APT29 has used HTTP for C2 and data exfiltration.


APT32 has used JavaScript that communicates over HTTP or HTTPS to attacker controlled domains to download additional frameworks. The group has also used downloaded encrypted payloads over HTTP.


APT33 has used HTTP for command and control.


APT37 uses HTTPS to conceal C2 communications.


APT38 used a backdoor, QUICKRIDE, to communicate to the C2 server over HTTP and HTTPS.


APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits.


Action RAT can use HTTP to communicate with C2 servers.


Agent Tesla has used HTTP for C2 communications.


Amadey has used HTTP for C2 communications.


Anchor has used HTTP and HTTPS in C2 communications.


AppleJeus has sent data to its C2 server via "POST" requests.


AppleSeed has the ability to communicate with C2 over HTTP.


AuTo Stealer can use HTTP to communicate with its C2 servers.


Avenger has the ability to use HTTP in communication with C2.


BACKSPACE uses HTTP as a transport to communicate with its command server.


BADNEWS establishes a backdoor over HTTP.


BBSRAT uses GET and POST requests over HTTP or HTTPS for command and control to obtain commands and send ZLIB compressed data back to the C2 server.


BLINDINGCAN has used HTTPS over port 443 for command and control.


BRONZE BUTLER malware has used HTTP for C2.


BUBBLEWRAP can communicate using HTTP or HTTPS.


BackConfig has the ability to use HTTPS for C2 communiations.


Bazar can use HTTP and HTTPS over ports 80 and 443 in C2 communications.


Bisonal has used HTTP for C2 communications.


BlackEnergy communicates with its C2 server over HTTP.


BlackMould can send commands to C2 in the body of HTTP POST requests.


BoomBox has used HTTP POST requests for C2.


CORESHELL can communicate over HTTP for C2.


CSPY Downloader can use GET requests to download additional payloads from C2.


Carberp has connected to C2 servers via HTTP.


Carbon can use HTTP in C2 communications.


ChChes communicates to its C2 server over HTTP and embeds data within the Cookie HTTP header.


Chaes has used HTTP for C2 communications.


Chimera has used HTTPS for C2 communications.


Clambling has the ability to communicate over HTTP.


Cobalt Strike can use a custom command and control protocol that can be encapsulated in HTTP or HTTPS. All protocols use their standard assigned ports.


CosmicDuke can use HTTP or HTTPS for command and control to hard-coded C2 servers.


CozyCar's main method of communicating with its C2 servers is using HTTP or HTTPS.


CreepyDrive can use HTTPS for C2 using the Microsoft Graph API.


Crutch has conducted C2 communications with a Dropbox account using the HTTP API.


Cyclops Blink can download files via HTTP and HTTPS.


DRATzarus can use HTTP or HTTPS for C2 communications.


Dacls can use HTTPS in C2 communications.


DanBot can use HTTP in C2 communication.


Dark Caracal's version of Bandook communicates with their server over a TCP port using HTTP payloads Base64 encoded and suffixed with the string “&&&”.


DarkWatchman uses HTTPS for command and control.


DealersChoice uses HTTP for communication with the C2 server.


Diavol has used HTTP GET and POST requests for C2.


Doki has communicated with C2 over HTTPS.


Donut can use HTTP to download previously staged shellcode payloads.


DownPaper communicates to its C2 server over HTTP.


Drovorub can use the WebSocket protocol and has initiated communication with C2 servers with an HTTP Upgrade request.


During Frankenstein, the threat actors used HTTP GET requests for C2.


During Night Dragon, threat actors used HTTP for C2.


During Operation CuckooBees, the threat actors enabled HTTP and HTTPS listeners.


DustySky has used both HTTP and HTTPS for C2.


ELMER uses HTTP for command and control.


Egregor has communicated with its C2 servers via HTTPS protocol.


EvilBunny has executed C2 commands directly via HTTP.


Exaramel for Linux uses HTTPS for C2 communications.


FELIXROOT uses HTTP and HTTPS to communicate with the C2 server.


FIN4 has used HTTP POST requests to transmit data.


FIN8 has used HTTPS for command and control.


FatDuke can be controlled via a custom C2 protocol over HTTP.


Flagpro can communicate with its C2 using HTTP.


Gamaredon Group has used HTTP and HTTPS for C2 communications.


Gazer communicates with its C2 servers over HTTP.


Gelsemium can use HTTP/S in C2 communications.


GeminiDuke uses HTTP and HTTPS for command and control.


Get2 has the ability to use HTTP to send information collected from an infected host to C2.


Gold Dragon uses HTTP for communication to the control servers.


GoldMax has used HTTPS and HTTP GET requests with custom HTTP cookies for C2.


GoldenSpy has used the Ryeol HTTP Client to facilitate HTTP internet communication.


Goopy has the ability to communicate with its C2 over HTTP.


Grandoreiro has the ability to use HTTP in C2 communications.


GreyEnergy uses HTTP and HTTPS for C2 communications.


HAFNIUM has used open-source C2 frameworks, including Covenant.


HTTPBrowser has used HTTP and HTTPS for command and control.


HyperBro has used HTTPS for C2 communications.


IceApple can use HTTP GET to request and pull information from C2.


IcedID has used HTTPS in communications with C2.


Inception has used HTTP, HTTPS, and WebDav in network communications.


InvisiMole uses HTTP for C2 communications.


Ixeshe uses HTTP for command and control.


JHUHUGIT variants have communicated with C2 servers over HTTP and HTTPS.


Ke3chang malware including RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer (IE) by using the COM interface IWebBrowser2.


Keydnap uses HTTPS for command and control.


Kinsing has communicated with C2 over HTTP.


Koadic has used HTTP for C2 communications.


LOWBALL command and control occurs via HTTPS over port 443.


Lazarus Group has conducted C2 over HTTP and HTTPS.


LiteDuke can use HTTP GET requests in C2 communications.


Lokibot has used HTTP for C2 communications.


LookBack’s C2 proxy tool sends data to a C2 server over HTTP.


MCMD can use HTTPS in communication with C2 web servers.


MacSpy uses HTTP for command and control.


Machete malware used Python’s urllib library to make HTTP requests to the C2 server.


Machete uses HTTP for Command & Control.


Magic Hound malware has used HTTP for C2.


Maze has communicated to hard-coded IP addresses via HTTP.


MechaFlounder has the ability to use HTTP in communication with C2.


Micropsia uses HTTP and HTTPS for C2 network communications.


Milan can use HTTPS for communication with C2.


MiniDuke uses HTTP and HTTPS for command and control.


Mis-Type network traffic can communicate over HTTP.


Mongall can use HTTP for C2 communication.


Mori can communicate using HTTP over IPv4 or IPv6 depending on a flag set.


MuddyWater has used HTTP for C2 communications.


NETWIRE has the ability to communicate over HTTP.


NOKKI has used HTTP for C2 communications.


Neoichor can use HTTP for C2 communications.


OSX_OCEANLOTUS.D can use HTTP POST and GET requests to send and receive C2 information.


Octopus has used HTTP GET and POST requests for C2 communications.


Out1 can use HTTP and HTTPS in communications with remote hosts.


OutSteel has used HTTP for C2 communications.


OwaAuth uses incoming HTTP requests with a username keyword and commands and handles them as instructions to perform actions.


PLEAD has used HTTP for communications with command and control (C2) servers.


POWRUNER can use HTTP for C2 communications.


PUNCHBUGGY enables remote interaction and can obtain additional code over HTTPS GET and POST requests.


PcShare has used HTTP for C2 communication.


PinchDuke transfers files from the compromised host via HTTP or HTTPS to a C2 server.


PlugX can be configured to use HTTP for command and control.


PoetRAT has used HTTP and HTTPs for C2 communications.


PolyglotDuke has has used HTTP GET requests in C2 communications.


Pony has sent collected information to the C2 via HTTP POST request.


PoshC2 can use protocols like HTTP/HTTPS for command and control traffic.


PowerShower has sent HTTP GET and POST requests to C2 servers to send information and receive instructions.


Proxysvc uses HTTP over SSL to communicate commands with the control server.


QUADAGENT uses HTTPS and HTTP for C2 communications.


QakBot has the ability to use HTTP and HTTPS in communication with C2 servers.


QuietSieve can use HTTPS in C2 communications.


RATANKBA uses HTTP/HTTPS for command and control communication.


RCSession can use HTTP in C2 communications.


REvil has used HTTP and HTTPS in communication with C2.


ROKRAT can use HTTP and HTTPS for command and control communication.


RTM has initiated connections to external domains using HTTPS.


RainyDay can use HTTP in C2 communications.


Remexi uses BITSAdmin to communicate with the C2 server over HTTP.


Remsec is capable of using HTTP and HTTPS for C2.


Rising Sun has used HTTP and HTTPS for command and control.


Rocke has executed wget and curl commands to Pastebin over the HTTPS protocol.


SLOTHFULMEDIA has used HTTP and HTTPS for C2 communications.


SNUGRIDE communicates with its C2 server over HTTP.


SUPERNOVA had to receive an HTTP GET request containing a specific set of parameters in order to execute.


Sandworm Team's BCS-server tool connects to the designated C2 server via HTTP.


ShimRat communicated over HTTP and HTTPS with C2 servers.


ShimRatReporter communicated over HTTP with preconfigured C2 servers.


Sibot communicated with its C2 server via HTTP GET requests.


SideTwist has used HTTP GET and POST requests over port 443 for C2.


SilverTerrier uses HTTP for C2 communications.


Sliver has the ability to support C2 communications over HTTP/S.


Small Sieve can contact actor-controlled C2 servers by using the Telegram API over HTTPS.


SoreFang can use HTTP in C2 communications.


Spark has used HTTP POST requests to communicate with its C2 server to receive commands.


SpeakUp uses POST and GET requests over HTTP to communicate with its main C&C server.


Squirrelwaffle has used HTTP POST requests for C2 communications.


Stealth Falcon malware communicates with its C2 server via HTTPS.


StrongPity can use HTTP and HTTPS in C2 communications.


Stuxnet uses HTTP to communicate with a command and control server.


TA551 has used HTTP for C2 communications.


TSCookie can multiple protocols including HTTP and HTTPS in communication with command and control (C2) servers.


