malware
Zeroaccess is a kernel-mode Rootkit that attempts to add victims to the ZeroAccess botnet, often for monetary gain. [1]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Zeroaccess is a kernel-mode rootkit.2
Some variants of the Zeroaccess Trojan have been known to store data in Extended Attributes.3
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
7th percentile · 93% of 825 ATT&CK software entries have more Enterprise techniques.
6th percentile · 94% of 825 ATT&CK software entries have more tactics spanned.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
40th percentile · 60% of 825 ATT&CK software entries have more detection rules per technique.
35 distinct rules cover the 2 techniques recorded for this malware. 24 Sigma · 11 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects execution from an Alternate Data Stream (ADS). (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2021-09-01 | 2022-10-09 | 7f43c430-5001-4f8b-aaa9-c3b88f18fa5c | ||||
Exports the target Registry key and hides it in the specified alternate data stream. | Generic | test | create_stream_hash | windows | Sysmon | - | high | Oddvar Moe, Sander Wiebing, oscd.community | 2020-10-07 | 2021-11-27 | 0d7a9363-af70-4e7b-a3b7-1a176b7fbe84 | ||||
Detects the creation of a named file stream with the imphash of a well-known hack tool | Generic | test | create_stream_hash | windows | Sysmon | - | high | Florian Roth (Nextron Systems) | 2022-08-24 | 2024-11-23 | 19b041f6-e583-40dc-b842-d6fa8011493f | ||||
Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a n (...) | Generic | test | create_stream_hash | windows | Sysmon | - | medium | Florian Roth (Nextron Systems), @0xrawsec | 2018-06-03 | 2023-02-10 | b69888d4-380c-45ce-9cf9-d9ce46e67821 | ||||
Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS. (...) | Generic | test | process_creation | macos | - | - | medium | Omar Khaled (@beacon_exe) | 2024-08-21 | — | 3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe | ||||
Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) | 2020-10-05 | 2024-03-05 | 04936b66-3915-43ad-a8e5-809eadfd1141 | ||||
Splunk | The following analytic identifies the use of the 'kmod' process to list kernel modules on a Linux system. (...) | Anomaly | stable | process_creation | linux | Linux Auditd | - | medium | Teoderick Contreras, Splunk | 2024-08-09 | 2026-05-13 | d1b088de-c47a-4572-9339-bdcc26493b32 | |||
Splunk | The following analytic identifies the use of the 'kmod' process to list kernel modules on a Linux system. (...) | Anomaly | stable | process_creation | linux | Sysmon | - | medium | Michael Haag, Splunk | 2022-06-17 | 2026-10-09 | 6df99886-0e04-4c11-8b88-325747419278 | |||
Splunk | This detection identifies file creation events associated with the installation of the Medusa rootkit, a userland LD_PRELOAD-based rootkit known for deploying shared objects, loader binaries, and configuration files into specific system directories. (...) | Generic | stable | file_event | linux | Sysmon | - | medium | Raven Tait, Splunk | 2022-04-26 | 2026-05-13 | 7add8520-71d5-43aa-b262-ee082b1f0238 | |||
Detects writing data into NTFS alternate data streams from powershell. (...) | Generic | test | ps_script | windows | PowerShell | - | high | Sami Ruohonen | 2018-07-24 | 2022-12-25 | 8c521530-5169-495d-a199-0a3a881ad24e | ||||
Detects the creation of hidden file/folder with the "::$index_allocation" stream. (...) | Generic | test | file_event | windows | Sysmon | - | medium | Scoubi (@ScoubiMtl) | 2023-10-09 | — | a8f866e1-bdd4-425e-a27a-37619238d9c7 | ||||
Detects command line containing reference to the "::$index_allocation" stream, which can be used as (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems), Scoubi (@ScoubiMtl) | 2023-10-09 | — | 0900463c-b33b-49a8-be1d-552a3b553dae | ||||
Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS). | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Harjot Singh, '@cyb3rjy0t' | 2023-01-21 | 2026-03-16 | 9248c7e1-2bf3-4661-a22c-600a8040b446 | ||||
Storing files in Alternate Data Stream (ADS) similar to Astaroth malware. | Generic | test | ps_script | windows | PowerShell | - | medium | frack113 | 2021-09-02 | 2022-12-25 | a699b30e-d010-46c8-bbd1-ee2e26765fe9 | ||||
Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | frack113 | 2022-05-02 | — | cafeeba3-01da-4ab4-b6c4-a31b1d9730c7 | ||||
Detects execution of "findstr" with specific flags and a remote share path. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) | 2020-10-05 | 2024-03-05 | 587254ee-a24b-4335-b3cd-065c0f1f4baa | ||||
Detects PowerShell script execution from Alternate Data Stream (ADS) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Sergey Soldatov, Kaspersky Lab, oscd.community | 2019-10-30 | 2022-07-14 | 45a594aa-1fbd-4972-a809-ff5a99dd81b8 | ||||
Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2021-11-26 | 2022-12-31 | 6b369ced-4b1d-48f1-b427-fdc0de0790bd | ||||
