EXOTIC LILY G1011

Created: 18 August 2022
Last modified: 31 July 2026
Alias: EXOTIC LILY

EXOTIC LILY is a financially motivated group that has been closely linked with Wizard Spider and the deployment of ransomware including Conti and Diavol. EXOTIC LILY may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021.[1]

Techniques44th pct

Tactics26th pct

Tools & malware39th pct

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

EXOTIC LILY MITRE reference G1011

Web Service T1102 ↗

EXOTIC LILY has used file-sharing services including WeTransfer, TransferNow, and OneDrive to deliver payloads.2

Command and Control17 detection rules

Exploitation for Client Execution T1203 ↗

EXOTIC LILY has used malicious documents containing exploits for CVE-2021-40444 affecting Microsoft MSHTML.3

Execution48 detection rules

Malicious Link T1204.001 ↗

EXOTIC LILY has used malicious links to lure users into executing malicious payloads.4

Execution6 detection rules

Malicious File T1204.002 ↗

EXOTIC LILY has gained execution through victims clicking on malicious LNK files contained within ISO files, which can execute hidden DLLs within the ISO.5 6

Execution66 detection rules

Spearphishing Attachment T1566.001 ↗

EXOTIC LILY conducted an e-mail thread-hijacking campaign with malicious ISO attachments.7 8

Initial Access56 detection rules

Spearphishing Link T1566.002 ↗

EXOTIC LILY has relied on victims to open malicious links in e-mails for execution.9

Initial Access13 detection rules

Standing G1011

Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques1544th pct

44th percentile · 56% of 176 ATT&CK groups have more Enterprise techniques.

Tactics526th pct

26th percentile · 74% of 176 ATT&CK groups have more tactics spanned.

Tools & malware239th pct

39th percentile · 61% of 176 ATT&CK groups have more tools and malware.

Campaigns089% tie · 4 values

89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique1medBottom 6%

6th percentile · 94% of 176 ATT&CK groups have more detection rules per technique.

Tests / technique0med

EXOTIC LILY detections G1011

188 distinct rules cover the 15 techniques recorded for this group. 110 Sigma · 78 Splunk.

