HEXANE has downloaded additional payloads and malicious scripts onto a compromised host.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1102.002|Bidirectional Communication|

HEXANE has used cloud services, including OneDrive, for C2.(Citation: Microsoft POLONIUM June 2022)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1567.002|Exfiltration to Cloud Storage|

HEXANE has used cloud services, including OneDrive, for data exfiltration.(Citation: Microsoft POLONIUM June 2022)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1583.002|DNS Server|

HEXANE has set up custom DNS servers to send commands to compromised hosts via TXT records.(Citation: Zscaler Lyceum DnsSystem June 2022)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

HEXANE has used

HEXANE has used

Ping and

HEXANE has used

netstat to monitor connections to specific ports.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Linux,macOS|T1016.001|Internet Connection Discovery|

HEXANE has used tools including

BITSAdmin to test internet connectivity from compromised hosts.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1053.005|Scheduled Task|

HEXANE has used a scheduled task to establish persistence for a keylogger.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

HEXANE has used a VisualBasic script named

HEXANE has used a