpTable` to retrieve a table containing a list of TCP endpoints available to the application.


Zebrocy uses "netstat -aon" to gather network connection information.


admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to display network connections: "netstat -ano >> %temp%\download"


menuPass has used "net use" to conduct connectivity checks to machines.


netstat can be used to enumerate local network connections, including active TCP connections and other network statistics.


Agent.btz creates a file named thumb.dd on all USB flash drives connected to the victim. This file contains information about the infected system and activity logs.


Mustang Panda has used a customized PlugX variant which could exfiltrate documents from air-gapped networks.


Remsec contains a module to move data from airgapped networks to Internet-connected systems by using a removable USB device.


SPACESHIP copies staged data to removable drives when they are inserted into the system.


USBStealer exfiltrates collected files via removable media from air-gapped victims.


Dragonfly has used a scheduled task to execute a malicious file.


Earth Lusca used the command "schtasks /Create /SC ONLOgon /TN WindowsUpdateCheck /TR “[file path]” /ru system" for persistence.


BRONZE BUTLER has used at to register a scheduled task to execute malware during lateral movement.


CrackMapExec can set a scheduled task on the target system to execute commands remotely using at.


at can be used to schedule a task on a system to be executed at a specific date or time.


Anchor can install itself as a cron job.


Exaramel for Linux uses crontab for persistence if it does not have root privileges.


Janicab used a cron job for persistence on Mac devices.


Kinsing has used crontab to download and run shell scripts every minute to ensure persistence.


Penquin can use Cron to create periodic and pre-scheduled background jobs.


Rocke installed a cron job that downloaded and executed files from the C2.


Skidmap has installed itself via crontab.


SpeakUp uses cron tasks to ensure persistence.


The GoldMax Linux variant has used a crontab entry with a "@reboot" line to gain persistence.


A Patchwork file stealer can run a TaskScheduler DLL to add persistence.


APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.


APT32 has used scheduled tasks to persist on victim systems.


APT33 has created a scheduled task to execute a .vbe file multiple times a day.


APT37 has created scheduled tasks to run malicious scripts on a compromised host.


APT39 has created scheduled tasks for persistence.


APT41 used a compromised account to create a scheduled task on a system.


Anchor can create a scheduled task for persistence.


AppleJeus has created a scheduled SYSTEM task that runs when a user logs in.


Attor's installer plugin can schedule a new task that loads the dispatcher on boot/logon.


BADNEWS creates a scheduled task to establish by executing a malicious payload every subsequent minute.


BITTER has used scheduled tasks for persistence and execution.


BONDUPDATER persists using a scheduled task that executes every minute.


BRONZE BUTLER has used schtasks to register a scheduled task to execute malware during lateral movement.


BabyShark has used scheduled tasks to maintain persistence.


BackConfig has the ability to use scheduled tasks to repeatedly execute malicious payloads on a compromised host.


Blue Mockingbird has used Windows Scheduled Tasks to establish persistence on local and remote hosts.


Carbon creates several tasks for later execution to continue persistence on the victim’s machine.


Cobalt Group has created Windows tasks to establish persistence.


ComRAT has used a scheduled task to launch its PowerShell loader.


Confucius has created scheduled tasks to maintain persistence on a compromised host.


CostaRicto has used scheduled tasks to download backdoor tools.


Crutch has the ability to persist using scheduled tasks.


Dragonfly 2.0 used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files.


Dragonfly has used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files.


During Frankenstein, the threat actors established persistence through a scheduled task using the command: `/Create /F /SC DAILY /ST 09:00 /TN WinUpdate /TR`, named "WinUpdate"


During Operation Wocao, threat actors used scheduled tasks to execute malicious PowerShell code on remote systems.


Empire has modules to interact with the Windows task scheduler.


EvilBunny has executed commands via scheduled tasks.


FIN10 has established persistence by using S4U tasks as well as the Scheduled Task option in PowerShell Empire.


FIN6 has used scheduled tasks to establish persistence for various malware it uses, including downloaders known as HARDTACK and SHIPBREAD and FrameworkPOS.


FIN7 malware has created scheduled tasks to establish persistence.


FIN8 has used scheduled tasks to maintain RDP backdoors.


Fox Kitten has used Scheduled Tasks for persistence and to load and execute a reverse proxy binary.