8 covered by at least one rule7 with no coverage188 distinct rules in total

Showing 1-50 of 100+ rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects a highly relevant Antivirus alert that reports APT malware. (...)	Generic	experimental	antivirus	-	-	Execution Exploitation for Client Execution Command and Control Remote Access Tools Remote Desktop Software	-	critical	Arnim Rupp (Nextron Systems)	2026-06-15	—	101a1877-2cf4-474d-abfd-7f6ac4788d1a
	Detects a highly relevant Antivirus alert that reports an exploitation framework. (...)	Generic	stable	antivirus	-	-	Execution Exploitation for Client Execution Command and Control Remote Access Tools Remote Desktop Software	-	critical	Florian Roth (Nextron Systems), Arnim Rupp	2018-09-09	2026-06-15	238527ad-3c2c-4e4f-a1f6-92fd63adb864
	Detects a highly relevant Antivirus alert that reports a remote access tool. (...)	Generic	experimental	antivirus	-	-	Execution Exploitation for Client Execution Command and Control Remote Access Tools Remote Desktop Software	-	critical	Arnim Rupp (Nextron Systems)	2026-06-15	—	97233998-3838-4581-88c6-f1d19d3993fb
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Initial Access Phishing Spearphishing Attachment Execution User Execution	-	medium	Sreeman	2020-03-13	2022-04-14	24de4f3b-804c-4165-b442-5a06a2302c7e
	Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. (...)	Generic	test	-	windows	WinEventLog Application	Impact Endpoint Denial of Service Application or System Exploitation Execution Exploitation for Client Execution Credential Access Exploitation for Credential Access Privilege Escalation Exploitation for Privilege Escalation Stealth Exploitation for Stealth Lateral Movement Exploitation of Remote Services	CVE-2020-0601	critical	Florian Roth (Nextron Systems), Zach Mathis	2020-01-15	2022-10-22	48d91a3a-2363-43ba-a456-ca71ac3da5c2
Splunk	The following analytic identifies Azure Device Code Phishing attacks, which can lead to Azure Account Take-Over (ATO). (...)	Generic	stable	authentication	-	Microsoft 365	Initial Access Phishing Spearphishing Link Credential Access Steal Application Access Token	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2023-11-16	2026-05-13	d68d8732-6f7e-4ee5-a6eb-737f2b990b91
Splunk	The following analytic detects the creation of a batch file (.bat) within the Windows system directory tree, specifically in the System32 or SysWOW64 folders. (...)	Anomaly	stable	file_event	windows	Sysmon	Execution User Execution Malicious File	-	medium	Steven Dick, Michael Haag, Rico Valdez, Splunk	2020-04-29	2026-07-02	503d17cb-9eab-4cf8-a20e-01d5c6987ae3	-
Splunk	This analytic detects script execution (`wscript.exe` or `cscript.exe`) triggered from compressed fi (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Execution Command and Scripting Interpreter Visual Basic Execution User Execution Malicious File	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	8b07c2c9-0cde-4c44-9fa6-59dcf2b25777
Splunk	The following analytic detects file downloads involving executable, archive, or scripting-related file types that are commonly used in malware delivery. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter Execution Exploitation for Client Execution	-	medium	Nasreddine Bencherchali, Splunk	2025-04-09	2026-09-22	24b2c2e3-2ff7-4a23-b814-87f8a62028cd
Splunk	The following analytic detects a blocked connection event by identifying a "Block" value in the action field. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	17e9b764-3a2b-4d36-9751-32d13ce4718b
Splunk	This analytic detects exploitation activity of CVE-2025-5777 using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter Execution Exploitation for Client Execution	CVE-2025-5777	medium	Michael Haag, Nasreddine Bencherchali, Splunk, Talos NTDR	2025-07-17	2026-05-13	93db24a0-fd21-45d7-9daf-84afd5a8cca2
Splunk	This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Initial Access Exploit Public-Facing Application Execution Exploitation for Client Execution Credential Access OS Credential Dumping Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Nasreddine Bencherchali, Splunk	2025-04-16	2026-05-13	ec99bb81-c31b-4837-8c7d-1b32aa70b337
Splunk	The following analytic detects file downloads that were classified as malware by Cisco Secure Firewall Threat Defense. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Exploitation for Client Execution Command and Control Ingress Tool Transfer	-	medium	Nasreddine Bencherchali, Splunk	2025-04-09	2026-09-22	3cc93f52-5aa6-4b7f-83b9-3430b1436813
Splunk	The following analytic highlights high-impact intrusion events assigned by Cisco Secure Firewall. (...)	Anomaly	experimental	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter Resource Development Develop Capabilities Malware Execution Exploitation for Client Execution	-	medium	Nasreddine Bencherchali, Splunk	2025-04-16	2026-05-13	244a77bb-3b2a-46f1-bf2c-b4f7cd29276d
Splunk	The following analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	1f57f10e-1dc5-47ea-852c-2e85b2503d79
	Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-05-17	2023-12-21	7050bba1-1aed-454e-8f73-3f46f09ce56a
	Detects execution of the "cloudflared" tool to connect back to a tunnel. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	medium	Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)	2023-05-17	2023-12-20	9a019ffc-3580-4c9d-8d87-079f7e8d3fd4
	Detects CLR DLL being loaded by an Office Product	Generic	test	image_load	windows	Sysmon	Execution User Execution Malicious File	-	medium	Antonlovesdnb	2020-02-19	2023-03-29	d13c43f0-f66b-4279-8b2c-5912077c1780
	Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. (...)	Generic	test	network_connection	windows	Sysmon	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Andreas Braathen (mnemonic.io)	2024-06-17	—	3ab65069-d82a-4d44-a759-466661a082d1
	Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. (...)	Generic	test	network_connection	linux	Sysmon	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Andreas Braathen (mnemonic.io)	2024-06-17	—	c4568f5d-131f-4e78-83d4-45b2da0ec4f1
	Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfi (...)	Generic	test	network_connection	linux	Sysmon	Command and Control Dynamic Resolution Domain Generation Algorithms Exfiltration Exfiltration Over Web Service Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Florian Roth (Nextron Systems)	2022-11-03	—	19bf6fdb-7721-4f3d-867f-53467f6a5db6
	Detects an executable initiating a network connection to "ngrok" tunneling domains. (...)	Generic	test	network_connection	windows	Sysmon	Command and Control Dynamic Resolution Domain Generation Algorithms Exfiltration Exfiltration Over Web Service Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Florian Roth (Nextron Systems)	2022-11-03	2024-02-02	1d08ac94-400d-4469-a82f-daee9a908849
	Detects possible successful exploitation for vulnerability described in CVE-2021-26858 by looking fo (...)	Emerging	test	file_event	windows	Sysmon	Execution Exploitation for Client Execution	CVE-2021-26858	high	Bhabesh Raj	2021-03-03	2022-10-09	b06335b3-55ac-4b41-937e-16b7f5d57dfd
	Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability a (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Execution Exploitation for Client Execution Initial Access Phishing	CVE-2021-33771 CVE-2021-31979	critical	Sittikorn S, frack113	2021-07-16	2023-08-17	32b5db62-cb5f-4266-9639-0fa48376ac00
	Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability a (...)	Emerging	test	file_event	windows	Sysmon	Execution Exploitation for Client Execution Initial Access Phishing	CVE-2021-33771 CVE-2021-31979	critical	Sittikorn S	2021-07-16	2022-10-09	ad7085ac-92e4-4b76-8ce2-276d2c0e68ef
	Detects exploitation attempt of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries.	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Exploitation for Client Execution	CVE-2023-38831 CVE-2023-38331	high	Nasreddine Bencherchali (Nextron Systems), Andreas Braathen (mnemonic.io)	2023-08-30	2024-01-22	ec3a3c2f-9bb0-4a9b-8f4b-5ec386544343
Splunk	The following analytic identifies the execution of `outlook.exe` writing a `.zip` file to the disk. (...)	Anomaly	stable	process_creation	windows	Sysmon	Initial Access Phishing Spearphishing Attachment	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	a51bfe1a-94f0-4822-b1e4-16ae10145893
Splunk	The following analytic detects attempts to exploit the SIGRed vulnerability (CVE-2020-1350) in Windows DNS servers. (...)	Generic	experimental	network_connection	-	Splunk Stream	Execution Exploitation for Client Execution	CVE-2020-1350	medium	Shannon Davis, Splunk	2020-08-04	2026-05-13	babd8d10-d073-11ea-87d0-0242ac130003	-
Splunk	The following analytic detects the presence of SIGRed, a critical DNS vulnerability, using Zeek DNS and Zeek Conn data. (...)	Generic	experimental	dns	-	-	Execution Exploitation for Client Execution	CVE-2020-1350	medium	Shannon Davis, Splunk	2020-08-04	2026-05-13	c5c622e4-d073-11ea-87d0-0242ac130003	-
	Detects an initiated network connection over uncommon ports from "dfsvc.exe". (...)	Hunting	test	network_connection	windows	Sysmon	Execution Exploitation for Client Execution	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-06-12	2024-01-31	4c5fba4a-9ef6-4f16-823d-606246054741
	Detects network connections from "dfsvc.exe" used to handled ClickOnce applications to non-local IPs	Hunting	test	network_connection	windows	Sysmon	Execution Exploitation for Client Execution	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-06-12	2024-03-12	3c21219b-49b5-4268-bce6-c914ed50f09c
	Detects the execution of the hdiutil utility in order to mount disk images.	Generic	test	process_creation	macos	-	Collection Archive Collected Data Archive via Utility Initial Access Phishing Spearphishing Attachment	-	medium	Omar Khaled (@beacon_exe)	2024-08-10	—	bf241472-f014-4f01-a869-96f99330ca8c
	Detects any assembly DLL being loaded by an Office Product	Generic	test	image_load	windows	Sysmon	Execution User Execution Malicious File	-	medium	Antonlovesdnb	2020-02-19	2023-03-29	ff0f2b05-09db-4095-b96d-1b75ca24894a
