malware
Carbanak is a full-featured, remote backdoor used by a group of the same name (Carbanak). It is intended for espionage, data exfiltration, and providing remote access to infected machines. [1] [2]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Carbanak checks the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings for proxy configurations information.4
Carbanak enables concurrent Remote Desktop Protocol (RDP) sessions.5
Carbanak exfiltrates data in compressed chunks if a message is larger than 4096 bytes.7
Carbanak downloads an executable and injects it directly into a new process.8
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
75th percentile · 75% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.
94th percentile · 94% of 825 ATT&CK software entries have this many tactics spanned or fewer.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
57th percentile · 57% of 825 ATT&CK software entries have this many detection rules per technique or fewer.
56th percentile · 56% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
57th percentile · 57% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 18 Enterprise techniques.
Technique Campaign use over its cumulative rule count.
510 distinct rules cover the 18 techniques recorded for this malware. 362 Sigma · 148 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects file access requests to browser credential stores by uncommon processes. (...) | Hunting | test | file_access | windows | - | - | low | frack113, X__Junior (Nextron Systems) | 2022-04-09 | 2024-07-29 | 91cb43db-302a-47e3-b3c8-7ede481e27bf | ||||
Detects file access requests to chromium based browser sensitive files by uncommon processes. (...) | Hunting | test | file_access | windows | - | - | low | X__Junior (Nextron Systems) | 2024-07-29 | — | c5f37810-a85f-4186-81e9-33f23abb4141 | ||||
Detects file access requests to crypto currency files by uncommon processes. (...) | Generic | test | file_access | windows | - | - | medium | X__Junior (Nextron Systems) | 2024-07-29 | — | f41b0311-44f9-44f0-816d-dd45e39d4bc8 | ||||
Detects the deletion of the "Zone.Identifier" ADS. (...) | Hunting | test | file_delete | windows | Sysmon | - | low | frack113 | 2023-09-04 | — | 7eac0a16-5832-4e81-865f-0268a6d19e4b | ||||
Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...) | Generic | test | file_delete | windows | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-09-04 | 2025-07-04 | 3109530e-ab47-4cc6-a953-cac5ebcc93ae | ||||
Splunk | The following analytic detects suspicious modifications to firewall rule registry settings that allow inbound traffic on specific ports with a public profile. (...) | Generic | stable | registry_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk, Steven Dick | 2021-05-26 | 2026-05-13 | 0a46537c-be02-11eb-92ca-acde48001122 | |||
Splunk | The following analytic detects a suspicious PowerShell command that allows inbound traffic to a specific local port within the public profile. (...) | Generic | stable | ps_script | windows | PowerShell | - | medium | Teoderick Contreras, Splunk | 2021-05-19 | 2026-05-13 | a5d85486-b89c-11eb-8267-acde48001122 | |||
Detects a highly relevant Antivirus alert that reports password dumpers and stealers. (...) | Generic | stable | antivirus | - | - | - | critical | Florian Roth (Nextron Systems), Arnim Rupp | 2018-09-09 | 2026-06-15 | 78cc2dd2-7d20-4d32-93ff-057084c38b93 | ||||
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled. | Generic | experimental | - | windows | AppLocker | - | medium | heyyanu | 2026-03-26 | — | 557e3bd3-7f21-495d-8d50-7c8bdfb8041c | ||||
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running. | Generic | test | - | windows | AppLocker | - | medium | Pushkarev Dmitry | 2020-06-28 | 2025-12-03 | 401e5d00-b944-11ea-8f9a-00163ecd60ae | ||||
Detects suspicious user agent strings used in APT malware in proxy logs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Markus Neis | 2019-11-12 | 2024-02-15 | 6ec820f2-e963-4801-9127-d8b2dce4d31b | ||||
Detects suspicious user agent string of APT40 Dropbox tool | Emerging | test | proxy | - | - | - | high | Thomas Patzke | 2019-11-12 | 2023-05-18 | 5ba715b6-71b7-44fd-8245-f66893e81b3d | ||||
