Procedure examples

TeamPCP has dropped malware into the Windows Startup folder to establish persistence.

Tropic Trooper has created the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell and sets the value to establish persistence.

Turla established persistence by adding a Shell value under the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.

Wizard Spider has established persistence using Userinit by adding the Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.

Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.

APT39 has modified LNK shortcuts.

Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.

Lazarus Group malware has maintained persistence on a system by creating a LNK shortcut in the user’s Startup folder.

Earth Lusca has added the Registry key `HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Print Processors\UDPrint” /v Driver /d “spool.dll /f` to load malware as a Print Processor.

Contagious Interview has established persistence using InvisibleFerret malware to create a .desktop entry to run on startup on GNOME-based Linux devices.

UNC3886 has used vSphere Installation Bundles (VIBs) that contained modified descriptor XML files with the `acceptance-level` set to `partner` which allowed for privilege escalation.

APT38 has used the legitimate application `ieinstal.exe` to bypass UAC.

Patchwork bypassed User Access Control (UAC).

Evilnum has used PowerShell to bypass UAC.

MuddyWater uses various techniques to bypass UAC.

APT37 has a function in the initial dropper to bypass Windows UAC in order to execute the next payload with higher privileges.

APT29 has bypassed UAC.

Medusa Group has attempted to bypass UAC using Component Object Model (COM) interface.

BRONZE BUTLER has used a Windows 10 specific tool and xxmm to bypass UAC for privilege escalation.

Earth Lusca has used the Fodhelper UAC bypass technique to gain elevated privileges.

Cobalt Group has bypassed UAC.

A Threat Group-3390 tool can use a public UAC bypass method to elevate privileges.

HAFNIUM has abused service principals with administrative permissions for data exfiltration.

APT28 has used several malicious applications that abused OAuth access tokens to gain access to target email accounts, including Gmail and Yahoo Mail.

TeamPCP has used stolen access tokens to inject malicious code into CI/CD workflows and to exfiltrate sensitive data from cloud, developer, and container environments.

ShinyHunters has used stolen OAuth keys to access cloud infrastructure and to bypass two-factor authentication.

GALLIUM used dumped hashes to authenticate to other machines via pass the hash.

Kimsuky has used pass the hash for authentication to remote access software used in C2.

APT41 uses tools such as Mimikatz to enable lateral movement via captured password hashes.

APT32 has used pass the hash for lateral movement.

Aquatic Panda used a registry edit to enable a Windows feature called RestrictedAdmin in victim environments. This change allowed Aquatic Panda to leverage "pass the hash" mechanisms as the alteration allows for RDP connections with a valid account name and hash only, without possessing a cleartext password value.

The APT1 group is known to have used pass the hash.

Chimera has dumped password hashes for use in pass the hash authentication attacks.

Ember Bear has used pass-the-hash techniques for lateral movement in victim environments.

APT28 has used pass the hash for lateral movement.

Wizard Spider has used the `Invoke-SMBExec` PowerShell cmdlet to execute the pass-the-hash technique and utilized stolen password hashes to move laterally.

FIN13 has used the PowerShell utility `Invoke-SMBExec` to execute the pass the hash method for lateral movement within an compromised environment.

APT32 successfully gained remote access by using pass the ticket.

APT29 used Kerberos ticket attacks for lateral movement.

BRONZE BUTLER has created forged Kerberos Ticket Granting Ticket (TGT) and Ticket Granting Service (TGS) tickets to maintain administrative access.

Star Blizzard has bypassed multi-factor authentication on victim email accounts by using session cookies stolen using EvilGinx.

Volt Typhoon has obtained credentials insecurely stored on targeted network appliances.

Indrik Spider has searched files to obtain and exfiltrate credentials.

APT3 has a tool that can locate credentials in files on the file system such as those from Firefox or Chrome.

Kimsuky has used tools that are capable of obtaining credentials from saved mail.

MuddyWater has run a tool that steals passwords saved in victim email.

Leafminer used several tools for retrieving login and password information, including LaZagne.

TeamTNT has searched for unsecured AWS credentials and Docker API credentials.

Scattered Spider Spider searches for credential storage documentation on a compromised host.

OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.