Frankenstein has established persistence through a scheduled task using the command: " /Create /F /SC DAILY /ST 09:00 /TN WinUpdate /TR ", named "WinUpdate".


GALLIUM established persistence for PoisonIvy by created a scheduled task.


GRIFFON has used "sctasks" for persistence.


Gamaredon Group has created scheduled tasks to launch executables after a designated number of minutes have passed.


Gazer can establish persistence by creating a scheduled task.


GoldMax has used scheduled tasks to maintain persistence.


Goopy has the ability to maintain persistence by creating scheduled tasks set to run every hour.


GravityRAT creates a scheduled task to ensure it is re-executed everyday.


GrimAgent has the ability to set persistence using the Task Scheduler.


HEXANE has used a scheduled task to establish persistence for a keylogger.


Helminth has used a scheduled task for persistence.


HotCroissant has attempted to install a scheduled task named “Java Maintenance64” on startup to establish persistence.


ISMInjector creates scheduled tasks to establish persistence.


IronNetInjector has used a task XML file named "mssch.xml" to run an IronPython script when a user logs in or when specific system events are created.


JHUHUGIT has registered itself as a scheduled task to run each time the current user logs in.


JSS Loader has the ability to launch scheduled tasks to establish persistence.


Koadic has used scheduled tasks to add persistence.


LitePower can create a scheduled task to enable persistence mechanisms.


Lokibot embedded the commands "schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I" inside a batch script.


Lucifer has established persistence by creating the following scheduled task "schtasks /create /sc minute /mo 1 /tn QQMusic ^ /tr C:Users\%USERPROFILE%\Downloads\spread.exe /F".


MCMD can use scheduled tasks for persistence.


Machete has created scheduled tasks to maintain Machete's persistence.


Machete used scheduled tasks for persistence.


Maze has created scheduled tasks using name variants such as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update", to launch Maze at a specific time.


Meteor execution begins from a scheduled task named `Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeAll` and it creates a separate scheduled task called `mstask` to run the wiper only once at 23:55:00.


Milan can establish persistence on a targeted host with scheduled tasks.


MuddyWater has used scheduled tasks to establish persistence.


Mustang Panda has created a scheduled task to execute additional malicious software, as well as maintain persistence.


NETWIRE can create a scheduled task to establish persistence.


Okrum's installer can attempt to achieve persistence by creating a scheduled task.


One persistence mechanism used by CozyCar is to register itself as a scheduled task.


OopsIE creates a scheduled task to run itself every three minutes.


Operation Wocao has used scheduled tasks to execute malicious PowerShell code on remote systems.


PowerSploit's "New-UserPersistenceOption" Persistence argument can be used to establish via a Scheduled Task/Job.


Pteranodon schedules tasks to invoke its components in order to establish persistence.


QUADAGENT creates a scheduled task to maintain persistence on the victim’s machine.


RTM tries to add a scheduled task to establish persistence.


RainyDay can use scheduled tasks to achieve persistence.


Ramsay can schedule tasks via the Windows COM API to maintain persistence.


Rancor launched a scheduled task to gain persistence using the "schtasks /create /sc" command.


Remexi utilizes scheduled tasks as a persistence mechanism.


RemoteCMD can execute commands remotely by creating a new schedule task on the remote system


Ryuk can remotely create a scheduled task to execute itself on a system.


SQLRat has created scheduled tasks in "%appdata%\Roaming\Microsoft\Templates\".


Saint Bot has created a scheduled task named "Maintenance" to establish persistence.


ServHelper contains modules that will use schtasks to carry out malicious operations.


SharpStage has a persistence component to write a scheduled task for the payload.


Stealth Falcon malware creates a scheduled task entitled “IE Web Cache” to execute a malicious file hourly.


Stuxnet schedules a network job to execute two minutes after host infection.


TEMP.Veles has used scheduled task XML triggers.


Tarrask is able to create “hidden” scheduled tasks for persistence.


Tomiris has used `SCHTASKS /CREATE /SC DAILY /TN StartDVL /TR "[path to self]" /ST 10:00` to establish persistence.


TrickBot creates a scheduled task on the system that provides persistence.


