Procedure examples

HyperStack can connect to the IPC$ share on remote machines.

Raspberry Robin contains an embedded custom Tor network client that communicates with the primary payload via shared process memory.

Uroburos has the ability to move data between its kernel and user mode components, generally using named pipes.

OilBooster can read the results of command line execution via an unnamed pipe connected to the process.

Cyclops Blink has the ability to create a pipe to enable inter-process communication.

ROADSWEEP can pipe command output to a targeted process.

StealBit can use interprocess communication (IPC) to enable the designation of multiple files for exfiltration in a scalable manner.

SPAWNCHIMERA has leveraged IPC using a UNIX domain socket between the dsmdm process and the web process.

PITSTOP can listen over the Unix domain socket located at `/data/runtime/cockpit/wd.fd`.

LunarWeb can retrieve output from arbitrary processes and shell commands via a pipe.

Mini Shai-Hulud has executed via the use of `subprocess.run` and fed input through standard input `stdin` which acted as a pipe to send data from the parent process and the child process `sys.executable` within memory.

Kimsuky has leveraged Component Object Model (COM) to create scheduled tasks to include using naming conventions that mimic legitimate applications. Kimsuky has leveraged obfuscation VBScript to form a string in `WScript.Shell` which has downloaded a malicious payload to the victim environment.

MuddyWater has used malware that has the capability to execute malicious code via COM, DCOM, and Outlook.

Gamaredon Group malware can insert malicious macros into documents using a Microsoft.Office.Interop object.

Medusa Group has leveraged Component Object Model (COM) to bypass UAC.

TrickBot used COM to setup scheduled task for persistence.

Bumblebee can use a COM object to execute queries to gather system information.

Ursnif droppers have used COM objects to execute the malware's full executable payload.

STATICPLUGIN has utilized Windows COM Installer Object to download an MSI package containing files masqueraded as a BMP file.

InvisiMole can use the ITaskService, ITaskDefinition and ITaskSettings COM interfaces to schedule a task.

CLAIMLOADER has leveraged Component Object Model (COM) objects to create a scheduled task using `ITaskService` interface.

Neoichor can use the Internet Explorer (IE) COM interface to connect and receive commands from C2.

Raspberry Robin creates an elevated COM object for CMLuaUtil and uses this to set a registry value that points to the malicious LNK file during execution.

RustyWater has used a WScript.Shell COM object to execute the CertificationKit.ini file.

DarkTortilla has used the `WshShortcut` COM object to create a .lnk shortcut file in the Windows startup folder.

Latrodectus can use the Windows Component Object Model (COM) to set scheduled tasks.

Milan can use a COM component to generate scheduled tasks.

Ramsay can use the Windows COM API to schedule tasks and maintain persistence.

FunnyDream can use com objects identified with `CLSID_ShellLink`(`IShellLink` and `IPersistFile`) and `WScript.Shell`(`RegWrite` method) to enable persistence mechanisms.

POWERSTATS can use DCOM (targeting the 127.0.0.1 loopback address) to execute additional payloads on compromised hosts.

Gelsemium can use the `IARPUinstallerStringLauncher` COM interface are part of its UAC bypass process.

HermeticWizard can execute files on remote machines using DCOM.

SILENTTRINITY can insert malicious shellcode into Excel.exe using a `Microsoft.Office.Interop` object.

During Operation Sharpshooter, threat actors sent malicious Word OLE documents to victims.

Patchwork leveraged the DDE protocol to deliver their malware.

MuddyWater has used malware that can execute PowerShell scripts via DDE.

Gallmaker attempted to exploit Microsoft’s DDE protocol in order to gain access to victim machines and for execution.

FIN7 spear phishing campaigns have included malicious Word documents with DDE execution.

Sidewinder has used the ActiveXObject utility to create OLE objects to obtain execution through Internet Explorer.

APT37 has used Windows DDE for execution of commands and a malicious VBS.

Leviathan has utilized OLE as a method to insert malicious content inside various phishing documents.

TA505 has leveraged malicious Word documents that abused DDE.

BITTER has executed OLE objects using Microsoft Equation Editor to download and run malicious payloads.

APT28 has delivered JHUHUGIT and Koadic by executing PowerShell commands through DDE in Word documents.

Cobalt Group has sent malicious Word OLE compound documents to victims.

HAWKBALL has used an OLE object that uses Equation Editor to drop the embedded shellcode.

GravityRAT has been delivered via Word documents using DDE for execution.

KeyBoy uses the Dynamic Data Exchange (DDE) protocol to download remote payloads.

RTM can search for specific strings within browser tabs using a Dynamic Data Exchange mechanism.

Valak can execute tasks via OLE.