GeminiDuke S0049

Type: malware
Platform: Windows
Created: 31 May 2017
Last modified: 25 April 2025

GeminiDuke is malware that was used by APT29 from 2009 to 2012. [1]

Techniques29th pct

TacticsBottom 12%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

GeminiDuke MITRE reference S0049

System Service Discovery T1007 ↗

GeminiDuke collects information on programs and services on the victim that are configured to automatically run at startup.2

Discovery13 detection rules

System Network Configuration Discovery T1016 ↗

GeminiDuke collects information on network settings and Internet proxy settings from the victim.3

Discovery25 detection rules

Process Discovery T1057 ↗

GeminiDuke collects information on running processes and environment variables from the victim.4

Discovery10 detection rules

Web Protocols T1071.001 ↗

GeminiDuke uses HTTP and HTTPS for command and control.5

Command and Control60 detection rules

File and Directory Discovery T1083 ↗

GeminiDuke collects information from the victim, including installed drivers, programs previously executed by users, programs and services configured to automatically run at startup, files and folders present in any user's home folder, files and folders present in any user's My Documents, programs installed to the Program Files folder, and recently accessed files, folders, and programs.6

Discovery29 detection rules

Local Account T1087.001 ↗

GeminiDuke collects information on local user accounts from the victim.7

Discovery27 detection rules

Standing S0049

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques629th pct

29th percentile · 71% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics2Bottom 12%

12th percentile · 88% of 825 ATT&CK software entries have more tactics spanned.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique26med64th pct

64th percentile · 64% of 825 ATT&CK software entries have this many detection rules per technique or fewer.

Tests / technique9.5med

GeminiDuke detections S0049

157 distinct rules cover the 6 techniques recorded for this malware. 108 Sigma · 49 Splunk.

