malware
LOWBALL is malware used by admin@338. It was used in August 2015 in email messages targeting Hong Kong-based media organizations. [1]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
LOWBALL command and control occurs via HTTPS over port 443.2
LOWBALL uses the Dropbox cloud storage service for command and control.3
LOWBALL uses the Dropbox API to request two files, one of which is the same file as the one dropped by the malicious email attachment. This is most likely meant to be a mechanism to update the compromised host with a new version of the LOWBALL malware.4
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
12th percentile · 88% of 825 ATT&CK software entries have more Enterprise techniques.
6th percentile · 94% of 825 ATT&CK software entries have more tactics spanned.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
96th percentile · 96% of 825 ATT&CK software entries have this many detection rules per technique or fewer.
193 distinct rules cover the 3 techniques recorded for this malware. 132 Sigma · 61 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects DNS queries made by "AppInstaller.EXE". (...) | Generic | test | dns | windows | Sysmon | - | medium | frack113 | 2021-11-24 | 2023-11-09 | 7cff77e1-9663-46a3-8260-17f2e1aa9d0a | ||||
Detects suspicious user agent strings used in APT malware in proxy logs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Markus Neis | 2019-11-12 | 2024-02-15 | 6ec820f2-e963-4801-9127-d8b2dce4d31b | ||||
Detects suspicious user agent string of APT40 Dropbox tool | Emerging | test | proxy | - | - | - | high | Thomas Patzke | 2019-11-12 | 2023-05-18 | 5ba715b6-71b7-44fd-8245-f66893e81b3d | ||||
Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Victor Sergeev, oscd.community | 2020-10-09 | 2023-10-18 | eee00933-a761-4cd0-be70-c42fe91731e7 | ||||
Detects file creation events linked to the Axios NPM supply chain compromise. (...) | Emerging | experimental | file_event | linux | Sysmon | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | b7cb840c-11f6-47f7-b3ef-5524739c9077 | ||||
Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...) | Emerging | experimental | file_event | macos | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 2db0458c-05c9-4069-a26f-77becd9c8c13 | ||||
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...) | Emerging | experimental | process_creation | linux | Sysmon | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 0a23a62d-c5b3-468b-a072-25064a9a8c87 | ||||
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup. | Emerging | experimental | process_creation | macos | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | a09ee860-31b3-4586-8a68-0ebd74ce0e5f | ||||
Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...) | Emerging | experimental | process_creation | windows | Sysmon · WinEventLog Security | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | f6c27ecc-d890-4452-80e6-2e274a10e097 | ||||
Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...) | Emerging | experimental | dns | - | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 73e5d24f-493f-4092-bd2f-c72cabda40ee | ||||
Splunk | The following analytic detects the use of `bitsadmin.exe` with the `transfer` parameter to download a remote object. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Sittikorn S | 2021-03-30 | 2026-10-02 | 80630ff4-8e4c-11eb-aab5-acde48001122 | |||
Detects Bitsadmin connections to IP addresses instead of FQDN names | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2022-06-10 | 2022-08-24 | 8ccd35a2-1c7c-468b-b568-ac6cdf80eec3 | ||||
Detects Bitsadmin connections to domains with uncommon TLDs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Tim Shelton | 2019-03-07 | 2026-09-30 | 9eb68894-7476-4cd6-8752-23b51f5883a7 | ||||
Detects execution of Chromium based browser in headless mode | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | Nasreddine Bencherchali (Nextron Systems) | 2023-09-12 | — | ef9dcfed-690c-4c5d-a9d1-482cd422225c | ||||
Detects HTTP request used by Chafer malware to receive data from its C2. | Emerging | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2019-01-31 | 2024-02-15 | fb502828-2db0-438e-93e6-801c7548686d | ||||
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. (...) | Generic | test | ps_script | windows | PowerShell | - | medium | frack113 | 2022-01-23 | 2025-07-18 | d4488827-73af-4f8d-9244-7b7662ef046e | ||||
