group

TA577 G1037

Created: 17 September 2024
Last modified: 31 July 2026
Alias: TA577

TA577 is an initial access broker (IAB) that has distributed QakBot and Pikabot, and was among the first observed groups distributing Latrodectus in 2023.[1]

TechniquesBottom 20%

TacticsBottom 20%

Tools & malware47th pct

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing G1037

Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-10-09	1fac1481-2dbc-48b2-9096-753c49b4ec71
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Generic	test	file_event	windows	Sysmon	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-12-02	0bcfabcb-7929-47f4-93d6-b33fb67d34d1
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
Splunk	The following analytic identifies Azure Device Code Phishing attacks, which can lead to Azure Account Take-Over (ATO). (...)	Generic	stable	authentication	-	Microsoft 365	Initial Access Phishing Spearphishing Link Credential Access Steal Application Access Token	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2023-11-16	2026-05-13	d68d8732-6f7e-4ee5-a6eb-737f2b990b91
Splunk	The following analytic detects the use of `cmd.exe /c` to execute commands, a technique often employed by adversaries and malware to run batch commands or invoke other shells like PowerShell. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	CVE-2021-44228	medium	Teoderick Contreras, Bhavin Patel, Splunk	2021-10-21	2026-05-13	54a6ed00-3256-11ec-b031-acde48001122
Splunk	The following analytic identifies the use of named-pipe impersonation for privilege escalation, commonly associated with Cobalt Strike and similar frameworks. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	medium	Michael Haag, Splunk	2021-05-27	2026-05-13	eb277ba0-b96b-11eb-b00e-acde48001122
	Detects a suspicious command line execution that includes an URL and AppData string in the command l (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Command and Control Ingress Tool Transfer	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community	2019-01-16	2021-11-27	1ac8666b-046f-4201-8aba-1951aaec03a3
	detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hi (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-06-14	—	ee5e119b-1f75-4b34-add8-3be976961e39
Splunk	The following analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). (...)	Generic	stable	file_event	-	CrushFTP	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Initial Access Exploit Public-Facing Application	CVE-2025-31161	medium	Michael Haag, Splunk	2025-04-14	2026-09-08	82eb7f64-d219-4e21-acfe-956de84c1a35
	Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic JavaScript Stealth Obfuscated Files or Information Compile After Delivery Stealth System Binary Proxy Execution Mshta	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)	2019-02-11	2026-03-23	b730a276-6b63-41b8-bcf8-55930c8fc6ee
	Detects Wscript/Cscript executing a file with an uncommon (i.e. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-05-15	2023-06-19	99b7460d-c9f1-40d7-a316-1f36f61d52ee
Splunk	The following analytic detects executions of cmd.exe spawned by processes that are commonly abused by attackers and do not typically launch cmd.exe. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	dcfd6b40-42f9-469d-a433-2e53f7486664	-
Splunk	The following detects the execution of cscript.exe or wscript.exe processes spawned by cmd.exe, leveraging Endpoint Detection and Response (EDR) telemetry mapped to the Endpoint data model, with additional contextual filtering to improve fidelity and reduce false positives. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	-	medium	Bhavin Patel, Mauricio Velazco, Splunk	2020-04-29	2026-05-13	b89919ed-fe5f-492c-b139-95dbb162039e
	Detects DNS queries made by the finger utility, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. (...)	Generic	experimental	dns	windows	Sysmon	Command and Control Application Layer Protocol DNS Execution Command and Scripting Interpreter Windows Command Shell	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-11-19	—	c082c2b0-525b-4dbc-9a26-a57dc4692074
	Detects Elise backdoor activity used by APT32	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell	-	critical	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2018-01-31	2023-03-09	e507feb7-5f73-4ef6-a970-91bb6f6d744f
	Detects outbound web proxy requests to URLs matching the EvilTokens Phishing-as-a-Service (PhaaS) kit infrastructure. (...)	Emerging	experimental	proxy	-	-	Initial Access Phishing Spearphishing Link	-	low	uniqu3-us3r	2026-04-28	—	e0e121d0-be4d-4281-af7e-17abbba4a408
	Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability rep (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Initial Access Exploit Public-Facing Application	CVE-2020-10189	high	Florian Roth (Nextron Systems)	2020-03-25	2023-01-21	846b866e-2a57-46ee-8e16-85fa92759be7
	Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and Partner (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Privilege Escalation Exploitation for Privilege Escalation Execution, Stealth Hijack Execution Flow	CVE-2019-1378	high	Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro	2019-11-15	2021-11-27	1c373b6d-76ce-4553-997d-8c1da9a6b5f5
	Detects remote thread creation from CACTUSTORCH as described in references.	Generic	test	create_remote_thread	windows	Sysmon	Execution Command and Scripting Interpreter Visual Basic JavaScript Privilege Escalation, Stealth Process Injection Process Hollowing Stealth System Binary Proxy Execution Mshta	-	high	@SBousseaden (detection), Thomas Patzke (rule)	2019-02-01	2023-05-05	2e4e488a-6164-4811-9ea1-f960c7359c40
	This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access Brute Force Execution Command and Scripting Interpreter PowerShell Windows Command Shell Discovery Password Policy Discovery Execution, Persistence, Privilege Escalation Scheduled Task/Job Execution Windows Management Instrumentation	-	high	Florian Roth (Nextron Systems)	2022-02-25	2023-03-08	42a993dd-bb3e-48c8-b372-4d6684c4106c
	Detects various execution patterns of the CrackMapExec pentesting framework	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Execution, Persistence, Privilege Escalation Scheduled Task/Job Execution Windows Management Instrumentation	-	high	Thomas Patzke	2020-05-22	2023-11-06	058f4380-962d-40a5-afce-50207d36d7e2
	Detects the use of Jlaive to execute assemblies in a copied PowerShell	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell	-	medium	Jose Luis Sanchez Martinez (@Joseliyo_Jstnk)	2022-05-24	2023-02-22	0a99eb3e-1617-41bd-b095-13dc767f3def
	Detects command line parameters used by Koadic hack tool	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic JavaScript	-	high	wagga, Jonhnathan Ribeiro, oscd.community	2020-01-12	2023-02-11	5cddf373-ef00-4112-ad72-960ac29bac34
	Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Execution Native API Stealth System Binary Proxy Execution Rundll32	-	high	Alexander Rausch	2020-06-24	2023-03-01	95022b85-ff2a-49fa-939a-d7b8f56eeb9b
	Detects the launch of a child process via "conhost.exe" with the "--headless" flag. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell	-	medium	Nasreddine Bencherchali (Nextron Systems)	2024-07-23	—	00ca75ab-d5ce-43be-b86c-55ff39c6abfc
	Detects a suspicious child process of a Microsoft HTML Help (HH.exe)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic JavaScript Initial Access Phishing Spearphishing Attachment Stealth System Binary Proxy Execution Compiled HTML File Regsvr32 Rundll32 Execution Windows Management Instrumentation	-	high	Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)	2020-04-01	2023-04-12	52cad028-0ff0-4854-8f67-d25dfcbc78b4
Splunk	The following analytic detects the execution of JScript using the cscript.exe process. (...)	Anomaly	stable	process_creation	windows	Sysmon	Execution Command and Scripting Interpreter JavaScript	-	medium	Teoderick Contreras, Splunk	2021-09-14	2026-10-09	002f1e24-146e-11ec-a470-acde48001122
	Detects possible malicious execution of JXA in-memory via OSAScript	Generic	test	process_creation	macos	-	Execution Command and Scripting Interpreter AppleScript JavaScript	-	high	Sohan G (D4rkCiph3r)	2023-01-31	—	f1408a58-0e94-4165-b80a-da9f96cf6fc3
Splunk	This analytic detects the macOS osascript utility executing JavaScript for Automation (JXA) code, id (...)	Anomaly	stable	process_creation	-	Osquery	Execution Command and Scripting Interpreter AppleScript JavaScript	-	medium	Radka Viskova, Splunk	2026-09-18	2026-09-18	9ad44dce-7291-47f8-84a7-e343a5147242
Splunk	The following analytic detects the execution of MS scripting processes (wscript.exe or cscript.exe) loading LDAP-related modules (Wldap32.dll, adsldp.dll, adsldpc.dll). (...)	Anomaly	stable	image_load	windows	Sysmon	Execution Command and Scripting Interpreter JavaScript	-	medium	Teoderick Contreras, Splunk	2021-09-17	2026-05-13	0b0c40dc-14a6-11ec-b267-acde48001122
Splunk	The following analytic detects the loading of WMI modules by Microsoft scripting processes like wscript.exe or cscript.exe. (...)	Anomaly	stable	image_load	windows	Sysmon	Execution Command and Scripting Interpreter JavaScript	-	medium	Teoderick Contreras, Splunk	2021-09-17	2026-05-13	2eba3d36-14a6-11ec-a682-acde48001122
