Clambling has the ability to enumerate network shares.


Cobalt Strike can query shared drives on the local system.


Conti can enumerate remote open SMB network shares using "NetShareEnum()".


Cuba can discover shared resources using the "NetShareEnum" API call.


DarkVishnya scanned the network for public shared folders.


During Operation CuckooBees, the threat actors used the `net share` command as part of their advanced reconnaissance.


During Operation Wocao, threat actors discovered network disks mounted to the system using netstat.


Empire can find shared drives on the local system.


FIVEHANDS can enumerate network shares and mounted drives on a network.


HELLOKITTY has the ability to enumerate network resources.


Koadic can scan local network for open SMB.


Kwampirs collects a list of network shares with the command "net share".


Olympic Destroyer will attempt to enumerate mapped network shares to later attempt to wipe all files on those shares.


PlugX has a module to enumerate network shares.


Pupy can list local and remote shared drives and folders over SMB.


QakBot can use "net share" to identify network shares for use in lateral movement.


QuietSieve can identify and search networked drives for specific file name extensions.


SILENTTRINITY can enumerate shares on a compromised host.


Stuxnet enumerates the directories of a network resource.


The "net view \\remotesystem" and "net share" commands in Net can be used to find shared drives and directories on remote and local systems respectively.


Tonto Team has used tools such as NBTscan to enumerate network shares.


TrickBot module shareDll/mshareDll discovers network shares via the WNetOpenEnumA API.


Tropic Trooper used "netview" to scan target systems for shared resources.


WastedLocker can identify network adjacent and accessible drives.


WhisperGate can enumerate connected remote logical drives.


Wizard Spider has used the “net view” command to locate mapped network shares.


Zebrocy identifies network drives when they are added to victim systems.


Dragonfly created accounts that appeared to be tailored to each individual staging target.


Indrik Spider used "wmic.exe" to add a new user to the system.


Sandworm Team added a login to a SQL Server with "sp_addlinkedsrvlogin".


APT3 has been known to create or enable accounts, such as "support_388945a0".


APT39 has created accounts on multiple compromised hosts to perform actions within the network.


APT41 created user accounts and adds them to the User and Admin groups.


Dragonfly 2.0 created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target.


Flame can create backdoor accounts with login “HelpAssistant” on domain connected systems if appropriate rights are available.


Fox Kitten has created a local user account with administrator privileges.


GoldenSpy can create new users on an infected system.


Hildegard has created a user named “monerodaemon”.


Kimsuky has created accounts with "net user".


Leafminer used a tool called Imecab to set up a persistent remote access account on the victim machine.


Magic Hound has created a user named `DefaultAccount` on compromised machines and assigned it to the Administrators and Remote Desktop Users groups.


Mis-Type may create a temporary user on the system named `Lost_{Unique Identifier}`.


Pupy can user PowerView to execute “net user” commands and create local system accounts.


SMOKEDHAM has created user accounts and added them to local Admin groups.


ServHelper has created a new user and added it to the "Remote Desktop Users" and "Administrators" groups.


TeamTNT has created local privileged users on victim machines.


The "net user username \password" commands in Net can be used to create a local account.


ZxShell has a feature to create local user accounts.


HAFNIUM has created and granted privileges to domain accounts.


PsExec has the ability to remotely create accounts on target systems.


Pupy can user PowerView to execute “net user” commands and create domain accounts.


Sandworm Team has created new domain accounts on an ICS access server.


The "net user username \password \domain" commands in Net can be used to create a domain account.


APT29 can create new users through Azure AD.


APT32 have replaced Microsoft Outlook's VbaProject.OTM file to install a backdoor macro for persistence.


Gamaredon Group has inserted malicious macros into existing documents, providing persistence when they are reopened. Gamaredon Group has loaded the group's previously delivered VBA project by relaunching Microsoft Outlook with the "/altvba" option, once the Application.Startup event is received.


Ruler can be used to automate the abuse of Outlook Rules, Forms, and Home Pages to establish persistence.


BackConfig has the ability to use hidden columns in Excel spreadsheets to store executable files or commands for VBA macros.


Cobalt Strike has the ability to use an Excel Workbook to execute additional code by enabling Office to trust macros and execute code without user permission.


MuddyWater has used a Word Template, Normal.dotm, for persistence.


APT28 has used the Office Test persistence mechanism within Microsoft Office by adding the Registry key "HKCU\Software\Microsoft\Office test\Special\Perf" to execute code.


OilRig has abused the Outlook Home Page feature for persistence. OilRig has also used CVE-2017-11774 to roll back the initial patch designed to protect against Home Page abuse.


Ruler can be used to automate the abuse of Outlook Home Pages to establish persistence.


Bisonal has been loaded through a `.wll` extension added to the ` %APPDATA%\microsoft\word\startup\` repository.


Naikon has used the RoyalRoad exploit builder to drop a second stage loader, intel.wll, into the Word Startup folder on the compromised host.


ABK has the ability to decrypt AES encrypted payloads.


APT29 used 7-Zip to decode its Raindrop malware.


APT34 has used certutil to decode base64-encoded files on victims.


APT39 has used malware to decrypt encrypted CAB files.


Agent Tesla has the ability to decrypt strings encrypted with the Rijndael symmetric encryption algorithm.


Amadey has decoded antivirus name strings.


An APT19 HTTP malware variant decrypts strings using single-byte XOR keys.


An APT28 macro uses the command "certutil -decode" to decode contents of a .txt file storing the base64 encoded payload.


AppleSeed can decode its payload prior to execution.


Aria-body has the ability to decrypt the loader configuration and payload DLL.


Astaroth uses a fromCharCode() deobfuscation method to avoid explicitly writing execution commands and to hide its code.


AuditCred uses XOR and RC4 to perform decryption on the code functions.


Avaddon has decrypted encrypted strings.


Azorult uses an XOR key to decrypt content and uses Base64 to decode the C2 address.


BADFLICK can decode shellcode using a custom rotating XOR cipher.


BBK has the ability to decrypt AES encrypted payloads.


BBSRAT uses Expand to decompress a CAB file into executable content.


BLINDINGCAN has used AES and XOR to decrypt its DLLs.


BRONZE BUTLER downloads encoded payloads and decodes them on the victim.


Babuk has the ability to unpack itself into memory using XOR.


BabyShark has the ability to decode downloaded files prior to execution.


BackConfig has used a custom routine to decrypt strings.


Bandook has decoded its PowerShell script.


Bazar can decrypt downloaded payloads. Bazar also resolves strings and other artifacts at runtime.


Bisonal has decoded strings in the malware using XOR and RC4.


BoomBox can decrypt AES-encrypted files downloaded from C2.


Bumblebee can deobfuscate C2 server responses and unpack its code on targeted hosts.


Bundlore has used "openssl" to decrypt AES encrypted payload data. Bundlore has also used base64 and RC4 with a hardcoded key to deobfuscate data.


Carbon decrypts task and configuration files for execution.


Cardinal RAT decodes many of its artifacts and is decrypted (AES-128) after being downloaded.


Chaes has decrypted an AES encrypted binary file to trigger the download of other files.


CharmPower can decrypt downloaded modules prior to execution.


Chrommme can decrypt its encrypted internal code.


Clambling can deobfuscate its payload prior to execution.


Clop has used a simple XOR operation to decrypt strings.


Cobalt Strike can deobfuscate shellcode using a rolling XOR and decrypt metadata from Beacon sessions.


CoinTicker decodes the initially-downloaded hidden encoded file using OpenSSL.


CookieMiner has used Google Chrome's decryption and extraction operations.


Crimson can decode its encoded PE file prior to execution.


Cyclops Blink can decrypt and parse instructions sent from C2.


DDKONG decodes an embedded configuration using XOR.


DarkWatchman has the ability to self-extract as a RAR archive.


Darkhotel has decrypted strings and imports using RC4 during execution.


Denis will decrypt important strings used for C&C communication.


Drovorub has de-obsfuscated XOR encrypted payloads in WebSocket messages.


Dtrack has used a decryption routine that is part of an executable physical patch.


During Frankenstein, the threat actors deobfuscated Base64-encoded commands following the execution of a malicious script, which revealed a small script designed to obtain an additional payload.


During Operation Dust Storm, attackers used VBS code to decode payloads.


During Operation Honeybee, malicious files were decoded prior to execution.


During execution, Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.


Earth Lusca has used certutil to decode a string into a cabinet file.


Ebury has verified C2 domain ownership by decrypting the TXT record using an embedded RSA public key.


Ecipekac has the ability to decrypt fileless loader modules.


Egregor has been decrypted before execution.


Exaramel for Linux can decrypt its configuration file.


Expand can be used to decompress a local or remote CAB file into an executable.


FatDuke can decrypt AES encrypted C2 communications.


FinFisher extracts and decrypts stage 3 malware, which is stored in encrypted resources.


For Operation Spalax, the threat actors used a variety of packers and droppers to decrypt malicious payloads.


Gelsemium can decompress and decrypt DLLs and shellcode.


GoldMax has decoded and decrypted the configuration file when executed.


Goopy has used a polymorphic decryptor to decrypt itself at runtime.


Green Lambert can use multiple custom routines to decrypt strings prior to execution.


GrimAgent can use a decryption algorithm for strings based on Rotate on Right (RoR) and Rotate on Left (RoL) functionality.


Hancitor has decoded Base64 encoded URLs to insert a recipient’s name into the filename of the Word document. Hancitor has also extracted executables from ZIP files.


HermeticWiper can decompress and copy driver files using `LZCopy`.


Heyoka Backdoor can decrypt its payload prior to execution.


Hildegard has decrypted ELF files with AES.


Honeybee drops a Word file containing a Base64-encoded file in it that is read, decoded, and dropped to the disk by the macro.


IceApple can use a Base64-encoded AES key to decrypt tasking.


Industroyer decrypts code to connect to a remote C2 server.


InvisiMole can decrypt, unpack and load a DLL from its resources, or from blobs encrypted with Data Protection API, two-key triple DES, and variations of the XOR cipher.


IronNetInjector has the ability to decrypt embedded .NET and PE payloads.


KGH_SPY can decrypt encrypted strings and write them to a newly created folder.


KOCTOPUS has deobfuscated itself before executing its commands.


Ke3chang has deobfuscated Base64-encoded shellcode strings prior to loading them.


