Windows File Transfer Methods

💾 Windows File Transfer Methods: Intro & APT Example

The Windows OS keeps changing — and so do the ways files can be transferred 📂 These methods can be used by attackers to avoid detection AND defenders to catch them!

---

🧠 Key Learning: Fileless Threats

🦠 Fileless threats = No obvious file stored on disk Instead, attackers use built-in Windows tools to carry out attacks in memory (sneaky!).

---

🕵️‍♂️ The Astaroth Attack – Step by Step

The Microsoft Astaroth Attack is used here as an example of an APT (Advanced Persistent Threat). It followed these steps:

1. 🎣 Phishing Email → victim clicks on an LNK file

2. 🛠️ This triggers the WMIC tool with the /Format flag

3. 📜 This executes JavaScript code

4. 🌐 JavaScript abuses the Bitsadmin tool to download more payloads

5. 🔐 Payloads are Base64-encoded and decoded using Certutil → DLL files

6. 🧩 DLLs are loaded using regsvr32

7. 💣 Final payload (Astaroth) is injected into the Userinit process

🎯 Goal: Fully compromise the system without leaving easy-to-find files!