Zebrocy has a command to create a scheduled task for persistence.


ccf32 can run on a daily basis using a scheduled task.


menuPass has used a script (atexec.py) to execute a command on a target machine via Task Scheduler.


schtasks is used to schedule tasks on a Windows system to run at a specific date and time.


yty establishes persistence by creating a scheduled task with the command "SchTasks /Create /SC DAILY /TN BigData /TR “ + path_file + “/ST 09:30“".


zwShell has used SchTasks for execution.


ABK has the ability to inject shellcode into svchost.exe.


APT32 malware has injected a Cobalt Strike beacon into Rundll32.exe.


APT37 injects its malware variant, ROKRAT, into the cmd.exe process.


APT41 malware TIDYELF loaded the main WINTERLOVE component by injecting it into the iexplore.exe process.


Agent Tesla can inject into known, vulnerable binaries on targeted hosts.


Attor's dispatcher can inject itself into running processes to gain higher privileges and to evade detection.


AuditCred can inject code from files to other running processes.


Avenger has the ability to inject shellcode into svchost.exe.


BBK has the ability to inject shellcode into svchost.exe.


Bumblebee can inject code into multiple processes on infected endpoints.


Cardinal RAT injects into a newly spawned process created from a native Windows executable.


Clambling can inject into the `svchost.exe` process for execution.


Cobalt Group has injected code into trusted processes.


Donut includes a subproject "DonutTest" to inject shellcode into a target process.


During Operation Sharpshooter, threat actors leveraged embedded shellcode to inject a downloader into the memory of Word.


During Operation Wocao, threat actors injected code into a selected process, which in turn launches a command as a child process of the original.


Gazer injects its communication module into an Internet accessible process through which it performs C2.


GuLoader has the ability to inject shellcode into a donor processes that is started in a suspended state. GuLoader has previously used RegAsm as a donor process.


HOPLIGHT has injected into running processes.


HiddenWasp adds itself to the LD_PRELOAD path and sets a series of environment variables.


Honeybee uses a batch file to load a DLL into the svchost.exe process.


InvisiMole can inject itself into another process to avoid detection including use of a technique called ListPlanting that customizes the sorting algorithm in a ListView structure.


IronNetInjector can use an IronPython scripts to load a .NET injector to inject a payload into its own or a remote process.


JHUHUGIT performs code injection injecting its own functions to browser processes.


JPIN can inject content into lsass.exe to load a module.


Kimsuky has used Win7Elevate to inject malicious code into explorer.exe.


Lizar can migrate the loader into another process.


Mis-Type has been injected directly into a running process, including `explorer.exe`.


NETWIRE can inject code into system processes including notepad.exe, svchost.exe, and vbc.exe.


NavRAT copies itself into a running Internet Explorer process to evade detection.


PLATINUM has used various methods of process injection including hot patching.


Pandora can start and inject code into a new `svchost` process.


PoshC2 contains multiple modules for injecting into processes, such as "Invoke-PSInject".


QakBot can inject itself into processes including explore.exe, Iexplore.exe, and Mobsync.exe.


REvil can inject itself into running processes on a compromised host.


ROKRAT can use `VirtualAlloc`, `WriteProcessMemory`, and then `CreateRemoteThread` to execute shellcode within the address space of `Notepad.exe`.


SILENTTRINITY can inject shellcode directly into Excel.exe or a specific process.


SLOTHFULMEDIA can inject into running processes on a compromised host.


ShadowPad has injected an install module into a newly created process.


Silence has injected a DLL library containing a Trojan into the fwmain32.exe process.


Smoke Loader injects into the Internet Explorer process.


StoneDrill has relied on injecting its payload directly into the process memory of the victim's preferred browser.


The PcShare payload has been injected into the `logagent.exe` and `rdpclip.exe` processes.


TrickBot has used "Nt*" Native API functions to inject code into legitimate processes such as "wermgr.exe".


Turla has also used PowerSploit's "Invoke-ReflectivePEInjection.ps1" to reflectively load a PowerShell payload into a random process on the victim system.


WarzoneRAT has the ability to inject malicious DLLs into a specific process for privilege escalation.


Waterbear can inject decrypted shellcode into the LanmanServer service.


Wiarp creates a backdoor through which remote attackers can inject files into running processes.


Wingbird performs multiple process injections to hijack system processes and execute malicious code.


gh0st RAT can inject malicious code into process created by the “Command_Create&Inject” function.


injects a malicious DLL into the IExplorer.exe process.


