campaign

C0011 C0011

First seen: December 2021
Last seen: July 2022
Created: 22 September 2022
Last modified: 31 July 2026

C0011 was a suspected cyber espionage campaign conducted by Transparent Tribe that targeted students at universities and colleges in India. Security researchers noted this campaign against students was a significant shift from Transparent Tribe's historic targeting Indian government, military, and think tank personnel, and assessed it was still ongoing as of July 2022.[1]

TechniquesBottom 21%

TacticsBottom 13%

Tool or malware45th pct

Threat groupunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing C0011

Reach is how much of ATT&CK this campaign touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 56 ATT&CK campaigns only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-10-09	1fac1481-2dbc-48b2-9096-753c49b4ec71
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Generic	test	file_event	windows	Sysmon	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-12-02	0bcfabcb-7929-47f4-93d6-b33fb67d34d1
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Initial Access Phishing Spearphishing Attachment Execution User Execution	-	medium	Sreeman	2020-03-13	2022-04-14	24de4f3b-804c-4165-b442-5a06a2302c7e
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
Splunk	The following analytic identifies Azure Device Code Phishing attacks, which can lead to Azure Account Take-Over (ATO). (...)	Generic	stable	authentication	-	Microsoft 365	Initial Access Phishing Spearphishing Link Credential Access Steal Application Access Token	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2023-11-16	2026-05-13	d68d8732-6f7e-4ee5-a6eb-737f2b990b91
Splunk	The following analytic detects the creation of a batch file (.bat) within the Windows system directory tree, specifically in the System32 or SysWOW64 folders. (...)	Anomaly	stable	file_event	windows	Sysmon	Execution User Execution Malicious File	-	medium	Steven Dick, Michael Haag, Rico Valdez, Splunk	2020-04-29	2026-07-02	503d17cb-9eab-4cf8-a20e-01d5c6987ae3	-
Splunk	This analytic detects suspicious use of 'mshta.exe' or 'rundll32.exe' invoking 'mshtml.dll' or the ' (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Execution Command and Scripting Interpreter Visual Basic Stealth System Binary Proxy Execution Mshta	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	f2a9df84-9b01-4a21-9e3a-7aa1a217f69e
Splunk	This analytic detects script execution (`wscript.exe` or `cscript.exe`) triggered from compressed fi (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Execution Command and Scripting Interpreter Visual Basic Execution User Execution Malicious File	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	8b07c2c9-0cde-4c44-9fa6-59dcf2b25777
	Detects CLR DLL being loaded by an Office Product	Generic	test	image_load	windows	Sysmon	Execution User Execution Malicious File	-	medium	Antonlovesdnb	2020-02-19	2023-03-29	d13c43f0-f66b-4279-8b2c-5912077c1780
	Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic JavaScript Stealth Obfuscated Files or Information Compile After Delivery Stealth System Binary Proxy Execution Mshta	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)	2019-02-11	2026-03-23	b730a276-6b63-41b8-bcf8-55930c8fc6ee
	Detects Wscript/Cscript executing a file with an uncommon (i.e. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-05-15	2023-06-19	99b7460d-c9f1-40d7-a316-1f36f61d52ee
Splunk	The following analytic identifies the execution of `outlook.exe` writing a `.zip` file to the disk. (...)	Anomaly	stable	process_creation	windows	Sysmon	Initial Access Phishing Spearphishing Attachment	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	a51bfe1a-94f0-4822-b1e4-16ae10145893