Kerrdown can decode, decrypt, and decompress multiple layers of shellcode.


Kessel has decrypted the binary's configuration once the "main" function was launched.


Kobalos decrypts strings right after the initial communication, but before the authentication process.


Kwampirs decrypts and extracts a copy of its main DLL payload when executing.


Lazarus Group has used shellcode within macros to decrypt and manually map DLLs and shellcode into memory at runtime.


Leviathan has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.


LightNeuron has used AES and XOR to decrypt configuration files and commands.


LiteDuke has the ability to decrypt and decode multiple layers of obfuscation.


Lokibot has decoded and decrypted its stages multiple times using hard-coded keys to deliver the final payload, and has decoded its server response hex string using XOR.


Lucifer can decrypt its C2 address upon execution.


MacMa decrypts a downloaded file using AES-128-EBC with a custom delta.


MirageFox has a function for decrypting data containing C2 configuration information.


Molerats decompresses ZIP files once on the victim machine.


Mongall has the ability to decrypt its payload prior to execution.


Mori can resolve networking APIs from strings that are ADD-encrypted.


NativeZone can decrypt and decode embedded  Cobalt Strike beacon stage shellcode.


Netwalker's PowerShell script can decode and decrypt multiple layers of obfuscation, leading to the Netwalker DLL being loaded into memory.


OSX/Shlayer can base64-decode and AES-decrypt downloaded payloads. Versions of OSX/Shlayer pass encrypted and password-protected code to "openssl" and then write the payload to the "/tmp" folder.


Okrum's loader can decrypt the backdoor code, embedded within the loader or within a legitimate PNG file. A custom XOR cipher or RC4 is used for decryption.


One TYPEFRAME variant decrypts an archive using an RC4 key, then decompresses and installs the decrypted malicious DLL module. Another variant decodes the embedded file by XORing it with the value "0x35".


OnionDuke can use a custom decryption algorithm to decrypt strings.


OopsIE concatenates then decompresses multiple resources to load an embedded .Net Framework assembly.


P.A.S. Webshell can use a decryption mechanism to process a user supplied password and allow execution.


PUNCHBUGGY has used PowerShell to decode base64-encoded assembly.


PcShare has decrypted its strings by applying a XOR operation and a decompression using a custom implemented LZM algorithm.


Pillowmint has been decompressed by included shellcode prior to being launched.


PlugX decompresses and decrypts itself using the Microsoft API call RtlDecompressBuffer.


PoetRAT has used LZMA and base64 libraries to decode obfuscated scripts.


Proton uses an encrypted file to store commands and configuration values.


Pteranodon can decrypt encrypted data strings prior to using them.


PyDCrypt has decrypted and dropped the DCSrv payload to disk.


QUADAGENT uses AES and a preshared key to decrypt the custom Base64 routine used to encode strings and scripts.


QakBot can deobfuscate and re-assemble code strings for execution.


RDAT can deobfuscate the base64-encoded and AES-encrypted files downloaded from the C2 server.


REvil can decode encrypted strings to enable execution of commands and payloads.


RGDoor decodes Base64 strings and decrypts strings using a custom XOR algorithm.


ROKRAT can decrypt strings using the victim's hostname as the key.


Raindrop decrypted its Cobalt Strike payload using an AES-256 encryption algorithm in CBC mode with a unique key per sample.


Ramsay can extract its agent from the body of a malicious document.


RegDuke can decrypt strings with a key either stored in the Registry or hardcoded in the code.


Rising Sun has decrypted itself using a single-byte XOR scheme. Additionally, Rising Sun can decrypt its configuration data at runtime.


RogueRobin decodes an embedded executable using base64 and decompresses it.


SDBbot has the ability to decrypt and decompress its payload to enable code execution.


SUNSPOT decrypts SUNBURST, which was stored in AES128-CBC encrypted blobs.


Saint Bot can deobfuscate strings and files for execution.


Sandworm Team's VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder. The group also decrypted received information using the Triple DES algorithm and decompresses it using GZip.


ShadowPad has decrypted a binary blob to start execution.


ShimRat has decompressed its core DLL using shellcode once an impersonated antivirus component was running on a system.


Sibot can decrypt data received from a C2 and save to a file.


Skidmap has the ability to download, unpack, and decrypt tar.gz files .


SombRAT can run "upload" to decrypt and upload files from storage.


SoreFang can decode and decrypt exfiltrated data sent to C2.


Spark has used a custom XOR algorithm to decrypt the payload.


Squirrelwaffle has decrypted files and payloads using a XOR-based algorithm.


SysUpdate can deobfuscate packed binaries in memory.


TA505 has decrypted packed DLLs with an XOR key.


TEARDROP was decoded using a custom rolling XOR algorithm to execute a customized Cobalt Strike payload.


TSCookie has the ability to decrypt, load, and execute a DLL and its resources.


Taidoor can use a stream cipher to decrypt stings used by the malware.


TeamTNT has used a script that decodes a Base64-encoded version of WeaveWorks Scope.


The Chinoxy dropping function can initiate decryption of its config file.


ThreatNeedle can decrypt its payload using RC4, AES, or one-byte XORing.


Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload. Tropic Trooper also decrypted image files which contained a payload.


Turian has the ability to use a XOR decryption key to extract C2 server domains and IP addresses.


Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads.


Upon execution, Metamorfo has unzipped itself after being downloaded to the system and has performed string decryption.


Ursnif has used crypto key information stored in the Registry to decrypt Tor clients dropped to disk.


VaporRage can deobfuscate XOR-encoded shellcode prior to execution.


Volgmer deobfuscates its strings and APIs once its executed.


WIRTE has used Base64 to decode malicious VBS script.


WastedLocker's custom cryptor, CryptOne, used an XOR based algorithm to decrypt the payload.


Waterbear has the ability to decrypt its RC4 encrypted payload for execution.


WellMail can decompress scripts received from C2.


WellMess can decode and decrypt data received from C2.


WhisperGate can deobfuscate downloaded files stored in reverse byte order and decrypt embedded resources using multiple XOR operations.


WindTail has the ability to decrypt strings using hard-coded AES keys.


Winnti for Linux has decoded XOR encoded strings holding its configuration upon execution.


ZIRCONIUM has used the AES256 algorithm with a SHA1 derived key to decrypt exploit code.


Zebrocy decodes its secondary payload and writes it to the victim’s machine. Zebrocy also uses AES and XOR to decrypt strings and payloads.


ZeroT shellcode decrypts and decompresses its RC4-encrypted payload.


Zeus Panda decrypts strings in the code during the execution process.


certutil has been used to decode binaries hidden inside certificate files as Base64 information.


menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used "certutil -decode" to decode files on the victim’s machine when dropping UPPERCUT.


xCaon has decoded strings from the C2 server before executing commands.


Bundlore can install malicious browser extensions that are used to hijack user searches.


Kimsuky has used Google Chrome browser extensions to infect victims and to steal passwords and cookies.


Agent Tesla has the ability to use form-grabbing to extract data from web data forms.


Carberp has captured credentials when a user performs login through a SSL session.


Cobalt Strike can perform browser pivoting and inject into a user's browser to inherit cookies, authenticated HTTP sessions, and client SSL certificates.


Dridex can perform browser attacks via web injects to steal information such as credentials, certificates, and cookies.


QakBot can use advanced web injects to steal web banking credentials.


TrickBot uses web injects and browser redirection to trick the user into providing their login credentials on a fake or modified web page.


Ursnif has injected HTML codes into banking sites to steal sensitive online banking information (ex: usernames and passwords).


DarkHydrus used Template Injection to launch an authentication window for users to enter their credentials.


Dragonfly 2.0 has gathered hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems.


Dragonfly has gathered hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems.


APT19 performed a watering hole attack on forbes.com in 2014 to compromise targets.


APT32 has infected victims by tricking them into visiting compromised watering hole websites.


APT37 has used strategic web compromises, particularly of South Korean websites, to distribute malware. The group has also used torrent file-sharing sites to more indiscriminately disseminate malware to victims. As part of their compromises, the group has used a Javascript based profiler called RICECURRY to profile a victim's web browser and deliver malicious code accordingly.


APT38 has conducted watering holes schemes to gain initial access to victims.


Andariel has used watering hole attacks, often with zero-day exploits, to gain initial access to victims within a specific IP range.


Axiom has used watering hole attacks to gain access.


BRONZE BUTLER compromised three Japanese websites using a Flash exploit to perform watering hole attacks.


Bundlore has been spread through malicious advertisements on websites.


Dark Caracal leveraged a watering hole to serve up malicious code.


Darkhotel used embedded iframes on hotel login portals to redirect selected victims to download malware.


Dragonfly 2.0 compromised legitimate organizations' websites to create watering holes to compromise victims.


Dragonfly has compromised targets via strategic web compromise (SWC) utilizing a custom exploit kit.


During Operation Dust Storm, the threat actors used a watering hole attack on a popular software reseller to exploit the then-zero-day Internet Explorer vulnerability CVE-2014-0322.


Earth Lusca has performed watering hole attacks.


Elderwood has delivered zero-day exploits and malware to victims by injecting malicious code into specific public Web pages visited by targets within a particular sector.


Grandoreiro has used compromised websites and Google Ads to bait victims into downloading its installer.


KARAE was distributed through torrent file-sharing websites to South Korean victims, using a YouTube video downloader application as a lure.


Lazarus Group delivered RATANKBA and other malicious code to victims via a compromised legitimate website.


Leafminer has infected victims using watering holes.


Leviathan has infected victims using watering holes.


LoudMiner is typically bundled with pirated copies of Virtual Studio Technology (VST) for Windows and macOS.


Machete has distributed Machete through a fake blog website.


Magic Hound has conducted watering-hole attacks through media and magazine websites.


PLATINUM has sometimes used drive-by attacks against vulnerable browser plugins.


POORAIM has been delivered through compromised sites acting as watering holes.


Patchwork has used watering holes to deliver files with exploits to initial victims.


REvil has infected victim machines through compromised websites and exploit kits.


Threat Group-3390 has extensively used strategic web compromises to target victims.


Turla has infected victims using watering holes.


Windigo has distributed Windows malware via drive-by downloads.


Windshift has used compromised websites to register custom URL schemes on a remote system.


APT28 has used a variety of public exploits, including CVE 2020-0688 and CVE 2020-17144, to gain execution on vulnerable Microsoft Exchange; they have also conducted SQL injection attacks against external websites.


APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access. They have also exploited CVE-2020-0688 against the Microsoft Exchange Control Panel to regain access to a network.


APT39 has used SQL injection for initial compromise.


APT41 exploited CVE-2020-10189 against Zoho ManageEngine Desktop Central, and CVE-2019-19781 to compromise Citrix Application Delivery Controllers (ADC) and gateway devices.


Axiom has been observed using SQL injection to gain access to systems.


BackdoorDiplomacy has exploited CVE-2020-5902, an F5 BIP-IP vulnerability, to drop a Linux backdoor. BackdoorDiplomacy has also exploited mis-configured Plesk servers.


BlackTech has exploited a buffer overflow vulnerability in Microsoft Internet Information Services (IIS) 6.0, CVE-2017-7269, in order to establish a new HTTP or command and control (C2) server.


Dragonfly has conducted SQL injection attacks, exploited vulnerabilities CVE-2019-19781 and CVE-2020-0688 for Citrix and MS Exchange, and CVE-2018-13379 for Fortinet VPNs.


During Operation CuckooBees, the threat actors exploited multiple vulnerabilities in externally facing servers.


During Operation Wocao, threat actors gained initial access by exploiting vulnerabilities in JBoss webservers.


Earth Lusca has compromised victims by directly exploiting vulnerabilities of public-facing servers, including those associated with Microsoft Exchange and Oracle GlassFish.


Fox Kitten has exploited known vulnerabilities in Fortinet, PulseSecure, and Palo Alto VPN appliances.


HAFNIUM has exploited CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065  to compromise on-premises versions of Microsoft Exchange Server, enabling access to email accounts and installation of additional malware.


Havij is used to automate SQL injection.


Ke3chang has compromised networks by exploiting Internet-facing applications, including vulnerable Microsoft Exchange and SharePoint servers.


Kimsuky has exploited various vulnerabilities for initial access, including Microsoft Exchange vulnerability CVE-2020-0688.


Magic Hound has used open-source JNDI exploit kits to exploit Log4j (CVE-2021-44228) and has exploited ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) on MS Exchange servers.


MuddyWater has exploited the Microsoft Exchange memory corruption vulnerability (CVE-2020-0688).


Operation Wocao has gained initial access via vulnerable webservers.


Rocke exploited Apache Struts, Oracle WebLogic (CVE-2017-10271), and Adobe ColdFusion (CVE-2017-3066) vulnerabilities to deliver malware.


SoreFang can gain access by exploiting a Sangfor SSL VPN vulnerability that allows for the placement and delivery of malicious update binaries.


Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.


Volatile Cedar has targeted publicly facing web servers, with both automatic and manual vulnerability discovery.


menuPass has leveraged vulnerabilities in Pulse Secure VPNs to hijack sessions.


sqlmap can be used to automate exploitation of SQL injection vulnerabilities.


Elderwood has targeted manufacturers in the supply chain for the defense industry.


NotPetya's initial infection vector for the June 27, 2017 compromise was a backdoor in the Ukrainian tax accounting software M.E.Doc.


Smoke Loader was distributed through a compromised update to a Tor client with a coin miner payload.


XCSSET adds malicious code to a host's Xcode projects by enumerating CocoaPods "target_integrator.rb" files under the "/Library/Ruby/Gems" folder or enumerates all ".xcodeproj" folders under a given directory. XCSSET then downloads a script and Mach-O file into the Xcode project folder.


APT29 gained initial network access to some victims via a trojanized update of SolarWinds Orion software.


APT41 gained access to production environments where they could inject malicious code into legitimate, signed files and widely distribute them to end users.


Cobalt Group has compromised legitimate web browser updates to deliver a backdoor.


Dragonfly has placed trojanized installers for control system software on legitimate vendor app stores.


GOLD SOUTHFIELD has distributed ransomware by backdooring software installers via a strategic web compromise of the site hosting Italian WinRAR.


Gelsemium has compromised software supply chains to gain access to victims.


GoldenSpy has been packaged with a legitimate tax preparation software.


SUNSPOT malware was designed and used to insert SUNBURST into software builds of the SolarWinds Orion IT management product.


Sandworm Team has distributed NotPetya by compromising the legitimate Ukrainian accounting software M.E.Doc and replacing a legitimate software update with a malicious one.


Threat Group-3390 has compromised the Able Desktop installer to gain access to victim's environments.


A JPIN variant downloads the backdoor payload via the BITS service.


APT39 has used the BITS protocol to exfiltrate stolen data from a compromised host.


BITSAdmin can be used to create BITS Jobs to launch a malicious process.


Cobalt Strike can download a hosted "beacon" payload using BITSAdmin.


Egregor has used BITSadmin to download and execute malicious DLLs.


Leviathan has used BITSAdmin to download additional tools.


MarkiRAT can use BITS Utility to connect with the C2 server.


Patchwork has used BITS jobs to download malicious payloads.


ProLock can use BITS jobs to download its malicious payload.


UBoatRAT takes advantage of the /SetNotifyCmdLine option in BITSAdmin to ensure it stays running on a system to maintain persistence.


APT29 has gained access through compromised accounts at cloud solution partners, and used compromised certificates issued by Mimecast to authenticate to Mimecast customer systems.


GOLD SOUTHFIELD has breached Managed Service Providers (MSP's) to deliver malware to MSP customers.


LAPSUS$ has accessed internet-facing identity providers such as Azure Active Directory and Okta to target specific organizations.


Once APT28 gained access to the DCCC network, the group then proceeded to use that access to compromise the DNC network.


POLONIUM has used compromised credentials from an IT company to target downstream customers including a law firm and aviation company.


Sandworm Team has used dedicated network connections from one victim organization to gain unauthorized access to a separate organization.


APT34 has used net.exe in a script with "net accounts /domain" to find the password policy of a domain.


BloodHound can collect password policy information on the target environment.


During Operation CuckooBees, the threat actors used the `net accounts` command as part of their advanced reconnaissance.


Kwampirs collects password policy information with the command "net accounts".


OilRig has used net.exe in a script with "net accounts /domain" to find the password policy of a domain.


The "net accounts" and "net accounts /domain" commands with Net can be used to obtain password policy information.


Turla has used "net accounts" and "net accounts /domain" to acquire password policy information.


Forfiles can be used to subvert controls and possibly conceal command execution by not directly invoking cmd.


Lazarus Group persistence mechanisms have used "forfiles.exe" to execute .htm files.


APT12 has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities (CVE-2009-3129, CVE-2012-0158) and vulnerabilities in Adobe Reader and Flash (CVE-2009-4324, CVE-2009-0927, CVE-2011-0609, CVE-2011-0611).


APT28 has exploited Microsoft Office vulnerability CVE-2017-0262 for execution.


APT29 has used multiple software exploits for common client software, like Microsoft Word, Exchange, and Adobe Reader, to gain code execution.


APT3 has exploited the Adobe Flash Player vulnerability CVE-2015-3113 and Internet Explorer vulnerability CVE-2014-1776.


APT32 has used RTF document that includes an exploit to execute malicious code. (CVE-2017-11882)


APT33 has attempted to exploit a known vulnerability in WinRAR (CVE-2018-20250), and attempted to gain remote code execution via a security bypass vulnerability (CVE-2017-11774).


APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.


APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.


Agent Tesla exploits CVE-2017-11882 in Microsoft’s Equation Editor to execute a process.


Agent Tesla has exploited Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570 for execution during delivery.


Aoqin Dragon has exploited CVE-2012-0158 and CVE-2010-3333 for execution against targeted systems.


Axiom has used exploits for multiple vulnerabilities including CVE-2014-0322, CVE-2012-4792, CVE-2012-1889, and CVE-2013-3893.


BITTER has exploited Microsoft Office vulnerabilities CVE-2012-0158, CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802.


BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.


Bankshot leverages a known zero-day vulnerability in Adobe Flash to execute the implant into the victims’ machines.


Cobalt Strike can exploit Oracle Java vulnerabilities for execution, including CVE-2011-3544, CVE-2013-2465, CVE-2012-4681, and CVE-2013-2460.


Confucius has exploited Microsoft Office vulnerabilities, including CVE-2015-1641, CVE-2017-11882, and CVE-2018-0802.


Dragonfly has exploited CVE-2011-0611 in Adobe Flash Player to gain execution on a targeted system.


During Frankenstein, the threat actors exploited CVE-2017-11882 to execute code on the victim's machine.


During Operation Dust Storm, the threat actors exploited Adobe Flash vulnerability CVE-2011-0611, Microsoft Windows Help vulnerability CVE-2010-1885, and several Internet Explorer vulnerabilities, including CVE-2011-1255, CVE-2012-1889, and CVE-2014-0322.


EXOTIC LILY has used malicious documents containing exploits for CVE-2021-40444 affecting Microsoft MSHTML.


Elderwood has used exploitation of endpoint software, including Microsoft Internet Explorer Adobe Flash vulnerabilities, to gain execution. They have also used zero-day exploits.


Ember Bear has exploited Microsoft Office vulnerability CVE-2017-11882.


EvilBunny has exploited CVE-2011-4369, a vulnerability in the PRC component in Adobe Reader.


Inception has exploited CVE-2012-0158, CVE-2014-1761, CVE-2017-11882 and CVE-2018-0802 for execution.


InvisiMole has installed legitimate but vulnerable Total Video Player software and wdigest.dll library drivers on compromised hosts to exploit stack overflow and input validation vulnerabilities for code execution.


KeyBoy exploits the vulnerability CVE-2012-0158 for execution.


Lazarus Group has exploited Adobe Flash vulnerability CVE-2018-4878 for execution.


Leviathan has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.


MuddyWater has exploited the Office vulnerability CVE-2017-0199 for execution.


Patchwork uses malicious documents to deliver remote execution exploits as part of. The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.


Ramsay has been embedded in documents exploiting CVE-2017-0199, CVE-2017-11882, and CVE-2017-8570.


SUPERNOVA was installed via exploitation of a SolarWinds Orion API authentication bypass vulnerability (CVE-2020-10148).


Sandworm Team has exploited vulnerabilities in Microsoft PowerPoint via OLE objects (CVE-2014-4114) and Microsoft Word via crafted TIFF images (CVE-2013-3906).