6 covered by at least one rule157 distinct rules in total

Showing 1-50 of 100+ rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects suspicious user agent strings used in APT malware in proxy logs	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems), Markus Neis	2019-11-12	2024-02-15	6ec820f2-e963-4801-9127-d8b2dce4d31b
	Detects suspicious user agent string of APT40 Dropbox tool	Emerging	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage	-	high	Thomas Patzke	2019-11-12	2023-05-18	5ba715b6-71b7-44fd-8245-f66893e81b3d
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
	Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...)	Emerging	experimental	dns	-	-	Command and Control Application Layer Protocol Web Protocols Command and Control Dynamic Resolution	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	73e5d24f-493f-4092-bd2f-c72cabda40ee
	Detects Bitsadmin connections to IP addresses instead of FQDN names	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Execution, Persistence, Stealth BITS Jobs	-	high	Florian Roth (Nextron Systems)	2022-06-10	2022-08-24	8ccd35a2-1c7c-468b-b568-ac6cdf80eec3
	Detects Bitsadmin connections to domains with uncommon TLDs	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Execution, Persistence, Stealth BITS Jobs	-	high	Florian Roth (Nextron Systems), Tim Shelton	2019-03-07	2026-09-30	9eb68894-7476-4cd6-8752-23b51f5883a7
	Detects default file names outputted by the BloodHound collection tool SharpHound	Generic	test	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	C.J. May	2022-08-09	2026-02-19	02773bed-83bf-469f-b7ff-e676e7d78bab
	Detects usage of "getcap" binary. (...)	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	low	Nasreddine Bencherchali (Nextron Systems)	2022-12-28	2026-01-24	d8d97d51-122d-4cdd-9e2f-01b4b4933530
	Detects HTTP request used by Chafer malware to receive data from its C2.	Emerging	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems)	2019-01-31	2024-02-15	fb502828-2db0-438e-93e6-801c7548686d
	Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. (...)	Generic	test	ps_script	windows	PowerShell	Command and Control Application Layer Protocol Web Protocols	-	medium	frack113	2022-01-23	2025-07-18	d4488827-73af-4f8d-9244-7b7662ef046e
	Collect pertinent data from the configuration files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery Account Discovery Local Account Collection Data from Local System Credential Access Unsecured Credentials Credentials In Files	-	low	Austin Clark	2019-08-11	2023-01-04	cd072b25-a418-4f98-8ebc-5093fb38fe1a
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Reconnaissance Gather Victim Network Information Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	71ac5328-2364-40cf-8381-92b8dc531399
Splunk	This analytic detects the usage of the Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes (600 seconds). (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Command and Control Application Layer Protocol Web Protocols Execution Command and Scripting Interpreter AppleScript	-	medium	Radka Viskova, Splunk	2026-09-18	2026-09-22	6bc88a9d-f7de-4257-b526-acf15bc5a517
Splunk	This analytic identifies non-browser processes reaching out to public IP lookup or geolocation servi (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Reconnaissance Gather Victim Network Information IP Addresses Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali, Splunk, Janantha Marasinghe	2025-07-01	2026-09-22	568cb83e-d79e-4a23-85ec-6e1f6c30cb2f
Splunk	The following analytic detects the use of known suspicious SSL certificates in any observed event where the SSL_CertFingerprint field is present. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Resource Development Develop Capabilities Code Signing Certificates Command and Control Encrypted Channel Asymmetric Cryptography Resource Development Obtain Capabilities Digital Certificates	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-09-22	c43f7b49-2dab-4e76-892e-7f971c2f20f1
Splunk	The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage Command and Control Ingress Tool Transfer Resource Development Obtain Capabilities Tool Command and Control Proxy External Proxy	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	f7e5e792-d907-46c1-a58e-4ff974dc462a
Splunk	The following analytic detects connections with a high Encrypted Visibility Engine (EVE) threat confidence score, indicating potentially malicious behavior within encrypted traffic. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Command and Control Encrypted Channel Asymmetric Cryptography Exfiltration Exfiltration Over C2 Channel Command and Control Ingress Tool Transfer	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	8c15183e-2e70-4db4-86c3-88f8d9129b66
Splunk	The following analytic detects outbound connections initiated by command-line tools such as curl or wget. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Execution Command and Scripting Interpreter Command and Control Ingress Tool Transfer Execution, Persistence, Privilege Escalation Scheduled Task/Job Cron	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	173a1cb9-1814-4128-a9dc-f29dade89957
	Detects DNS requests to Cloudflared tunnels domains. (...)	Generic	test	dns	windows	Sysmon	Command and Control Application Layer Protocol Web Protocols Command and Control Protocol Tunneling	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-12-20	—	a1d9eec5-33b2-4177-8d24-27fe754d0812
	Detects Turla ComRAT network communication.	Emerging	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems)	2020-05-26	2024-02-26	7857f021-007f-4928-8b2c-7aedbe64bb82
	Detects usage of crontab to list the tasks of the user	Generic	test	process_creation	linux	Sysmon	Discovery System Service Discovery	-	low	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-06-02	—	403ed92c-b7ec-4edd-9947-5b535ee12d46
	Detects suspicious user agent strings used by crypto miners in proxy logs	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems)	2019-10-21	2021-11-27	fa935401-513b-467b-81f4-f9e77aa0dd78
	Detects execution of curl.exe with custom useragent options	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Application Layer Protocol Web Protocols	-	medium	frack113	2022-01-23	2023-02-21	3286d37a-00fd-41c2-a624-a672dcd34e60
Splunk	The following analytic detects the execution of the `Invoke-AzureHound` command-line argument, commonly used by the AzureHound tool. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-05-13	26f02e96-c300-11eb-b611-acde48001122
