Juicy Mix C0044

First seen: January 2022
Last seen: December 2022
Created: 25 November 2024
Last modified: 31 July 2026

Juicy Mix was a campaign conducted by OilRig throughout 2022 that targeted Israeli organizations with the Mango backdoor.[1]

Techniques38th pct

Tactics54th pct

Tool or malware45th pct

Threat groupunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Juicy Mix MITRE reference C0044

Scheduled Task T1053.005 ↗

During Juicy Mix, OilRig used VBS droppers to schedule tasks for persistence.2

Execution · Persistence · Privilege Escalation79 detection rules

PowerShell T1059.001 ↗

During Juicy Mix, OilRig used a PowerShell script to steal credentials.3

Execution300 detection rules

Visual Basic T1059.005 ↗

During Juicy Mix, OilRig used VBS droppers to deliver and establish persistence for the Mango backdoor.4

Execution36 detection rules

Web Protocols T1071.001 ↗

During Juicy Mix, OilRig used a VBS script to send POST requests to register installed malware with C2.5

Command and Control60 detection rules

Local Data Staging T1074.001 ↗

During Juicy Mix, OilRig used browser data and credential stealer tools to stage stolen files named Cupdate, Eupdate, and IUpdate in the %TEMP% directory.6

Collection5 detection rules

System Information Discovery T1082 ↗

During Juicy Mix, OilRig used a script to send the name of the compromised host via HTTP POST to register it with C2.7

Discovery54 detection rules

Standing C0044

Reach is how much of ATT&CK this campaign touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 56 ATT&CK campaigns only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques1438th pct

38th percentile · 62% of 56 ATT&CK campaigns have more Enterprise techniques.

Tactics954th pct

54th percentile · 54% of 56 ATT&CK campaigns have this many tactics spanned or fewer.

Tool or malware145th pct

45th percentile · 55% of 56 ATT&CK campaigns have more tools and malware.

Threat group155% tie · 3 values

55% of the population shares a single value across only 3 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique12med41st pct

41st percentile · 59% of 56 ATT&CK campaigns have more detection rules per technique.

Tests / technique4.5med

Juicy Mix detections C0044

568 distinct rules cover the 14 techniques recorded for this campaign. 426 Sigma · 142 Splunk.

