Procedure examples

dsquery can be used to gather information on domain trusts with dsquery * -filter "(objectClass=trustedDomain)" -attr *.

PoshC2 has modules for enumerating domain trusts.

Brute Ratel C4 can use LDAP queries and `nltest /domain_trusts` for domain trust discovery.

Nltest may be used to enumerate trusted domains by using commands such as nltest /domain_trusts.

Rubeus can gather information about domain trusts.

AdFind can gather information about organizational units (OUs) and domain trusts from Active Directory.

Prestige has been deployed using the Default Domain Group Policy Object from an Active Directory Domain Controller.

LockBit 3.0 can enable options for propogation through Group Policy Objects.

HermeticWiper has the ability to deploy through an infected system's default domain policy.

LockBit 2.0 can modify Group Policy to disable Windows Defender and to automatically infect devices in Windows domains.

Egregor can modify the GPO to evade detection.

Meteor can use group policy to push a scheduled task from the AD to all network machines.

Qilin has pushed a scheduled task via a Group Policy Object for payload execution.

Empire can use New-GPOImmediateTask to modify a GPO that will install and execute a malicious Scheduled Task/Job.

AADInternals can create a backdoor by converting a domain to a federated domain which will be able to authenticate any user across the tenant. AADInternals can also modify DesktopSSO information.

PowerDuke has a command to write random data across a file and delete it.

AcidRain performs an in-depth wipe of the target filesystem and various attached storage devices through either a data overwrite or calling various IOCTLS to erase it.

Proxysvc can overwrite files indicated by the attacker before deleting them.

Olympic Destroyer overwrites files locally and on remote shares.

DynoWiper has overwritten files with 16-byte sequences of random data generated by the Mersenne Twister algorithm using the Microsoft Windows native `CreateFileW()` function to open the file and the `SetFilePointerEx()` and `WriteFile()` functions to overwrite the file. Additionally, versions of DynoWiper can also delete files using the `DeleteFileW` API.

ShrinkLocker can initiate a destructive payload depending on the operating system check through resizing and reformatting portions of the victim machine's disk, leading to system instability and potential data corruption.

Apostle initially masqueraded as ransomware but actual functionality is a data destruction tool, supported by an internal name linked to an early version, wiper-action. Apostle writes random data to original files after an encrypted copy is created, along with resizing the original file to zero and changing time property metadata before finally deleting the original file.

WhisperGate can corrupt files by overwriting the first 1 MB with `0xcc` and appending random extensions.

AcidPour can perform an in-depth wipe of victim filesystems and attached storage devices through either data overwrite or calling various IOCTLS to erase them, similar to AcidRain.

SameCoin can overwrite designated files on targeted systems with random bytes.

Diavol can delete specified files from a targeted system.

Kazuar can overwrite files with random data before deleting them.

BlackEnergy 2 contains a "Destroy" plug-in that destroys data stored on victim hard drives by overwriting file contents.

MultiLayer Wiper deletes files on network drives, but corrupts and overwrites with random data files stored locally.

Xbash has destroyed Linux-based databases as part of its ransomware capabilities.

Shamoon attempts to overwrite operating system files and disk structures with image files. In a later variant, randomly generated data was used for data overwrites.

StoneDrill has a disk wiper module that targets files other than those in the Windows directory.

HermeticWiper can recursively wipe folders and files in `Windows`, `Program Files`, `Program Files(x86)`, `PerfLogs`, `Boot, System`, `Volume Information`, and `AppData` folders using `FSCTL_MOVE_FILE`. HermeticWiper can also overwrite symbolic links and big files in `My Documents` and on the Desktop with random bytes.

REvil has the capability to destroy files and folders.

CaddyWiper can work alphabetically through drives on a compromised system to take ownership of and overwrite all files.

Meteor can fill a victim's files and directories with zero-bytes in replacement of real content before deleting them.

Shai-Hulud has destroyed the victim’s home directory by overwriting and deleting every writable file within the user's home folder. Shai-Hulud has also utilized the `shred` command on Linux devices.

KillDisk deletes system files to make the OS unbootable. KillDisk also targets and deletes files with 35 different file extensions.

Industroyer’s data wiper module clears registry keys and overwrites both ICS configuration and Windows files.

LazyWiper has overwritten files with pseudorandom 32‑byte sequences written at 16‑byte intervals making the file unrecoverable.

DEADWOOD overwrites files on victim systems with random data to effectively destroy them.

RawDisk was used in Shamoon to write to protected system locations such as the MBR and disk partitions in an effort to destroy data.

SDelete deletes data in a way that makes it unrecoverable.

Mini Shai-Hulud has wiped data on devices that fall within specified parameters to include those that resolve to specific geolocations including Iran and Israel. Mini Shai-Hulud has also implemented a dead-man’s switch that wipes the victims home directory if the operator revokes a GitHub token created by the adversary.

CanisterWorm has targeted wiper components that can delete entire clusters and execute recursive file deletions on non-containerized hosts.

EKANS uses standard encryption library functions to encrypt files.

SynAck encrypts the victims machine followed by asking the victim to pay a ransom.

AvosLocker has encrypted files and network resources using AES-256 and added an `.avos`, `.avos2`, or `.AvosLinux` extension to filenames.

RobbinHood will search for an RSA encryption key and then perform its encryption process on the system files.

RansomHub can use Elliptic Curve Encryption to encrypt files on targeted systems. RansomHub can also skip content at regular intervals (ex. encrypt 1 MB, skip 3 MB) to optomize performance and enable faster encryption for large files.