MoustachedBouncer G1019

Created: 25 September 2023
Last modified: 31 July 2026
Alias: MoustachedBouncer

MoustachedBouncer is a cyberespionage group that has been active since at least 2014 targeting foreign embassies in Belarus.[1]

Techniques26th pct

Tactics34th pct

Tools & malware47th pct

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

MoustachedBouncer MITRE reference G1019

Software Packing T1027.002 ↗

MoustachedBouncer has used malware plugins packed with Themida.2

Stealth1 detection rules

PowerShell T1059.001 ↗

MoustachedBouncer has used plugins to execute PowerShell scripts.3

Execution300 detection rules

JavaScript T1059.007 ↗

MoustachedBouncer has used JavaScript to deliver malware hosted on HTML pages.4

Execution36 detection rules

Exploitation for Privilege Escalation T1068 ↗

MoustachedBouncer has exploited CVE-2021-1732 to execute malware components with elevated rights.5

Privilege Escalation88 detection rules

Remote Data Staging T1074.002 ↗

MoustachedBouncer has used plugins to save captured screenshots to .\AActdata\ on an SMB share.6

Collectionno detection rules

Proxy T1090 ↗

MoustachedBouncer has used a reverse proxy tool similar to the GitHub repository revsocks.7

Command and Control30 detection rules

Standing G1019

Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques826th pct

26th percentile · 74% of 176 ATT&CK groups have more Enterprise techniques.

Tactics634th pct

34th percentile · 66% of 176 ATT&CK groups have more tactics spanned.

Tools & malware347th pct

47th percentile · 53% of 176 ATT&CK groups have more tools and malware.

Campaigns089% tie · 4 values

89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique22.5med59th pct

59th percentile · 59% of 176 ATT&CK groups have this many detection rules per technique or fewer.

Tests / technique3med

MoustachedBouncer detections G1019

464 distinct rules cover the 8 techniques recorded for this group. 324 Sigma · 140 Splunk.

