Procedure examples

Earth Lusca has used Tasklist to obtain information from a compromised host.

Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.

Inception has used a reconnaissance module to identify active processes and other associated loaded modules.

Play has used the information stealer Grixba to check for a list of security processes.

HEXANE has enumerated processes on targeted systems.

Magic Hound malware can list running processes.

Dragonfly has used the command line for execution.

APT32 has used COM scriptlets to download Cobalt Strike beacons.

FIN6 has used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.

FIN7 used SQL scripts to help perform tasks on the victim's machine.

Mustang Panda has utilized meterpreter shellcode.

APT39 has utilized custom scripts to perform internal reconnaissance.

APT37 has used Ruby scripts to execute payloads.

OilRig has used various types of scripting for execution.

Windigo has used a Perl script for information gathering.

Malware used by Ke3chang can run commands on the command-line interface.

Saint Bear has used the Windows Script Host (wscript) to execute intermediate files written to victim machines.

Winter Vivern used XLM 4.0 macros for initial code execution for malicious document files.

FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.

Stealth Falcon malware uses WMI to script data collection and command execution on the victim.

Whitefly has used a simple remote shell tool that will call back to the C2 server and wait for commands.

Fox Kitten has used a Perl reverse shell to communicate with C2.

APT19 downloaded and launched code within a SCT file.

APT38 has used PowerShell to execute commands and other operational tasks.

Indrik Spider has used PowerShell Empire for execution of malware.

BlackByte used encoded PowerShell commands during operations. BlackByte has used remote PowerShell commands in victim networks.

GALLIUM used PowerShell for execution to assist in lateral movement as well as for dumping credentials stored on compromised machines.

APT3 has used PowerShell on victim systems to download and run payloads after exploitation.

Kimsuky has executed a variety of PowerShell scripts including Invoke-Mimikatz. Kimsuky has also utilized PowerShell scripts for execution, persistence, and defense evasion. Kimsuky has leveraged PowerShell’s cmdlet `Expand-Archive` to extract contents of zip files into the same directory. Kimsuky has employed ClickFix type tactics enticing victims to copy and paste malicious PowerShell commands and scripts, where the scripts ultimately led to QuasarRAT.

Volt Typhoon has used PowerShell including for remote system discovery.

Patchwork used PowerSploit to download payloads, run a reverse shell, and execute malware on the victim's machine.

APT41 leveraged PowerShell to deploy malware families in victims’ environments.

Dragonfly has used PowerShell scripts for execution.

Gorgon Group malware can use PowerShell commands to download and execute a payload and open a decoy document on the victim’s machine.

menuPass uses PowerSploit to inject shellcode into PowerShell.

APT32 has used PowerShell-based tools, PowerShell one-liners, and shellcode loaders for execution.

HAFNIUM has used the Exchange Power Shell module Set-OabVirtualDirectoryPowerShell to export mailbox data.

MuddyWater has used PowerShell for execution.

FIN6 has used PowerShell to gain access to merchant's networks, and a Metasploit PowerShell module to download and execute shellcode and to set up a local listener.

Gamaredon Group has used obfuscated PowerShell scripts for staging. Additionally, (LinkById : G0047) has used PowerShell based tools later in its attack chain. Additionally, Gamaredon Group has used the PowerShell cmdlet `Get-Command` to download and execute the next stage payload.

Gallmaker used PowerShell to download additional payloads and for execution.

Storm-1811 has used PowerShell for multiple purposes, such as using PowerShell scripts executing in an infinite loop to create an SSH connection to a command and control server.

TeamTNT has executed PowerShell commands in batch scripts.

FIN7 used a PowerShell script to launch shellcode that retrieved an additional payload. Additionally, FIN7 has executed a custom obfuscation of the shellcode invoker in PowerSploit called POWERTRASH.

Sandworm Team has used PowerShell scripts to run a credential harvesting tool in memory to evade defenses.

CURIUM has leveraged PowerShell scripts for initial process execution and data gathering in victim environments.

Sidewinder has used PowerShell to drop and execute malware loaders.

Mustang Panda has used malicious PowerShell scripts to enable execution.

Scattered Spider has used the PowerShell cmdlet Get-ADUser.

APT39 has used PowerShell to execute malicious code.