malware
PlugX is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.[1][2][3][4]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
PlugX can enumerate and query for information contained within the Windows Registry.567
PlugX has captured victim IP address details of the targeted machine.89
PlugX can use API hashing and modify the names of strings to evade detection.1011
PlugX has utilized junk code and opaque predicates in payloads to hinder analysis.12
PlugX has leveraged obfuscated Windows API function calls that were concealed as unique names, or hashes of the Windows API.13
PlugX has leveraged XOR encryption with the key of 123456789.14
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
99th percentile · 99% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.
100th percentile · None of the 825 ATT&CK software entries has more tactics spanned — the highest in the population.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
29th percentile · 71% of 825 ATT&CK software entries have more detection rules per technique.
55th percentile · 55% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
57th percentile · 57% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 49 Enterprise techniques.
Technique Campaign use over its cumulative rule count.
1289 distinct rules cover the 49 techniques recorded for this malware. 888 Sigma · 401 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups. | Hunting | test | file_access | windows | - | - | low | frack113 | 2023-09-15 | 2024-07-29 | 337a31c6-46c4-46be-886a-260d7aa78cac | ||||
Detect set Notification_Suppress to 1 to disable the Windows security center notification | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 0c93308a-3f1b-40a9-b649-57ea1a1c1d63 | ||||
Detect set DisallowRun to 1 to prevent user running specific computer program | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 275641a5-a492-45e2-a817-7c81e9d9d3e9 | ||||
Detects the deletion of the "Zone.Identifier" ADS. (...) | Hunting | test | file_delete | windows | Sysmon | - | low | frack113 | 2023-09-04 | — | 7eac0a16-5832-4e81-865f-0268a6d19e4b | ||||
Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...) | Generic | test | file_delete | windows | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-09-04 | 2025-07-04 | 3109530e-ab47-4cc6-a953-cac5ebcc93ae | ||||
Splunk | The following analytic detects the execution of network scanning utilities such as Advanced IP Scanner or Advanced Port Scanner. (...) | Anomaly | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Nasreddine Bencherchali, Splunk | 2025-10-24 | 2026-05-13 | 9a4e50c7-5b62-4d52-93b4-f2b61332e9a5 | |||
Detect enable rdp feature to allow specific user to rdp connect on the targeted machine | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 37b437cf-3fc5-4c8e-9c94-1d7c9aff842b | ||||
Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nasreddine Bencherchali (Nextron Systems) | 2023-02-28 | 2025-10-22 | 6c8fbee5-dee8-49bc-851d-c3142d02aa47 | ||||
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled. | Generic | experimental | - | windows | AppLocker | - | medium | heyyanu | 2026-03-26 | — | 557e3bd3-7f21-495d-8d50-7c8bdfb8041c | ||||
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running. | Generic | test | - | windows | AppLocker | - | medium | Pushkarev Dmitry | 2020-06-28 | 2025-12-03 | 401e5d00-b944-11ea-8f9a-00163ecd60ae | ||||
Detects DNS queries made by "AppInstaller.EXE". (...) | Generic | test | dns | windows | Sysmon | - | medium | frack113 | 2021-11-24 | 2023-11-09 | 7cff77e1-9663-46a3-8260-17f2e1aa9d0a | ||||
Detects suspicious user agent strings used in APT malware in proxy logs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Markus Neis | 2019-11-12 | 2024-02-15 | 6ec820f2-e963-4801-9127-d8b2dce4d31b | ||||
Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27 | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | critical | Florian Roth (Nextron Systems) | 2018-09-03 | 2023-03-09 | 9aa01d62-7667-4d3b-acb8-8cb5103e2014 | ||||
This method detects malicious services mentioned in APT29 report by FireEye. (...) | Unsupported | unsupported | process_creation | windows | WinEventLog System | - | high | Thomas Patzke | 2017-11-01 | 2022-03-21 | c069f460-2b87-4010-8dcf-e45bab362624 | ||||
Detects suspicious user agent string of APT40 Dropbox tool | Emerging | test | proxy | - | - | - | high | Thomas Patzke | 2019-11-12 | 2023-05-18 | 5ba715b6-71b7-44fd-8245-f66893e81b3d | ||||
Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Victor Sergeev, oscd.community | 2020-10-09 | 2023-10-18 | eee00933-a761-4cd0-be70-c42fe91731e7 | ||||
Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanets (...) | Generic | test | image_load | windows | Sysmon | - | high | Nasreddine Bencherchali (Nextron Systems) | 2023-01-22 | 2023-03-15 | 90ae0469-0cee-4509-b67f-e5efcef040f7 | ||||
Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. (...) | Emerging | experimental | file_event | macos | - | - | high | Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital) | 2025-11-22 | — | e710a880-1f18-4417-b6a0-b5afdf7e3023 | ||||
Splunk | The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike · Cisco NVM · Cisco | - | medium | Bhavin Patel, Splunk, sventec, Github Community | 2021-07-12 | 2026-09-22 | a51bfe1a-94f0-48cc-b4e4-16a110145893 | - | ||
Detects automated lateral movement by Turla group | Unsupported | unsupported | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Markus Neis | 2017-11-07 | 2023-02-24 | 75925535-ca97-4e0a-a850-00b5c00779dc | ||||
Detects changes to the EC2 instance startup script. (...) | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | high | faloker | 2020-02-12 | 2022-06-07 | 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df | ||||
Detects file creation events linked to the Axios NPM supply chain compromise. (...) | Emerging | experimental | file_event | linux | Sysmon | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | b7cb840c-11f6-47f7-b3ef-5524739c9077 | ||||
Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...) | Emerging | experimental | file_event | macos | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 2db0458c-05c9-4069-a26f-77becd9c8c13 | ||||
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...) | Emerging | experimental | process_creation | linux | Sysmon | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 0a23a62d-c5b3-468b-a072-25064a9a8c87 | ||||
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup. | Emerging | experimental | process_creation | macos | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | a09ee860-31b3-4586-8a68-0ebd74ce0e5f | ||||
Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...) | Emerging | experimental | process_creation | windows | Sysmon · WinEventLog Security | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | f6c27ecc-d890-4452-80e6-2e274a10e097 | ||||
Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...) | Emerging | experimental | dns | - | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 73e5d24f-493f-4092-bd2f-c72cabda40ee | ||||
This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent. (...) | Generic | test | - | windows | WinEventLog Security | - | medium | Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC | 2021-08-26 | 2022-10-09 | ff151c33-45fa-475d-af4f-c2f93571f4fe | ||||
This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS). (...) | Generic | test | - | windows | WinEventLog Security | - | medium | Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC | 2021-08-26 | 2022-10-09 | 1d2ab8ac-1a01-423b-9c39-001510eae8e8 | ||||
Detects backup catalog deletions | Generic | test | - | windows | WinEventLog Application | - | medium | Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection) | 2017-05-12 | 2022-12-25 | 9703792d-fd9a-456d-a672-ff92efe4806a | ||||
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2020-01-29 | 2023-01-26 | e32d4572-9826-4738-b651-95fa63747e8a | ||||
Splunk | The following analytic detects the creation of a batch file (.bat) within the Windows system directory tree, specifically in the System32 or SysWOW64 folders. (...) | Anomaly | stable | file_event | windows | Sysmon | - | medium | Steven Dick, Michael Haag, Rico Valdez, Splunk | 2020-04-29 | 2026-07-02 | 503d17cb-9eab-4cf8-a20e-01d5c6987ae3 | - | ||
Adversaries may use binary padding to add junk data and change the on-disk representation of malware. (...) | Generic | test | process_creation | linux | Linux Auditd | - | high | Igor Fits, oscd.community | 2020-10-13 | 2023-05-03 | c52a914f-3d8b-4b2a-bb75-b3991e75f8ba | ||||
Adversaries may use binary padding to add junk data and change the on-disk representation of malware. (...) | Generic | test | process_creation | macos | - | - | high | Igor Fits, Mikhail Larin, oscd.community | 2020-10-19 | 2023-02-17 | 95361ce5-c891-4b0a-87ca-e24607884a96 | ||||
Detects user data export activity. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | medium | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | 5259cbf2-0a75-48bf-b57a-c54d6fabaef3 | ||||
Detects user permission data export attempt. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | medium | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | 87cc6698-3e07-4ba2-9b43-a85a73e151e2 | ||||
Splunk | The following analytic detects the use of `bitsadmin.exe` with the `transfer` parameter to download a remote object. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Sittikorn S | 2021-03-30 | 2026-10-02 | 80630ff4-8e4c-11eb-aab5-acde48001122 | |||
Detects Bitsadmin connections to IP addresses instead of FQDN names | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2022-06-10 | 2022-08-24 | 8ccd35a2-1c7c-468b-b568-ac6cdf80eec3 | ||||
Detects Bitsadmin connections to domains with uncommon TLDs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Tim Shelton | 2019-03-07 | 2026-09-30 | 9eb68894-7476-4cd6-8752-23b51f5883a7 | ||||
Detects specific windows registry modifications made by BlackByte ransomware variants. (...) | Emerging | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | frack113 | 2022-01-24 | 2025-10-21 | 83314318-052a-4c90-a1ad-660ece38d276 | ||||
Attempts to detect system changes made by Blue Mockingbird | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Trent Liffick (@tliffick) | 2020-05-14 | 2022-10-09 | c3198a27-23a0-4c2c-af19-e5328d49680e | ||||
Attempts to detect system changes made by Blue Mockingbird | Emerging | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | Trent Liffick (@tliffick) | 2020-05-14 | 2023-08-17 | 92b0b372-a939-44ed-a11b-5136cf680e27 | ||||
detects BPFDoor .lock and .pid files access in temporary file storage facility | Generic | test | file_event | linux | Linux Auditd | - | high | Rafal Piasecki | 2022-08-10 | 2026-03-30 | 808146b2-9332-4d78-9416-d7e47012d83d | ||||
All TCP traffic on particular port from attacker is routed to different port. (...) | Generic | test | process_creation | linux | Linux Auditd | - | medium | Rafal Piasecki | 2022-08-10 | — | 70b4156e-50fc-4523-aa50-c9dddf1993fc | ||||
Detects execution of Chromium based browser in headless mode | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | Nasreddine Bencherchali (Nextron Systems) | 2023-09-12 | — | ef9dcfed-690c-4c5d-a9d1-482cd422225c | ||||
Detects usage of "getcap" binary. (...) | Generic | test | process_creation | linux | Sysmon | - | low | Nasreddine Bencherchali (Nextron Systems) | 2022-12-28 | 2026-01-24 | d8d97d51-122d-4cdd-9e2f-01b4b4933530 | ||||
Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) | 2023-02-15 | 2024-03-05 | 3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5 | ||||
Splunk | The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Splunk | 2021-03-25 | 2026-10-02 | bfe94226-8c10-11eb-a4b3-acde48001122 | |||
Detects HTTP request used by Chafer malware to receive data from its C2. | Emerging | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2019-01-31 | 2024-02-15 | fb502828-2db0-438e-93e6-801c7548686d | ||||
Detect possible persistence using Fax DLL load when service restart | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | frack113 | 2022-07-17 | 2022-12-30 | 9e3357ba-09d4-4fbd-a7c5-ad6386314513 |