6 covered by at least one rule2 with no coverage464 distinct rules in total

Showing 1-50 of 400+ rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-10-09	1fac1481-2dbc-48b2-9096-753c49b4ec71
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Generic	test	file_event	windows	Sysmon	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-12-02	0bcfabcb-7929-47f4-93d6-b33fb67d34d1
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g	2019-08-11	2025-10-17	64e8e417-c19a-475a-8d19-98ea705394cc
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	pipe_created	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g, Tim Shelton	2019-09-12	2025-10-07	58cb02d5-78ce-4692-b3e1-dce850aae41a
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. (...)	Generic	test	-	windows	WinEventLog Application	Impact Endpoint Denial of Service Application or System Exploitation Execution Exploitation for Client Execution Credential Access Exploitation for Credential Access Privilege Escalation Exploitation for Privilege Escalation Stealth Exploitation for Stealth Lateral Movement Exploitation of Remote Services	CVE-2020-0601	critical	Florian Roth (Nextron Systems), Zach Mathis	2020-01-15	2022-10-22	48d91a3a-2363-43ba-a456-ca71ac3da5c2
	Detects kernel auto-loading of the authencesn crypto module via modprobe This occurs when user-space (...)	Emerging	experimental	process_creation	linux	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Kernel Modules and Extensions Privilege Escalation Exploitation for Privilege Escalation	CVE-2026-31431	high	Gene Kazimiarovich	2026-05-09	—	474b415a-d917-4f3b-8c62-9e1a0d5f7b48
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
	focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cob (...)	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	critical	ok @securonix invrep_de, oscd.community	2020-10-09	2022-12-25	8d31a8ce-46b5-4dd6-bdc3-680931f1db86
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
	Detects default file names outputted by the BloodHound collection tool SharpHound	Generic	test	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	C.J. May	2022-08-09	2026-02-19	02773bed-83bf-469f-b7ff-e676e7d78bab
	Detects buffer overflow attempts in Unix system log files	Generic	test	-	linux	-	Privilege Escalation Exploitation for Privilege Escalation	-	high	Florian Roth (Nextron Systems)	2017-03-01	2025-03-17	18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781
	Detects powershell execution with that make use of to the bxor (Bitwise XOR). (...)	Hunting	test	ps_classic_start	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	low	Teymur Kheirkhabarov, Harish Segar	2020-06-29	2024-12-11	812837bb-b17f-45e9-8bd0-0ec35d2e3bd6
	Detects calls to cmdlets that are used to export certificates from the local certificate store. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Credential Access Unsecured Credentials Private Keys	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-05-18	—	9e716b33-63b2-46da-86a4-bd3c3b9b5dfb
	Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell	-	medium	frack113	2021-11-01	2025-10-07	87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180
	Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet.	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	frack113	2021-10-20	2023-12-14	61d0475c-173f-4844-86f7-f3eebae1c66b
	Detects execution of ChromeLoader malware via a registered scheduled task	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task Persistence Software Extensions	-	high	@kostastsale	2022-01-10	—	0a74c5a9-1b71-4475-9af2-7829d320d5c2
Splunk	This analytic detects creation of a Cisco IOS-XE tunnel interface with tunnel source, tunnel destination, and an IP address in the 10.10.12.0 network. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Command and Control Protocol Tunneling Command and Control Proxy	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	8654314d-8e4d-4971-9f35-b9d477bf668e
Splunk	This analytic detects excessive kernel probe (kprobe) events in a Kubernetes cluster over a short period of time. (...)	Hunting	stable	network_device	-	Cisco	Privilege Escalation Exploitation for Privilege Escalation	-	medium	Bhavin Patel, Splunk	2026-01-05	2026-05-13	3df0e9a8-7d5e-4b2f-bcd7-bf93e671d1f2
Splunk	The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter PowerShell Command and Control Ingress Tool Transfer Command and Control Non-Standard Port Privilege Escalation, Stealth Process Injection Command and Control Remote Access Tools Lateral Movement Remote Services	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	d85c05c8-42c0-4e4a-87e7-4e1bb3e844e3
Splunk	This analytic detects exploitation activity of CVE-2023-27532 using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter PowerShell Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services Credential Access OS Credential Dumping LSASS Memory	CVE-2023-27532	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	7b7c2e92-f0b2-48d2-9c9b-b8de52b6b2ae
	Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-05-17	2023-12-21	7050bba1-1aed-454e-8f73-3f46f09ce56a
	Detects execution of the "cloudflared" tool to connect back to a tunnel. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	medium	Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)	2023-05-17	2023-12-20	9a019ffc-3580-4c9d-8d87-079f7e8d3fd4
	Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell	-	high	Florian Roth (Nextron Systems)	2022-08-23	2026-05-13	a16980c2-0c56-4de0-9a79-17971979efdd
	Detects a suspicious command line execution that includes an URL and AppData string in the command l (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Command and Control Ingress Tool Transfer	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community	2019-01-16	2021-11-27	1ac8666b-046f-4201-8aba-1951aaec03a3
	Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. (...)	Generic	test	network_connection	windows	Sysmon	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Andreas Braathen (mnemonic.io)	2024-06-17	—	3ab65069-d82a-4d44-a759-466661a082d1
	Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. (...)	Generic	test	network_connection	linux	Sysmon	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Andreas Braathen (mnemonic.io)	2024-06-17	—	c4568f5d-131f-4e78-83d4-45b2da0ec4f1
	Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfi (...)	Generic	test	network_connection	linux	Sysmon	Command and Control Dynamic Resolution Domain Generation Algorithms Exfiltration Exfiltration Over Web Service Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Florian Roth (Nextron Systems)	2022-11-03	—	19bf6fdb-7721-4f3d-867f-53467f6a5db6
	Detects an executable initiating a network connection to "ngrok" tunneling domains. (...)	Generic	test	network_connection	windows	Sysmon	Command and Control Dynamic Resolution Domain Generation Algorithms Exfiltration Exfiltration Over Web Service Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Florian Roth (Nextron Systems)	2022-11-03	2024-02-02	1d08ac94-400d-4469-a82f-daee9a908849
	Detects setting proxy configuration	Generic	test	process_creation	linux	Sysmon	Command and Control Proxy	-	low	Ömer Günal	2020-06-17	2022-10-05	72f4ab3f-787d-495d-a55d-68c2ff46cf4c	-
	Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton	2020-10-11	2023-02-01	74403157-20f5-415d-89a7-c505779585cf
Splunk	The following analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). (...)	Generic	stable	file_event	-	CrushFTP	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Initial Access Exploit Public-Facing Application	CVE-2025-31161	medium	Michael Haag, Splunk	2025-04-14	2026-09-08	82eb7f64-d219-4e21-acfe-956de84c1a35
	Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic JavaScript Stealth Obfuscated Files or Information Compile After Delivery Stealth System Binary Proxy Execution Mshta	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)	2019-02-11	2026-03-23	b730a276-6b63-41b8-bcf8-55930c8fc6ee
	Detects Wscript/Cscript executing a file with an uncommon (i.e. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-05-15	2023-06-19	99b7460d-c9f1-40d7-a316-1f36f61d52ee
	Detects exploitation attempt of vulnerability described in CVE-2021-3156. (...)	Unsupported	unsupported	process_creation	linux	Linux Auditd	Privilege Escalation Exploitation for Privilege Escalation	CVE-2021-3156 CVE-2021.3156	high	Bhabesh Raj	2021-02-01	2023-03-24	5ee37487-4eb8-4ac2-9be1-d7d14cdc559f
	Detects exploitation attempt of vulnerability described in CVE-2021-3156. (...)	Unsupported	unsupported	process_creation	linux	Linux Auditd	Privilege Escalation Exploitation for Privilege Escalation	CVE-2021-3156 CVE-2021.3156	high	Bhabesh Raj	2021-02-01	2023-03-24	b9748c98-9ea7-4fdb-80b6-29bed6ba71d2
	Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected (...)	Emerging	test	file_event	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell	CVE-2022-24527	high	Florian Roth (Nextron Systems)	2022-04-13	—	e0a41412-c69a-446f-8e6e-0e6d7483dad7
Splunk	The following analytic detects attempts to exploit the Baron Samedit vulnerability (CVE-2021-3156) by identifying the use of the "sudoedit -s \\" command. (...)	Generic	experimental	-	-	-	Privilege Escalation Exploitation for Privilege Escalation	CVE-2021-3156	medium	Shannon Davis, Splunk	2021-01-28	2026-05-13	93fbec4e-0375-440c-8db3-4508eca470c4	-
Splunk	The following analytic identifies a heap-based buffer overflow in sudoedit by detecting Linux logs containing both "sudoedit" and "segfault" terms. (...)	Generic	experimental	-	-	-	Privilege Escalation Exploitation for Privilege Escalation	CVE-2021-3156	medium	Shannon Davis, Splunk	2021-01-28	2026-05-13	10f2bae0-bbe6-4984-808c-37dc1c67980d	-
Splunk	The following analytic detects the execution of the "sudoedit -s *" command, which is associated with the Baron Samedit CVE-2021-3156 heap-based buffer overflow vulnerability. (...)	Generic	experimental	process_creation	-	-	Privilege Escalation Exploitation for Privilege Escalation	CVE-2021-3156	medium	Shannon Davis, Splunk	2021-01-28	2026-05-13	1de31d5d-8fa6-4ee0-af89-17069134118a	-
Splunk	The following analytic detects the use of the Certify tool via an in-memory PowerShell function to enumerate Active Directory Certificate Services (AD CS) environments. (...)	Generic	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Credential Access Steal or Forge Authentication Certificates	-	medium	Steven Dick	2023-07-28	2026-05-13	f533ca6c-9440-4686-80cb-7f294c07812a
Splunk	The following analytic detects suspicious PowerShell execution indicative of PowerShell-Empire activity. (...)	Generic	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	Michael Haag, Splunk	2021-06-09	2026-05-13	bc1dc6b8-c954-11eb-bade-acde48001122
Splunk	The following analytic detects the execution of Mimikatz commands via PowerShell by leveraging PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Credential Access OS Credential Dumping	-	medium	Michael Haag, Splunk	2021-06-09	2026-05-13	8148c29c-c952-11eb-9255-acde48001122
	This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Execution, Stealth Trusted Developer Utilities Proxy Execution	-	medium	Agro (@agro_sev) oscd.community	2020-10-10	2022-12-09	0152550d-3a26-4efd-9f0e-54a0b28ae2f3
	Detects execution and usage of the DSInternals PowerShell module. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell	-	high	Nasreddine Bencherchali (Nextron Systems), Nounou Mbeiri	2024-06-26	—	43d91656-a9b2-4541-b7e2-6a9bd3a13f4e
	Detects execution and usage of the DSInternals PowerShell module. (...)	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	high	Nasreddine Bencherchali (Nextron Systems)	2024-06-26	—	846c7a87-8e14-4569-9d49-ecfd4276a01c
Splunk	The following analytic detects the usage of specific Exchange PowerShell modules, such as New-MailboxExportRequest, New-ManagementRoleAssignment, New-MailboxSearch, and Get-Recipient. (...)	Generic	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	Michael Haag, Splunk	2021-08-25	2026-05-13	2d10095e-05ae-11ec-8fdf-acde48001122
	Detects adding and using Exchange PowerShell snap-ins to export mailbox data. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Collection Email Collection	-	high	FPT.EagleEye, Nasreddine Bencherchali (Nextron Systems)	2021-03-03	2023-03-24	25676e10-2121-446e-80a4-71ff8506af47
	Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth System Script Proxy Execution	-	medium	Julia Fomina, oscd.community	2020-10-08	2023-11-09	59e938ff-0d6d-4dc3-b13f-36cc28734d4e

...