DarkVishnya G0105

Created: 15 May 2020
Last modified: 31 July 2026
Alias: DarkVishnya

DarkVishnya is a financially motivated threat actor targeting financial institutions in Eastern Europe. In 2017-2018 the group attacked at least 8 banks in this region.[1]

Techniques31st pct

Tactics48th pct

Tools & malware39th pct

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

DarkVishnya MITRE reference G0105

Network Sniffing T1040 ↗

DarkVishnya used network sniffing to obtain login data. 2

Credential Access · Discovery12 detection rules

Network Service Discovery T1046 ↗

DarkVishnya performed port scanning to obtain the list of active services.3

Discovery33 detection rules

PowerShell T1059.001 ↗

DarkVishnya used PowerShell to create shellcode loaders.4

Execution300 detection rules

Brute Force T1110 ↗

DarkVishnya used brute-force attack to obtain login data.5

Credential Access50 detection rules

Network Share Discovery T1135 ↗

DarkVishnya scanned the network for public shared folders.6

Discovery16 detection rules

Hardware Additions T1200 ↗

DarkVishnya physically connected Bash Bunny, Raspberry Pi, netbooks, and inexpensive laptops to the target organization's environment to access the company’s local network.7

Initial Access13 detection rules

Standing G0105

Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques1031st pct

31st percentile · 69% of 176 ATT&CK groups have more Enterprise techniques.

Tactics848th pct

48th percentile · 52% of 176 ATT&CK groups have more tactics spanned.

Tools & malware239th pct

39th percentile · 61% of 176 ATT&CK groups have more tools and malware.

Campaigns089% tie · 4 values

89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique18.5med49th pct

49th percentile · 51% of 176 ATT&CK groups have more detection rules per technique.

Tests / technique9med

DarkVishnya detections G0105

529 distinct rules cover the 10 techniques recorded for this group. 370 Sigma · 159 Splunk.