Taidoor has used HTTP GET and POST requests for C2.


The "Uploader" variant of HAMMERTOSS visits a hard-coded server over HTTP/S to download the images HAMMERTOSS uses to receive commands.


The Komplex C2 channel uses HTTP POST requests.


The Regin malware platform supports many standard protocols, including HTTP and HTTPS.


ThiefQuest uploads files via unencrypted HTTP.


Threat Group-3390 malware has used HTTP for C2.


TinyTurla can use HTTPS in C2 communications.


Tomiris can use HTTP to establish C2 communications.


Torisma can use HTTP and HTTPS for C2 communications.


TrickBot uses HTTPS to communicate with its C2 servers, to get malware updates, modules that perform most of the malware logic and various configuration files.


Turian has the ability to use HTTP for its C2.


Turla has used HTTP and HTTPS for C2 communications.


UBoatRAT has used HTTP for C2 communications.


UNC2452 used HTTP for C2 and data exfiltration.


UPPERCUT has used HTTP for C2, including sending error codes in Cookie headers.


VBShower has attempted to obtain a VBS script from command and control (C2) nodes over HTTP.


VaporRage can use HTTP to download shellcode from compromised websites.


Various implementations of CHOPSTICK communicate with C2 over HTTP.


Vasport creates a backdoor by making a connection using a HTTP POST.


WellMess can use HTTP and HTTPS in C2 communications.


WindTail has the ability to use HTTP for C2 communications.


Windshift has used tools that communicate with C2 over HTTP.


Winnti for Linux has used HTTP in outbound communications.


Winnti for Windows has the ability to use encapsulated HTTP/S in C2 communications.


Wizard Spider has used HTTP for network communications.


Zeus Panda uses HTTP for C2 communications.


ZxShell has used HTTP for C2 connections.


httpclient uses HTTP for command and control.


pngdowner uses HTTP for command and control.


xCaon has communicated with the C2 server by sending POST requests over HTTP.


CARROTBALL has the ability to use FTP in C2 communications.


During Operation Honeybee, the threat actors had the ability to use FTP for C2.


Kimsuky has used FTP to download additional malware to the target machine.


NOKKI has used FTP for C2 communications.


SYSCON has the ability to use FTP in C2 communications.


ShadowPad has used FTP for C2 communications.


SilverTerrier uses FTP for C2 communications.


XAgentOSX contains the ftpUpload function to use the FTPManager:uploadFile method to upload files from the target system.


ZxShell has used FTP for C2 connections.


APT28 has used IMAP, POP3, and SMTP for a communication channel in various implants, including using self-registered Google Mail accounts and later compromised email servers of its victims.


APT32 has used email for C2 via an Office macro.


Agent Tesla has used SMTP for C2 communications.


CORESHELL can communicate over SMTP and POP3 for C2.


Cannon uses SMTP/S and POP3/S for C2 communications by sending and receiving emails.


NavRAT uses the email platform, Naver, for C2 communications, leveraging SMTP.


RDAT can use email attachments for C2 communications.


SilverTerrier uses SMTP for C2 communications.


Turla has used multiple backdoors which communicate with a C2 server via email attachments.


Various implementations of CHOPSTICK communicate with C2 over SMTP and POP3.


APT39 has used remote access tools that leverage DNS in communications with C2.


BONDUPDATER can use DNS and TXT records within its DNS tunneling protocol for command and control.


Chimera has used Cobalt Strike to encapsulate C2 in DNS traffic.


Cobalt Group has used DNS tunneling for C2.


Cobalt Strike can use a custom command and control protocol that can be encapsulated in DNS. All protocols use their standard assigned ports.


Cobalt Strike uses a custom command and control protocol that can encapsulated in DNS. All protocols use their standard assigned ports.


DanBot can use use IPv4 A records and IPv6 AAAA DNS records in C2 communications.


Denis has used DNS tunneling for C2 communications.


DnsSystem  can direct queries to custom DNS servers and return C2 commands using TXT records.


Ebury has used DNS requests over UDP port 53 for C2.


Gelsemium has the ability to use DNS in communication with C2.


Goopy has the ability to communicate with its C2 over DNS.


HTTPBrowser has used DNS for command and control.


Heyoka Backdoor can use DNS tunneling for C2 communications.


InvisiMole has used a custom implementation of DNS tunneling to embed C2 communications in DNS requests and replies.


Ke3chang malware RoyalDNS has used DNS for C2.


LazyScripter has leveraged dynamic DNS providers for C2 communications.


NanHaiShu uses DNS for the C2 communications.


OilRig has used DNS for C2 including the publicly available "requestbin.net" tunneling service.


POWRUNER can use DNS for C2 communications.


RDAT has used DNS to communicate with the C2.


SUNBURST used DNS for C2 traffic designed to mimic normal SolarWinds API communications.


ShadowPad has used DNS tunneling for C2 communications.


Sliver can support C2 communications over DNS.


SombRAT can communicate over DNS with the C2 server.


Variants of Kevin can communicate over DNS through queries to the server for constructed domain names with embedded information.


APT32 compromised McAfee ePO to move laterally by distributing malware as a software deployment task.


Threat Group-1314 actors used a victim's endpoint management platform, Altiris, for lateral movement.


Kevin can create directories to store logs and other collected data.


Kobalos can write captured SSH connection credentials to a file under the "/var/run" directory with a ".pid" extension for exfiltration.


Shark has stored information in folders named `U1` and `U2` prior to exfiltration.


ADVSTORESHELL stores output from command execution in a .dat file in the %TEMP% directory.


APT28 has stored captured credential information in a file named pi.log.


APT39 has utilized tools to aggregate data prior to exfiltration.


AppleSeed can stage files in a central location prior to exfiltration.


Astaroth collects data in a plaintext file named r1.log before exfiltration.


Attor has staged collected data in a central upload directory prior to exfiltration.


AuTo Stealer can store collected data from an infected host to a file named `Hostname_UserName.txt` prior to exfiltration.


BADNEWS copies documents under 15MB found on the victim system to is the user's "%temp%\SMB\" folder. It also copies files from USB devices to a predefined directory.


BackdoorDiplomacy has copied files of interest to the main drive's recycle bin.


BadPatch stores collected data in log files before exfiltration.


BoxCaon has created a working folder for collected files that it sends to the C2 server.


Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.


Carbon creates a base directory that contains the files and folders that are collected.


Chimera has staged stolen data locally on compromised hosts.


Data captured by RawPOS is placed in a temporary file under a directory named "memdump".


Dragonfly 2.0 created a directory named "out" in the user's %AppData% folder and copied files to it.


Dragonfly has created a directory named "out" in the user's %AppData% folder and copied files to it.


During Operation Honeybee, stolen data was copied into a text file using the format `From <COMPUTER-NAME> (<Month>-<Day> <Hour>-<Minute>-<Second>).txt` prior to compression, encoding, and exfiltration.


During Operation Wocao, threat actors staged archived files in a temporary directory prior to exfiltration.


DustySky created folders in temp directories to host collected files before exfiltration.


Dyre has the ability to create files in a TEMP folder to act as a database to store information.


Elise creates a file in "AppData\Local\Microsoft\Windows\Explorer" and stores all harvested data in that file.


Exaramel for Windows specifies a path to store files scheduled for exfiltration.


FLASHFLOOD stages data it copies from the local system or removable drives in the "%WINDIR%\$NtUninstallKB885884$\" directory.


FrameworkPOS can identifiy payment card track data on the victim and copy it to a local file in a subdirectory of C:\Windows\.


FunnyDream can stage collected information including screen captures and logged keystrokes locally.


GALLIUM compressed and staged files in multi-part archives in the Recycle Bin prior to exfiltration.


Gold Dragon stores information gathered from the endpoint in a file named 1.hwp.


Helminth creates folders to store output from batch scripts prior to sending the information to its C2 server.


Honeybee adds collected files to a temp.zip file saved in the %temp% folder, then base64 encodes it and uploads it to control server.


Indrik Spider has stored collected date in a .tmp file.


InvisiMole determines a working directory where it stores all the gathered data about the compromised machine.


Kazuar stages command output and collected data in files before exfiltration.


Kimsuky has staged collected data files under "C:\Program Files\Common Files\System\Ole DB\".


Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.


Leviathan has used C:\Windows\Debug and C:\Perflogs as staging directories.


LightNeuron can store email data in files and directories specified in its configuration, such as "C:\Windows\ServiceProfiles\NetworkService\appdata\Local\Temp\".


MESSAGETAP stored targeted SMS messages that matched its target list in CSV files on the compromised system.


Machete created their own directories to drop files into.


Machete stores files and logs in a folder on the local drive.


Mis-Type has temporarily stored collected information to the files `“%AppData%\{Unique Identifier}\HOSTRURKLSR”` and `“%AppData%\{Unique Identifier}\NEWERSSEMP”`.


MoonWind saves information from its keylogging routine as a .zip file in the present working directory.


NETWIRE has the ability to write collected data to a file created in the "./LOGS" directory.


NOKKI can collect data from the victim and stage it in "LOCALAPPDATA%\MicroSoft Updatea\uplog.tmp".


ObliqueRAT can copy specific files, webcam captures, and screenshots to local directories.


Octopus has stored collected information in the Application Data directory on a compromised host.


OopsIE stages the output from command execution and collected files in specific folders before exfiltration.


Operation Wocao has staged archived files in a temporary directory prior to exfiltration.


PUNCHTRACK aggregates collected data in a tmp file.


Patchwork copied all targeted files to a directory called index that was eventually uploaded to the C&C server.


PoisonIvy stages collected data in a text file.


PowerLess can stage stolen browser data in `C:\\Windows\\Temp\\cup.tmp` and keylogger data in `C:\\Windows\\Temp\\Report.06E17A5A-7325-4325-8E5D-E172EBA7FC5BK`.


Prikormka creates a directory, "%USERPROFILE%\AppData\Local\SKC\", which is used to store collected log files.


Rover copies files from removable drives to "C:\system".


SPACESHIP identifies files with certain extensions and copies them to a directory in the user's profile.


STARWHALE has stored collected data in a file called `stari.txt`.


