Procedure examples

SUPERNOVA is a Web shell.

Neo-reGeorg can be installed on compromised web servers to tunnel C2 connections.

FRAMESTING is a web shell capable of enabling arbitrary command execution on compromised Ivanti Connect Secure VPNs.

WIREFIRE is a web shell that can download files to and execute arbitrary commands from compromised Ivanti Connect Secure VPNs.

STEADYPULSE is a web shell that can enable the execution of arbitrary commands on compromised web servers.

PHASEJAM has inserted Perl-based web shells into legitimate files that provided threat actors with remote access and code execution capabilities on the compromised network appliance.

SLIGHTPULSE is a web shell that can read, write, and execute files on compromised servers.

SPAWNCHIMERA has created web shells that facilitate actions on the victim host.

During Operation Dream Job, Lazarus Group targeted Windows servers running Internet Information Systems (IIS) to install C2 components.

During SharePoint ToolShell Exploitation, threat actors modified Internet Information Services (IIS) components to load suspicious .NET assemblies for persistence.

OwaAuth has been loaded onto Exchange servers and disguised as an ISAPI filter (owaauth.dll). The IIS w3wp.exe process then loads the malicious DLL.

RGDoor establishes persistence on webservers as an IIS module.

IceApple is an IIS post-exploitation framework, consisting of 18 modules that provide several functionalities.

UNC3886 has used vSphere Installation Bundles (VIBs) to install malware and establish persistence across ESXi hypervisors.

VIRTUALPIE has been installed on VMware ESXi servers through malicious vSphere Installation Bundles (VIBs).

During Operation Dust Storm, the threat actors deployed a file called `DeployJava.js` to fingerprint installed software on a victim system prior to exploit delivery.

During Juicy Mix, OilRig used browser data dumper tools to create a list of users with Google Chrome installed.

During Operation Wocao, threat actors collected a list of installed software on the infected system.

SideCopy has collected browser information from a compromised host.

Volt Typhoon has queried the Registry on compromised systems for information on installed software.

MuddyWater has used a PowerShell backdoor to check for Skype connectivity on the target machine.

Sidewinder has used tools to enumerate software installed on an infected host.

Mustang Panda has searched the victim system for the InstallUtil.exe program and its version.

Windigo has used a script to detect installed software on targeted systems.

Tropic Trooper's backdoor could list the infected system's installed software.

BRONZE BUTLER has used tools to enumerate software installed on an infected host.

Windshift has used malware to identify installed software.

Inception has enumerated installed software on compromised systems.

HEXANE has enumerated programs installed on an infected machine.

Orz can gather the victim's Internet Explorer version.

IronWind can list installed software on targeted hosts.

InvisibleFerret has gathered installed programs and running processes.

PUBLOAD has used several commands executed in sequence via `cmd` in a short interval to gather software versions including querying Registry keys.

Woody RAT can collect .NET, PowerShell, and Python information from an infected host.

Cuckoo Stealer has the ability to search systems for installed applications.

InvisiMole can collect information about installed software used by specific users, software executed on user login, and software executed by each system.

P.A.S. Webshell can list PHP server configuration details.

Siloscape searches for the kubectl binary.

MarkiRAT can check for the Telegram installation directory by enumerating the files on disk.

SocGholish can identify the victim's browser in order to serve the correct fake update page.

SpicyOmelette can enumerate running software on a targeted system.

If sent the command `16001`, LightSpy uses the `NSFileManger contentsOfDirectoryAtPath()` to enumerate the Applications folder to collect the bundle name, bundle identifier, and version information from each application's `info.plist` file. The results are then converted into a JSON blob for exfiltration.

Dyre has the ability to identify installed programs on a compromised host.

DustySky lists all installed software for the infected machine.

SVCReady can collect a list of installed software from an infected host.

CharmPower can list the installed applications on a compromised host.

Bundlore has the ability to enumerate what browser is being used as well as version information for Safari.

GlassWorm has searched for existing wallet applications to include Ledger Live and Trezor Suite.

Metamorfo has searched the compromised system for banking applications.

KGH_SPY can collect information on installed applications.