10 covered by at least one rule529 distinct rules in total

Showing 1-50 of 500+ rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.	Generic	test	authentication	-	Azure Sign-in Logs · Azure	Credential Access Brute Force	-	medium	AlertIQ	2021-10-10	2022-12-25	2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a
Splunk	The following analytic detects the execution of network scanning utilities such as Advanced IP Scanner or Advanced Port Scanner. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Network Service Discovery Discovery Network Share Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-10-24	2026-05-13	9a4e50c7-5b62-4d52-93b4-f2b61332e9a5
	Detects the use of Advanced IP Scanner. (...)	Generic	test	file_event	windows	Sysmon	Discovery Network Service Discovery	-	medium	@ROxPinTeddy	2020-05-12	2022-11-29	fed85bf9-e075-4280-9159-fbe8a023d6fa
	Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-02-28	2025-10-22	6c8fbee5-dee8-49bc-851d-c3142d02aa47
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g	2019-08-11	2025-10-17	64e8e417-c19a-475a-8d19-98ea705394cc
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	pipe_created	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g, Tim Shelton	2019-09-12	2025-10-07	58cb02d5-78ce-4692-b3e1-dce850aae41a
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	This method detects malicious services mentioned in APT29 report by FireEye. (...)	Unsupported	unsupported	process_creation	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Thomas Patzke	2017-11-01	2022-03-21	c069f460-2b87-4010-8dcf-e45bab362624
Splunk	The following analytic detects the resetting of the master user password for an Amazon RDS DB instance. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Credential Access Brute Force Resource Development Compromise Accounts Cloud Accounts	-	medium	Patrick Bareiss, Splunk	2022-08-07	2026-05-13	d15e9bd9-ef64-4d84-bc04-f62955a9fee8
Splunk	The following analytic detects multiple failed attempts to assume an AWS IAM role, indicating a potential brute force attack. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Credential Access Brute Force Discovery Cloud Infrastructure Discovery	-	medium	Patrick Bareiss, Splunk	2022-10-04	2026-05-13	726959fe-316d-445c-a584-fa187d64e295
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
	Detects failed AWS console login attempts due to authentication failures. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Credential Access Brute Force	-	medium	Ivan Saakov, Nasreddine Bencherchali	2025-10-19	—	6393e346-1977-46ef-8987-ad414a145fad
Splunk	The following analytic detects the resetting of the master user password for an Amazon RDS DB instance. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Credential Access Brute Force Resource Development Compromise Accounts Cloud Accounts	-	medium	Gowthamaraj Rajendran, Splunk	2022-08-07	2026-05-13	6153c5ea-ed30-4878-81e6-21ecdb198189
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
Splunk	The following analytic detects multiple failed attempts to assume an AWS IAM role, indicating a potential brute force attack. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Credential Access Brute Force Discovery Cloud Infrastructure Discovery	-	medium	Michael Haag, Splunk	2021-04-06	2026-05-13	f19e09b0-9308-11eb-b7ec-acde48001122
	focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cob (...)	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	critical	ok @securonix invrep_de, oscd.community	2020-10-09	2022-12-25	8d31a8ce-46b5-4dd6-bdc3-680931f1db86
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
	Detects user authentication failure events. (...)	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Credential Access Brute Force Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	70ed1d26-0050-4b38-a599-92c53d57d45a
	Detects SSH user login access failures. (...)	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Credential Access Brute Force Lateral Movement Remote Services SSH	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	d3f90469-fb05-42ce-b67d-0fded91bbef3
	Detects default file names outputted by the BloodHound collection tool SharpHound	Generic	test	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	C.J. May	2022-08-09	2026-02-19	02773bed-83bf-469f-b7ff-e676e7d78bab
	Detects powershell execution with that make use of to the bxor (Bitwise XOR). (...)	Hunting	test	ps_classic_start	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	low	Teymur Kheirkhabarov, Harish Segar	2020-06-29	2024-12-11	812837bb-b17f-45e9-8bd0-0ec35d2e3bd6
	Detects calls to cmdlets that are used to export certificates from the local certificate store. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Credential Access Unsecured Credentials Private Keys	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-05-18	—	9e716b33-63b2-46da-86a4-bd3c3b9b5dfb
	Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell	-	medium	frack113	2021-11-01	2025-10-07	87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180
	Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet.	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	frack113	2021-10-20	2023-12-14	61d0475c-173f-4844-86f7-f3eebae1c66b
	Detects execution of ChromeLoader malware via a registered scheduled task	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task Persistence Software Extensions	-	high	@kostastsale	2022-01-10	—	0a74c5a9-1b71-4475-9af2-7829d320d5c2
Splunk	This analytic detects execution of packet capture commands on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Credential Access, Collection Adversary-in-the-Middle Credential Access, Discovery Network Sniffing	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	7e9c3f8a-4b2d-4c5e-9a1f-6d8e5b3c2a9f
	Detects BGP failures which may be indicative of brute force attacks to manipulate routing	Generic	test	-	-	BGP · Cisco	Credential Access, Collection Adversary-in-the-Middle Credential Access Brute Force Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	low	Tim Brown	2023-01-09	2023-01-23	56fa3cd6-f8d6-4520-a8c7-607292971886