	Detects the execution of the hdiutil utility in order to mount disk images.	Generic	test	process_creation	macos	-	Collection Archive Collected Data Archive via Utility Initial Access Phishing Spearphishing Attachment	-	medium	Omar Khaled (@beacon_exe)	2024-08-10	—	bf241472-f014-4f01-a869-96f99330ca8c
	Detects any assembly DLL being loaded by an Office Product	Generic	test	image_load	windows	Sysmon	Execution User Execution Malicious File	-	medium	Antonlovesdnb	2020-02-19	2023-03-29	ff0f2b05-09db-4095-b96d-1b75ca24894a
	Detects download of certain file types from hosts in suspicious TLDs	Generic	test	proxy	-	-	Execution Exploitation for Client Execution Initial Access Phishing Execution User Execution Malicious File	-	low	Florian Roth (Nextron Systems)	2017-11-07	2023-05-18	00d0b5ab-1f55-4120-8e83-487c0a7baf19
	Detects executable downloads from suspicious remote systems	Generic	test	proxy	-	-	Execution Exploitation for Client Execution Initial Access Phishing Execution User Execution Malicious File	-	low	Florian Roth (Nextron Systems)	2017-03-13	2023-05-18	b5de2919-b74a-4805-91a7-5049accbaefe
Splunk	The following analytic detects the dropping of a suspicious file named "license.dat" in %appdata% or %programdata%. (...)	Hunting	stable	file_event	windows	Sysmon	Execution User Execution Malicious File	-	medium	Teoderick Contreras, Splunk	2021-08-05	2026-05-13	b7a045fc-f14a-11eb-8e79-acde48001122
	Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.ex (...)	Emerging	stable	process_creation	windows	Sysmon · WinEventLog Security	Execution Exploitation for Client Execution Initial Access Phishing Spearphishing Attachment Execution User Execution Malicious File	CVE-2017-11882	critical	Florian Roth (Nextron Systems)	2017-11-23	2021-11-27	678eb5f4-8597-4be6-8be7-905e4234b53a
Splunk	The following analytic detects email attachments with an unusually high number of spaces in their file names, which is a common tactic used by attackers to obfuscate file extensions. (...)	Anomaly	experimental	email	-	-	Stealth Masquerading Masquerade File Type Initial Access Phishing Spearphishing Attachment	-	medium	David Dorsey, Splunk	2020-04-29	2026-05-13	56e877a6-1455-4479-ada6-0550dc1e22f8	-
	Detects outbound web proxy requests to URLs matching the EvilTokens Phishing-as-a-Service (PhaaS) kit infrastructure. (...)	Emerging	experimental	proxy	-	-	Initial Access Phishing Spearphishing Link	-	low	uniqu3-us3r	2026-04-28	—	e0e121d0-be4d-4281-af7e-17abbba4a408
Splunk	The following analytic detects the execution of JavaScript using the JScript.Encode CLSID (COM Object) by cscript.exe. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Visual Basic	-	medium	Teoderick Contreras, Splunk	2021-06-23	2026-05-13	dc64d064-d346-11eb-8588-acde48001122
	Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and C (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Exploitation for Client Execution Initial Access Phishing Spearphishing Attachment Execution User Execution Malicious File	CVE-2017-0261 CVE-2017-0262	medium	Florian Roth (Nextron Systems)	2018-02-22	2021-11-27	864403a1-36c9-40a2-a982-4c9a45f7d833
	Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Exploitation for Client Execution Initial Access Phishing Spearphishing Attachment Execution User Execution Malicious File	CVE-2017-8759	critical	Florian Roth (Nextron Systems)	2017-09-15	2021-11-27	fdd84c68-a1f6-47c9-9477-920584f94905
	This rule will monitor executable and script file creation by office applications. (...)	Unsupported	experimental	file_event	windows	Sysmon	Stealth System Binary Proxy Execution Regsvr32 Execution User Execution Malicious File Execution Windows Management Instrumentation	-	high	Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule)	2021-08-23	2022-06-02	8c6fd6fc-28fc-4597-a86a-fc1de20b039d