	Detects download of certain file types from hosts in suspicious TLDs	Generic	test	proxy	-	-	Execution Exploitation for Client Execution Initial Access Phishing Execution User Execution Malicious File	-	low	Florian Roth (Nextron Systems)	2017-11-07	2023-05-18	00d0b5ab-1f55-4120-8e83-487c0a7baf19
	Detects executable downloads from suspicious remote systems	Generic	test	proxy	-	-	Execution Exploitation for Client Execution Initial Access Phishing Execution User Execution Malicious File	-	low	Florian Roth (Nextron Systems)	2017-03-13	2023-05-18	b5de2919-b74a-4805-91a7-5049accbaefe
Splunk	The following analytic detects the dropping of a suspicious file named "license.dat" in %appdata% or %programdata%. (...)	Hunting	stable	file_event	windows	Sysmon	Execution User Execution Malicious File	-	medium	Teoderick Contreras, Splunk	2021-08-05	2026-05-13	b7a045fc-f14a-11eb-8e79-acde48001122
	Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.ex (...)	Emerging	stable	process_creation	windows	Sysmon · WinEventLog Security	Execution Exploitation for Client Execution Initial Access Phishing Spearphishing Attachment Execution User Execution Malicious File	CVE-2017-11882	critical	Florian Roth (Nextron Systems)	2017-11-23	2021-11-27	678eb5f4-8597-4be6-8be7-905e4234b53a
Splunk	The following analytic detects email attachments with an unusually high number of spaces in their file names, which is a common tactic used by attackers to obfuscate file extensions. (...)	Anomaly	experimental	email	-	-	Stealth Masquerading Masquerade File Type Initial Access Phishing Spearphishing Attachment	-	medium	David Dorsey, Splunk	2020-04-29	2026-05-13	56e877a6-1455-4479-ada6-0550dc1e22f8	-
	Detects outbound web proxy requests to URLs matching the EvilTokens Phishing-as-a-Service (PhaaS) kit infrastructure. (...)	Emerging	experimental	proxy	-	-	Initial Access Phishing Spearphishing Link	-	low	uniqu3-us3r	2026-04-28	—	e0e121d0-be4d-4281-af7e-17abbba4a408
	Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and C (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Exploitation for Client Execution Initial Access Phishing Spearphishing Attachment Execution User Execution Malicious File	CVE-2017-0261 CVE-2017-0262	medium	Florian Roth (Nextron Systems)	2018-02-22	2021-11-27	864403a1-36c9-40a2-a982-4c9a45f7d833
	Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Exploitation for Client Execution Initial Access Phishing Spearphishing Attachment Execution User Execution Malicious File	CVE-2017-8759	critical	Florian Roth (Nextron Systems)	2017-09-15	2021-11-27	fdd84c68-a1f6-47c9-9477-920584f94905
	Detects cast exceptions in Windows Server Update Services (WSUS) application logs that highly indicate exploitation attempts of CVE-2025-59287, a deserialization vulnerability in WSUS.	Emerging	experimental	-	windows	WinEventLog Application	Initial Access Exploit Public-Facing Application Execution Exploitation for Client Execution	CVE-2025-59287	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-10-31	—	e5f66e87-7d6b-404f-92fe-7aa67814b5cd
	Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Initial Access Exploit Public-Facing Application Execution Exploitation for Client Execution	CVE-2025-59287	high	Huntress Labs, Swachchhanda Shrawan Poudel (Nextron Systems)	2025-10-31	—	43259cc4-1b80-4931-bd98-baea01afc196
	This rule will monitor executable and script file creation by office applications. (...)	Unsupported	experimental	file_event	windows	Sysmon	Stealth System Binary Proxy Execution Regsvr32 Execution User Execution Malicious File Execution Windows Management Instrumentation	-	high	Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule)	2021-08-23	2022-06-02	8c6fd6fc-28fc-4597-a86a-fc1de20b039d
	Detects the creation of files with an executable or script extension by an Office application.	Generic	test	file_event	windows	Sysmon	Execution User Execution Malicious File	-	high	Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems)	2021-08-23	2025-10-17	c7a74c80-ba5a-486e-9974-ab9e682bc5e4
	Detects a flashplayer update from an unofficial location	Generic	test	proxy	-	-	Initial Access Drive-by Compromise Stealth Masquerading Match Legitimate Resource Name or Location Execution User Execution Malicious File	-	high	Florian Roth (Nextron Systems)	2017-10-25	2022-08-08	4922a5dd-6743-4fc2-8e81-144374280997
	Detects any GAC DLL being loaded by an Office Product	Generic	test	image_load	windows	Sysmon	Execution User Execution Malicious File	-	high	Antonlovesdnb	2020-02-19	2023-02-10	90217a70-13fc-48e4-b3db-0d836c5824ac
Splunk	The following analytic detects suspicious attachment file extensions in GSuite emails, potentially indicating a spear-phishing attack. (...)	Anomaly	stable	account_management	-	Google Cloud	Initial Access Phishing Spearphishing Attachment	-	medium	Teoderick Contreras, Splunk	2021-08-16	2026-05-13	6d663014-fe92-11eb-ab07-acde48001122