SUGARDUMP has stored collected data under `%<malware_execution_folder>%\\CrashLog.txt`.


Sidewinder has collected stolen files in a temporary folder in preparation for exfiltration.


SombRAT can store harvested data in a custom database under the %TEMP% directory.


TeamTNT has aggregated collected credentials in text files before exfiltrating.


Threat Group-3390 has locally staged encrypted archives for later exfiltration efforts.


Turian can store copied files in a specific directory prior to exfiltration.


USBStealer collects files matching certain criteria from the victim and stores them in a local directory for later exfiltration.


Ursnif has used tmp files to stage gathered information.


Zebrocy stores all collected information in a single file before exfiltration.


ccf32 can temporarily store files in a hidden directory on the local host.


APT28 has staged archives of collected data on a target's Outlook Web Access (OWA) server.


Chimera has staged stolen data on designated servers in the target environment.


During Night Dragon, threat actors copied files to company web servers and subsequently downloaded them.


FIN6 actors have compressed data from remote systems and moved it to another staging system before exfiltration.


FIN8 aggregates staged data from a network into a single location.


Leviathan has staged data remotely prior to exfiltration.


Threat Group-3390 has moved staged encrypted archives to Internet-facing servers that had previously been compromised with China Chopper prior to exfiltration.


UNC2452 staged data and files in password-protected archives on a victim's OWA server.


menuPass has staged data on remote MSP systems or other victim networks prior to exfiltration.


APT18 actors leverage legitimate credentials to log into external remote services.


APT28 has used legitimate credentials to gain initial access, maintain access, and exfiltrate data from a victim network. The group has specifically used credentials stolen through a spearphishing email to login to the DCCC network. The group has also leveraged default manufacturer's passwords to gain initial access to corporate networks via IoT devices such as a VOIP phone, printer, and video decoder.


APT29 used different compromised credentials for remote access and to move laterally.


APT34 has used valid administrator credentials to assist in lateral movement.


Carbanak actors used legitimate credentials of banking employees to perform operations that sent them millions of dollars.


Chimera has used a valid account to maintain persistence via scheduled task.


Dragonfly 2.0 compromised user credentials and used valid accounts for operations.


Dtrack used hard-coded credentials to gain access to a network share.


During Night Dragon, threat actors used compromised VPN accounts to gain access to victim systems.


FIN10 has used stolen credentials to connect remotely to victim networks using VPNs protected with only a single factor.


FIN4 has used legitimate credentials to hijack email communications.


FIN5 has used legitimate VPN, RDP, Citrix, or VNC credentials to maintain access to a victim environment.


FIN7 has harvested valid administrative credentials for lateral movement.


Fox Kitten has used valid credentials with various services during lateral movement.


GALLIUM leveraged valid accounts to maintain access to a victim network.


Industroyer can use supplied user credentials to execute processes and stop services.


Ke3chang has used credential dumpers or stealers to obtain legitimate credentials, which they used to gain access to victim accounts.


Kinsing has used valid SSH credentials to access remote hosts.


Leviathan has obtained valid accounts to gain initial access.


Leviathan has used valid, compromised email accounts for defense evasion, including to send malicious emails to other victim organizations.


Night Dragon has used compromised VPN accounts to gain access to victim systems.


OilRig has used compromised credentials to access other systems on a victim network.


Operation Wocao has used valid VPN credentials to gain initial access.


POLONIUM has used valid compromised credentials to gain access to victim environments.


PittyTiger attempts to obtain legitimate credentials during operations.


Sandworm Team have used previously acquired legitimate credentials prior to attacks.


Silence has used compromised credentials to log on to other systems and escalate privileges.


Silent Librarian has used compromised credentials to obtain unauthorized access to online accounts.


Some SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials.


Suckfly used legitimate account credentials that they dumped to navigate the internal victim network as though they were the legitimate account owner.


TEMP.Veles has used compromised VPN accounts.


Threat Group-3390 actors obtain legitimate credentials using a variety of methods and use them to further lateral movement on victim networks.


To move laterally on a victim network, FIN6 has used credentials stolen from various systems on which it gathered usernames and password hashes.


UNC2452 used different compromised credentials for remote access and to move laterally.


Wizard Spider has used valid credentials for privileged accounts with the goal of accessing domain controllers.


menuPass has used valid accounts including shared between Managed Service Providers and clients to move between the two environments.


HyperStack can use default credentials to connect to IPC$ shares on remote machines.


Stuxnet infected WinCC machines via a hardcoded database server password.


APT29 has used valid accounts, including administrator accounts, to help facilitate lateral movement on compromised networks.


Chimera has used compromised domain accounts to gain access to the target environment.


Cobalt Strike can use known credentials to run commands and spawn processes as a domain user account.


CreepySnail can use stolen credentials to authenticate on target networks.


During Night Dragon, threat actors used domain accounts to gain further access to victim systems.


During Operation CuckooBees, the threat actors used compromised domain administrator credentials as part of their lateral movement.


If Shamoon cannot access shares using current privileges, it attempts access using hard coded, domain-specific credentials gathered earlier in the intrusion.


Indrik Spider has collected credentials from infected systems, including domain accounts.


Naikon has used administrator credentials for lateral movement in compromised networks.


Operation Wocao has used domain credentials, including domain admin, for lateral movement and privilege escalation.


Sandworm Team has used stolen credentials to access administrative accounts within the domain.


Stuxnet attempts to access network resources with a domain account’s credentials.


Threat Group-1314 actors used compromised domain credentials for the victim's endpoint management platform, Altiris, to move laterally.


Wizard Spider has used administrative accounts, including Domain Admin, to move laterally within a victim network.


APT29 has used compromised local accounts to access victims' networks.


APT32 has used legitimate local admin account credentials.


Cobalt Strike can use known credentials to run commands and spawn processes as a local user account.


Emotet can brute force a local admin password, then use it to facilitate lateral movement.


FIN10 has moved laterally using the Local Administrator account.


Kimsuky has used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.


NotPetya can use valid credentials with PsExec or "wmic" to spread itself to remote systems.


PROMETHIUM has created admin accounts on a compromised host.


Stolen Pencil has a tool to add a Windows admin account in order to allow them to ensure continued access via RDP.


Tropic Trooper has used known administrator account credentials to execute the backdoor directly.


APT28 has used compromised Office 365 service accounts with Global Administrator privileges to collect email from user inboxes.


APT33 has used compromised Office 365 accounts in tandem with Ruler in an attempt to gain control of endpoints.


Ke3chang has used compromised credentials to sign into victims’ Microsoft 365 accounts.


Peirates can use stolen service account tokens to perform its operations.


ROADTools leverages valid cloud credentials to perform enumeration operations using the internal Azure AD Graph API.


BRONZE BUTLER has placed malware on file shares and given it the same name as legitimate documents on the share.


Conti can spread itself by infecting other remote machines via network shared drives.


Darkhotel used a virus that propagates by infecting executables stored on shared drives.


Gamaredon Group has injected malicious macros into all Word and Excel documents on mapped network drives.


H1N1 has functionality to copy itself to network shares.


Ramsay can spread itself by infecting other portable executable files on networks shared drives.


Ursnif has copied itself to and infected files in network drives for propagation.


4H RAT sends an OS version identifier in its beacons.


A Gamaredon Group file stealer can gather the victim's computer name and drive serial numbers to send to a C2 server.


A module in Prikormka collects information from the victim about Windows OS version, computer name, battery info, and physical memory.


ADVSTORESHELL can run Systeminfo to gather information about the victim.


APT19 collected system architecture information. APT19 used an HTTP malware variant and a Port 22 malware variant to gather the hostname and CPU information from the victim’s machine.


APT28 has enumerated installed applications on macOS devices with built-in utilities such as "ls -al /Applications".


APT3 has a tool that can obtain information about the local system.


APT32 has collected the OS version and computer name from victims. One of the group's backdoors can also query the Windows Registry to gather system information, and another macOS backdoor performs a fingerprint of the machine on its first connection to the C&C server. APT32 executed shellcode to identify the name of the infected host.


APT38 has attempted to get detailed information about a compromised host, including the operating system, version, patches, hotfixes, and service packs.


Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host.


Agent Tesla can collect the system's computer name and also has the capability to collect information on the processor, memory, OS, and video card from the system.


Amadey has collected the computer name and OS version from a compromised machine.


Anchor can determine the hostname and linux version on a compromised host.


AppleJeus has collected the victim host information after infection.


Aquatic Panda has used native OS commands to understand privilege levels and system details.


Aria-body has the ability to identify the hostname, computer name, Windows version, processor speed, machine GUID, and disk information on a compromised host.


Attor monitors the free disk space on the system.


AuTo Stealer has the ability to collect the hostname and OS information from an infected host.


Avenger has the ability to identify the host volume ID and the OS architecture on a compromised host.


Azorult can collect the machine information, system architecture, the OS version, computer name, Windows product name, the number of CPU cores, video card information, and the system language.


BADCALL collects the computer name and host name on the compromised system.


BISCUIT has a command to collect the processor type, operation system, computer name, uptime, and whether the system is a laptop or PC.


BLUELIGHT has collected the computer name and OS version from victim machines.


BUBBLEWRAP collects system information, including the operating system version and hostname.


BabyShark has executed the "ver" command.


BackConfig has the ability to gather the victim's computer name.


BadPatch collects the OS system, OS version, MAC address, and the computer name from the victim’s machine.


Bandook can collect information about the drives available on the system.


Bisonal has used commands and API calls to gather system information.


Blue Mockingbird has collected hardware details for the victim's system, including CPU and memory information.


Bonadan has discovered the OS version, CPU model, and RAM size of the system it has been installed on.


BoomBox can enumerate the hostname, domain, and IP of a compromised host.


Brave Prince collects hard drive content and system configuration information.


Bumblebee can enumerate the OS version and domain on a targeted system.


Bundlore will enumerate the macOS version to determine which follow-on behaviors to execute using "/usr/bin/sw_vers -productVersion".


CARROTBAT has the ability to determine the operating system of the compromised host and whether Windows is being run with x86 or x64 architecture.


CORESHELL collects hostname, volume serial number and OS version data from the victim and sends the information to its C2 server.