Splunk | The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike · Cisco NVM · Cisco | - | medium | Bhavin Patel, Splunk, sventec, Github Community | 2021-07-12 | 2026-09-22 | a51bfe1a-94f0-48cc-b4e4-16a110145893 | - | ||
Detects changes to the EC2 instance startup script. (...) | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | high | faloker | 2020-02-12 | 2022-06-07 | 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df | ||||
Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...) | Emerging | experimental | process_creation | windows | Sysmon · WinEventLog Security | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | f6c27ecc-d890-4452-80e6-2e274a10e097 | ||||
Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...) | Emerging | experimental | dns | - | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 73e5d24f-493f-4092-bd2f-c72cabda40ee | ||||
This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent. (...) | Generic | test | - | windows | WinEventLog Security | - | medium | Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC | 2021-08-26 | 2022-10-09 | ff151c33-45fa-475d-af4f-c2f93571f4fe | ||||
This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS). (...) | Generic | test | - | windows | WinEventLog Security | - | medium | Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC | 2021-08-26 | 2022-10-09 | 1d2ab8ac-1a01-423b-9c39-001510eae8e8 | ||||
Detects backup catalog deletions | Generic | test | - | windows | WinEventLog Application | - | medium | Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection) | 2017-05-12 | 2022-12-25 | 9703792d-fd9a-456d-a672-ff92efe4806a | ||||
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2020-01-29 | 2023-01-26 | e32d4572-9826-4738-b651-95fa63747e8a | ||||
Detects Bitsadmin connections to IP addresses instead of FQDN names | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2022-06-10 | 2022-08-24 | 8ccd35a2-1c7c-468b-b568-ac6cdf80eec3 | ||||
Detects Bitsadmin connections to domains with uncommon TLDs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Tim Shelton | 2019-03-07 | 2026-09-30 | 9eb68894-7476-4cd6-8752-23b51f5883a7 | ||||
Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Julia Fomina, oscd.community | 2020-10-09 | 2025-10-31 | 93671f99-04eb-4ab4-a161-70d446a84003 | ||||
Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) | 2023-02-15 | 2024-03-05 | 3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5 | ||||
Detects HTTP request used by Chafer malware to receive data from its C2. | Emerging | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2019-01-31 | 2024-02-15 | fb502828-2db0-438e-93e6-801c7548686d | ||||
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. (...) | Generic | test | ps_script | windows | PowerShell | - | medium | frack113 | 2022-01-23 | 2025-07-18 | d4488827-73af-4f8d-9244-7b7662ef046e | ||||
Splunk | This analytic detects creation of new user accounts on Cisco ASA devices via CLI or ASDM. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-11-21 | 2026-05-13 | 9c8e4f2a-7d3b-4e5c-8a9f-1b6d4e8c3f5a | |||
Find information about network devices that is not stored in config files | Generic | test | authentication | - | Cisco AAA · Cisco | - | low | Austin Clark | 2019-08-12 | 2023-01-04 | 9705a6a1-6db6-4a16-a987-15b7151e299b | ||||
See what files are being deleted from flash file systems | Generic | test | authentication | - | Cisco AAA · Cisco | - | medium | Austin Clark | 2019-08-12 | 2023-01-04 | 71d65515-c436-43c0-841b-236b1f32c21e | - | |||
Find local accounts being created or modified as well as remote authentication configurations | Generic | test | authentication | - | Cisco AAA · Cisco | - | high | Austin Clark | 2019-08-12 | 2023-01-04 | 6d844f0f-1c18-41af-8f19-33e7654edfc3 | - | |||
Splunk | This analytic detects the usage of the Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes (600 seconds). (...) | Anomaly | stable | network_connection | - | Cisco NVM · Cisco | - | medium | Radka Viskova, Splunk | 2026-09-18 | 2026-09-22 | 6bc88a9d-f7de-4257-b526-acf15bc5a517 | |||
Splunk | The following analytic detects the use of known suspicious SSL certificates in any observed event where the SSL_CertFingerprint field is present. (...) | Generic | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-09-22 | c43f7b49-2dab-4e76-892e-7f971c2f20f1 | |||