SpeakUp attempts to exploit the following vulnerabilities in order to execute its malicious script: CVE-2012-0874, CVE-2010-1871, CVE-2017-10271, CVE-2018-2894, CVE-2016-3088, JBoss AS 3/4/5/6, and the Hadoop YARN ResourceManager.


The White Company has taken advantage of a known vulnerability in Microsoft Word (CVE 2012-0158) to execute code.


Threat Group-3390 has exploited CVE-2018-0798 in Equation Editor.


Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.


Transparent Tribe has crafted malicious files to exploit CVE-2012-0158 and CVE-2010-3333 for execution.


Tropic Trooper has executed commands through Microsoft security vulnerabilities, including CVE-2017-11882, CVE-2018-0802, and CVE-2012-0158.


admin@338 has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158.


LAPSUS$ has recruited target organization employees or contractors who provide credentials and approve an associated MFA prompt, or install remote management software onto a corporate workstation, allowing LAPSUS$ to take control of an authenticated system.


Magic Hound has attempted to get users to execute malware via social media and spearphishing emails.


APT29 has used various forms of spearphishing attempting to get a user to click on a malicous link.


APT32 has lured targets to download a Cobalt Strike beacon by including a malicious link within spearphishing emails.


APT33 has lured users to click links to malicious HTML applications delivered via spearphishing emails.


APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious link.


Bazar can gain execution after a user clicks on a malicious link to decoy landing pages hosted on Google Docs.


Cobalt Group has sent emails containing malicious links that require users to execute a file or macro to infect the victim machine.


Dragonfly 2.0 has used various forms of spearphishing in attempts to get users to open links.


During Night Dragon, threat actors enticed users to click on links in spearphishing emails to download malware.


During Operation Spalax, the threat actors relied on a victim to click on a malicious link distributed via phishing emails.


EXOTIC LILY has used malicious links to lure users into executing malicious payloads.


Earth Lusca  has sent spearphishing emails that required the user to click on a malicious link and subsequently open a decoy document with a malicious loader.


Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open links.


FIN4 has lured victims to click malicious links delivered via spearphishing emails (often sent from compromised accounts).


FIN7 has used malicious links to lure victims into downloading malware.


Grandoreiro has used malicious links to gain execution on victim machines.


Hancitor has relied upon users clicking on a malicious link delivered through phishing.


Javali has achieved execution through victims clicking links to malicious websites.


KOCTOPUS has relied on victims clicking on a malicious link delivered via email.


Kerrdown has gained execution through victims opening malicious links.


Kimsuky has lured victims into clicking malicious links.


Lazarus Group has sent spearphishing emails in an attempt to lure users to click on a malicious link.


LazyScripter has relied upon users clicking on links to malicious files.


Leviathan has sent spearphishing email links attempting to get a user to click.


Magic Hound has attempted to lure victims into opening malicious links embedded in emails.


Melcoz has gained execution through victims opening malicious links.


Mofang's spearphishing emails required a user to click the link to connect to a compromised website.


MuddyWater has distributed URLs in phishing e-mails that link to lure documents.


Mustang Panda has sent malicious links including links directing victims to a Google Drive folder.


NETWIRE has been executed through convincing victims into clicking malicious links.


ObliqueRAT has gained execution on targeted systems through luring users to click on links to malicious URLs.


OilRig has delivered malicious links to achieve execution on the target system.


OutSteel has relied on a user to click a malicious link within a spearphishing email.


PLEAD has been executed via malicious links in e-mails.


QakBot has gained execution through users opening malicious links.


SMOKEDHAM has relied upon users clicking on a malicious link delivered through phishing.


Sandworm Team has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.


Sidewinder has lured targets to click on malicious links to gain execution in the target environment.


SpicyOmelette has been executed through malicious links within spearphishing emails.


Squirrelwaffle has relied on victims to click on a malicious link send via phishing campaigns.


TSCookie has been executed via malicious links embedded in e-mails spoofing the Ministries of Education, Culture, Sports, Science and Technology of Japan.


Transparent Tribe has directed users to open URLs hosting malicious content.


Turla has used spearphishing via a link to get users to download and run their malware.


Windshift has used links embedded in e-mails to lure victims into executing malicious code.


Wizard Spider has lured victims into clicking a malicious link delivered through spearphishing.


ZIRCONIUM has used malicious links in e-mails to lure victims into downloading malware.


A Word document delivering TYPEFRAME prompts the user to enable macro execution.


APT-C-36 has prompted victims to accept macros in order to execute the subsequent payload.


APT28 attempted to get users to click on Microsoft Office attachments containing malicious macro scripts.


APT29 has used various forms of spearphishing attempting to get a user to open attachments, including, but not limited to, malicious Microsoft Word documents, .pdf, and .lnk files.


APT30 has relied on users to execute malicious file attachments delivered via spearphishing emails.


APT32 has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment.


APT37 has sent spearphishing attachments attempting to get a user to open them.


APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious attachment.


Ajax Security Team has lured victims into executing malicious files.


Aoqin Dragon has lured victims into opening weaponized documents, fake external drives, and fake antivirus to execute malicious payloads.


AppleJeus has required user execution of a malicious MSI installer.


AppleSeed can achieve execution through users running malicious file attachments distributed via email.


Astaroth has used malicious files including VBS, LNK, and HTML for execution.


BITTER has attempted to lure victims into opening malicious attachments delivered via spearphishing.


BLINDINGCAN has lured victims into executing malicious macros embedded within Microsoft Office documents.


BRONZE BUTLER has attempted to get users to launch malicious Microsoft Word attachments delivered via spearphishing emails.


Bad Rabbit has been executed through user installation of an executable disguised as a flash installer.


Bisonal has relied on users to execute malicious file attachments delivered via spearphishing emails.


BlackTech has used e-mails with malicious documents to lure victims into installing malware.


BoomBox has gained execution through user interaction with a malicious file.


Bumblebee has relied upon a user opening an ISO file to enable execution of malicious shortcut files and DLLs.


Bundlore has attempted to get users to execute a malicious .app file that looks like a Flash Player update.


CARROTBALL has been executed through users being lured into opening malicious e-mail attachments.


CSPY Downloader has been delivered via malicious documents with embedded macros.


Clambling has gained execution through luring victims into opening malicious files.


Cobalt Group has sent emails containing malicious attachments that require users to execute a file or macro to infect the victim machine.


DanBot has relied on victims' opening a malicious file for initial execution.


Dark Caracal makes their malware look like Flash Player, Office, or PDF documents in order to entice a user to click on it.


DnsSystem has lured victims into opening macro-enabled Word documents for execution.


Dragonfly has used various forms of spearphishing in attempts to get users to open malicious attachments.


During C0011, Transparent Tribe relied on a student target to open a malicious document delivered via email.


During Operation Dust Storm, the threat actors relied on potential victims to open a malicious Microsoft Word document sent via email.


During Operation Sharpshooter, the threat actors relied on victims executing malicious Microsoft Word or PDF files.


During Operation Spalax, the threat actors relied on a victim to open a PDF document and click on an embedded malicious link to download malware.


EXOTIC LILY has gained execution through victims clicking on malicious LNK files contained within ISO files, which can execute hidden DLLs within the ISO.


Earth Lusca required users to click on a malicious file for the loader to activate.


Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open attachments.


Ember Bear has attempted to lure victims into executing malicious files.


Emotet has relied upon users clicking on a malicious attachment delivered through spearphishing.


FIN4 has lured victims to launch malicious attachments delivered via spearphishing emails (often sent from compromised accounts).


FIN7 lured victims to double-click on images in the attachments they sent which would then execute the hidden LNK file.


FIN8 has used malicious e-mail attachments to lure victims into executing malware.


Ferocious Kitten has attempted to convince victims to enable malicious content within a spearphishing email by including an odd decoy message.


Frankenstein has used trojanized Microsoft Word documents sent via email, which prompted the victim to enable macros.


Gallmaker sent victims a lure document with a warning that asked victims to “enable content” for execution.


Gamaredon Group has attempted to get users to click on Office attachments with malicious macros embedded.


Gorgon Group attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails.


Grandoreiro has infected victims via malicious attachments.


IcedID has been executed through Word documents with malicious embedded macros.


InvisiMole can deliver trojanized versions of software and documents, relying on user execution.


JCry has achieved execution by luring users to click on a file that appeared to be an Adobe Flash Player update installer.


Javali has achieved execution through victims opening malicious attachments, including MSI files with embedded VBScript.


KONNI has relied on a victim to enable malicious macros within an attachment delivered via email.


Kerrdown has gained execution through victims opening malicious files.


Kimsuky has used attempted to lure victims into opening malicious e-mail attachments.


Leviathan has sent spearphishing attachments attempting to get a user to click.


Lokibot has tricked recipients into enabling malicious macros by getting victims to click "enable content" in email attachments.


Magic Hound has attempted to lure victims into opening malicious email attachments.


Magic Hound has lured victims into executing malicious files.


Metamorfo requires the user to double-click the executable to run the malicious HTA file or to download a malicious installer.


Mofang's malicious spearphishing attachments required a user to open the file after receiving.


Molerats has sent malicious files via email that tricked users into clicking Enable Content to run an embedded macro and to download malicious archives.


Mongall has relied on a user opening a malicious document for execution.


MuddyWater has attempted to get users to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails.


Mustang Panda has sent malicious files requiring direct victim interaction to execute.


NETWIRE has been executed through luring victims into opening malicious documents.


Naikon has convinced victims to open malicious attachments to execute malware.


NativeZone can display an RTF document to the user  to enable execution of  Cobalt Strike stage shellcode.


OSX/Shlayer has relied on users mounting and executing a malicious DMG file.


OilRig has delivered macro-enabled documents that required targets to click the "enable content" button to execute the payload on the system.


OutSteel has relied on a user to execute a malicious attachment delivered via spearphishing.


PLATINUM has attempted to get users to open malicious files by sending spearphishing emails with attachments to victims.


PROMETHIUM has attempted to get users to execute compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.


Patchwork embedded a malicious macro in a Word document and lured the victim to click on an icon to execute the malware.


PoetRAT has used spearphishing attachments to infect victims.


Pony has attempted to lure targets into downloading an attached executable (ZIP, RAR, or CAB archives) or document (PDF or other MS Office format).


QakBot has gained execution through users opening malicious attachments.