CaddyWiper can use `DsRoleGetPrimaryDomainInformation` to determine the role of the infected machine. CaddyWiper can also halt execution if the compromised host is identified as a domain controller.


Cadelspy has the ability to discover information about the compromised host.


Cannon can gather system information from the victim’s machine such as the OS version, machine name, and drive information.


Carberp has collected the operating system version from the infected system.


Cardinal RAT can collect the hostname, Microsoft Windows version, and processor architecture from a victim machine.


ChChes collects the victim hostname, window resolution, and Microsoft Windows version.


Chaes has collected system information, including the machine name and OS version.


CharmPower can enumerate the OS version and computer name on a targeted system.


Chimera has used `fsutil fsinfo drives`, `systeminfo`, and `vssadmin list shadows` for system information including shadow volumes and drive information.


Chrommme has the ability to list drives and obtain the computer name of a compromised host.


Clambling can discover the hostname, computer name, and Windows version of a targeted machine.


Comnie collects the hostname of the victim machine.


Confucius has used a file stealer that can examine system drives, including those other than the C drive.


CrackMapExec can enumerate the system drives and associated system name.


Crimson contains a command to collect the victim PC name, disk drive information, and operating system.


Cuba can enumerate local drives, disk type, and disk free space.


Cyclops Blink has the ability to query device information.


DarkComet can collect the computer name, RAM used, and operating system version from the victim’s machine.


DarkWatchman can collect the OS version, system architecture, uptime, and computer name.


Denis collects OS information and the computer name from the victim’s machine.


Derusbi gathers the name of the local host, version of GNU Compiler Collection (GCC), and the system information about the CPU, machine, and operating system.


Diavol can collect the computer name and OS version from the system.


DownPaper collects the victim host name and serial number, and then sends the information to the C2 server.


DropBook has checked for the presence of Arabic language in the infected machine's settings.


Dtrack can collect the victim's computer name, hostname and adapter information to create a unique identifier.


During FunnyDream, the threat actors used Systeminfo to collect information on targeted hosts.


During Operation CuckooBees, the threat actors used the `systeminfo` command to gather details about a compromised system.


During Operation Wocao, threat actors discovered the local disks attached to the system and their hardware information including manufacturer and model, as well as the OS versions of systems connected to a targeted network.


DustySky extracts basic information about the operating system.


EVILNUM can obtain the computer name from the victim's system.


Egregor can perform a language check of the infected system and can query the CPU information (cupid).


Elise executes "systeminfo" after initial communication is made to the remote server.


Emissary has the capability to execute ver and systeminfo commands.


Empire can enumerate host system information like OS, architecture, domain name, applied patches, and more.


EnvyScout can determine whether the ISO payload was received by a Windows or iOS device.


Epic collects the OS version, hardware information, computer name, available system memory status, disk space information, and system and user language settings.


Explosive has collected the computer name from the infected host.


FALLCHILL can collect operating system (OS) version information, processor information, system name, and information about installed disks from the victim.


FELIXROOT collects the victim’s computer name, processor architecture, OS version, volume serial number, and system type.


Ferocious can use "GET.WORKSPACE" in Microsoft Excel to determine the OS version of the compromised host.


Final1stspy obtains victim Microsoft Windows version information and CPU architecture.


GRIFFON has used a reconnaissance module that can be used to retrieve information about a victim's computer, including the resolution of the workstation .


Gelsemium can determine the operating system and whether a targeted machine has a 32 or 64 bit architecture.


Gold Dragon collects endpoint information using the "systeminfo" command.


GravityRAT collects the MAC address, computer name, and CPU information.


Green Lambert can use `uname` to identify the operating system name, version, and processor type.


GrimAgent can collect the OS, and build version on a compromised host.


HAWKBALL can collect the OS version, architecture information, and computer name.


HELLOKITTY can enumerate logical drives on a target system.


HEXANE has collected the hostname of a compromised machine.


HermeticWiper can determine the OS version, bitness, and enumerate physical drives on a targeted host.


Heyoka Backdoor can enumerate drives on a compromised host.


Higaisa collected the system volume serial number, GUID, and computer name.


Hildegard has collected the host's OS, CPU, and memory information.


HotCroissant has the ability to determine if the current user is an administrator, Windows product name, processor name, screen resolution, and physical RAM of the infected host.


Hydraq creates a backdoor through which remote attackers can retrieve information such as computer name, OS version, processor speed, memory size, and CPU speed.


IcedID has the ability to identify the computer name and OS version on a compromised host.


Inception has used a reconnaissance module to gather information about the operating system and hardware on the infected host.


Industroyer collects the victim machine’s Windows GUID.


InnaputRAT gathers volume drive information and system information.


Ixeshe collects the computer name of the victim's system during the initial infection.


JPIN can obtain system information such as OS version and disk space.


KGH_SPY can collect drive information from a compromised host.


KOMPROGO is capable of retrieving information about the infected system.


KONNI can gather the OS version, architecture information, connected drives, hostname, RAM size, and disk space information from the victim’s machine and has used "cmd /c systeminfo" command to get a snapshot of the current system state of the target machine.


Kasidet has the ability to obtain a victim's system name and operating system version.


Kazuar gathers information on the system and local drives.


Ke3chang performs operating system information discovery using "systeminfo" and has used implants to identify the system language and computer name.


Kessel has collected the system architecture, OS version, and MAC address information.


Kevin can enumerate the OS version and hostname of a targeted machine.


KeyBoy can gather extended system information, such as information about the operating system, disks, and memory.


KillDisk retrieves the hard disk name by calling the "CreateFileA to \\.\PHYSICALDRIVE0" API.


Kimsuky has enumerated drives, OS type, OS version, and other information using a script or the "systeminfo" command.


Koadic can obtain the OS version and build, computer name, and processor architecture from a compromised host.


Kobalos can record the hostname and kernel version of the target machine.


Kwampirs collects OS version information such as registered owner details, manufacturer details, processor type, available storage, installed patches, hostname, version info, system date, and other system information by using the commands "systeminfo", "net config workstation", "hostname", "ver", "set", and "date /t".


Linfo creates a backdoor through which remote attackers can retrieve system information.


LitePower has the ability to list local drives and enumerate the OS architecture.


Lizar can collect the computer name from the machine,.


Lokibot has the ability to discover the computer name and Windows product name/version.


MacMa can collect information about a compromised computer, including: Hardware UUID, Mac serial number, macOS version, and disk sizes.


Magic Hound malware has used a PowerShell command to check the victim system architecture to determine if it is an x64 machine. Other malware has obtained the OS version, UUID, and computer/host name to send to the C2 server.


MarkiRAT can obtain the computer name from a compromised host.


Metamorfo has collected the hostname and operating system version from the compromised host.


Meteor has the ability to discover the hostname of a compromised host.


Milan can enumerate the targeted machine's name and GUID.


MiniDuke can gather the hostname on a compromised machine.


MobileOrder has a command to upload to its C2 server victim mobile device information, including IMEI, IMSI, SIM card serial number, phone number, Android version, and other information.


Mongall can identify drives on compromised hosts and retrieve the hostname via `gethostbyname`.


MoonWind can obtain the victim hostname, Windows version, RAM amount, number of drives, and screen resolution.


More_eggs has the capability to gather the OS version and computer name.


MuddyWater has used malware that can collect the victim’s OS version and machine name.


Mustang Panda has gathered system information using "systeminfo".


NETWIRE can discover and collect victim system information.


Naid collects a unique identifier (UID) from a compromised host.


Nebulae can discover logical drive information including the drive type, free space, and volume information.


Netwalker can determine the system architecture it is running on to choose which version of the DLL to use.


OSInfo discovers information about the infected machine.


OceanSalt can collect the computer name from the system.


OilRig has run "hostname" and "systeminfo" on a victim.


Okrum can collect computer name, locale information, and information about the OS and architecture.


Orz can gather the victim OS version and whether it is 64 or 32 bit.


POWERSTATS can retrieve OS name/architecture and computer/domain name information from compromised hosts.


PUNCHBUGGY can gather system information such as computer names.


Pasam creates a backdoor through which remote attackers can retrieve information such as hostname and free disk space.


Patchwork collected the victim computer name, OS version, and architecture type and sent the information to its C2 server. Patchwork also enumerated all available drives on the victim's machine.


Penquin can report the file system type and disk space of a compromised host to C2.


PipeMon can collect and send OS version and computer name as a part of its C2 beacon.


PoetRAT has the ability to gather information about the compromised host.


Pony has collected the Service Pack, language, and region information to send to the C2.


PoshC2 contains modules, such as "Get-ComputerInfo", for enumerating common system information.


PowerShower has collected system information on the infected host.


Proxysvc collects the OS version, country name, MAC address, computer name, physical memory statistics, and volume information for all drives on the system.


QakBot can collect system information including the OS version and domain on a compromised host.


QuasarRAT can gather system information from the victim’s machine including the OS type.


RATANKBA gathers information about the OS architecture, OS name, and OS version/Service pack.


REvil can identify the username, machine name, system language, keyboard layout, OS version, and system drive information on a compromised host.


ROKRAT can gather the hostname and the OS version to ensure it doesn’t run on a Windows XP or Windows Server 2003 systems.


RTM can obtain the computer name, OS version, and default language identifier.


Ramsay can detect system information--including disk names, total space, and remaining space--to create a hardware profile GUID which acts as a system identifier for operators.


Reaver collects system information from the victim, including CPU speed, computer name, volume serial number, ANSI code page, OEM code page identifier for the OS, Microsoft Windows version, and memory information.


RedLeaves can gather extended system information including the hostname, OS version number, platform, memory information, time elapsed since system startup, and CPU information.


Remsec can obtain the OS version information, computer name, processor architecture, machine role, and OS edition.


Revenge RAT collects the CPU information, OS information, and system language.


Rifdoor has the ability to identify the Windows version on the compromised host.


Rising Sun can detect the computer name, operating system, and drive information, including drive type, total number of bytes on disk, total number of free bytes on disk, and name of a specified volume.


Rocke has used uname -m to collect the name and information about the infected system's kernel.


RogueRobin gathers BIOS versions and manufacturers, the number of CPU cores, the total physical memory, and the computer name.


RunningRAT gathers the OS version, logical drives information, processor information, and volume information.


