Procedure examples

Egregor can perform a long sleep (greater than or equal to 3 minutes) to evade detection.

metaMain has delayed execution for five to six minutes during its persistence establishment process.

LunarWeb can pause for a number of hours before entering its C2 communication loop.

Using the machine's local time, XCSSET waits 43200 seconds (12 hours) from the initial creation timestamp of a specific file, .report. After the elapsed time, XCSSET executes additional modules.

AppleJeus has waited a specified time before downloading a second stage payload.

The QakBot dropper can delay dropping the payload to evade detection.

StrifeWater can modify its sleep time responses from the default of 20-22 seconds.

evilginx2 has the ability to hide phishing lures for a set time to avoid scanning by sandboxes.

Brute Ratel C4 can call `NtDelayExecution` to pause execution.

CanisterWorm has leveraged a Sleep setting of five minutes before executing tasks to evade sandbox environments.

BADFLICK has delayed communication to the actor-controlled IP address by 5 minutes.

Lucifer can execute TCP, UDP, and HTTP denial of service (DoS) attacks.

NKAbuse enables multiple types of network denial of service capabilities across several protocols post-installation.

OnionDuke has the capability to use a Denial of Service module.

ZxShell has a feature to perform SYN flood attack on a host.

Industroyer uses a custom DoS tool that leverages CVE-2015-5374 and targets hardcoded IP addresses of Siemens SIPROTEC devices.

Stuxnet used xp_cmdshell to store and execute SQL code.

LightNeuron has used a malicious Microsoft Exchange transport agent for persistence.

SEASHARPEE is a Web shell.

reGeorg is a web shell that has been installed on exposed web servers for access to victim environments.

BUSHWALK is a web shell that has the ability to execute arbitrary commands or write files.

P.A.S. Webshell can gain remote access and execution on target web servers.

GLASSTOKEN is a web shell capable of tunneling C2 connections and code execution on compromised Ivanti Secure Connect VPNs.

ASPXSpy is a Web shell. The ASPXTool version used by Threat Group-3390 has been deployed to accessible servers running Internet Information Services (IIS).

China Chopper's server component is a Web Shell payload.

SnappyTCP is a reverse TCP shell with command and control capabilities used for persistence purposes.

LIGHTWIRE is a web shell capable of command execution and establishing persistence on compromised Ivanti Secure Connect VPNs.

Line Runner is a persistent Lua-based web shell.

RAPIDPULSE is a web shell that is capable of arbitrary file read on targeted web servers to exfiltrate items of interest on the victim device.

PHPsert can use the .php assert function to execute attacker-provided code and maintain persistence on targeted web servers.

PULSECHECK is a web shell that can enable command execution on compromised servers.

OwaAuth is a Web shell that appears to be exclusively used by Threat Group-3390. It is installed as an ISAPI filter on Exchange servers and shares characteristics with the China Chopper Web shell.

SUPERNOVA is a Web shell.

Neo-reGeorg can be installed on compromised web servers to tunnel C2 connections.

FRAMESTING is a web shell capable of enabling arbitrary command execution on compromised Ivanti Connect Secure VPNs.

WIREFIRE is a web shell that can download files to and execute arbitrary commands from compromised Ivanti Connect Secure VPNs.

STEADYPULSE is a web shell that can enable the execution of arbitrary commands on compromised web servers.

PHASEJAM has inserted Perl-based web shells into legitimate files that provided threat actors with remote access and code execution capabilities on the compromised network appliance.

SLIGHTPULSE is a web shell that can read, write, and execute files on compromised servers.

SPAWNCHIMERA has created web shells that facilitate actions on the victim host.

OwaAuth has been loaded onto Exchange servers and disguised as an ISAPI filter (owaauth.dll). The IIS w3wp.exe process then loads the malicious DLL.

RGDoor establishes persistence on webservers as an IIS module.

IceApple is an IIS post-exploitation framework, consisting of 18 modules that provide several functionalities.

VIRTUALPIE has been installed on VMware ESXi servers through malicious vSphere Installation Bundles (VIBs).

Orz can gather the victim's Internet Explorer version.

IronWind can list installed software on targeted hosts.

InvisibleFerret has gathered installed programs and running processes.

PUBLOAD has used several commands executed in sequence via `cmd` in a short interval to gather software versions including querying Registry keys.

Woody RAT can collect .NET, PowerShell, and Python information from an infected host.

Cuckoo Stealer has the ability to search systems for installed applications.