REvil has been executed via malicious MS Word e-mail attachments.


RTM has attempted to lure victims into opening e-mail attachments to execute malicious code.


RTM has relied on users opening malicious email attachments, decompressing the attached archive, and double-clicking the executable within.


Ramsay has been executed through malicious e-mail attachments.


Rifdoor has been executed from malicious Excel or Word documents containing macros.


SQLRat relies on users clicking on an embedded image to execute the scripts.


STARWHALE has relied on victims opening a malicious Excel file for execution.


Saint Bot has relied upon users to execute a malicious attachment delivered via spearphishing.


Sandworm Team has tricked unwitting recipients into clicking on spearphishing attachments and enabling malicious macros embedded within files.


Silence attempts to get users to launch malicious attachments delivered via spearphishing emails.


Some SUGARDUMP variants required a user to enable a macro within a malicious .xls file for execution.


TA459 has attempted to get victims to open malicious Microsoft Word attachment sent via spearphishing.


TA505 has used lures to get users to enable content in malicious attachments and execute malicious files contained in archives. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files.


TA551 has prompted users to enable macros within spearphishing attachments to install malware.


The White Company has used phishing lure documents that trick users into opening them and infecting their computers.


Threat Group-3390 has lured victims into opening malicious files containing malware.


ThreatNeedle relies on a victim to click on a malicious document for initial execution.


Tonto Team has relied on user interaction to open their malicious RTF documents.


Tropic Trooper has lured victims into executing malware via malicious e-mail attachments.


WIRTE has attempted to lure users into opening malicious MS Word and Excel files to execute malicious payloads.


WarzoneRAT has relied on a victim to open a malicious attachment within an email for execution.


Windshift has used e-mail attachments to lure victims into executing malicious code.


Wizard Spider has lured victims to execute malware with spearphishing attachments containing macros to download either Emotet, Bokbot, TrickBot, or Bazar.


ZxxZ has relied on victims to open a malicious attachment delivered via email.


admin@338 has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails.


menuPass has attempted to get victims to open malicious files such as Windows Shortcuts (.lnk) and/or Microsoft Office documents, sent via email as part of spearphishing campaigns.


TeamTNT has relied on users to download and execute malicious Docker images.


Kobalos is triggered by an incoming TCP connection to a legitimate service from a specific source port.


Pandora can identify if incoming HTTP traffic contains a token and if so it will intercept the traffic and process the received command.


Ryuk has used Wake-on-Lan to power on turned off systems for lateral movement.


SYNful Knock can be sent instructions via special packets to change its functionality. Code for new functionality can be included in these messages.


Umbreon provides additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet


Winnti for Linux has used a passive listener, capable of identifying a specific magic value before executing tasking, as a secondary command and control (C2) mechanism.


PROMETHIUM has used a script that configures the knockd service and firewall to only accept C2 connections from systems that use a specified sequence of knock ports.


Penquin installs a `TCP` and `UDP` filter on the `eth0` interface.


APT28 exploited a Windows SMB Remote Code Execution Vulnerability to conduct lateral movement.


Conficker exploited the MS08-067 Windows vulnerability for remote code execution through a crafted RPC request.


Dragonfly has exploited a Windows Netlogon vulnerability (CVE-2020-1472) to obtain access to Windows Active Directory servers.


Earth Lusca has used Mimikatz to exploit a domain controller via the ZeroLogon exploit (CVE-2020-1472).


Emotet has been seen exploiting SMB via a vulnerability exploit like EternalBlue (MS17-010) to achieve lateral movement and propagation.


Empire has a limited number of built-in modules for exploiting remote SMB, JBoss, and Jenkins servers.


Fox Kitten has exploited known vulnerabilities in remote services including RDP.


InvisiMole can spread within a network via the BlueKeep (CVE-2019-0708) and EternalBlue (CVE-2017-0144) vulnerabilities in RDP and SMB respectively.


Lucifer can exploit multiple vulnerabilities including EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0144).


MuddyWater has exploited the Microsoft Netlogon vulnerability (CVE-2020-1472).


NotPetya can use two exploits in SMBv1, EternalBlue and EternalRomance, to spread itself to other remote systems on the network.


PoshC2 contains a module for exploiting SMB via EternalBlue.


QakBot can move laterally using worm-like functionality through exploitation of SMB.


Stuxnet propagates using the MS10-061 Print Spooler and MS08-067 Windows Server Service vulnerabilities.


Wizard Spider has exploited or attempted to exploit Zerologon (CVE-2020-1472) and EternalBlue (MS17-010) vulnerabilities.


APT28 has collected files from various information repositories.


APT29 has accessed victims’ internal knowledge repositories (wikis) to view sensitive corporate information on products, services, and internal business operations.


FIN6 has collected schemas and user accounts from systems running SQL Server.


Fox Kitten has accessed victim security and IT environments and Microsoft Teams to mine valuable information.


LAPSUS$ has searched a victim's network for organization collaboration channels like MS Teams or Slack to discover further high-privilege account credentials.


P.A.S. Webshell has the ability to list and extract data from SQL databases.


LAPSUS$ has searched a victim's network for collaboration platforms like Confluence and JIRA to discover further high-privilege account credentials.


APT28 has collected information from Microsoft SharePoint services within target networks.


Ke3chang used a SharePoint enumeration and data dumping tool known as spwebmember.


LAPSUS$ has searched a victim's network for collaboration platforms like SharePoint to discover further high-privilege account credentials.


spwebmember is used to enumerate and dump information from Microsoft SharePoint.


APT29 has downloaded source code from code repositories.


APT32 has used PubPrn.vbs within execution scripts to execute malware, possibly bypassing defenses.


APT38 has collected browser bookmark information to learn more about compromised hosts, obtain personal information about users, and acquire details about internal network resources.


Calisto collects information on bookmarks from Google Chrome.


Empire has the ability to gather browser data such as bookmarks and visited sites.


Fox Kitten has used Google Chrome bookmarks to identify internal resources and assets.


MobileOrder has a command to upload to its C2 server victim browser bookmarks.


PowerLess can use a .NET browser information stealer module.


APT38 has used CHM files to move concealed payloads.


APT41 used compiled HTML (.chm) files for targeting.


Astaroth uses ActiveX objects for file execution and manipulation.


OilRig has used a CHM payload to load and execute another malicious file once delivered to a victim.


Silence has weaponized CHM files in their phishing campaigns.


InvisiMole can register itself for execution and persistence via the Control Panel.


Cobalt Group has used the command "cmstp.exe /s /ns C:\Users\ADMINI~W\AppData\Local\Temp\XKNqbpzl.txt" to bypass AppLocker and launch a malicious script.


MuddyWater has used CMSTP.exe and a malicious INF to execute its POWERSTATS payload.


Chaes has used Installutill to download content.


Saint Bot had used `InstallUtil.exe` to download and deploy executables.


WhisperGate has used `InstallUtil.exe` as part of its process to disable Windows Defender.


menuPass has used "InstallUtil.exe" to execute malicious software.


APT29 has use `mshta` to execute malicious scripts on a compromised host.


APT32 has used mshta.exe for code execution.


BabyShark has used mshta.exe to download and execute applications from a remote server.


Confucius has used mshta.exe to execute malicious VBScript.


During C0015, the threat actors used `mshta` to execute DLLs.


During Operation Dust Storm, the threat actors executed JavaScript code via `mshta.exe`.


Earth Lusca has used `mshta.exe` to load an HTA script within a malicious .LNK file.


FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.


Gamaredon Group has used `mshta.exe` to execute malicious HTA files.


Inception has used malicious HTA files to drop and execute malware.


Kimsuky has used mshta.exe to run malicious scripts on the system.


Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence.


Lazarus Group has used "mshta.exe" to execute HTML pages downloaded by initial access documents.


Lazarus Group has used mshta.exe to run malicious scripts and download programs.


LazyScripter has used `mshta.exe` to execute Koadic stagers.


MuddyWater has used mshta.exe to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution.


NanHaiShu uses mshta.exe to load its program and files.


Pteranodon can use mshta.exe to execute an HTA file hosted on a remote server.


Revenge RAT uses mshta.exe to run malicious scripts on the system.


Sibot has been executed via MSHTA application.


Sidewinder has used "mshta.exe" to execute malicious payloads.


TA551 has used mshta.exe to execute malicious payloads.


Xbash can use mshta for executing scripts.


AppleJeus has been installed via MSI installer.


Chaes has used .MSI files as an initial way to start the infection chain.


Clop can use msiexec.exe to disable security tools on the system.


Duqu has used "msiexec" to execute malicious Windows Installer packages. Additionally, a PROPERTY=VALUE pair containing a 56-bit encryption key has been used to decrypt the main payload from the installer packages.


FlawedAmmyy has been installed via `msiexec.exe`.


Grandoreiro can use MSI files to execute DLLs.


IcedID can inject itself into a suspended msiexec.exe process to send beacons to C2 while appearing as a normal msi application.


Javali has used the MSI installer to download and execute malicious payloads.


LoudMiner used an MSI installer to install the virtualization software.


Machete has used msiexec to install the Machete malware.


Maze has delivered components for its ransomware attacks using MSI files, some of which have been executed from the command-line using "msiexec".


Melcoz can use MSI files with embedded VBScript for execution.


Metamorfo has used MsiExec.exe to automatically execute files.


RCSession has the ability to execute inside the msiexec.exe process.


Ragnar Locker has been delivered as an unsigned MSI package that was executed with "msiexec.exe".


Rancor has used "msiexec" to download and execute malicious installer files over HTTP.


TA505 has used "msiexec" to download and execute malicious Windows Installer files.


Bumblebee can use `odbcconf.exe` to run DLLs on targeted hosts.


Agent Tesla has dropped RegAsm.exe onto systems for performing malicious activity.


APT19 used Regsvr32 to bypass application control techniques.


APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory. The group has also used regsvr32 to run their backdoor.


AppleSeed can call regsvr32.exe for execution.


Astaroth can be loaded through regsvr32.exe.


Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using regsvr32.exe.


Cobalt Group has used regsvr32.exe to execute scripts.


Derusbi variants have been seen that use Registry persistence to proxy execution through regsvr32.exe.


During C0015, the threat actors employed code that used `regsvr32` for execution.


EVILNUM can run a remote scriptlet that drops a file and executes it via regsvr32.exe.