13 covered by at least one rule1 with no coverage568 distinct rules in total

Showing 1-50 of 500+ rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects file access requests to browser credential stores by uncommon processes. (...)	Hunting	test	file_event	windows	WinEventLog Security	Credential Access Credentials from Password Stores Credentials from Web Browsers	-	low	Daniel Koifman (@Koifsec), Nasreddine Bencherchali	2024-10-21	—	4b60e527-ec73-4b47-8cb3-f02ad927ca65
	Adversaries may acquire credentials from web browsers by reading files specific to the target browser. (...)	Generic	test	ps_script	windows	PowerShell	Credential Access Credentials from Password Stores Credentials from Web Browsers	-	medium	frack113	2022-01-30	—	fc028194-969d-4122-8abe-0470d5b8f12f
	Detects file access requests to the Windows Credential History File by an uncommon application. (...)	Generic	test	file_access	windows	-	Credential Access Credentials from Password Stores Windows Credential Manager	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-10-17	2024-07-29	7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2
	Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. (...)	Generic	test	file_access	windows	-	Credential Access Credentials from Password Stores Windows Credential Manager	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-10-17	2026-07-28	46612ae6-86be-4802-bc07-39b59feb1309
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-10-09	1fac1481-2dbc-48b2-9096-753c49b4ec71
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Generic	test	file_event	windows	Sysmon	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-12-02	0bcfabcb-7929-47f4-93d6-b33fb67d34d1
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g	2019-08-11	2025-10-17	64e8e417-c19a-475a-8d19-98ea705394cc
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	pipe_created	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g, Tim Shelton	2019-09-12	2025-10-07	58cb02d5-78ce-4692-b3e1-dce850aae41a
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	Detects suspicious user agent strings used in APT malware in proxy logs	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems), Markus Neis	2019-11-12	2024-02-15	6ec820f2-e963-4801-9127-d8b2dce4d31b
	Detects suspicious user agent string of APT40 Dropbox tool	Emerging	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage	-	high	Thomas Patzke	2019-11-12	2023-05-18	5ba715b6-71b7-44fd-8245-f66893e81b3d
	Adversaries may enumerate browser bookmarks to learn more about compromised hosts. (...)	Generic	test	ps_script	windows	PowerShell	Discovery Browser Information Discovery	-	low	frack113	2021-12-13	2022-12-25	e0565f5d-d420-4e02-8a68-ac00d864f9cf
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
	Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...)	Emerging	experimental	dns	-	-	Command and Control Application Layer Protocol Web Protocols Command and Control Dynamic Resolution	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	73e5d24f-493f-4092-bd2f-c72cabda40ee
	focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cob (...)	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	critical	ok @securonix invrep_de, oscd.community	2020-10-09	2022-12-25	8d31a8ce-46b5-4dd6-bdc3-680931f1db86
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
	Detects user data export activity.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	5259cbf2-0a75-48bf-b57a-c54d6fabaef3
	Detects user permission data export attempt.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	87cc6698-3e07-4ba2-9b43-a85a73e151e2
	Detects Bitsadmin connections to IP addresses instead of FQDN names	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Execution, Persistence, Stealth BITS Jobs	-	high	Florian Roth (Nextron Systems)	2022-06-10	2022-08-24	8ccd35a2-1c7c-468b-b568-ac6cdf80eec3
	Detects Bitsadmin connections to domains with uncommon TLDs	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Execution, Persistence, Stealth BITS Jobs	-	high	Florian Roth (Nextron Systems), Tim Shelton	2019-03-07	2026-09-30	9eb68894-7476-4cd6-8752-23b51f5883a7
	Detects default file names outputted by the BloodHound collection tool SharpHound	Generic	test	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	C.J. May	2022-08-09	2026-02-19	02773bed-83bf-469f-b7ff-e676e7d78bab
	Detects powershell execution with that make use of to the bxor (Bitwise XOR). (...)	Hunting	test	ps_classic_start	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	low	Teymur Kheirkhabarov, Harish Segar	2020-06-29	2024-12-11	812837bb-b17f-45e9-8bd0-0ec35d2e3bd6
	Detects calls to cmdlets that are used to export certificates from the local certificate store. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Credential Access Unsecured Credentials Private Keys	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-05-18	—	9e716b33-63b2-46da-86a4-bd3c3b9b5dfb
Splunk	The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Deobfuscate/Decode Files or Information	-	medium	Michael Haag, Splunk	2021-03-25	2026-10-02	bfe94226-8c10-11eb-a4b3-acde48001122
	Detects HTTP request used by Chafer malware to receive data from its C2.	Emerging	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems)	2019-01-31	2024-02-15	fb502828-2db0-438e-93e6-801c7548686d
	Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell	-	medium	frack113	2021-11-01	2025-10-07	87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180
	Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet.	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	frack113	2021-10-20	2023-12-14	61d0475c-173f-4844-86f7-f3eebae1c66b
	Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. (...)	Generic	test	ps_script	windows	PowerShell	Command and Control Application Layer Protocol Web Protocols	-	medium	frack113	2022-01-23	2025-07-18	d4488827-73af-4f8d-9244-7b7662ef046e
