malware
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
23rd percentile · 77% of 825 ATT&CK software entries have more Enterprise techniques.
32nd percentile · 68% of 825 ATT&CK software entries have more tactics spanned.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
47th percentile · 53% of 825 ATT&CK software entries have more detection rules per technique.
139 distinct rules cover the 5 techniques recorded for this malware. 105 Sigma · 34 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects file access requests to browser credential stores by uncommon processes. (...) | Hunting | test | file_access | windows | - | - | low | frack113, X__Junior (Nextron Systems) | 2022-04-09 | 2024-07-29 | 91cb43db-302a-47e3-b3c8-7ede481e27bf | ||||
Detects file access requests to chromium based browser sensitive files by uncommon processes. (...) | Hunting | test | file_access | windows | - | - | low | X__Junior (Nextron Systems) | 2024-07-29 | — | c5f37810-a85f-4186-81e9-33f23abb4141 | ||||
Detects file access requests to crypto currency files by uncommon processes. (...) | Generic | test | file_access | windows | - | - | medium | X__Junior (Nextron Systems) | 2024-07-29 | — | f41b0311-44f9-44f0-816d-dd45e39d4bc8 | ||||
Detects a highly relevant Antivirus alert that reports password dumpers and stealers. (...) | Generic | stable | antivirus | - | - | - | critical | Florian Roth (Nextron Systems), Arnim Rupp | 2018-09-09 | 2026-06-15 | 78cc2dd2-7d20-4d32-93ff-057084c38b93 | ||||
Detects suspicious user agent strings used in APT malware in proxy logs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Markus Neis | 2019-11-12 | 2024-02-15 | 6ec820f2-e963-4801-9127-d8b2dce4d31b | ||||
Detects suspicious user agent string of APT40 Dropbox tool | Emerging | test | proxy | - | - | - | high | Thomas Patzke | 2019-11-12 | 2023-05-18 | 5ba715b6-71b7-44fd-8245-f66893e81b3d | ||||
Splunk | The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike · Cisco NVM · Cisco | - | medium | Bhavin Patel, Splunk, sventec, Github Community | 2021-07-12 | 2026-09-22 | a51bfe1a-94f0-48cc-b4e4-16a110145893 | - | ||
Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...) | Emerging | experimental | dns | - | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 73e5d24f-493f-4092-bd2f-c72cabda40ee | ||||
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2020-01-29 | 2023-01-26 | e32d4572-9826-4738-b651-95fa63747e8a | ||||
Detects Bitsadmin connections to IP addresses instead of FQDN names | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2022-06-10 | 2022-08-24 | 8ccd35a2-1c7c-468b-b568-ac6cdf80eec3 | ||||
Detects Bitsadmin connections to domains with uncommon TLDs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Tim Shelton | 2019-03-07 | 2026-09-30 | 9eb68894-7476-4cd6-8752-23b51f5883a7 | ||||
Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Julia Fomina, oscd.community | 2020-10-09 | 2025-10-31 | 93671f99-04eb-4ab4-a161-70d446a84003 | ||||
Splunk | The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Splunk | 2021-03-25 | 2026-10-02 | bfe94226-8c10-11eb-a4b3-acde48001122 | |||
Detects HTTP request used by Chafer malware to receive data from its C2. | Emerging | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2019-01-31 | 2024-02-15 | fb502828-2db0-438e-93e6-801c7548686d | ||||
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. (...) | Generic | test | ps_script | windows | PowerShell | - | medium | frack113 | 2022-01-23 | 2025-07-18 | d4488827-73af-4f8d-9244-7b7662ef046e | ||||
Splunk | This analytic detects the usage of the Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes (600 seconds). (...) | Anomaly | stable | network_connection | - | Cisco NVM · Cisco | - | medium | Radka Viskova, Splunk | 2026-09-18 | 2026-09-22 | 6bc88a9d-f7de-4257-b526-acf15bc5a517 | |||
Splunk | The following analytic detects the use of known suspicious SSL certificates in any observed event where the SSL_CertFingerprint field is present. (...) | Generic | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-09-22 | c43f7b49-2dab-4e76-892e-7f971c2f20f1 | |||