Egregor has used regsvr32.exe to execute malicious DLLs.


HermeticWizard has used `regsvr32.exe /s /i` to execute malicious payloads.


Kimsuky has executed malware with "regsvr32s".


Koadic can use Regsvr32 to execute additional payloads.


Lazarus Group has used rgsvr32 to execute custom malware.


QakBot can use Regsvr32 to execute malicious DLLs.


Ragnar Locker has used regsvr32.exe to execute components of VirtualBox.


RogueRobin uses regsvr32.exe to run a .sct file for execution.


Saint Bot has used `regsvr32` to execute scripts.


Some Orz versions have an embedded DLL known as MockDll that uses Process Hollowing and regsvr32 to execute another payload.


Valak has used "regsvr32.exe" to launch malicious DLLs.


WIRTE has used `regsvr32.exe` to trigger the execution of a malicious script.


Xbash can use regsvr32 for executing scripts.


A gh0st RAT variant has used rundll32 for execution.


APT19 configured its payload to inject into the rundll32.exe.


APT28 executed CHOPSTICK by using rundll32 commands such as "rundll32.exe “C:\Windows\twain_64.dll”". APT28 also executed a .dll for a first stage dropper using rundll32.exe. An APT28 loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.


APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools.


APT41 has used rundll32.exe to execute a loader.


After copying itself to a DLL file, a variant of Elise calls the DLL file using rundll32.exe.


Attor's installer plugin can schedule rundll32.exe to load the dispatcher.


BLINDINGCAN has used Rundll32 to load a malicious DLL.


Backdoor.Oldrea can use rundll32 for execution on compromised hosts.


Briba uses rundll32 within Registry Run Keys / Startup Folder entries to execute malicious DLLs.


CORESHELL is installed via execution of rundll32 with an export named "init" or "InitW."


Carbanak installs VNC server software that executes through rundll32.


Cobalt Strike can use `rundll32.exe` to load DLL from the command line.


Comnie uses Rundll32 to load a malicious DLL.


CopyKittens uses rundll32 to load various tools on victims, including a lateral movement tool named Vminst, Cobalt Strike, and shellcode.


DDKONG uses Rundll32 to ensure only a single instance of itself is running at once.


During Operation Spalax, the threat actors used `rundll32.exe` to execute malicious installers.


EVILNUM can execute commands and scripts through rundll32.


Egregor has used rundll32 during execution.


FlawedAmmyy has used `rundll32` for execution.


FunnyDream can use `rundll32` for execution of its components.


GreyEnergy uses PsExec locally in order to execute rundll32.exe at the highest privileges (NTAUTHORITY\SYSTEM).


HAFNIUM has used "rundll32" to load malicious DLLs.


HermeticWizard has the ability to create a new process using `rundll32`.


InvisiMole has used rundll32.exe for execution.


KONNI has used Rundll32 to execute its loader for privilege escalation purposes.


Koadic can use Rundll32 to execute additional payloads.


Kwampirs uses rundll32.exe in a Registry value added to establish persistence.


Lazarus Group has used rundll32 to execute malicious payloads on a compromised host.


MegaCortex has used "rundll32.exe" to load a DLL for file encryption.


Mongall can use `rundll32.exe` for execution.


Mosquito's launcher uses rundll32.exe in a Registry Key value to start the main backdoor capability.


MuddyWater has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll.


PUNCHBUGGY can load a DLL using Rundll32.


PcShare has used `rundll32.exe` for execution.


PolyglotDuke can be executed using rundll32.exe.


Pteranodon executes functions using rundll32.exe.


QakBot can use Rundll32.exe to enable C2 communication.


RTM runs its core DLL file using rundll32.exe.


Ragnar Locker has used rundll32.exe to execute components of VirtualBox.


Rundll32.exe is used as a way of executing Flame at the command-line.


Sakula calls cmd.exe to run various DLL files via rundll32.


Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe.


ServHelper contains a module for downloading and executing DLLs that leverages "rundll32.exe".


Sibot has executed downloaded DLLs with "rundll32.exe".


Squirrelwaffle has been executed using `rundll32.exe`.


StreamEx uses rundll32 to call an exported function.


TA505 has leveraged "rundll32.exe" to execute malicious DLLs.


TA551 has used rundll32.exe to load malicious DLLs.


The CozyCar dropper copies the system file rundll32.exe to the install location for the malware, then uses the copy of rundll32.exe to load and execute the main CozyCar component.


USBferry can execute rundll32.exe in memory to avoid detection.


Variants of Emissary have used rundll32.exe in Registry values added to establish persistence.


ZxShell has used rundll32.exe to execute other DLLs and named pipes.


Carbanak used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems.


During C0015, the threat actors installed the AnyDesk remote desktop application onto the compromised network.


During Night Dragon, threat actors used several remote administration tools as persistent infiltration channels.


Egregor has checked for the LogMein event log in an attempt to encrypt files in remote machines.


Hildegard has established tmate sessions for C2 communications.


MuddyWater has used a legitimate application, ScreenConnect, to manage systems remotely and move laterally.


Mustang Panda has installed TeamViewer on targeted systems.


Night Dragon has used several remote administration tools as persistent infiltration channels.


RTM has the capability to download a VNC module from command and control (C2).


Sandworm Team has used remote administration tools or remote industrial control system client software to maliciously release electricity breakers.


TeamTNT has established tmate sessions for C2 communications.


Thrip used a cloud-based remote access software called LogMeIn for their attacks.


Astaroth executes embedded JScript or VBScript in an XSL stylesheet located on a remote domain.


Higaisa used an XSL file to run VBScript code.


Lazarus Group has used WMIC to execute a remote XSL script to establish persistence.


APT28 used weaponized Microsoft Word documents abusing the remote template function to retrieve a malicious macro.


Chaes changed the template target of the settings.xml file embedded in the Word document and populated that field with the downloaded URL of the next payload.


DarkHydrus used an open-source tool, Phishery, to inject malicious remote template URLs into Microsoft Word documents and then sent them to victims to enable Forced Authentication.


Dragonfly 2.0 has injected SMB URLs into malicious Word spearphishing attachments to initiate Forced Authentication.


Dragonfly has injected SMB URLs into malicious Word spearphishing attachments to initiate Forced Authentication.


During Frankenstein, the threat actors used trojanized documents that retrieved remote templates from an adversary-controlled website.


Frankenstein has used trojanized documents that retrieve remote templates from an adversary-controlled website.


Gamaredon Group has used DOCX files to download malicious DOT document templates and has used RTF template injection to download malicious payloads. Gamaredon Group can also inject malicious macros or remote templates into documents already present on compromised systems.


Tropic Trooper delivered malicious documents with the XLSX extension, typically used by OpenXML documents, but the file itself was actually an OLE (XLS) document.


WarzoneRAT has been install via template injection through a malicious DLL embedded within a template RTF in a Word document.


BitPaymer can use "icacls /reset" and "takeown /F" to reset a targeted executable's permissions and then take ownership.


Grandoreiro can modify the binary ACL to prevent security tools from running.


WannaCry uses "attrib +h" and "icacls . /grant Everyone:F /T /C /Q" to make some of its files hidden and grant all users full access controls.


WastedLocker has a command to take ownership of a file and reset the ACL permissions using the "takeown.exe /F filepath" command.


Wizard Spider has used the icacls command to modify access control to backup servers, providing them with full control of all the system folders.


Bundlore changes the permissions of a payload using the command "chmod -R 755".


Dok gives all users execute permissions for the application using the command "chmod +x /Users/Shared/AppStore.app".


Kinsing has used chmod to modify permissions on key files for use.


OSX/Shlayer can use the "chmod" utility to set a file as executable, such as "chmod 777" or "chmod +x".


OSX_OCEANLOTUS.D has changed permissions of a second-stage payload to an executable via "chmod".


P.A.S. Webshell has the ability to modify file permissions.


Penquin can add the executable flag to a downloaded file.


Rocke has changed file permissions of files so they could not be modified.


TeamTNT has modified the permissions on binaries with "chattr".


Anchor can terminate itself if specific execution flags are not present.


BitPaymer compares file names and paths to a list of excluded names and directory names during encryption.


EnvyScout can call "window.location.pathname" to ensure that embedded files are being executed from the C: drive, and will terminate if they are not.


SUNSPOT only replaces SolarWinds Orion source code if the MD5 checksums of both the original source code file and backdoored replacement source code match hardcoded values.


Small Sieve can only execute correctly if the word `Platypus` is passed to it on the command line.


Stuxnet checks for specific operating systems on 32-bit machines, Registry keys, and dates for vulnerabilities, and will exit execution if the values are not met.


Torisma is only delivered to a compromised host if the victim's IP address is on an allow-list.


VaporRage has the ability to check for the presence of a specific DLL and terminate if it is not found.


APT41 has encrypted payloads using the Data Protection API (DPAPI), which relies on keys tied to specific user accounts on specific machines. APT41 has also environmentally keyed second stage malware with an RC5 key derived in part from the infected system's volume serial number.


Equation has been observed utilizing environmental keying in payload delivery.


ROKRAT relies on a specific victim hostname to execute and decrypt important strings.


The Winnti for Windows dropper component can verify the existence of a single command line parameter and either terminate if it is not found or later use it as a decryption key.


Bazar can use Nltest tools to obtain information about the domain.


During C0015, the threat actors used the command `nltest /domain_trusts /all_trusts` to enumerate domain trusts.


Earth Lusca has used Nltest to obtain information about domain controllers.


FIN8 has retrieved a list of trusted domains by using "Nltest.exe /domain_trusts".


Nltest may be used to enumerate trusted domains by using commands such as "nltest /domain_trusts".


PoshC2 has modules for enumerating domain trusts.


PowerSploit has modules such as "Get-NetDomainTrust" and "Get-NetForestTrust" to enumerate domain and forest trusts.


QakBot can run "nltest /domain_trusts /all_trusts" for domain trust discovery.


TrickBot can gather information about domain trusts by utilizing Nltest.


UNC2452 used the "Get-AcceptedDomain" PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell. They also used AdFind to enumerate domains and to discover trust between federated domains.


dsquery can be used to gather information on domain trusts with "dsquery * -filter "(objectClass=trustedDomain)" -attr *".


Empire can use "New-GPOImmediateTask" to modify a GPO that will install and execute a malicious Scheduled Task/Job.