Splunk | The following analytic detects the execution of curl commands with insecure flags within the Cisco Isovalent environment. (...) | Anomaly | stable | process_creation | - | Cisco | - | medium | Bhavin Patel, Splunk | 2026-01-05 | 2026-10-02 | c16c4899-d3f7-461b-92c2-cc0ef5758855 | |||
Splunk | This analytic detects the usage of the Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes (600 seconds). (...) | Anomaly | stable | network_connection | - | Cisco NVM · Cisco | - | medium | Radka Viskova, Splunk | 2026-09-18 | 2026-09-22 | 6bc88a9d-f7de-4257-b526-acf15bc5a517 | |||
Splunk | This analytic identifies the use of Chromium-based browsers (like Microsoft Edge) running in headless mode with the `--dump-dom` argument. (...) | Generic | stable | network_connection | - | Cisco NVM · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-07-01 | 2026-09-22 | cd0e816f-f67d-4dbe-a153-480b546e867e | |||
Splunk | This analytic detects unexpected outbound network connections initiated by known webserver processes such as `httpd.exe`, `nginx.exe`, or `tomcat.exe` to common file sharing or public content hosting services like GitHub, Discord CDN, Transfer.sh, or Pastebin. (...) | Generic | stable | network_connection | - | Cisco NVM · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-07-01 | 2026-09-22 | 1984f997-3b49-4d4b-a7e9-dc5dbf88370e | |||
Splunk | The following analytic detects the use of known suspicious SSL certificates in any observed event where the SSL_CertFingerprint field is present. (...) | Generic | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-09-22 | c43f7b49-2dab-4e76-892e-7f971c2f20f1 | |||
Splunk | The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | d85c05c8-42c0-4e4a-87e7-4e1bb3e844e3 | |||
Splunk | The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | f7e5e792-d907-46c1-a58e-4ff974dc462a | |||
Splunk | The following analytic detects file transfers flagged as malware that occurred over non-standard ports (other than 80 and 443). (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-09 | 2026-09-22 | f26445a8-a6a2-4855-bec0-0c39e52e5b8f | |||
Splunk | The following analytic detects connections with a high Encrypted Visibility Engine (EVE) threat confidence score, indicating potentially malicious behavior within encrypted traffic. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 8c15183e-2e70-4db4-86c3-88f8d9129b66 | |||
Splunk | The following analytic detects file downloads that were classified as malware by Cisco Secure Firewall Threat Defense. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-09 | 2026-09-22 | 3cc93f52-5aa6-4b7f-83b9-3430b1436813 | |||
Splunk | The following analytic detects repeated malware file downloads initiated by the same internal host (src) within a short time window. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-09 | 2026-09-22 | aeff2bb5-3483-48d4-9be8-c8976194be1e | |||
Splunk | This analytic identifies Snort intrusion signatures that have been triggered by ten or more distinct internal IP addresses within a one-hour window. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-16 | 2026-05-13 | a4c76d0a-56b6-44be-814b-939746c4d406 | |||
Splunk | The following analytic detects outbound connections initiated by command-line tools such as curl or wget. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 173a1cb9-1814-4128-a9dc-f29dade89957 | |||
Various protocols maybe used to put data on the device for exfil or infil | Generic | test | authentication | - | Cisco AAA · Cisco | - | low | Austin Clark | 2019-08-12 | 2023-01-04 | 5e51acb2-bcbe-435b-99c6-0e3cd5e2aa59 | - | |||
Detects DNS requests to Cloudflared tunnels domains. (...) | Generic | test | dns | windows | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-12-20 | — | a1d9eec5-33b2-4177-8d24-27fe754d0812 | ||||
Detects a suspicious command line execution that includes an URL and AppData string in the command l (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community | 2019-01-16 | 2021-11-27 | 1ac8666b-046f-4201-8aba-1951aaec03a3 | ||||
Detects Turla ComRAT network communication. | Emerging | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2020-05-26 | 2024-02-26 | 7857f021-007f-4928-8b2c-7aedbe64bb82 | ||||