Splunk | The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | f7e5e792-d907-46c1-a58e-4ff974dc462a | |||
Splunk | The following analytic detects connections with a high Encrypted Visibility Engine (EVE) threat confidence score, indicating potentially malicious behavior within encrypted traffic. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 8c15183e-2e70-4db4-86c3-88f8d9129b66 | |||
Splunk | This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs. (...) | Generic | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-16 | 2026-05-13 | ec99bb81-c31b-4837-8c7d-1b32aa70b337 | |||
Splunk | This analytic detects activity associated with "Static Tundra" threat actor abuse of the Cisco Smart (...) | Generic | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Bhavin Patel, Michael Haag, Splunk | 2025-04-16 | 2026-05-13 | 7e9a5a2c-2f1a-4b6a-9a4b-9e7d9c8f5a21 | |||
Splunk | The following analytic detects outbound connections initiated by command-line tools such as curl or wget. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 173a1cb9-1814-4128-a9dc-f29dade89957 | |||
Detects DNS requests to Cloudflared tunnels domains. (...) | Generic | test | dns | windows | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-12-20 | — | a1d9eec5-33b2-4177-8d24-27fe754d0812 | ||||
Detects Turla ComRAT network communication. | Emerging | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2020-05-26 | 2024-02-26 | 7857f021-007f-4928-8b2c-7aedbe64bb82 | ||||
Detects suspicious processes based on name and location that access the windows credential manager and vault. (...) | Generic | test | file_access | windows | - | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2022-10-11 | 2026-07-28 | 407aecb1-e762-4acf-8c7b-d087bcff3bb6 | ||||
Detects suspicious user agent strings used by crypto miners in proxy logs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2019-10-21 | 2021-11-27 | fa935401-513b-467b-81f4-f9e77aa0dd78 | ||||
Detects execution of curl.exe with custom useragent options | Hunting | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-01-23 | 2023-02-21 | 3286d37a-00fd-41c2-a624-a672dcd34e60 | ||||
Detects exploitation attempt of CVE-2024-49113 known as LDAP Nightmare, based on "Application Error" log where the faulting application is "lsass.exe" and the faulting module is "WLDAP32.dll". | Emerging | experimental | - | windows | WinEventLog Application | high | Samuel Monsempes | 2025-01-08 | — | 3f2c93c7-7b2a-4d58-bb8d-6f39422d8148 | |||||
Splunk | The following analytic detects the execution of Mimikatz commands via PowerShell by leveraging PowerShell Script Block Logging (EventCode=4104). (...) | Generic | stable | ps_script | windows | PowerShell | - | medium | Michael Haag, Splunk | 2021-06-09 | 2026-05-13 | 8148c29c-c952-11eb-9255-acde48001122 | |||
Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session. | Generic | experimental | dns | windows | Sysmon | - | low | Muhammad Faisal (@faisalusuf) | 2024-12-19 | — | 882e858a-3233-4ba8-855e-2f3d3575803d | ||||
Detects DNS query requests to Devtunnels domains. (...) | Generic | test | dns | windows | Sysmon | - | medium | citron_ninja | 2023-10-25 | 2023-11-20 | 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b | ||||
Detects DNS query requests to Visual Studio Code tunnel domains. (...) | Generic | test | dns | windows | Sysmon | - | medium | citron_ninja | 2023-10-25 | 2023-11-20 | b3e6418f-7c7a-4fad-993a-93b65027a9f1 | ||||
Detects when a user enables DNS-over-HTTPS. (...) | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | Austin Songer | 2021-07-22 | 2023-08-17 | 04b45a8a-d11d-49e4-9acc-4a1b524407a5 | ||||
ntds.dit retrieving using synchronisation with legitimate domain controller using Directory Replicat (...) | Unsupported | unsupported | authentication | windows | WinEventLog Security | - | medium | Teymur Kheirkhabarov, oscd.community | 2019-10-24 | 2019-11-13 | 51238c62-2b29-4539-ad75-e94575368a12 | ||||