Ryuk has called "GetLogicalDrives" to emumerate all mounted drives, and "GetDriveTypeW" to determine the drive type.


SDBbot has the ability to identify the OS version, OS bit information and computer name.


SHARPSTATS has the ability to identify the IP address, machine name, and OS of the compromised host.


SILENTTRINITY can collect information related to a compromised host, including OS version and a list of drives.


SLOWDRIFT collects and sends system information to its C2.


SMOKEDHAM has used the "systeminfo" command on a compromised host.


SOUNDBITE is capable of gathering system information.


STARWHALE can gather the computer name of an infected host.


SUNBURST collected hostname, OS version, and device uptime.


SYSCON has the ability to use Systeminfo to identify system information.


Saint Bot can identify the OS version, CPU, and other details from a victim's machine.


Sandworm Team used a backdoor to enumerate information about the infected system's operating system.


ServHelper will attempt to enumerate Windows version and system architecture.


Several Lazarus Group malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information. A Destover-like variant used by Lazarus Group also collects disk space information and sends it to its C2 server.


ShadowPad has discovered system information including memory status, CPU frequency, OS versions, and volume serial numbers.


SideTwist can collect the computer name of a targeted system.


Skidmap has the ability to check whether the infected system’s OS is Debian or RHEL/CentOS to determine which cryptocurrency miner it should use.


SodaMaster can enumerate the host name and OS version on a target system.


SombRAT can execute "getinfo" to enumerate the computer name and OS version of a compromised system.


SoreFang can collect the hostname, operating system configuration, product ID, and disk space on victim machines by executing Systeminfo.


Sowbug obtained OS version and hardware configuration from a victim.


Spark can collect the hostname, keyboard layout, and language from the system.


Squirrelwaffle has gathered victim computer information and configurations.


Stealth Falcon malware gathers system information via WMI, including the system directory, build number, serial number, version, manufacturer, model, and total physical memory.


StoneDrill has the capability to discover the system OS, Windows version, architecture and environment.


StreamEx has the ability to enumerate system information.


StrifeWater can collect the OS version, architecture, and machine name to create a unique token for the infected host.


StrongPity can identify the hard disk volume serial number on a compromised host.


SysUpdate can determine whether a system has a 32 bit or 64 bit architecture.


Systeminfo can be used to gather information about the operating system.


TeamTNT has searched for system version, architecture, disk partition, logical volume, and hostname information.


The IceApple Server Variable Dumper module iterates over all server variables present for the current request and returns them to the adversary.


The initial beacon packet for Mis-Type contains the operating system version and file system of the victim.


The initial beacon packet for Misdat contains the operating system version of the victim.


The initial beacon packet for S-Type contains the operating system version and file system of the victim.


ThreatNeedle can collect system profile information from a compromised host.


Trojan.Karagany can capture information regarding the victim's OS, security, and hardware configuration.


Tropic Trooper has detected a target system’s OS version and system volume information.


Tropic Trooper has detected a target system’s OS version.


Turla surveys a system upon check-in to discover operating system configuration details using the "systeminfo" and "set" commands.


UPPERCUT has the capability to gather the system’s hostname and OS version.


Ursnif has used Systeminfo to gather system information.


VERMIN collects the OS name, machine name, and architecture information.


Valak can determine the Windows version and computer name on a compromised host.


Volgmer can gather system information, the computer name, OS version, drive and serial information from the victim's machine.


WINDSHIELD can gather the victim computer name.


WINERACK can gather information about the host.


WellMess can identify the computer name of a compromised host.


WhisperGate has the ability to enumerate fixed logical drives on a targeted system.


WinMM collects the system name, OS version including service pack, and system install date and sends the information to the C2 server.


Windigo has used a script to detect which Linux distribution and version is currently installed on the system.


Windshift has used malware to identify the computer name of a compromised host.


Wingbird checks the victim OS version after executing to determine where to drop files based on whether the victim is 32-bit or 64-bit.


Winnti for Windows can determine if the OS on a compromised host is newer than Windows XP.


XAgentOSX contains the getInstalledAPP function to run "ls -la /Applications" to gather what applications are installed.


XCSSET identifies the macOS version and uses "ioreg" to determine serial number.


YAHOYAH checks for the system’s Windows OS version and hostname.


ZIRCONIUM has used a tool to capture the processor architecture of a compromised host in order to register it with C2.


ZeroT gathers the victim's computer name, Windows version, and system language, and then sends it to its C2 server.


Zeus Panda collects the OS version, system architecture, computer name, product ID, install date, and information on the keyboard mapping to determine the language used on the system.


ZxShell can collect the local hostname, operating system details, CPU speed, and total physical memory.


ZxxZ has collected the host name and operating system product name from a compromised machine.


admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about the OS: "ver >> %temp%\download" "systeminfo >> %temp%\download"


build_downer has the ability to send system volume information to C2.


cmd can be used to find information about the operating system.


down_new has the ability to identify the system volume information of a compromised host.


gh0st RAT has gathered system architecture, processor, OS configuration, and installed hardware information.


jRAT collects information about the OS (version, build type, install date) as well as system up-time upon receiving a connection from a backdoor.


njRAT enumerates the victim operating system and computer name during the initial infection.


3PARA RAT has a command to retrieve metadata for files on disk as well as a command to list the current working directory.


4H RAT has the capability to obtain file and directory listings.


A Patchwork payload has searched all fixed drives on the victim for files matching a specified list of extensions.


A module in Prikormka collects information about the paths, size, and creation time of files with specific file extensions, but not the actual content of the file.


A variant of Elise executes "dir C:\progra~1" when initially run.


A version of KONNI searches for filenames created with a previous version of the malware, suggesting different versions targeted the same victims and the versions may work together.


ADVSTORESHELL can list files and directories.


APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection. The group also searched a compromised DCCC computer for specific terms.


APT29 obtained information about the configured Exchange virtual directory using "Get-WebServicesVirtualDirectory".


APT3 has a tool that looks for files and directories on the local file system.


APT32's backdoor possesses the capability to list files and directories on a machine.


APT38 have enumerated files and directories, or searched in specific locations within a compromised host.


Action RAT has the ability to collect drive and file information on an infected machine.


Amadey has searched for folders associated with antivirus software.


Aoqin Dragon has run scripts to identify file formats including Microsoft Word.


AppleSeed has the ability to search for .txt, .ppt, .hwp, .pdf, and .doc files in specified directories.


Aria-body has the ability to gather metadata from a file and to search for file and directory names.


Attor has a plugin that enumerates files with specific extensions on all hard disk drives and stores file information in encrypted log files.


AuditCred can search through folders and files on the system.


AutoIt backdoor is capable of identifying documents on the victim with the following extensions: .doc; .pdf, .csv, .ppt, .docx, .pst, .xls, .xlsx, .pptx, and .jpeg.


Avaddon has searched for specific files prior to encryption.


Avenger has the ability to browse files in directories such as Program Files and the Desktop.


Azorult can recursively search for files in folders and collects files from the desktop with certain extensions.


BACKSPACE allows adversaries to search for files.


BADNEWS identifies files with certain extensions from USB devices, then copies them to a predefined directory.


BBSRAT can list file and directory information.


BLACKCOFFEE has the capability to enumerate files.


BLINDINGCAN can search, read, write, move, and execute files.


BRONZE BUTLER has collected a list of files from the victim and uploaded it to its C2 server, and then created a new list of specific files to steal.


Babuk has the ability to enumerate files on a targeted system.


BabyShark has used "dir" to search for "programfiles" and "appdata".


BackConfig has the ability to identify folders and files related to previous infections.


Backdoor.Oldrea collects information about available drives, default browser, desktop file list, My Documents, Internet history, program files, and root of available drives. It also searches for ICS-related software files.


BadPatch searches for files with specific file extensions.


Bandook has a command to list files on a system.


Bazar can enumerate the victim's desktop.


BlackMould has the ability to find files on the targeted system.


BoomBox can search for specific files and directories on a machine.


BoxCaon has searched for files on the system, such as documents located in the desktop folder.


Brave Prince gathers file and directory information from the victim’s machine.


CaddyWiper can enumerate all files and directories on a compromised host.


Cardinal RAT checks its current working directory upon execution and also contains watchdog functionality that ensures its executable is located in the correct path (else it will rewrite the payload).


Caterpillar WebShell can search for files in directories.


ChChes collects the victim's %TEMP% directory path and version of Internet Explorer.


CharmPower can enumerate drives and list the contents of the C: drive on a victim's computer.


Chimera has utilized multiple commands to identify data of interest in file and directory listings.


China Chopper's server component can list directory contents.


Clambling can browse directories on a compromised host.


Clop has searched folders and subfolders for files to encrypt.


Cobalt Strike can explore files on a compromised system.


Confucius has used a file stealer that checks the Document, Downloads, Desktop, and Picture folders for documents and images with specific extensions.


Conti can discover files on a local system.


CosmicDuke searches attached and mounted drives for file extensions and keywords that match a predefined list.


CrackMapExec can discover specified filetypes and log files on a targeted system.


Crimson contains commands to list files and directories, as well as search for files matching certain extensions from a defined list.


Cryptoistic can scan a directory to identify files for deletion.


Cuba can enumerate files by using a variety of functions.


Cyclops Blink can use the Linux API `statvfs` to enumerate the current working directory.


DDKONG lists files on the victim’s machine.


DEATHRANSOM can use loop operations to enumerate directories on a compromised host.


Dacls can scan directories on a compromised host.


Dark Caracal collected file listings of all default Windows directories.


DarkWatchman has the ability to enumerate file and folder names.


Darkhotel has used malware that searched for files with specific patterns.


Denis has several commands to search directories for files.


Derusbi is capable of obtaining directory, file, and drive listings.


Diavol has a command to traverse the files and directories in a given path.


Dragonfly 2.0 used a batch script to gather folder and file names from victim hosts.


Dragonfly has used a batch script to gather folder and file names from victim hosts.


DropBook can collect the names of all files and folders in the Program Files directories.


Dtrack can list files on available disk volumes.


During C0015, the threat actors conducted a file listing discovery against multiple hosts to ensure locker encryption was successful.


Dust Storm has used Android backdoors capable of enumerating specific files on the infected devices.