Splunk	This analytic detects bursts of ping, SSH, and Telnet commands issued from Cisco IOS or NX-OS devices. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Discovery Network Service Discovery Lateral Movement Remote Services SSH Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	efb20922-17bc-4fb0-880c-be50cfc100dd
	Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels	Generic	test	-	-	LDAP · Cisco	Credential Access, Collection Adversary-in-the-Middle Credential Access Brute Force Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	low	Tim Brown	2023-01-09	—	50e606bf-04ce-4ca7-9d54-3449494bbd4b
Splunk	The following analytic detects any outbound network connection from an endpoint process to a known suspicious or non-standard port. (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Command and Control Non-Standard Port	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	fc32a8d5-bc79-4437-b48f-4646ab7bed9d
Splunk	The following analytic detects a blocked connection event by identifying a "Block" value in the action field. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	17e9b764-3a2b-4d36-9751-32d13ce4718b
Splunk	The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter PowerShell Command and Control Ingress Tool Transfer Command and Control Non-Standard Port Privilege Escalation, Stealth Process Injection Command and Control Remote Access Tools Lateral Movement Remote Services	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	d85c05c8-42c0-4e4a-87e7-4e1bb3e844e3
Splunk	The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage Command and Control Ingress Tool Transfer Resource Development Obtain Capabilities Tool Command and Control Proxy External Proxy	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	f7e5e792-d907-46c1-a58e-4ff974dc462a
Splunk	The following analytic detects file transfers flagged as malware that occurred over non-standard ports (other than 80 and 443). (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Ingress Tool Transfer Command and Control Non-Standard Port	-	medium	Nasreddine Bencherchali, Splunk	2025-04-09	2026-09-22	f26445a8-a6a2-4855-bec0-0c39e52e5b8f
Splunk	The following analytic detects network traffic associated with known remote access software applicat (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Remote Access Tools	-	medium	Nasreddine Bencherchali, Splunk	2025-05-28	2026-09-22	ac54d39e-a75d-4f42-971d-006db3a0423a
Splunk	The following analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	1f57f10e-1dc5-47ea-852c-2e85b2503d79
Splunk	This analytic detects exploitation activity of CVE-2023-27532 using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter PowerShell Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services Credential Access OS Credential Dumping LSASS Memory	CVE-2023-27532	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	7b7c2e92-f0b2-48d2-9c9b-b8de52b6b2ae
	Show when a monitor or a span/rspan is setup or modified	Generic	test	authentication	-	Cisco AAA · Cisco	Credential Access, Discovery Network Sniffing	-	medium	Austin Clark	2019-08-11	2023-01-04	b9e1f193-d236-4451-aaae-2f3d2102120d	-
Splunk	This analytic detects changes to SNMP community strings on Cisco devices, which could indicate an attacker establishing persistence or attempting to extract credentials. (...)	Anomaly	stable	configuration_change	-	Cisco IOS · Cisco	Defense Impairment Disable or Modify Tools Credential Access, Discovery Network Sniffing Credential Access Unsecured Credentials	CVE-2018-0171	medium	Bhavin Patel, Michael Haag, Splunk	2025-08-21	2026-05-13	b0ce5521-2533-4f24-b8d5-c2ff977aae08
Splunk	The following analytic identifies the use of named-pipe impersonation for privilege escalation, commonly associated with Cobalt Strike and similar frameworks. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	medium	Michael Haag, Splunk	2021-05-27	2026-05-13	eb277ba0-b96b-11eb-b00e-acde48001122
	Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell	-	high	Florian Roth (Nextron Systems)	2022-08-23	2026-05-13	a16980c2-0c56-4de0-9a79-17971979efdd
	Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...)	Generic	test	service	windows	WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Wojciech Lesicki	2021-05-26	2022-11-27	d7a95147-145f-4678-b85d-d1ff4a3bb3f6
	Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...)	Generic	test	service	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems), Wojciech Lesicki	2021-05-26	2022-11-27	5a105d34-05fc-401e-8553-272b45c1522d
	Detects a suspicious command line execution that includes an URL and AppData string in the command l (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Command and Control Ingress Tool Transfer	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community	2019-01-16	2021-11-27	1ac8666b-046f-4201-8aba-1951aaec03a3
	Detects programs that connect to uncommon destination ports	Generic	test	network_connection	windows	Sysmon	Command and Control Non-Standard Port	-	medium	Florian Roth (Nextron Systems)	2017-03-19	2024-03-12	6d8c3d20-a5e1-494f-8412-4571d716cf5c
	Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton	2020-10-11	2023-02-01	74403157-20f5-415d-89a7-c505779585cf
	Detects the installation of a service named "javamtsup" on the system. (...)	Emerging	test	service	windows	WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update)	2017-03-27	2022-10-09	cb062102-587e-4414-8efa-dbe3c7bf19c6
Splunk	The following analytic detects CrowdStrike alerts for admin weak password policy violations, identifying instances where administrative passwords do not meet security standards. (...)	Generic	stable	authentication	-	CrowdStrike	Credential Access Brute Force	-	medium	Teoderick Contreras, Splunk	2024-07-31	2026-05-13	bb1481fd-23c0-4195-b6a0-94d746c9637c
Splunk	The following analytic detects CrowdStrike alerts for admin accounts with duplicate password risk, identifying instances where administrative users share the same password. (...)	Generic	stable	authentication	-	CrowdStrike	Credential Access Brute Force	-	medium	Teoderick Contreras, Splunk	2024-07-31	2026-05-13	b8bccfbf-6ac2-40f2-83b6-e72b7efaa7d4

...