ntds.dit retrieving (only computer accounts) using synchronisation with legit domain controller usin (...) | Unsupported | unsupported | authentication | windows | WinEventLog Security | - | medium | Teymur Kheirkhabarov, oscd.community | 2019-11-01 | — | 757b2a11-73e7-411a-bd46-141d906e0167 | ||||
Splunk | The following analytic detects a suspicious registry modification that enables the plain text credential feature in Windows by setting the "UseLogonCredential" value to 1 in the WDigest registry path. (...) | Generic | stable | registry_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk, Steven Dick | 2021-10-05 | 2026-10-09 | 0c7d8ffe-25b1-11ec-9f39-acde48001122 | |||
Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | sam0x90 | 2021-08-06 | 2022-10-09 | 7df1713a-1a5b-4a4b-a071-dc83b144a101 | ||||
Splunk | The following analytic detects when all virtual machines on an ESXi host are abruptly terminated, which may indicate malicious activity such as a deliberate denial-of-service, ransomware staging, or an attempt to destroy critical workloads. | Generic | stable | - | esxi | VMware ESXi · VMware | - | medium | Raven Tait, Splunk | 2025-07-11 | 2026-09-08 | cfe094b4-0737-4a33-9d63-e0562ce2b883 | |||
Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy (...) | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2017-07-08 | 2025-01-18 | fdd1bfb5-f60b-4a35-910e-f36ed3d0b32f | ||||
Detects access to Signal Desktop's sensitive data files: db.sqlite and config.json. (...) | Generic | experimental | file_event | windows | WinEventLog Security | - | medium | Andreas Braathen (mnemonic.io) | 2025-10-19 | — | 5d6c375a-18ae-4952-b4f6-8b803f6c8555 | ||||
Detects Baby Shark C2 Framework default communication patterns | Generic | test | proxy | - | - | - | critical | Florian Roth (Nextron Systems) | 2021-06-09 | 2024-02-15 | 304810ed-8853-437f-9e36-c4975c3dfd7e | ||||
Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods). | Generic | test | proxy | - | - | - | high | Markus Neis, Florian Roth (Nextron Systems) | 2024-02-15 | — | f3f21ce1-cdef-4bfc-8328-ed2e826f5fac | ||||
Detects user agent and URI paths used by empire agents | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2020-07-13 | 2024-02-26 | b923f7d6-ac89-4a50-a71a-89fb846b4aa8 | ||||
Detects default filenames output from the execution of CrackMapExec and Impacket-secretsdump against an endpoint. | Generic | test | file_event | windows | Sysmon | - | high | SecurityAura | 2022-11-16 | 2024-06-27 | 6e2a900a-ced9-4e4a-a9c2-13e706f9518a | ||||
Detects the execution of the hacktool Rubeus via PE information of command line parameters | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security | - | critical | Florian Roth (Nextron Systems) | 2018-12-19 | 2023-04-20 | 7ec2c172-dceb-4c10-92c9-87c1881b7e18 | ||||
Detects the execution of the hacktool Rubeus using specific command line flags | Generic | test | ps_script | windows | PowerShell | - | high | Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems) | 2023-04-27 | — | 3245cd30-e015-40ff-a31d-5cadd5f377ec | ||||
Detects the execution of different Windows based hacktools via their import hash (imphash) even if t (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | critical | Florian Roth (Nextron Systems) | 2022-03-04 | 2024-11-23 | 24e3e58a-646b-4b50-adef-02ef935b9fc8 | ||||
Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2022-04-27 | 2024-01-15 | 37c1333a-a0db-48be-b64b-7393b2386e3b | ||||
Splunk | This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of c2 frameworks. (...) | Generic | stable | webserver | - | Suricata | - | medium | Ravent Tait, Splunk | 2026-01-06 | 2026-09-22 | 229dc225-6abe-4d28-89fd-edf874086162 | |||
Splunk | Detects when a request has more than one of the same header. (...) | Anomaly | stable | network_connection | - | Suricata | - | medium | Raven Tait, Splunk | 2025-10-21 | 2026-05-13 | 1606cc5b-fd5f-4865-9fe3-0ed1eaec2df6 |
16th percentile · 84% of 825 ATT&CK software entries have more atomic tests per technique.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
91st percentile · 91% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 5 Enterprise techniques.
Technique Campaign use over its cumulative rule count.