DustySky scans the victim for files that contain certain keywords and document types including PDF, DOC, DOCX, XLS, and XLSX, from a list that is obtained from the C2 as a text file. It can also identify logical drives for the infected machine.


Empire includes various modules for finding files of interest on hosts and network shares.


Epic recursively searches for all .doc files on the system and collects a directory listing of the Desktop, %TEMP%, and %WINDOWS%\Temp directories.


FIVEHANDS has the ability to enumerate files on a compromised host in order to encrypt files with specific extensions.


FYAnti can search the "C:\Windows\Microsoft.NET\" directory for files of a specified size.


FatDuke can enumerate directories on target machines.


FinFisher enumerates directories and scans for certain files.


FoggyWeb's loader can check for the FoggyWeb backdoor .pri file on a compromised AD FS server.


Forfiles can be used to locate certain types of files/directories in a system.(ex: locate all files with a specific extension, name, and/or age)


FunnyDream can identify files with .doc, .docx, .ppt, .pptx, .xls, .xlsx, and .pdf extensions and specific timestamps for collection.


Fysbis has the ability to search for files.


Gamaredon Group macros can scan for Microsoft Word and Excel files to inject with additional malicious macros. Gamaredon Group has also used its backdoors to automatically list interesting files (such as Office documents) found on a system.


Gelsemium can retrieve data from specific Windows directories, as well as open random files as part of Virtualization/Sandbox Evasion.


GeminiDuke collects information from the victim, including installed drivers, programs previously executed by users, programs and services configured to automatically run at startup, files and folders present in any user's home folder, files and folders present in any user's My Documents, programs installed to the Program Files folder, and recently accessed files, folders, and programs.


Gold Dragon lists the directories for Desktop, program files, and the user’s recently accessed files.


GoldenSpy has included a program "ExeProtector", which monitors for the existence of GoldenSpy on the infected system and redownloads if necessary.


GravityRAT collects the volumes mapped on the system, and also steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.


HOPLIGHT has been observed enumerating system drives and partitions.


HTTPBrowser is capable of listing files, folders, and drives on a victim.


Heyoka Backdoor has the ability to search the compromised host for files.


Honeybee's service-based DLL implant traverses the FTP server’s directories looking for files with keyword matches for computer names or certain keywords.


HotCroissant has the ability to retrieve a list of files in a given directory as well as drives and drive types.


Hydraq creates a backdoor through which remote attackers can check for the existence of files, including its own components, as well as retrieve a list of logical drives.


Imminent Monitor has a dynamic debugging feature to check whether it is located in the %TEMP% directory, otherwise it copies itself there.


Inception used a file listing plugin to collect information about file and directories both on local and remote drives.


InnaputRAT enumerates directories and obtains file attributes on a system.


InvisiMole can list information about files in a directory and recently opened or used documents. InvisiMole can also search for specific files by supplied file mask.


Ixeshe can list file and directory information.


JPIN can enumerate drives and their types. It can also change file permissions using cacls.exe.


KEYMARBLE has a command to search for files on the victim’s machine.


Kasidet has the ability to search for a given filename on a victim.


Ke3chang uses command-line interaction to search files and directories.


KeyBoy has a command to launch a file browser or explorer on the system.


KillDisk has used the "FindNextFile" command as part of its file deletion process.


Koadic can obtain a list of directories.


Kwampirs collects a list of files and directories in C:\ with the command "dir /s /a c:\ >> "C:\windows\TEMP\[RANDOM].tmp"".


Leafminer used a tool called MailSniper to search for files on the desktop and another utility called Sobolsoft to extract attachments from EML files.


Linfo creates a backdoor through which remote attackers can list contents of drives and search for files.


MESSAGETAP checks for the existence of two configuration files (keyword_parm.txt and parm.txt) and attempts to read the files every 30 seconds.


MacMa can search for a specific file on the compromised computer and can enumerate files in Desktop, Downloads, and Documents folders.


Machete produces file listings in order to search for files to be exfiltrated.


Magic Hound malware can list a victim's logical drives and the type, as well the total/free space of the fixed devices. Other malware can list a directory's contents.


MarkiRAT can look for files carrying specific extensions such as: .rtf, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pps, .ppsx, .txt, .gpg, .pkr, .kdbx, .key, and .jpb.


MegaCortex can parse the available drives and directories to determine which files to encrypt.


Micropsia can perform a recursive directory listing for all volume drives available on the victim's machine and can also fetch specific files by their paths.


Misdat is capable of running commands to obtain a list of files and directories, as well as enumerating logical drives.


MobileOrder has a command to upload to its C2 server information about files on the victim mobile device, including SD card size, installed app list, SMS content, contacts, and calling history.


MoonWind has a command to return a directory listing for a specified directory.


NETEAGLE allows adversaries to enumerate and modify the infected host's file system. It supports searching for directories, creating directories, listing directory contents, reading and writing to files, retrieving file attributes, and retrieving volume information.


NETWIRE has the ability to search for files on the compromised host.


Nebulae can list files and directories on a compromised host.


NotPetya searches for files ending with dozens of different file extensions prior to encryption.


ObliqueRAT has the ability to recursively enumerate files on an infected endpoint.


OceanSalt can extract drive information from the endpoint and search files on the system.


Octopus can collect information on the Windows directory and searches for compressed RAR files on the host.


Okrum has used DriveLetterView to enumerate drive information.


Operation Wocao has gathered a recursive directory listing to find files and directories of interest.


Orz can gather victim drive information.


OutSteel can search for specific file extensions, including zipped files.


POWRUNER may enumerate user directories on a victim.


Pasam creates a backdoor through which remote attackers can retrieve lists of files.


Penquin can use the command code "do_vslist" to send file names, size, and status to C2.


Peppy can identify specific files for exfiltration.


PingPull can enumerate storage volumes and folder contents of a compromised host.


Pisloader has commands to list drives on the victim machine and to list file information for a given directory.


PlugX has a module to enumerate drives and find files recursively.


PoetRAT has the ability to list files upon receiving the "ls" command from C2.


PowerDuke has commands to get the current directory name as well as the size of a file. It also has commands to obtain information about logical drives, drive type, and free space.


Psylo has commands to enumerate all storage devices and to find all files that start with a particular string.


Pteranodon identifies files matching certain file extension and copies them to subdirectories it created.


Pupy can walk through directories and recursively search for strings in files.


QakBot can identify whether it has been run previously on a host by checking for a specified folder.


QuietSieve can search files on the target host by extension, including doc, docx, xls, rtf, odt, txt, jpg, pdf, rar, zip, and 7z.


RARSTONE obtains installer properties from Uninstall Registry Key entries to obtain information about installed applications and how to uninstall certain applications.


REvil has the ability to identify specific files and directories that are not to be encrypted.


ROKRAT has the ability to gather a list of files and directories on the infected system.


RainyDay can use a file exfiltration tool to collect recently changed files with specific extensions.


Ramsay can collect directory and file lists.


Rclone can list files and directories with the `ls`, `lsd`, and `lsl` commands.


Remexi searches for files on the system.


RemoteUtilities can enumerate files and directories on a target machine.


Remsec is capable of listing contents of folders on the victim. Remsec also searches for custom network encryption software on victims.


Rising Sun can enumerate information about files from the infected system, including file size, attributes, creation time, last access time, and write time. Rising Sun can enumerate the compilation timestamp of Windows executable files.


Rover automatically searches for files on local drives based on a predefined list of file extensions.


SDBbot has the ability to get directory listings or drive information on a compromised host.


SHOTPUT has a command to obtain a directory listing.


SILENTTRINITY has several modules, such as `ls.py`, `pwd.py`, and `recentFiles.py`, to enumerate directories and files.


SLOTHFULMEDIA can enumerate files and directories.


SPACESHIP identifies files and directories for collection by searching for specific file extensions or file modification time.


SUGARDUMP can search for and collect data from specific Chrome, Opera, Microsoft Edge, and Firefox files, including any folders that have the string `Profile` in its name.


SUNSPOT enumerated the Orion software Visual Studio solution directory path.


Sandworm Team has enumerated files on a compromised host.


Seasalt has the capability to identify the drive type on a victim.


Several Lazarus Group has conducted word searches on compromised machines to identify specific documents of interest. Lazarus Group malware can use a common function to identify target files by their extension, and some also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives.


Shamoon attempts to access the "ADMIN$", "C$\Windows", "D$\Windows", and "E$\Windows" shares on the victim with its current privileges.


Sidewinder has used malware to collect information on files and directories.


Siloscape searches for the Kubernetes config file and other related files using a regular expression.


Skidmap has checked for the existence of specific files including "/usr/sbin/setenforce" and " /etc/selinux/config". It also has the ability to monitor the cryptocurrency miner file and process.


Sliver can enumerate files on a target system.


Smoke Loader recursively searches through directories for files.


SombRAT can execute "enum" to enumerate files in storage on a compromised system.


Sowbug identified and extracted all Word documents on a server by using a command containing * .doc and *.docx. The actors also searched for documents based on a specific date range and attempted to identify all installed software on a victim.


StreamEx has the ability to enumerate drive types.


StrifeWater can enumerate files on a compromised host.


StrongPity can parse the hard drive on a compromised host to identify specific file extensions.


Stuxnet uses a driver to scan for specific filesystem driver objects.


SynAck checks its directory location in an attempt to avoid launching in a sandbox.


SysUpdate can search files on a compromised host.


TAINTEDSCRIBE can use "DirectoryList" to enumerate files in a specified directory.


TINYTYPHON searches through the drive containing the OS, then all drive letters C through to Z, for documents matching certain extensions.


TSCookie has the ability to discover drive information on the infected host.


TajMahal has the ability to index files from drives, user profiles, and removable drives.


TeamTNT has used a script that checks `/proc/*/environ` for environment variables related to AWS.


The IceApple Directory Lister module can list information about files and directories including creation time, last write time, name, and size.


TrickBot searches the system for all of the following file extensions: .avi, .mov, .mkv, .mpeg, .mpeg4, .mp4, .mp3, .wav, .ogg, .jpeg, .jpg, .png, .bmp, .gif, .tiff, .ico, .xlsx, and .zip. It can also obtain browsing history, cookies, and plug-in information.


