Procedure examples

Gelsemium can use dynamic DNS domain names in C2.

AsyncRAT can be configured to use dynamic DNS.

Remcos has used dynamic DNS domains in C2 communications.

Amadey has used fast flux DNS for its C2.

gh0st RAT operators have used dynamic DNS to mask the true location of their C2 behind rapidly changing IP addresses.

njRAT has used a fast flux DNS for C2 IP resolution.

Ursnif has used a DGA to generate domain names for C2.

Aria-body has the ability to use a DGA for C2 communications.

SombRAT can use a custom DGA to generate a subdomain for C2.

Doki has used the DynDNS service and a DGA based on the Dogecoin blockchain to generate C2 domains.

Conficker has used a DGA that seeds with the current UTC victim system date to generate domains.

POSHSPY uses a DGA to derive command and control URLs from a word list.

MiniDuke can use DGA to generate new Twitter URLs for C2.

DarkWatchman has used a DGA to generate a domain name for C2.

Grandoreiro can use a DGA for hiding C2 addresses, including use of an algorithm with a user-specific key that changes daily.

Shark can send DNS C2 communications using a unique domain generation algorithm.

Bazar can implement DGA using the current date as a seed variable.

HiddenFace has used dynamic domain generation algorithms in C2.

Milan can use hardcoded domains as an input for domain generation algorithms.

CCBkdr can use a DGA for Fallback Channels if communications with the primary command and control server are lost.

CHOPSTICK can use a DGA for Fallback Channels, domains are generated by concatenating words from lists.

BONDUPDATER uses a DGA to communicate with command and control servers.

Ebury has used a DGA to generate a domain name for C2.

ShadowPad uses a DGA that is based on the day of the month for C2 servers.

Astaroth has used a DGA in C2 communications.

QakBot can use domain generation algorithms in C2 communication.

ngrok can provide DGA for C2 servers through the use of random URL strings that change every 12 hours.

AsyncRAT use a DGA to generate a C2 domains.

macOS.OSAMiner has used `launchctl` to restart the Launch Agent.

Cuckoo Stealer can use `launchctl` to load a LaunchAgent for persistence.

Calisto uses launchctl to enable screen sharing on the victim’s machine.

XCSSET loads a system level launchdaemon using the launchctl load -w command from /System/Librarby/LaunchDaemons/ssh.plist.

AppleJeus has loaded a plist file using the launchctl command.

LoudMiner launched the QEMU services in the /Library/LaunchDaemons/ folder using launchctl. It also uses launchctl to unload all Launch Daemons when updating to a newer version of LoudMiner.

Proxysvc registers itself as a service on the victim’s machine to run as a standalone process.

StrongPity can install a service to execute itself as a service.

TinyTurla can install itself as a service on compromised machines.

Bad Rabbit drops a file named infpub.datinto the Windows directory and is executed through SCManager and rundll.exe.

Olympic Destroyer utilizes PsExec to help propagate itself across a network.

Mafalda can create a remote service, let it run once, and then delete it.

BlackByte 2.0 Ransomware executes as a service when deployed.

HOPLIGHT has used svchost.exe to execute a malicious DLL .

WastedLocker can execute itself as a service.

InvisiMole has used Windows services as a way to execute its malicious payload.

WhisperGate can download and execute AdvancedRun.exe via `sc.exe`.

Okrum's loader can create a new service named NtmsSvc to execute the payload.

RemoteCMD can execute commands remotely by creating a new service on the remote system.

Ragnar Locker has used sc.exe to execute a service that it creates.

NotPetya can use PsExec to help propagate itself across a network.

HyperBro has the ability to start and stop a specified service.