	Detects execution of ChromeLoader malware via a registered scheduled task	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task Persistence Software Extensions	-	high	@kostastsale	2022-01-10	—	0a74c5a9-1b71-4475-9af2-7829d320d5c2
Splunk	This analytic detects potential reconnaissance activities on Cisco ASA devices by identifying execution of multiple information-gathering "show" commands within a short timeframe. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Gather Victim Network Information Domain Properties IP Addresses Discovery System Information Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	6e9d4f7a-3c8b-4a9e-8d2f-7b5c9e1a6f3d
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Reconnaissance Gather Victim Network Information Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	71ac5328-2364-40cf-8381-92b8dc531399
Splunk	This analytic detects suspicious use of 'mshta.exe' or 'rundll32.exe' invoking 'mshtml.dll' or the ' (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Execution Command and Scripting Interpreter Visual Basic Stealth System Binary Proxy Execution Mshta	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	f2a9df84-9b01-4a21-9e3a-7aa1a217f69e
Splunk	This analytic detects the usage of the Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes (600 seconds). (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Command and Control Application Layer Protocol Web Protocols Execution Command and Scripting Interpreter AppleScript	-	medium	Radka Viskova, Splunk	2026-09-18	2026-09-22	6bc88a9d-f7de-4257-b526-acf15bc5a517
Splunk	This analytic detects script execution (`wscript.exe` or `cscript.exe`) triggered from compressed fi (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Execution Command and Scripting Interpreter Visual Basic Execution User Execution Malicious File	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	8b07c2c9-0cde-4c44-9fa6-59dcf2b25777
Splunk	The following analytic detects the use of known suspicious SSL certificates in any observed event where the SSL_CertFingerprint field is present. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Resource Development Develop Capabilities Code Signing Certificates Command and Control Encrypted Channel Asymmetric Cryptography Resource Development Obtain Capabilities Digital Certificates	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-09-22	c43f7b49-2dab-4e76-892e-7f971c2f20f1
Splunk	The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter PowerShell Command and Control Ingress Tool Transfer Command and Control Non-Standard Port Privilege Escalation, Stealth Process Injection Command and Control Remote Access Tools Lateral Movement Remote Services	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	d85c05c8-42c0-4e4a-87e7-4e1bb3e844e3
Splunk	The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage Command and Control Ingress Tool Transfer Resource Development Obtain Capabilities Tool Command and Control Proxy External Proxy	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	f7e5e792-d907-46c1-a58e-4ff974dc462a
Splunk	The following analytic detects connections with a high Encrypted Visibility Engine (EVE) threat confidence score, indicating potentially malicious behavior within encrypted traffic. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Command and Control Encrypted Channel Asymmetric Cryptography Exfiltration Exfiltration Over C2 Channel Command and Control Ingress Tool Transfer	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	8c15183e-2e70-4db4-86c3-88f8d9129b66
Splunk	The following analytic highlights high-impact intrusion events assigned by Cisco Secure Firewall. (...)	Anomaly	experimental	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter Resource Development Develop Capabilities Malware Execution Exploitation for Client Execution	-	medium	Nasreddine Bencherchali, Splunk	2025-04-16	2026-05-13	244a77bb-3b2a-46f1-bf2c-b4f7cd29276d
Splunk	This analytic detects exploitation activity of CVE-2023-27532 using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter PowerShell Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services Credential Access OS Credential Dumping LSASS Memory	CVE-2023-27532	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	7b7c2e92-f0b2-48d2-9c9b-b8de52b6b2ae
Splunk	The following analytic detects outbound connections initiated by command-line tools such as curl or wget. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Execution Command and Scripting Interpreter Command and Control Ingress Tool Transfer Execution, Persistence, Privilege Escalation Scheduled Task/Job Cron	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	173a1cb9-1814-4128-a9dc-f29dade89957
	Detects DNS requests to Cloudflared tunnels domains. (...)	Generic	test	dns	windows	Sysmon	Command and Control Application Layer Protocol Web Protocols Command and Control Protocol Tunneling	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-12-20	—	a1d9eec5-33b2-4177-8d24-27fe754d0812
	Detects the use of the redirection character ">" to redirect information on the command line. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	low	frack113	2022-01-22	2024-03-19	4f4eaa9f-5ad4-410c-a4be-bc6132b0175a
	Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell	-	high	Florian Roth (Nextron Systems)	2022-08-23	2026-05-13	a16980c2-0c56-4de0-9a79-17971979efdd
	Detects a suspicious command line execution that includes an URL and AppData string in the command l (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Command and Control Ingress Tool Transfer	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community	2019-01-16	2021-11-27	1ac8666b-046f-4201-8aba-1951aaec03a3
	Detects Turla ComRAT network communication.	Emerging	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems)	2020-05-26	2024-02-26	7857f021-007f-4928-8b2c-7aedbe64bb82
	Detects potential container discovery via listing of certain kernel features in the "/proc" virtual (...)	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Seth Hanford	2023-08-23	—	746c86fb-ccda-4816-8997-01386263acc4

...