Tropic Trooper has monitored files' modified time.


Turian can search for specific files and list directories.


Turla surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, the Program Files directory, and Recent. Turla RPC backdoors have also searched for files matching the "lPH*.dll" pattern.


UNC2452 obtained information about the configured Exchange virtual directory using "Get-WebServicesVirtualDirectory".


USBferry can detect the victim's file or folder list.


Volgmer can list directories on a victim.


WannaCry searches for variety of user files by file extension before encrypting them using RSA and AES, including Office, PDF, image, audio, video, source code, archive/compression format, and key and certificate files.


WarzoneRAT can enumerate directories on a compromise host.


WastedLocker can enumerate files and directories just prior to encryption.


WhisperGate can locate files based on hardcoded file extensions.


WinMM sets a WH_CBT Windows hook to search for and capture files on the victim.


WindTail has the ability to enumerate the users home directory and the path to its own application bundle.


Windigo has used a script to check for the presence of files created by OpenSSH backdoors.


Winnti Group has used a program named ff.exe to search for specific documents on compromised hosts.


Winnti for Windows can check for the presence of specific files prior to moving to the next phase of execution.


XAgentOSX contains the readFiles function to return a detailed listing (sometimes recursive) of a specified directory. XAgentOSX contains the showBackupIosFolder function to check for IOS device backups by running "ls -la ~/Library/Application\ Support/MobileSync/Backup/".


XCSSET has used `mdfind` to enumerate a list of apps known to grant screen sharing permissions.


Zebrocy searches for files that are 60mb and less and contain the following extensions: .doc, .docx, .xls, .xlsx, .ppt, .pptx, .exe, .zip, and .rar. Zebrocy also runs the "echo %APPDATA%" command to list the contents of the directory. Zebrocy can obtain the current execution path as well as perform drive enumeration.


Zox can enumerate files on a compromised host.


ZxShell has a command to open a file manager and explorer on the system.


admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about files and directories: "dir c:\ >> %temp%\download" "dir "c:\Documents and Settings" >> %temp%\download" "dir "c:\Program Files\" >> %temp%\download" "dir d:\ >> %temp%\download"


ccf32 can parse collected files to identify specific file extensions.


cmd can be used to find files and directories with native functionality such as "dir" commands.


down_new has the ability to list the directories on a compromised host.


menuPass has searched compromised systems for folders of interest including those related to HR, audit and expense, and meeting memos.


njRAT can browse file systems using a file manager module.


APT29 obtained a list of users and their roles from an Exchange server using "Get-ManagementRoleAssignment".


XCSSET attempts to discover accounts from various locations such as a user's Evernote, AppleID, Telegram, Skype, and WeChat data.


APT1 used the commands "net localgroup","net user", and "net group" to find accounts on the system.


APT3 has used a tool that can obtain info about local and global group users, power users, and administrators.


APT32 enumerated administrative users using the commands "net localgroup administrators".


Agent Tesla can collect account information from the victim’s machine.


Bankshot gathers domain and account names/information through process monitoring.


Bazar can identify administrator accounts on an infected host.


BitPaymer can enumerate the sessions for each user logged onto the infected host.


Chimera has used "net user" for account discovery.


Commands under "net user" can be used in Net to gather information about and manipulate user accounts.


During Operation CuckooBees, the threat actors used the `net user` command to gather account information.


Elise executes "net user" after initial communication is made to the remote server.


Empire can acquire local and domain user account information.


Epic gathers a list of all user accounts, privilege classes, and time of last logon.


HyperStack can enumerate all account names on a remote share.


InvisiMole has a command to list account information on the victim’s machine.


Kazuar gathers information on local groups and members on the victim’s machine.


Ke3chang performs account discovery using commands such as "net localgroup administrators" and "net group "REDACTED" /domain" on specific permissions groups.


Kwampirs collects a list of accounts with the command "net users".


MURKYTOP has the capability to retrieve information about users on remote hosts.


Milan has run `C:\Windows\system32\cmd.exe /c cmd /c dir c:\users\ /s 2>&1` to discover local accounts.


Mis-Type may create a file containing the results of the command "cmd.exe /c net user {Username}".


OSInfo enumerates local and domain users


OilRig has run "net user", "net user /domain", "net group “domain admins” /domain", and "net group “Exchange Trusted Subsystem” /domain" to get account listings on a victim.


P.A.S. Webshell can display the /etc/passwd file on a compromised host.


POWERSTATS can retrieve usernames from compromised hosts.


Pony has used the "NetUserEnum" function to enumerate local accounts.


Poseidon Group searches for administrator accounts on both the local victim machine and the network.


PoshC2 can enumerate local and domain user account information.


S-Type has run the command `net user` on a victim.


SMOKEDHAM has used "net.exe user" and "net.exe users" to enumerate local accounts on a compromised host.


Stuxnet enumerates user accounts of the local host.


TrickBot collects the users of the system.


Turla has used "net user" to enumerate local accounts on the system.


Bazar has the ability to identify domain administrator accounts.


BloodHound can collect information about domain users, including identification of domain admin accounts.


BoomBox has the ability to execute an LDAP query to enumerate the distinguished name, SAM account name, and display name for all domain users.


CrackMapExec can enumerate the domain user accounts on a targeted system.


Dragonfly 2.0 used batch scripts to enumerate users on a victim domain controller.


Dragonfly has used batch scripts to enumerate users on a victim domain controller.


During Operation Wocao, threat actors used the `net` command to retrieve information about domain accounts.


LAPSUS$ has used the AD Explorer tool to enumerate users on a victim's network.


Lazarus Group has queried an active directory server to obtain the list of accounts, including administrator accounts.


MuddyWater has used "cmd.exe net user /domain" to enumerate domain users.


Net commands used with the "/domain" flag can be used to gather information about and manipulate user accounts on the current domain.


Operation Wocao has used the "net" command to retrieve information about domain accounts.


POWRUNER may collect user account information by running "net user /domain" or a series of other commands on a victim.


SILENTTRINITY can use `System.Security.AccessControl` namespaces to retrieve domain user information.


Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about usernames listed in AD.


SoreFang can enumerate domain accounts via "net.exe user /domain".


Stuxnet enumerates user accounts of the domain.


The IceApple Active Directory Querier module  can perform authenticated requests against an Active Directory server.


Turla has used "net user /domain" to enumerate domain accounts.


Valak has the ability to enumerate domain admin accounts.


dsquery can be used to gather information on user accounts within a domain.


menuPass has used the Microsoft administration tool csvde.exe to export Active Directory data.


Backdoor.Oldrea collects address book information from Outlook.


BoomBox can execute an LDAP query to discover e-mail accounts for domain users.


Emotet has been observed leveraging a module that can scrape email addresses from Outlook.


Lizar can collect email accounts from Microsoft Outlook and Mozilla Thunderbird.


Magic Hound has used Powershell to discover email accounts.


MailSniper can be used to obtain account names from Exchange and Office 365 using the "Get-GlobalAddressList" cmdlet.


Ruler can be used to enumerate Exchange users and dump the GAL.


TrickBot collects email addresses from Outlook.


AADInternals can enumerate Azure AD users.


APT41 used a tool called CLASSFON to covertly proxy network communications.


BADCALL functions as a proxy server between the victim and C2 server.


Dridex contains a backconnect module for tunneling network traffic through a victim's computer. Infected computers become part of a P2P botnet that can relay C2 traffic to other infected peers.


Earth Lusca adopted Cloudflare as a proxy for compromised servers.


FLIPSIDE is a simple proxy that creates an outbound RDP connection.


For Operation Sharpshooter, the threat actors used the ExpressVPN service to hide their location.


Fox Kitten has used the open source reverse proxy tools including FRPC and Go Proxy to establish connections from C2 to local servers.


Gazer identifies a proxy server if it exists and uses it to make HTTP requests.


HOPLIGHT has multiple proxy options that mask traffic between the malware and the remote operators.


HTRAN can proxy TCP socket connections to obfuscate command and control infrastructure.


KOCTOPUS has deployed a modified version of Invoke-Ngrok to expose open local ports to the Internet.


LAPSUS$ has leverage NordVPN for its egress points when targeting intended victims.


NETWIRE can implement use of proxies to pivot traffic.


Ngrok can be used to proxy connections to machines located behind NAT or firewalls.


POLONIUM has used the AirVPN service for operational activity.


PoshC2 contains modules that allow for use of proxies in command and control.


QuasarRAT can communicate over a reverse proxy using SOCKS5.


Remcos uses the infected hosts as SOCKS5 proxies to allow for tunneling and proxying.


SDBbot has the ability to use port forwarding to establish a proxy between a target host and C2.


SombRAT has the ability to use an embedded SOCKS proxy in C2 communications.


Ursnif has used a peer-to-peer (P2P) network for C2.


Vasport is capable of tunneling though a proxy.


WarzoneRAT has the capability to act as a reverse proxy.


Windigo has delivered a generic Windows proxy Win32/Glubteta.M. Windigo has also used multiple reverse proxy chains as part of their C2 infrastructure.


Wizard Spider has used a module named NewBCtestnDll64 as a reverse SOCKS proxy.


ZxShell can set up an HTTP or SOCKS proxy.


netsh can be used to set up a proxy tunnel to allow remote host access to an infected host.


APT39 used custom tools to create SOCK5 and custom protocol proxies between infected hosts.


CHOPSTICK used a proxy server between victims and the C2 server.


Cobalt Strike can be configured to have commands relayed over a peer-to-peer network of infected hosts. This can be used to limit the number of egress points, or provide access to a host without direct internet access.


Duqu can be configured to have commands relayed over a peer-to-peer network of infected hosts if some of the hosts do not have Internet access.


FatDuke can used pipes to connect machines with restricted internet access to remote machines via other infected hosts.


Higaisa discovered system proxy settings and used them if available.


Lazarus Group has used a compromised router to serve as a proxy between a victim network's corporate and restricted segments.


MiniDuke can can use a named pipe to forward communications from one compromised machine with internet access to other compromised machines.


Mythic can leverage a peer-to-peer C2 profile between agents.


Operation Wocao can proxy traffic through multiple infected systems.