Splunk	The following analytic detects the creation of specific AzureHound-related files, such as `*-azurecollection.zip` and various `.json` files, on disk. (...)	Generic	stable	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-05-13	1c34549e-c31b-11eb-996b-acde48001122
Splunk	The following analytic detects the execution of SharpHound command-line arguments, specifically `-collectionMethod` and `invoke-bloodhound`. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	a0bdd2f6-c2ff-11eb-b918-acde48001122
Splunk	The following analytic detects the creation of files typically associated with SharpHound, a reconnaissance tool used for gathering domain and trust data. (...)	Generic	stable	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	42b4b438-beed-11eb-ba1d-acde48001122
Splunk	The following analytic detects the usage of the SharpHound binary by identifying its original filename, `SharpHound.exe`, and the process name. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	dd04b29a-beed-11eb-87bc-acde48001122
	Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery	-	low	frack113	2022-08-20	2023-02-04	b4dc61f5-6cce-468e-a608-b48b469feaa2
	Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session.	Generic	experimental	dns	windows	Sysmon	Command and Control Application Layer Protocol Web Protocols Lateral Movement Exploitation of Remote Services	-	low	Muhammad Faisal (@faisalusuf)	2024-12-19	—	882e858a-3233-4ba8-855e-2f3d3575803d
	Detects DNS query requests to Devtunnels domains. (...)	Generic	test	dns	windows	Sysmon	Command and Control Application Layer Protocol Web Protocols Command and Control Protocol Tunneling	-	medium	citron_ninja	2023-10-25	2023-11-20	1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b
	Detects DNS query requests to Visual Studio Code tunnel domains. (...)	Generic	test	dns	windows	Sysmon	Command and Control Application Layer Protocol Web Protocols	-	medium	citron_ninja	2023-10-25	2023-11-20	b3e6418f-7c7a-4fad-993a-93b65027a9f1
	Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.	Generic	test	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Hypervisor CLI Discovery System Owner/User Discovery Discovery System Service Discovery	-	medium	Cedric Maurugeon	2023-09-04	—	33e814e0-1f00-4e43-9c34-31fb7ae2b174
	Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. (...)	Generic	test	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Hypervisor CLI Discovery System Owner/User Discovery Discovery System Service Discovery	-	medium	Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon	2023-09-04	—	f41dada5-3f56-4232-8503-3fb7f9cf2d60
	Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. (...)	Generic	test	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Hypervisor CLI Discovery System Owner/User Discovery Discovery System Service Discovery	-	medium	Cedric Maurugeon	2023-09-04	—	e80273e1-9faf-40bc-bd85-dbaff104c4e9
	Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.	Generic	test	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Hypervisor CLI Discovery System Owner/User Discovery Discovery System Service Discovery	-	medium	Cedric Maurugeon	2023-09-04	—	5f1573a7-363b-4114-9208-ad7a61de46eb
	Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. (...)	Generic	test	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Hypervisor CLI Discovery System Owner/User Discovery Discovery System Service Discovery	-	medium	Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon	2023-09-04	—	d54c2f06-aca9-4e2b-81c9-5317858f4b79
	Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy (...)	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems)	2017-07-08	2025-01-18	fdd1bfb5-f60b-4a35-910e-f36ed3d0b32f
	Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	informational	Daniil Yugoslavskiy, oscd.community, CheraghiMilad	2020-10-19	2024-12-01	d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72
	Detects usage of system utilities to discover files and directories	Generic	test	process_creation	macos	-	Discovery File and Directory Discovery	-	informational	Daniil Yugoslavskiy, oscd.community	2020-10-19	2022-11-25	089dbdf6-b960-4bcc-90e3-ffc3480c20f6
	Adversaries may look for details about the network configuration and settings of systems they access (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Network Configuration Discovery	-	low	frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'	2021-12-07	2025-10-18	0e4164da-94bc-450d-a7be-a4b176179f1f
Splunk	The following analytic detects the execution of `powershell.exe` with the `Get-LocalUser` commandlet, which is used to query local user accounts. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account	-	medium	Mauricio Velazco, Splunk	2021-08-24	2026-10-02	85fae8fa-0427-11ec-8b78-acde48001122
Splunk	The following analytic detects the execution of the `Get-LocalUser` PowerShell commandlet using PowerShell Script Block Logging (EventCode=4104). (...)	Hunting	stable	ps_script	windows	PowerShell	Discovery Account Discovery Local Account Execution Command and Scripting Interpreter PowerShell	-	medium	Mauricio Velazco, Splunk	2021-08-24	2026-05-13	2e891cbe-0426-11ec-9c9c-acde48001122
Splunk	The following analytic detects the execution of `powershell.exe` with command-line arguments that utilize the `Get-WmiObject` cmdlet and the `Win32_UserAccount` parameter to query local user accounts. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account	-	medium	Mauricio Velazco, Splunk	2021-08-24	2026-05-13	b44f6ac6-0429-11ec-87e9-acde48001122
Splunk	The following analytic detects the execution of the `Get-WmiObject` commandlet with the `Win32_UserAccount` parameter via PowerShell Script Block Logging (EventCode=4104). (...)	Hunting	stable	ps_script	windows	PowerShell	Discovery Account Discovery Local Account Execution Command and Scripting Interpreter PowerShell	-	medium	Mauricio Velazco, Splunk	2021-08-24	2026-05-13	640b0eda-0429-11ec-accd-acde48001122
	Detects Baby Shark C2 Framework default communication patterns	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	critical	Florian Roth (Nextron Systems)	2021-06-09	2024-02-15	304810ed-8853-437f-9e36-c4975c3dfd7e
	Detects command line parameters used by Bloodhound and Sharphound hack tools	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	Florian Roth (Nextron Systems)	2019-12-20	2023-02-04	f376c8a7-a2d0-4ddc-aa0c-16c17236d962
	Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Markus Neis, Florian Roth (Nextron Systems)	2024-02-15	—	f3f21ce1-cdef-4bfc-8328-ed2e826f5fac
	Detects user agent and URI paths used by empire agents	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems)	2020-07-13	2024-02-26	b923f7d6-ac89-4a50-a71a-89fb846b4aa8