HermeticWiper has the ability to deploy through an infected system's default domain policy.


AADInternals can create a backdoor by converting a domain to a federated domain which will be able to authenticate any user across the tenant. AADInternals can also modify DesktopSSO information.


APT38 has used a custom secure delete function to make deleted files unrecoverable.


BlackEnergy 2 contains a "Destroy" plug-in that destroys data stored on victim hard drives by overwriting file contents.


CaddyWiper can work alphabetically through drives on a compromised system to take ownership of and overwrite all files.


HermeticWiper can recursively wipe folders and files in `Windows`, `Program Files`, `Program Files(x86)`, `PerfLogs`, `Boot, System`, `Volume Information`, and `AppData` folders using `FSCTL_MOVE_FILE`. HermeticWiper can also overwrite symbolic links and big files in `My Documents` and on the Desktop with random bytes.


Industroyer’s data wiper module clears registry keys and overwrites both ICS configuration and Windows files.


Kazuar can overwrite files with random data before deleting them.


Meteor can fill a victim's files and directories with zero-bytes in replacement of real content before deleting them.


Olympic Destroyer overwrites files locally and on remote shares.


REvil has the capability to destroy files and folders.


RawDisk was used in Shamoon to write to protected system locations such as the MBR and disk partitions in an effort to destroy data.


Sandworm Team has used the BlackEnergy KillDisk component to overwrite files on Windows-based Human-Machine Interfaces.


Shamoon attempts to overwrite operating system files and disk structures with image files. In a later variant, randomly generated data was used for data overwrites.


APT38 has used Hermes ransomware to encrypt files with AES256.


Avaddon encrypts the victim system using a combination of AES256 and RSA encryption schemes.


BitPaymer can import a hard-coded RSA 1024-bit public key, generate a 128-bit RC4 key for each file, and encrypt the file in place, appending ".locked" to the filename.


Clop can encrypt files using AES, RSA, and RC4 and will add the ".clop" extension to encrypted files.


Conti can use "CreateIoCompletionPort()", "PostQueuedCompletionStatus()", and "GetQueuedCompletionPort()" to rapidly encrypt files, excluding those with the extensions of .exe, .dll, and .lnk. It has used a different AES-256 encryption key per file with a bundled RAS-4096 public encryption key that is unique for each victim. Conti can use “Windows Restart Manager” to ensure files are unlocked and open for encryption.


Cuba has the ability to encrypt system data and add the ".cuba" extension to encrypted files.


DEATHRANSOM can use public and private key pair encryption to encrypt files for ransom payment.


Diavol has encrypted files using an RSA key though the `CryptEncrypt` API and has appended filenames with ".lock64".


EKANS uses standard encryption library functions to encrypt files.


Egregor can encrypt all non-system files using a hybrid AES-RSA algorithm prior to displaying a ransom note.


HELLOKITTY can use an embedded RSA-2048 public key to encrypt victim data for ransom.


Indrik Spider has encrypted domain-controlled systems using BitPaymer.


JCry has encrypted files and demanded Bitcoin to decrypt those files.


LockerGoga has encrypted files, including core Windows OS files, using RSA-OAEP MGF1 and then demanded Bitcoin be paid for the decryption key.


Maze has disrupted systems by encrypting files on targeted machines, claiming to decrypt files if a ransom payment is made. Maze has used the ChaCha algorithm, based on Salsa20, and an RSA algorithm to encrypt files.


MegaCortex has used the open-source library, Mbed Crypto, and generated AES keys to carry out the file encryption process.


Netwalker can encrypt files on infected machines to extort victims.


Pay2Key can encrypt data on victim's machines using RSA and AES algorithms in order to extort a ransom payment for decryption.


REvil can encrypt files on victim systems and demands a ransom to decrypt the files.


RobbinHood will search for an RSA encryption key and then perform its encryption process on the system files.


Ryuk has used a combination of symmetric (AES) and asymmetric (RSA) encryption to encrypt files. Files have been encrypted with their own AES key and given a file extension of .RYK. Encrypted directories have had a ransom note of RyukReadMe.txt written to the directory.


SamSam encrypts victim files using RSA-2048 encryption and demands a ransom be paid in Bitcoin to decrypt those files.


Shamoon has an operational mode for encrypting data instead of overwriting it.


SynAck encrypts the victims machine followed by asking the victim to pay a ransom.


TA505 has used a wide variety of ransomware, such as Clop, Locky, Jaff, Bart, Philadelphia, and GlobeImposter, to encrypt victim files and demand a ransom payment.


ThiefQuest encrypts a set of file extensions on a host, deletes the original files, and provides a ransom note with no contact information.


WannaCry encrypts user files and demands that a ransom be paid in Bitcoin to decrypt those files.


XCSSET performs AES-CBC encryption on files under "~/Documents", "~/Downloads", and
"~/Desktop" with a fixed key and renames files to give them a ".enc" extension. Only files with sizes
less than 500MB are encrypted.


Xbash has maliciously encrypted victim's database systems and demanded a cryptocurrency ransom be paid.


Babuk can stop specific services related to backups.


Conti can stop up to 146 Windows services related to security, backup, database, and email solutions through the use of "net stop".


Diavol will terminate services using the Service Control Manager (SCM) API.


Indrik Spider has used PsExec to stop services prior to the execution of ransomware.


Industroyer’s data wiper module writes zeros into the registry keys in "SYSTEM\CurrentControlSet\Services" to render a system inoperable.


Lazarus Group has stopped the MSExchangeIS service to render Exchange contents inaccessible to users.


LookBack can kill processes and delete services.


Maze has stopped SQL services to ensure it can encrypt any database.


MegaCortex can stop and disable services on the system.


Meteor can disconnect all network adapters on a compromised host using `powershell -Command "Get-WmiObject -class Win32_NetworkAdapter | ForEach { If ($.NetEnabled) { $.Disable() } }" > NUL`.


Netwalker can terminate system processes and services, some of which relate to backup software.


Olympic Destroyer uses the API call "ChangeServiceConfigW" to disable all services on the affected system.


Pay2Key can stop the MS SQL service at the end of the encryption process to release files locked by the service.


REvil has the capability to stop services and kill processes.


Ragnar Locker has attempted to stop services associated with business applications and databases to release the lock on files used by these applications so they may be encrypted.


RobbinHood stops 181 Windows services on the system before beginning the encryption process.


WannaCry attempts to kill processes associated with Exchange, Microsoft SQL Server, and MySQL to make it possible to encrypt their data stores.


Wizard Spider has used taskkill.exe and net.exe to stop backup, catalog, cloud, and other services prior to network encryption.


Avaddon deletes backups and shadow copies using native system tools.


Babuk has the ability to delete shadow volumes using "vssadmin.exe delete shadows /all /quiet".


Conti can delete Windows Volume Shadow Copies using "vssadmin".


DEATHRANSOM can delete volume shadow copies on compromised hosts.


DarkWatchman can delete shadow volumes using "vssadmin.exe".


EKANS removes backups of Volume Shadow Copies to disable any restoration capabilities.


HELLOKITTY can delete volume shadow copies on compromised hosts.


InvisiMole can can remove all system restore points.


JCry has been observed deleting shadow copies to ensure that data cannot be restored easily.


Meteor can use `bcdedit` to delete different boot identifiers on a compromised host; it can also use `vssadmin.exe delete shadows /all /quiet` and `C:\\Windows\\system32\\wbem\\wmic.exe shadowcopy delete`.


Netwalker can delete the infected system's Shadow Volumes to prevent recovery.


ProLock can use vssadmin.exe to remove volume shadow copies.


Pysa has the functionality to delete shadow copies.


RobbinHood deletes shadow copies to ensure that all the data cannot be restored easily.


Ryuk has used "vssadmin Delete Shadows /all /quiet" to to delete volume shadow copies and "vssadmin resize shadowstorage" to force deletion of shadow copies created by third-party applications.


WannaCry uses "vssadmin", "wbadmin", "bcdedit", and "wmic" to delete and disable operating system recovery features.


After encryption, Diavol will capture the desktop background window, set the background color to black, and change the desktop wallpaper to a newly created bitmap image with the text “All your files are encrypted! For more information see “README-FOR-DECRYPT.txt".


Gamaredon Group has left taunting images and messages on the victims' desktops as proof of system access.


Sandworm Team defaced approximately 15,000 websites belonging to Georgian government, non-government, and private sector organizations in 2019.


Bad Rabbit has used an executable that installs a modified bootloader to prevent normal boot-up.


APT41 deployed a Monero cryptocurrency mining tool in a victim’s environment.


CookieMiner has loaded coinmining software onto systems to mine for Koto cryptocurrency.


Hildegard has used xmrig to mine cryptocurrency.


Imminent Monitor has the capability to run a cryptocurrency miner on the victim machine.


Kinsing has created and run a Bitcoin cryptocurrency miner.


Lazarus Group has subset groups like Bluenoroff who have used cryptocurrency mining software on victim machines.


LoudMiner harvested system resources to mine cryptocurrency, using XMRig to mine Monero.


Lucifer can use system resources to mine cryptocurrency, dropping XMRig to mine Monero.


Rocke has distributed cryptomining malware.


Skidmap is a kernel-mode rootkit used for cryptocurrency mining.


TeamTNT has deployed XMRig Docker images to mine cryptocurrency. TeamTNT has also infected Docker containers and Kubernetes clusters with XMRig, and used RainbowMiner and lolMiner for mining cryptocurrency.


Agent Tesla has he ability to perform anti-sandboxing and anti-virtualization checks.


Bumblebee has the ability to perform anti-virtualization checks.


CHOPSTICK  includes runtime checks to identify an analysis environment and prevent execution on it.


Carberp has removed various hooks before installing the trojan or bootkit to evade sandbox analysis or other analysis software.


Darkhotel malware has employed just-in-time decryption of strings to evade sandbox detection.


During Operation Spalax, the threat actors used droppers that would run anti-analysis checks before executing malware on a compromised host.


Gelsemium can use junk code to generate random activity to obscure malware behavior.


HAWKBALL has methods to check if the process the malware uses is being debugged.


Kevin can sleep for a time interval between C2 communication attempts.


Lucifer can crash a debugger by passing a format string to "OutputDebugStringA()".


Metamorfo has embedded a "vmdetect.exe" executable to identify virtual machines at the beginning of execution.