	Detects the creation of files with an executable or script extension by an Office application.	Generic	test	file_event	windows	Sysmon	Execution User Execution Malicious File	-	high	Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems)	2021-08-23	2025-10-17	c7a74c80-ba5a-486e-9974-ab9e682bc5e4
	Detects a flashplayer update from an unofficial location	Generic	test	proxy	-	-	Initial Access Drive-by Compromise Stealth Masquerading Match Legitimate Resource Name or Location Execution User Execution Malicious File	-	high	Florian Roth (Nextron Systems)	2017-10-25	2022-08-08	4922a5dd-6743-4fc2-8e81-144374280997
	Detects any GAC DLL being loaded by an Office Product	Generic	test	image_load	windows	Sysmon	Execution User Execution Malicious File	-	high	Antonlovesdnb	2020-02-19	2023-02-10	90217a70-13fc-48e4-b3db-0d836c5824ac
Splunk	The following analytic detects suspicious attachment file extensions in GSuite emails, potentially indicating a spear-phishing attack. (...)	Anomaly	stable	account_management	-	Google Cloud	Initial Access Phishing Spearphishing Attachment	-	medium	Teoderick Contreras, Splunk	2021-08-16	2026-05-13	6d663014-fe92-11eb-ab07-acde48001122
Splunk	The following analytic identifies Gsuite emails with suspicious subjects and attachments commonly used in spear phishing attacks. (...)	Anomaly	stable	account_management	-	Google Cloud	Initial Access Phishing Spearphishing Attachment	-	medium	Teoderick Contreras, Splunk	2021-08-19	2026-05-13	8ef3971e-00f2-11ec-b54f-acde48001122
Splunk	The following analytic detects emails in Gsuite containing links to known abuse web services such as Pastebin, Telegram, and Discord. (...)	Anomaly	stable	account_management	-	Google Cloud	Initial Access Phishing Spearphishing Attachment	-	medium	Teoderick Contreras, Splunk	2021-08-23	2026-05-13	8630aa22-042b-11ec-af39-acde48001122
Splunk	The following analytic detects shared files in Google Drive with suspicious filenames commonly used in spear phishing campaigns. (...)	Anomaly	experimental	cloud_audit	-	Google Cloud	Initial Access Phishing Spearphishing Attachment	-	medium	Teoderick Contreras, Splunk	2021-08-23	2026-05-13	07eed200-03f5-11ec-98fb-acde48001122
	Detects remote thread creation from CACTUSTORCH as described in references.	Generic	test	create_remote_thread	windows	Sysmon	Execution Command and Scripting Interpreter Visual Basic JavaScript Privilege Escalation, Stealth Process Injection Process Hollowing Stealth System Binary Proxy Execution Mshta	-	high	@SBousseaden (detection), Thomas Patzke (rule)	2019-02-01	2023-05-05	2e4e488a-6164-4811-9ea1-f960c7359c40
	Detects command line parameters used by Koadic hack tool	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic JavaScript	-	high	wagga, Jonhnathan Ribeiro, oscd.community	2020-01-12	2023-02-11	5cddf373-ef00-4112-ad72-960ac29bac34
	Detects the process injection of a LittleCorporal generated Maldoc.	Generic	test	process_access	windows	Sysmon	Privilege Escalation, Stealth Process Injection Thread Execution Hijacking Execution User Execution Malicious File	-	high	Christian Burkard (Nextron Systems)	2021-08-09	2023-11-28	7bdde3bf-2a42-4c39-aa31-a92b3e17afac
	Detects file creation events indicating NetExec (nxc.exe) execution on the local machine. (...)	Generic	experimental	file_event	windows	Sysmon	Execution Command and Scripting Interpreter Visual Basic Lateral Movement Remote Services SMB/Windows Admin Shares	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-08	—	efc21479-9e83-41da-8cf1-122e06ba8db3
	Detects web browser process opening an HTML file from a user's Downloads folder. (...)	Hunting	experimental	process_creation	windows	Sysmon · WinEventLog Security	Initial Access Phishing Spearphishing Attachment Reconnaissance Phishing for Information Spearphishing Attachment	-	low	Joseph Kamau	2025-12-05	—	538c5851-8c03-4724-8ec4-623bc7aadaea