Extract data from cab file and hide it in an alternate data stream | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2021-11-26 | 2022-12-30 | 4b13db67-0c45-40f1-aba8-66a1a7198a1e | ||||
Detects the download of suspicious file type from a well-known file and paste sharing domain | Generic | test | create_stream_hash | windows | Sysmon | - | high | Florian Roth (Nextron Systems) | 2022-08-24 | 2026-03-29 | 52182dfb-afb7-41db-b4bc-5336cb29b464 | ||||
Detects default install commands of the Triple Cross eBPF rootkit based on the "deployer.sh" script | Generic | test | process_creation | linux | Sysmon | - | high | Nasreddine Bencherchali (Nextron Systems) | 2022-07-05 | — | 22236d75-d5a0-4287-bf06-c93b1770860f | ||||
Detects the download of suspicious file type from URLs with IP | Generic | test | create_stream_hash | windows | Sysmon | - | high | Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) | 2022-09-07 | 2023-02-10 | 025bd229-fd1f-4fdb-97ab-20006e1a5368 | ||||
Detects the download of suspicious file type from a well-known file and paste sharing domain | Generic | test | create_stream_hash | windows | Sysmon | - | medium | Florian Roth (Nextron Systems) | 2022-08-24 | 2026-03-29 | ae02ed70-11aa-4a22-b397-c0d0e8f6ea99 | ||||
Detect use of the Windows 8.3 short name. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113, Nasreddine Bencherchali (Nextron Systems) | 2022-08-05 | 2022-09-21 | dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795 | ||||
Detect use of the Windows 8.3 short name. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113, Nasreddine Bencherchali (Nextron Systems) | 2022-08-06 | 2023-07-20 | 3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b | ||||
Detects the use of short name paths (8.3 format) in command lines, which can be used to obfuscate paths or access restricted locations. (...) | Hunting | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113, Nasreddine Bencherchali | 2022-08-07 | 2025-10-22 | 349d891d-fef0-4fe4-bc53-eee623a15969 | ||||
Detect use of the Windows 8.3 short name. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113, Nasreddine Bencherchali | 2022-08-07 | 2025-10-20 | a96970af-f126-420d-90e1-d37bf25e50e1 | ||||
Splunk | The following analytic detects the creation of an NTFS alternate data stream (ADS) accessed over a local administrative share targeting the loopback address (127.0.0.1). (...) | Anomaly | stable | network_connection | windows | WinEventLog Security | - | medium | Onur Mustafa Erdogan, Splunk | 2026-08-19 | 2026-09-30 | e974a5c9-cbe9-4b4a-8fba-b55e7dbc8259 | |||
Splunk | The following analytic detects the creation of Alternate Data Streams (ADS) with Base64 content on Windows systems. (...) | Generic | stable | create_stream_hash | windows | Sysmon | - | medium | Steven Dick, Teoderick Contreras, Michael Haag, Splunk | 2024-01-10 | 2026-05-13 | 683f48de-982f-4a7e-9aac-9cec550da498 | |||
Splunk | The following analytic detects the writing of data with an IMPHASH value to an Alternate Data Stream (ADS) in the NTFS file system. (...) | Generic | stable | create_stream_hash | windows | Sysmon | - | medium | Steven Dick, Teoderick Contreras, Splunk | 2024-01-10 | 2026-05-13 | a258bf2a-34fd-4986-8086-78f506e00206 | |||
Splunk | The following analytic detects when a process attempts to execute a file from within an NTFS file system alternate data stream. (...) | Generic | stable | process_creation | windows | WinEventLog Security · Sysmon | - | medium | Steven Dick | 2024-01-10 | 2026-06-04 | 30c32c5c-41fe-45db-84fe-275e4320da3f | |||
Splunk | The following analytic detects the loading of new Kernel Mode Drivers from non-standard paths using Windows EventCode 7045. (...) | Generic | stable | service | windows | WinEventLog System | - | medium | Michael Haag, Splunk | 2022-05-16 | 2026-05-13 | 9216ef3d-066a-4958-8f27-c84589465e62 | |||
Splunk | The following analytic identifies all drivers being loaded on Windows systems using Sysmon EventCode 6 (Driver Load). (...) | Hunting | stable | driver_load | windows | Sysmon | - | medium | Michael Haag, Splunk | 2022-04-04 | 2026-05-13 | d2d4af6a-6c2b-4d79-80c5-fc2cf12a2f68 | |||
Splunk | Detects the execution of tools from the `symboliclink-testing-tools` toolkit. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Raven Tait, Splunk | 2026-05-05 | 2026-05-13 | f1926fc8-f98d-473c-b4f4-465645b8e66a | |||
Splunk | The following analytic detects the wermgr.exe process creating an alternate stream in the temp directory. (...) | Anomaly | stable | create_stream_hash | windows | Sysmon | - | medium | Teoderick Contreras, Splunk | 2026-06-11 | 2026-10-12 | 65222e9b-9d0b-4bfe-8da1-199b98e1d44a |
32nd percentile · 68% of 825 ATT&CK software entries have more atomic tests per technique.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
23rd percentile · 77% of 825 ATT&CK software entries have more mitigations per technique.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 2 Enterprise techniques.
Technique Campaign use over its cumulative rule count.