Pteranodon has the ability to use anti-detection functions to identify sandbox environments.


Some versions of CozyCar will check to ensure it is not being executed inside a virtual machine or a known malware analysis sandbox environment. If it detects that it is, it will exit.


The White Company has performed anti-analysis checks to determine if its malware was in a debugging environment.


Attor can detect whether it is executed in some virtualized or emulated environment by searching for specific artifacts, such as communication with I/O ports and using VM-specific instructions.


BadPatch attempts to detect if it is being run in a Virtual Machine (VM) using a WMI query for disk drive name, BIOS, and motherboard information.


Bumblebee has the ability to search for designated file paths and Registry keys that indicate a virtualized environment from multiple products.


Darkhotel malware has used a series of checks to determine if it's being analyzed; checks include the length of executable names, if a filename ends with ".Md5.exe", and if the program is executed from the root of the C:\ drive, as well as checks for sandbox-related libraries.


Denis ran multiple system checks, looking for processor and register characteristics, to evade emulation and analysis.


During Frankenstein, the threat actors used a script that ran WMI queries to check if a VM or sandbox was running, including VMWare and Virtualbox. The script would also call WMI to determine the number of cores allocated to the system; if less than two the script would stop execution.


Dyre can detect sandbox analysis environments by inspecting the process list and Registry.


EvilBunny's dropper has checked the number of processes and the length and strings of its own file name to identify if the malware is in a sandbox environment.


Evilnum has used a component called TerraLoader to check certain hardware and file information to detect sandboxed environments.


Ferocious can run anti-sandbox checks using the Microsoft Excel 4.0 function "GET.WORKSPACE" to determine the OS version, if there is a mouse present, and if the host is capable of playing sounds.


FinFisher obtains the hardware device list and checks if the MD5 of the vendor ID is equal to a predefined list in order to check for sandbox/virtualized environments.


Frankenstein has used WMI queries to check if various security applications were running, including VMWare and Virtualbox.


GoldMax will check if it is being run in a virtualized environment by comparing the collected MAC address to "c8:27:cc:c2:37:5a".


Grandoreiro can detect VMWare via its I/O port and Virtual PC via the "vpcext" instruction.


GuLoader has the ability to perform anti-VM and anti-sandbox checks using string hashing, the API call "EnumWindows", and checking for Qemu guest agent.


InvisiMole can check for artifacts of VirtualBox, Virtual PC and VMware environment, and terminate itself if they are detected.


Lazarus Group has used tools to detect sandbox or VMware services through identifying the presence of a debugger or related services.


Lucifer can check for specific usernames, computer names, device drivers, DLL's, and virtual devices associated with sandboxed environments and can enter an infinite loop and stop itself if any are detected.


MegaCortex has checked the number of CPUs in the system to avoid being run in a sandbox or emulator.


NativeZone has checked if Vmware or VirtualBox VM is running on a compromised host.


OSX_OCEANLOTUS.D has variants that check a number of system parameters to see if it is being run on real hardware or in a virtual machine environment, such as "sysctl hw.model".


OilRig has used macros to verify if a mouse is connected to a compromised machine.


Okrum's loader can check the amount of physical memory and terminates itself if the host has less than 1.5 Gigabytes of physical memory in total.


PlugX checks if VMware tools is running in the background by searching for any process named "vmtoolsd".


PoetRAT checked the size of the hard drive to determine if it was being run in a sandbox environment. In the event of sandbox detection, it would delete itself by overwriting the malware scripts with the contents of "License.txt" and exiting.


Pupy has a module that checks a number of indicators on the system to determine if its running on a virtual machine.


QakBot can check the compromised host for the presence of multiple executables associated with analysis tools and halt execution if any are found.


ROKRAT can check for VMware-related files and DLLs related to sandboxes.


Remcos searches for Sandboxie and VMware on the system.


Smoke Loader scans processes to perform anti-VM checks.


UBoatRAT checks for virtualization software such as VMWare, VirtualBox, or QEmu on the compromised machine.


WastedLocker checked if UCOMIEnumConnections and IActiveScriptParseProcedure32 Registry keys were detected as part of its anti-analysis technique.


WhisperGate can stop its execution when it recognizes the presence of certain monitoring tools.


macOS.OSAMiner can parse the output of the native `system_profiler` tool to determine if the machine is running with 4 cores.


yty has some basic anti-sandbox detection that tries to detect Virtual PC, Sandboxie, and VMware.


Darkhotel has used malware that repeatedly checks the mouse cursor position to determine if a real user is on the system.


FIN7 used images embedded into document lures that only activate the payload when a user double clicks to avoid sandboxes.


Okrum loader only executes the payload after the left mouse button has been pressed at least three times, in order to avoid being executed within virtualized or emulated environments.


After initial installation, Raindrop runs a computation to delay execution.


AppleJeus has waited a specified time before downloading a second stage payload.


BADFLICK has delayed communication to the actor-controlled IP address by 5 minutes.


Bazar can use a timer to delay execution of core functionality.


BendyBear can check for analysis environments and signs of debugging using the Windows API "kernel32!GetTickCountKernel32" call.


Bisonal has checked if the malware is running in a virtual environment with the anti-debug function GetTickCount() to compare the timing.


Clambling can wait 30 minutes before initiating contact with C2.


Crimson can determine when it has been installed on a host for at least 15 days before downloading the final payload.


Egregor can perform a  long sleep (greater than or equal to 3 minutes) to evade detection.


FatDuke can turn itself on or off at random intervals.


GrimAgent can sleep for 195 - 205 seconds after payload execution and before deleting its task.


HermeticWiper has the ability to receive a command parameter to sleep prior to carrying out destructive actions on a targeted host.


LiteDuke can wait 30 seconds before executing additional code if security software is detected.


P8RAT has the ability to "sleep" for a specified time to evade detection.


Pony has delayed execution using a built-in function to avoid detection and analysis.


SUNBURST remained dormant after initial access for a period of up to two weeks.


Saint Bot has used the command `timeout 20` to pause the execution of its initial loader.


SodaMaster has the ability to put itself to "sleep" for a specified time.


The QakBot dropper can delay dropping the payload to evade detection.


ThiefQuest invokes "time" call to check the system's time, executes a "sleep" command, invokes a second "time" call, and then compares the time difference between the two "time" calls and the amount of time the system slept to identify the sandbox.


TrickBot has used "printf" and file I/O loops to delay process execution as part of API hammering.


Using the machine's local time, XCSSET waits 43200 seconds (12 hours) from the initial creation timestamp of a specific file, ".report". After the elapsed time, XCSSET executes additional modules.


WhisperGate can pause for 20 seconds to bypass antivirus solutions.


OnionDuke has the capability to use a Denial of Service module.


Sandworm Team temporarily disrupted service to Georgian government, non-government, and private sector websites after compromising a Georgian web hosting provider in 2019.


ZxShell has a feature to perform SYN flood attack on a host.


Industroyer uses a custom DoS tool that leverages CVE-2015-5374 and targets hardcoded IP addresses of Siemens SIPROTEC devices.


Sandworm Team has used various MS-SQL stored procedures.


Stuxnet used xp_cmdshell to store and execute SQL code.


LightNeuron has used a malicious Microsoft Exchange transport agent for persistence.


APT28 has used a modified and obfuscated version of the reGeorg web shell to maintain persistence on a target's Outlook Web Access (OWA) server.


APT29 has installed web shells on exploited Microsoft Exchange servers.


APT32 has used Web shells to maintain access to victim websites.


APT38 has used web shells for persistence or to ensure redundant access.


APT39 has installed ANTAK and ASPXSPY web shells.


ASPXSpy is a Web shell. The ASPXTool version used by Threat Group-3390 has been deployed to accessible servers running Internet Information Services (IIS).


BackdoorDiplomacy has used web shells to establish an initial foothold and for lateral movement within a victim's system.


China Chopper's server component is a Web Shell payload.


Dragonfly has commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.


During Operation Wocao, threat actors used their own web shells, as well as those previously placed on target systems by other threat actors, for reconnaissance and lateral movement.


GALLIUM used Web shells to persist in victim environments and assist in execution and exfiltration.


HAFNIUM has deployed multiple web shells on compromised servers including SIMPLESEESHARP, SPORTSBALL, China Chopper, and ASPXSpy.


Kimsuky has used modified versions of open source PHP web shells to maintain access, often adding "Dinosaur" references within the code.


Leviathan relies on web shells for an initial foothold as well as persistence into the victim's systems.


Moses Staff has dropped a web shell onto a compromised system.


OilRig has used web shells, often to maintain access to a victim network.


OwaAuth is a Web shell that appears to be exclusively used by Threat Group-3390. It is installed as an ISAPI filter on Exchange servers and shares characteristics with the China Chopper Web shell.


P.A.S. Webshell can gain remote access and execution on target web servers.


Sandworm Team has used webshells including P.A.S. Webshell to maintain access to victim networks.


TEMP.Veles has planted Web shells on Outlook Exchange servers.


Threat Group-3390 has used a variety of Web shells.


Tonto Team has used a first stage web shell after compromising a vulnerable Exchange server.


Tropic Trooper has started a web service in the target host and wait for the adversary to connect, acting as a web shell.


IceApple is an IIS post-exploitation framework, consisting of 18 modules that provide several functionalities.


RGDoor establishes persistence on webservers as an IIS module.


Bazar can query the Registry for installed applications.


CharmPower can list the installed applications on a compromised host.


ComRAT can check the victim's default browser to determine which process to inject its communications module into.


Dridex has collected a list of installed software on the system.


During Operation Dust Storm, the threat actors deployed a file called `DeployJava.js` to fingerprint installed software on a victim system prior to exploit delivery.


During Operation Wocao, threat actors collected a list of installed software on the infected system.


HEXANE has enumerated programs installed on an infected machine.


HotCroissant can retrieve a list of applications from the "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths" registry key.


Inception has enumerated installed software on compromised systems.


InvisiMole can collect information about installed software used by specific users, software executed on user login, and software executed by each system.


KGH_SPY can collect information on installed applications.


MarkiRAT can check for the Telegram installation directory by enumerating the files on disk.


Metamorfo has searched the compromised system for banking applications.


MuddyWater has used a PowerShell backdoor to check for Skype connectivity on the target machine.


P.A.S. Webshell can list PHP server configuration details.