Procedure examples

During Operation Dream Job, Lazarus Group conducted word searches within documents on a compromised host in search of security and financial matters.

KV Botnet Activity gathers a list of filenames from the following locations during execution of the final botnet stage: \/usr\/sbin\/, \/usr\/bin\/, \/sbin\/, \/pfrm2.0\/bin\/, \/usr\/local\/bin\/.

During SharePoint ToolShell Exploitation, threat actors leveraged commands to locate accessible file shares, backup paths, or SharePoint content.

During Operation Honeybee, the threat actors used a malicious DLL to search for files with specific keywords.

During the Anthropic AI-orchestrated Campaign, the adversary leveraged Claude Code to identify sensitive data within the victim environment for extraction.

During C0015, the threat actors conducted a file listing discovery against multiple hosts to ensure locker encryption was successful.

During the SolarWinds Compromise, APT29 obtained information about the configured Exchange virtual directory using `Get-WebServicesVirtualDirectory`.

During Operation AkaiRyū, MirrorFace enumerated file system details in compromised environments.

During Operation CuckooBees, the threat actors used `dir c:\\` to search for files.

During Salesforce Data Exfiltration, threat actors queried customers' Salesforce environments to identify sensitive information for exfiltration.

During the 2025 Poland Wiper Attacks, the adversaries obtained the contents of users’ directories using `dir /s /b C:\Users` command.

During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and browse the victim file system.

During Operation Wocao, threat actors gathered a recursive directory listing to find files and directories of interest.