	Detects a suspicious child process of a Microsoft HTML Help (HH.exe)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic JavaScript Initial Access Phishing Spearphishing Attachment Stealth System Binary Proxy Execution Compiled HTML File Regsvr32 Rundll32 Execution Windows Management Instrumentation	-	high	Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)	2020-04-01	2023-04-12	52cad028-0ff0-4854-8f67-d25dfcbc78b4
	Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. (...)	Generic	test	file_event	windows	Sysmon	Initial Access Phishing Spearphishing Attachment	-	high	@sam0x90	2022-07-30	—	2f9356ae-bf43-41b8-b858-4496d83b2acb
	Detects the mount of an ISO image on an endpoint	Generic	test	file_event	windows	WinEventLog Security	Initial Access Phishing Spearphishing Attachment	-	medium	Syed Hasan (@syedhasan009)	2021-05-29	2023-11-09	0248a7bc-8a9a-4cd8-a57e-3ae8e073a073
	Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing attacks. (...)	Generic	test	file_event	windows	Sysmon	Initial Access Phishing Spearphishing Attachment	-	medium	Florian Roth (Nextron Systems)	2022-02-11	—	4358e5a5-7542-4dcb-b9f3-87667371839b
	Detects the Kapeka Backdoor binary being loaded by rundll32.exe. (...)	Emerging	test	image_load	windows	Sysmon	Stealth System Binary Proxy Execution Rundll32 Execution User Execution Malicious File	-	high	Swachchhanda Shrawan Poudel	2024-07-03	—	a7e6b1f9-8d2c-4f1e-9a7d-63e4c8a2bf4c
Splunk	The following analytic detects exploitation of Ghostscript causing command execution. (...)	Generic	stable	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Privilege Escalation Exploitation for Privilege Escalation Initial Access Phishing Execution User Execution Malicious File	CVE-2024-29510	medium	Raven Tait, Splunk	2026-07-08	2026-09-01	580f99d8-a4c8-4ef1-9c84-f355867bca41
	Detects Microsoft Excel loading an Add-In (.xll) file	Hunting	test	image_load	windows	Sysmon	Execution User Execution Malicious File	-	low	Nasreddine Bencherchali (Nextron Systems)	2023-05-12	—	c5f4b5cb-4c25-4249-ba91-aa03626e3185
	Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location	Generic	test	image_load	windows	Sysmon	Execution User Execution Malicious File	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-05-12	—	af4c4609-5755-42fe-8075-4effb49f5d44
	Detects outlvba (Microsoft VBA for Outlook Addin) DLL being loaded by the outlook process	Generic	test	image_load	windows	Sysmon	Execution User Execution Malicious File	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-02-08	2024-03-12	9a0b8719-cd3c-4f0a-90de-765a4cb3f5ed
	Detects Microsoft Word loading an Add-In (.wll) file which can be used by threat actors for initial access or persistence.	Hunting	test	image_load	windows	Sysmon	Execution User Execution Malicious File	-	low	Steffen Rogge (dr0pd34d)	2024-07-10	—	1337afba-d17d-4d23-bd55-29b927603b30
	Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-Left Override (RLO) abuse, disguising them as document formats.	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Right-to-Left Override Stealth System Binary Proxy Execution MMC Execution User Execution Malicious File	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-02-05	—	9cfe4b27-1e56-48b4-b7a8-d46851c91a44
	Detects when the Microsoft Management Console (MMC) loads the DLL libraries like vbscript, jscript e (...)	Generic	experimental	image_load	windows	Sysmon	Execution Command and Scripting Interpreter Visual Basic Stealth System Binary Proxy Execution MMC	-	medium	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-02-05	—	a9c73e8b-3b2d-4c45-8ef2-5f9a9c9998ad

Title

Description

C0011 C0011

C0011 MITRE reference C0011

Standing C0011

Reach

Coverage

C0011 detections C0011