Pay2Key has designated machines in the compromised network to serve as reverse proxy pivot points to channel communications with C2.


Strider has used local servers with both local network and Internet access to act as internal proxy nodes to exfiltrate data from other parts of the network without direct Internet access.


The "ZJ" variant of BACKSPACE allows "ZJ link" infections with Internet access to relay traffic from "ZJ listen" to a command server.


The Winnti for Windows HTTP/S C2 mode can make use of a local proxy.


Turla has compromised internal network systems to act as a proxy to forward traffic to C2.


UNC2452 configured at least one instance of Cobalt Strike to use a network pipe over SMB during the 2020 SolarWinds intrusion.


APT28 used other victims as proxies to relay command traffic, for instance using a compromised Georgian military email server as a hop point to NATO victims. The group has also used a tool that acts as a proxy to allow C2 even if the victim is behind a router. APT28 has also used a machine to relay and obscure communications between CHOPSTICK and their server.


An APT3 downloader establishes SOCKS5 connections for its initial C2.


FIN5 maintains access to victim environments by using FLIPSIDE to create a proxy for a backup RDP tunnel.


GALLIUM used a modified version of HTRAN to redirect connections between networks.


Lazarus Group has used multiple proxies to obfuscate network traffic from victims.


MuddyWater has controlled POWERSTATS from behind a proxy network to obfuscate the C2 location. MuddyWater has used a series of compromised websites that victims connected to randomly to relay information to command and control (C2).


Mythic can leverage a modified SOCKS5 proxy to tunnel egress C2 traffic.


Okrum can identify proxy servers configured and used by the victim, and use it to make HTTP requests to C2 its server.


POWERSTATS has connected to C2 servers through proxies.


QakBot has a module that can proxy C2 communications.


Silence has used ProxyBot, which allows the attacker to redirect traffic from the current node to the backconnect server via Sock4\Socks5.


The Winnti for Windows HTTP/S C2 mode can make use of an external proxy.


Tonto Team has routed their traffic through an external server in order to obfuscate their location.


TrickBot has been known to reach a command and control server via one of nine proxy IP addresses.


menuPass has used a global service provider's IP as a proxy for C2 traffic from a victim.


A backdoor used by APT29 created a Tor hidden service to forward traffic from the Tor client to local ports 3389 (RDP), 139 (Netbios), and 445 (SMB) enabling full remote access from outside the network and has also used TOR.


APT28 has routed traffic over Tor and VPN servers to obfuscate their activities.


CostaRicto has used a layer of proxies to manage C2 communications.


Cyclops Blink has used Tor nodes for C2 traffic.


Dok downloads and installs Tor via homebrew.


Dridex can use multiple layers of proxy servers to hide terminal nodes in its infrastructure.


During Operation Wocao, threat actors executed commands through the installed web shell via Tor exit nodes.


FIN4 has used Tor to log in to victims' email accounts.


GreyEnergy has used Tor relays for Command and Control servers.


Inception used chains of compromised routers to proxy C2 communications between them and cloud service providers.


MacSpy uses Tor for command and control.


Operation Wocao has executed commands through the installed web shell via Tor exit nodes.


StrongPity can use multiple layers of proxy servers to hide terminal nodes in its infrastructure.


Traffic traversing the Tor network will be forwarded to multiple nodes before exiting the Tor network and continuing on to its intended destination.


WannaCry uses Tor for command and control traffic.


APT29 has used the meek domain fronting plugin for Tor to hide the destination of C2 traffic.


Cobalt Strike has the ability to accept a value for HTTP Host Header to enable domain fronting.


SMOKEDHAM has used a fronted domain to obfuscate its hard-coded C2 server domain.


APT28 uses a tool to infect connected USB devices and transmit itself to air-gapped computers when the infected USB device is inserted.


APT30 may have used the SHIPSHAPE malware to move onto air-gapped networks. SHIPSHAPE targets removable drives to spread to other systems by modifying the drive to use Autorun to execute or by hiding legitimate document files and copying an executable to the folder with the same name as the legitimate document.


Agent.btz drops itself onto removable media devices and creates an autorun.inf file with an instruction to run that file. When the device is inserted into another system, it opens autorun.inf and loads the malware.


Conficker variants used the Windows AUTORUN feature to spread through USB propagation.


Crimson can spread across systems by infecting removable media.


Darkhotel's selective infector modifies executables stored on removable media as a method of spreading across computers.


DustySky searches for removable media and duplicates itself onto it.


FIN7 actors have mailed USB drives to potential victims containing malware that downloads and installs various backdoors, including in some cases for ransomware operations.


Flame contains modules to infect USB sticks and spread laterally to other Windows systems the stick is plugged into using Autorun functionality.


H1N1 has functionality to copy itself to removable media.


Mustang Panda has used a customized PlugX variant which could spread through USB connections.


Ramsay can spread itself by infecting other portable executable files on removable drives.


Stuxnet can propagate via removable media using an autorun.inf file or the CVE-2010-2568 LNK vulnerability.


USBStealer drops itself onto removable media and relies on Autorun to execute the malicious file when a user opens the removable media on another system.


USBferry can copy its installer to attached USB storage devices.


Ursnif has copied itself to and infected removable drives for propagation.


njRAT can be configured to spread via removable drives.


USBStealer drops commands for a second victim onto a removable media drive inserted into the first victim, and commands are executed when the drive is inserted into the second victim.


Anchor has used ICMP in C2 communications.


Aria-body has used TCP in C2 communications.


AuTo Stealer can use TCP to communicate with command and control servers.


BITTER has used TCP for C2 communications.


BackdoorDiplomacy has used EarthWorm for network tunneling with a SOCKS5 server and port transfer functionalities.


Bandook has a command built in to use a raw TCP socket.


Cobalt Strike can be configured to use TCP, ICMP, and UDP for C2 communications.


Cryptoistic can use TCP in communications with C2.


Derusbi binds to a raw socket on a random source port between 31800 and 31900 for C2.


Drovorub can use TCP to communicate between its agent and client modules.


FIN6 has used Metasploit Bind and Reverse TCP stagers.


FunnyDream can communicate with C2 over TCP and UDP.


Gelsemium has the ability to use TCP and UDP in C2 communications.


If NETEAGLE does not detect a proxy configured on the infected machine, it will send beacons via UDP/6000. Also, after retrieving a C2 IP address and Port Number, NETEAGLE will initiate a TCP connection to this socket. The ensuing connection is a plaintext C2 channel in which commands are specified by DWORDs.


LookBack uses a custom binary protocol over sockets for C2 communications.


MacMa has used a custom JSON-based protocol for its C&C communications.


Mis-Type network traffic can communicate over a raw socket.


MoonWind completes network communication via raw sockets.


Mythic supports WebSocket and TCP-based C2 profiles.


NETWIRE can use TCP in C2 communications.


Nebulae can use TCP in C2 communications.


PLATINUM has used the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel for command and control.


Pay2Key has sent its public key to the C2 server over TCP.


PingPull variants have the ability to communicate with C2 servers using ICMP or TCP.


QuasarRAT can use TCP for C2 communication.


RCSession has the ability to use TCP and UDP in C2 communications.


RainyDay can use TCP in C2 communications.


Remsec is capable of using ICMP, TCP, and UDP for C2.


SDBbot has the ability to communicate with C2 with TCP over port 443.


SombRAT has the ability to use TCP sockets to send data and ICMP to ping the C2 server.


Some Reaver variants use raw TCP for C2.


Some variants of FakeM use SSL to communicate with C2 servers.


TSCookie can use ICMP to receive information on the destination server.


Taidoor can use TCP for C2 communications.


WINDSHIELD C2 traffic can communicate via TCP raw sockets.


Winnti for Linux has used ICMP, custom TCP, and UDP in outbound communications.


Winnti for Windows can communicate using custom TCP.


gh0st RAT has used an encrypted protocol within TCP segments to communicate with the C2.


APT3 has been known to add created accounts to local admin groups to maintain elevated access.


Kimsuky has added accounts to specific groups with "net localgroup".


Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.


Magic Hound granted compromised email accounts read access to the email boxes of additional targeted accounts. The group then was able to authenticate to the intended victim's OWA (Outlook Web Access) portal and read hundreds of email communications for information on Middle East organizations.


Sandworm Team used the "sp_addlinkedsrvlogin" command in MS-SQL to create a link between a created account and other servers in the network.


The Mimikatz credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The "LSADUMP::ChangeNTLM" and "LSADUMP::SetNTLM" modules can also manipulate the password hash of an account without knowing the clear text value.


APT29 has added credentials to OAuth Applications and Service Principals.


UNC2452 added credentials to OAuth Applications and Service Principals.


APT28 has used a Powershell cmdlet to grant the "ApplicationImpersonation" role to a compromised account.


APT29 added their own devices as allowed IDs for active sync using "Set-CASMailbox", allowing it to obtain copies of victim mailboxes. It also added additional permissions (such as Mail.Read and Mail.ReadWrite) to compromised Application or Service Principals.


UNC2452 added their own devices as allowed IDs for active sync using "Set-CASMailbox", allowing it to obtain copies of victim mailboxes. It also added additional permissions (such as Mail.Read and Mail.ReadWrite) to compromised Application or Service Principals.


APT29 has granted `company administrator` privileges to a newly created service principal.


Bundlore creates a new key pair with "ssh-keygen" and drops the newly created user key in "authorized_keys" to enable remote login.


Earth Lusca has dropped an SSH-authorized key in the `/root/.ssh` folder in order to access a compromised server with SSH.


Skidmap has the ability to add the public key of its handlers to the "authorized_keys" file to maintain persistence on an infected host.


TeamTNT has added RSA keys in "authorized_keys".


XCSSET will create an ssh key if necessary with the "ssh-keygen -t rsa -f $HOME/.ssh/id_rsa -P" command. XCSSET will upload a private key file to the server to remotely access the host without a password.


AADInternals can register a device to Azure AD.


APT29 registered devices in order to enable mailbox syncing via the "Set-CASMailbox" command.


APT32 has used Dropbox, Amazon S3, and Google Drive to host malicious downloads.


Bazar downloads have been hosted on Google Docs.


BoomBox can download files from Dropbox using a hardcoded access token.