	Detects execution of mshta.exe with file types that looks like they do not typically represent HTA ( (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter JavaScript Stealth Deobfuscate/Decode Files or Information Stealth System Binary Proxy Execution Mshta	CVE-2020-1599	high	Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems)	2019-02-22	2025-05-12	cc7abbd0-762b-41e3-8a26-57ad50d2eea3
	Detects network connections via finger.exe, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. (...)	Generic	experimental	network_connection	windows	Sysmon	Command and Control Application Layer Protocol DNS Execution Command and Scripting Interpreter Windows Command Shell	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-11-19	—	2fdaf50b-9fd5-449f-ba69-f17248119af6
	Detects the attempt to install new skills for AI agents using the "npx skills" command. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter JavaScript	-	medium	Marco Pedrinazzi (@pedrinazziM) (InTheCyber)	2026-02-03	—	afa71271-6a97-4e47-810f-83120fb1a4ce
	Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter JavaScript Execution, Stealth Trusted Developer Utilities Proxy Execution	-	medium	Max Altgelt (Nextron Systems)	2022-04-06	—	df1f26d3-bea7-4700-9ea2-ad3e990cf90e
	Detects execution of JavaScript or JSC files using NodeJs binary node.exe, that could be potentially suspicious. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter JavaScript	-	low	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-04-21	—	ba3874b9-0fae-465f-836c-eb5d071a1789
Splunk	The following analytic detects when an email manually submitted to Microsoft through the Security & Compliance portal is found to be malicious. (...)	Generic	stable	cloud_audit	-	Microsoft 365	Initial Access Phishing Spearphishing Attachment Spearphishing Link	-	medium	Steven Dick	2024-04-07	2026-05-13	94396c3e-7728-422a-9956-e4b77b53dbdf
Splunk	The following analytic detects when an email submitted to Microsoft using the built-in report button in Outlook is found to be malicious. (...)	Generic	stable	cloud_audit	-	Microsoft 365	Initial Access Phishing Spearphishing Attachment Spearphishing Link	-	medium	Steven Dick	2024-04-07	2026-05-13	7698b945-238e-4bb9-b172-81f5ca1685a1
Splunk	The following analytic identifies when a suspicious email is detected within the Microsoft Office 365 ecosystem through the Advanced Threat Protection engine and delivered to an end user. (...)	Anomaly	stable	cloud_audit	-	Microsoft 365	Initial Access Phishing Spearphishing Attachment Spearphishing Link	-	medium	Steven Dick	2024-04-07	2026-05-13	605cc93a-70e4-4ee3-9a3d-1a62e8c9b6c2
Splunk	The following analytic detects when the Microsoft Zero-hour Automatic Purge (ZAP) capability takes action against a user's mailbox. (...)	Anomaly	stable	cloud_audit	-	Microsoft 365	Initial Access Phishing Spearphishing Attachment Spearphishing Link	-	medium	Steven Dick	2024-04-07	2026-05-13	4df275fd-a0e5-4246-8b92-d3201edaef7a
	Detects the OpenEDR ssh-shellhost.exe spawning a command shell (cmd.exe) or PowerShell with PTY (pseudo-terminal) capabilities. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Command and Control Remote Access Tools Lateral Movement Remote Services SSH	-	medium	@kostastsale	2026-02-19	—	7f3a9c2d-4e8b-4a7f-9d3e-5c6f8a9b2e1d
	Detects use of Cobalt Strike commands accidentally entered in the CMD shell	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell	-	high	_pete_0, TheDFIRReport	2022-05-06	2023-01-30	647c7b9e-d784-4fda-b9a0-45c565a7b729
	Detects Cobalt Strike module/commands accidentally entered in CMD shell	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell	-	high	_pete_0, TheDFIRReport	2022-05-06	2023-01-30	4f154fb6-27d1-4813-a759-78b93e0b9c48
	Detects potential APT FIN7 exploitation activity as reported by Google. (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell	-	medium	Alex Walston (@4ayymm)	2024-07-29	—	6676896b-2cce-422d-82af-5a1abe65e241
	Detects activity that could be related to Baby Shark malware	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Discovery Query Registry Stealth System Binary Proxy Execution Mshta	-	high	Florian Roth (Nextron Systems)	2019-02-24	2023-03-08	2b30fa36-3a18-402f-a22d-bf4ce2189f35
	Detects potential ClickFix malware execution patterns by monitoring registry modifications in RunMRU keys containing HTTP/HTTPS links. (...)	Generic	experimental	registry_set	windows	Sysmon · WinEventLog Security	Execution User Execution Malicious Link	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-03-25	2025-11-19	f5fe36cf-f1ec-4c23-903d-09a3110f6bbb
	Detects potential path traversal attempt via cmd.exe. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell	-	high	xknow @xknow_infosec, Tim Shelton	2020-06-11	2023-03-06	087790e3-3287-436c-bccf-cbd0184a7db1

Title

Description

TA577 G1037

TA577 MITRE reference G1037

Standing G1037

Reach

Coverage

TA577 detections G1037