Detects suspicious user agent strings used by crypto miners in proxy logs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2019-10-21 | 2021-11-27 | fa935401-513b-467b-81f4-f9e77aa0dd78 | ||||
Adversaries can use curl to download payloads remotely and execute them. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Sreeman, Nasreddine Bencherchali (Nextron Systems) | 2020-01-13 | 2024-03-05 | 21dd6d38-2b18-4453-9404-a0fe4a0cc288 | ||||
Splunk | The following analytic detects the execution of the curl utility where the command line includes percent-encoded characters and explicit file output options (such as -o or --output). (...) | Anomaly | stable | process_creation | windows · linux | CrowdStrike · Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali, Splunk | 2026-03-03 | 2026-05-13 | 9a8d5516-4c5e-11ef-9d42-acde48001122 | |||
Detects a curl process start on linux, which indicates a file download from a remote location or a s (...) | Generic | test | process_creation | linux | Sysmon | - | low | Nasreddine Bencherchali (Nextron Systems) | 2022-09-15 | — | ea34fb97-e2c4-4afb-810f-785e4459b194 | ||||
Detects a curl process start on Windows, which could indicates a file download from a remote locatio (...) | Hunting | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | Florian Roth (Nextron Systems) | 2022-07-05 | 2023-02-21 | bbeaed61-1990-4773-bf57-b81dbad7db2d | ||||
Detects execution of curl.exe with custom useragent options | Hunting | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-01-23 | 2023-02-21 | 3286d37a-00fd-41c2-a624-a672dcd34e60 | ||||
Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. (...) | Emerging | test | file_event | windows | Sysmon | - | medium | Micah Babinski | 2023-10-15 | — | 1a433e1d-03d2-47a6-8063-ece992cf4e73 | ||||
Splunk | The following analytic detects the use of Certify or Certipy tools to enumerate Active Directory Certificate Services (AD CS) environments. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Steven Dick | 2023-07-28 | 2026-05-13 | e6d2dc61-a8b9-4b03-906c-da0ca75d71b8 | |||
Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session. | Generic | experimental | dns | windows | Sysmon | - | low | Muhammad Faisal (@faisalusuf) | 2024-12-19 | — | 882e858a-3233-4ba8-855e-2f3d3575803d | ||||
Detects DNS query requests to Devtunnels domains. (...) | Generic | test | dns | windows | Sysmon | - | medium | citron_ninja | 2023-10-25 | 2023-11-20 | 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b | ||||
Detects DNS query requests to Visual Studio Code tunnel domains. (...) | Generic | test | dns | windows | Sysmon | - | medium | citron_ninja | 2023-10-25 | 2023-11-20 | b3e6418f-7c7a-4fad-993a-93b65027a9f1 | ||||
Detects the use of wget to download content to a suspicious directory | Generic | test | process_creation | linux | Sysmon | - | medium | Joseliyo Sanchez, @Joseliyo_Jstnk | 2023-06-02 | — | cf610c15-ed71-46e1-bdf8-2bd1a99de6c4 | ||||
Splunk | The following analytic detects suspicious file downloads by the Telegram application on a Windows system. (...) | Generic | stable | create_stream_hash | windows | Sysmon | - | medium | Teoderick Contreras, Splunk | 2021-05-07 | 2026-05-13 | 58194e28-ae5e-11eb-8912-acde48001122 | |||
Detects download of certain file types from hosts with dynamic DNS names (selected list) | Generic | test | proxy | - | - | - | medium | Florian Roth (Nextron Systems) | 2017-11-08 | 2023-05-18 | 195c1119-ef07-4909-bb12-e66f5e07bf3c | ||||
Detects executable access via webdav6. (...) | Generic | test | - | - | HTTP · Zeek | - | medium | SOC Prime, Adam Swan | 2020-05-01 | 2021-11-27 | aac2fd97-bcba-491b-ad66-a6edf89c71bf | ||||
Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy (...) | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2017-07-08 | 2025-01-18 | fdd1bfb5-f60b-4a35-910e-f36ed3d0b32f | ||||
Detects execution of the IEExec utility to download and execute files | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nasreddine Bencherchali (Nextron Systems) | 2022-05-16 | 2023-11-09 | 9801abb8-e297-4dbf-9fbd-57dde0e830ad |
16th percentile · 84% of 825 ATT&CK software entries have more atomic tests per technique.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
91st percentile · 91% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 3 Enterprise techniques.
Technique Campaign use over its cumulative rule count.