A Lazarus Group malware sample performs reflective DLL injection.


After decrypting itself in memory, RARSTONE downloads a DLL file from its C2 server and loads it in the memory space of a hidden Internet Explorer process. This “downloaded” file is actually not dropped onto the system.


Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe.


Carberp's bootkit can inject a malicious DLL into the address space of running processes.


Carbon has a command to inject code into a process.


Duqu will inject itself into different processes to evade detection. The selection of the target process is influenced by the security software that is installed on the system (Duqu will inject into different processes depending on which security suite is installed on the infected host).


During C0015, the threat actors used a DLL named `D8B3.dll` that was injected into the Winlogon process.


Dyre injects into other processes to load modules.


Elise injects DLL files into iexplore.exe.


Emissary injects its DLL file into a newly spawned Internet Explorer process.


Emotet has been observed injecting in to Explorer.exe and other processes.


Gelsemium has the ability to inject DLLs into specific processes.


Get2 has the ability to inject DLLs into processes.


HIDEDRV injects a DLL for Downdelph into the explorer.exe process.


If running in a Windows environment, Kazuar saves a DLL to disk that is injected into the explorer.exe process to execute the payload. Kazuar can also be configured to inject and execute within specific processes.


Koadic can perform process injection by using a reflective DLL.


Leviathan has utilized techniques like reflective DLL loading to write a DLL into memory and load a shell that provides backdoor access to the victim.


Matryoshka uses reflective DLL injection to inject the malicious library and execute the RAT.


Maze has injected the malware DLL into a target process.


MegaCortex loads "injecthelper.dll" into a newly created "rundll32.exe" process.


Metamorfo has injected a malicious DLL into the Windows Media Player process (wmplayer.exe).


Mongall can inject a DLL into `rundll32.exe` for execution.


PS1 can inject its payload DLL Into memory.


PipeMon can inject its modules into various processes using reflective DLL loading.


PoisonIvy can inject a malicious DLL into a process.


Pupy can migrate into another process using reflective DLL injection.


RATANKBA performs a reflective DLL injection using a given pid.


SDBbot has the ability to inject a downloaded DLL into a newly created rundll32.exe process.


Saint Bot has injected its DLL component into `EhStorAurhn.exe`.


Socksbot creates a suspended svchost process and injects its DLL into it.


SombRAT can execute "loadfromfile", "loadfromstorage", and "loadfrommem" to inject a DLL  from disk, storage, or memory respectively.


Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.


Sykipot injects itself into running instances of outlook.exe, iexplore.exe, or firefox.exe.


The Bumblebee loader can support the `Dij` command which gives it the ability to inject DLLs into the memory of other processes.


The FunnyDream FilepakMonitor component can inject into the Bka.exe process using the `VirtualAllocEx`, `WriteProcessMemory` and `CreateRemoteThread` APIs to load the DLL component.


The Netwalker DLL has been injected reflectively into the memory of a legitimate running process.


Tropic Trooper has injected a DLL backdoor into dllhost.exe and svchost.exe.


Turla has used Metasploit to perform reflective DLL injection in order to escalate privileges.


Wizard Spider has injected malicious DLLs into memory with read, write, and execute permissions.


ZxShell is injected into a shared SVCHOST process.


Carbanak downloads an executable and injects it directly into a new process.


GreyEnergy has a module to inject a PE binary into a remote process.


Lizar can execute PE files in the address space of the specified process.


Rocke's miner, "TermsHost.exe", evaded defenses by injecting itself into Windows processes, including Notepad.exe.


Zeus Panda checks processes on the system and if they meet the necessary requirements, it injects into that process.


Gazer performs thread execution hijacking to inject its orchestrator into a running thread from a remote process.


Trojan.Karagany can inject a suspended thread of its own process into a new process and initiate via the "ResumeThread" API.


Waterbear can use thread injection to inject shellcode into the process of security software.


Attor performs the injection by attaching its code into the APC queue using NtQueueApcThread API.


Bumblebee can use asynchronous procedure call (APC) injection to execute commands received from C2.


Carberp has queued an APC routine to explorer.exe by calling ZwQueueApcThread.


FIN8 has injected malicious code into a new svchost.exe process.