Splunk | The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | d85c05c8-42c0-4e4a-87e7-4e1bb3e844e3 | |||
Splunk | The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | f7e5e792-d907-46c1-a58e-4ff974dc462a | |||
Splunk | The following analytic detects connections with a high Encrypted Visibility Engine (EVE) threat confidence score, indicating potentially malicious behavior within encrypted traffic. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 8c15183e-2e70-4db4-86c3-88f8d9129b66 | |||
Splunk | This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs. (...) | Generic | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-16 | 2026-05-13 | ec99bb81-c31b-4837-8c7d-1b32aa70b337 | |||
Splunk | This analytic detects Lumma Stealer activity using Cisco Secure Firewall Intrusion Events. (...) | Generic | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk, Talos NTDR | 2025-04-16 | 2026-05-13 | 96bce783-c22e-4e48-8cf1-3eb2794c5083 | |||
Splunk | The following analytic detects network traffic associated with known remote access software applicat (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-05-28 | 2026-09-22 | ac54d39e-a75d-4f42-971d-006db3a0423a | |||
Splunk | The following analytic detects repeated malware file downloads initiated by the same internal host (src) within a short time window. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-09 | 2026-09-22 | aeff2bb5-3483-48d4-9be8-c8976194be1e | |||
Splunk | This analytic identifies Snort intrusion signatures that have been triggered by ten or more distinct internal IP addresses within a one-hour window. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-16 | 2026-05-13 | a4c76d0a-56b6-44be-814b-939746c4d406 | |||
Splunk | The following analytic detects outbound connections initiated by command-line tools such as curl or wget. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 173a1cb9-1814-4128-a9dc-f29dade89957 | |||
Detects modification of Windows Registry Classes keys used for persistence. (...) | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) | 2019-10-25 | 2025-10-22 | 9df5f547-c86a-433e-b533-f2794357e242 | ||||
Splunk | The following analytic detects the execution of `cipher.exe` with the `/w` flag to clear unallocated sectors on a disk. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Splunk | 2021-06-10 | 2026-05-13 | cd80a6ac-c9d9-11eb-8839-acde48001122 | |||
Detects DNS requests to Cloudflared tunnels domains. (...) | Generic | test | dns | windows | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-12-20 | — | a1d9eec5-33b2-4177-8d24-27fe754d0812 | ||||
Splunk | The following analytic detects the use of `cmd.exe /c` to execute commands, a technique often employed by adversaries and malware to run batch commands or invoke other shells like PowerShell. (...) | Hunting | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | medium | Teoderick Contreras, Bhavin Patel, Splunk | 2021-10-21 | 2026-05-13 | 54a6ed00-3256-11ec-b031-acde48001122 | ||||
Splunk | The following analytic identifies the use of named-pipe impersonation for privilege escalation, commonly associated with Cobalt Strike and similar frameworks. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Splunk | 2021-05-27 | 2026-05-13 | eb277ba0-b96b-11eb-b00e-acde48001122 | |||
Detects a suspicious command line execution that includes an URL and AppData string in the command l (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community | 2019-01-16 | 2021-11-27 | 1ac8666b-046f-4201-8aba-1951aaec03a3 | ||||
Detects modification of autostart extensibility point (ASEP) in registry. | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name) | 2019-10-25 | 2025-10-22 | f59c3faf-50f3-464b-9f4c-1b67ab512d99 | ||||
Detects Turla ComRAT network communication. | Emerging | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2020-05-26 | 2024-02-26 | 7857f021-007f-4928-8b2c-7aedbe64bb82 | ||||
detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hi (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nasreddine Bencherchali (Nextron Systems) | 2022-06-14 | — | ee5e119b-1f75-4b34-add8-3be976961e39 |