malware

SeaDuke S0053

Type: malware
Platform: Windows
Created: 31 May 2017
Last modified: 25 April 2025

SeaDuke is malware that was used by APT29 from 2014 to 2015. It was used primarily as a secondary backdoor for victims that were already compromised with CozyCar. [1]

Techniques66th pct

TacticsTop 20%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0053

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects accounts that are created or deleted by non-approved users.	Placeholder	test	cloud_audit	-	Azure Audit Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1'	2022-08-11	2023-12-15	c98184ba-4a27-4e10-b7b7-da48e71f4d25
	Detects when an account was created and deleted in a short period of time.	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	high	Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton	2022-08-11	2022-08-18	6f583da0-3a90-4566-a4ed-83c09fe18bbf
	This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.	Generic	test	authentication	windows	WinEventLog Security	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Florian Roth (Nextron Systems)	2017-02-19	2025-10-17	9eb99343-d336-4020-a3cd-67f3819e68ee
	Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.	Generic	test	-	-	Azure Risk Detection · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	high	Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'	2023-09-03	—	be4d9c86-d702-4030-b52e-c7859110e5e8
	Detects the deletion of the "Zone.Identifier" ADS. (...)	Hunting	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	low	frack113	2023-09-04	—	7eac0a16-5832-4e81-865f-0268a6d19e4b
	Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...)	Generic	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-09-04	2025-07-04	3109530e-ab47-4cc6-a953-cac5ebcc93ae
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g	2019-08-11	2025-10-17	64e8e417-c19a-475a-8d19-98ea705394cc
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	pipe_created	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g, Tim Shelton	2019-09-12	2025-10-07	58cb02d5-78ce-4692-b3e1-dce850aae41a
	Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. (...)	Generic	test	authentication	-	Azure Sign-in Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'	2022-06-01	—	248649b7-d64f-46f0-9fb2-a52774166fb5
	Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. (...)	Generic	test	authentication	-	Azure Sign-in Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'	2022-06-01	—	55695bc0-c8cf-461f-a379-2535f563c854
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	Detects DNS queries made by "AppInstaller.EXE". (...)	Generic	test	dns	windows	Sysmon	Command and Control Ingress Tool Transfer	-	medium	frack113	2021-11-24	2023-11-09	7cff77e1-9663-46a3-8260-17f2e1aa9d0a
	Detects suspicious user agent strings used in APT malware in proxy logs	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems), Markus Neis	2019-11-12	2024-02-15	6ec820f2-e963-4801-9127-d8b2dce4d31b
	Detects suspicious user agent string of APT40 Dropbox tool	Emerging	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage	-	high	Thomas Patzke	2019-11-12	2023-05-18	5ba715b6-71b7-44fd-8245-f66893e81b3d
	Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer	-	medium	Victor Sergeev, oscd.community	2020-10-09	2023-10-18	eee00933-a761-4cd0-be70-c42fe91731e7
Splunk	The following analytic detects updates to the SAML provider in AWS. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Patrick Bareiss, Splunk	2022-10-04	2026-05-13	635c26cc-0fd1-4098-8ec9-824bf9544b11
	Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.	Generic	test	-	-	Azure Risk Detection · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	high	Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'	2023-09-03	—	1a41023f-1e70-4026-921a-4d9341a9038e
	Detect when authentications to important application(s) only required single-factor authentication	Placeholder	test	authentication	-	Azure Sign-in Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	MikeDuddington, '@dudders1'	2022-07-28	2026-05-08	f272fb46-25f2-422c-b667-45837994980f
Splunk	The following analytic identifies access denied error when attempting to invoke AWS Bedrock models. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Lateral Movement Use Alternate Authentication Material Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Bhavin Patel, Splunk	2025-03-25	2026-05-13	c53a8e62-f741-11ee-9f6e-acde48001122
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
	Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Ivan Saakov	2024-12-19	—	92f84194-8d9a-4ee0-8699-c30bfac59780
	Detects when an user creates or invokes a lambda function.	Unsupported	unsupported	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	low	Austin Songer @austinsonger	2021-10-03	2023-03-24	d914951b-52c8-485f-875e-86abab710c0b
Splunk	The following analytic detects updates to the SAML provider in AWS. (...)	Generic	stable	account_management	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Rod Soto, Splunk	2021-01-26	2026-05-13	2f0604c6-6030-11eb-ae93-0242ac130002
	Identifies when suspicious SAML activity has occurred in AWS. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Privilege Escalation Abuse Elevation Control Mechanism Lateral Movement Use Alternate Authentication Material Application Access Token Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Austin Songer	2021-09-22	2022-12-18	f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e
	Detects file creation events linked to the Axios NPM supply chain compromise. (...)	Emerging	experimental	file_event	linux	Sysmon	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	b7cb840c-11f6-47f7-b3ef-5524739c9077
	Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...)	Emerging	experimental	file_event	macos	-	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	2db0458c-05c9-4069-a26f-77becd9c8c13
	Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...)	Emerging	experimental	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Unix Shell Python Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	0a23a62d-c5b3-468b-a072-25064a9a8c87
	Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.	Emerging	experimental	process_creation	macos	-	Execution Command and Scripting Interpreter AppleScript Unix Shell Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	a09ee860-31b3-4586-8a68-0ebd74ce0e5f
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
	Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...)	Emerging	experimental	dns	-	-	Command and Control Application Layer Protocol Web Protocols Command and Control Dynamic Resolution	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	73e5d24f-493f-4092-bd2f-c72cabda40ee
Splunk	The following analytic detects unusual authentication activity in Azure AD, specifically when a single user account has over 8 authentication attempts using 3+ unique application IDs and 5+ unique user agents within a short period. (...)	Anomaly	stable	authentication	-	Microsoft 365	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Mauricio Velazco, Splunk	2023-11-16	2026-05-13	5d8bb1f0-f65a-4b4e-af2e-fcdb88276314
	Indicates user activity that is unusual for the user or consistent with known attack patterns.	Generic	test	-	-	Azure Risk Detection · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	high	Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'	2023-09-07	—	a2cb56ff-4f46-437a-a0fa-ffa4d1303cba
	Identifies when an user or application modified the federation settings on the domain.	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Austin Songer	2021-09-06	2022-06-08	352a54e1-74ba-4929-9d47-8193d67aba1e
	Identifies when an admission controller is executed in Azure Kubernetes. (...)	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Credential Access Unsecured Credentials Container API Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Austin Songer @austinsonger	2021-11-25	2022-12-18	a61a3c56-4ce2-4351-a079-88ae4cbd2b58
	Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.	Generic	experimental	-	-	Audit · Microsoft 365	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	high	Josh Nickels, Marius Rothenbücher	2025-01-08	—	13f2d3f5-6497-44a7-bf5f-dc13ffafe5dc
	Detects when a user has been elevated to manage all Azure Subscriptions. (...)	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	high	Austin Songer @austinsonger	2021-11-26	2026-09-26	ca9bf243-465e-494a-9e54-bf9fc239057d
	Detects when there is a interruption in the authentication process.	Generic	test	authentication	-	Azure Sign-in Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Austin Songer @austinsonger	2021-11-26	2022-12-18	8366030e-7216-476b-9927-271d79f13cf3
	Detects backup catalog deletions	Generic	test	-	windows	WinEventLog Application	Stealth Indicator Removal File Deletion	-	medium	Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection)	2017-05-12	2022-12-25	9703792d-fd9a-456d-a672-ff92efe4806a
	focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cob (...)	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	critical	ok @securonix invrep_de, oscd.community	2020-10-09	2022-12-25	8d31a8ce-46b5-4dd6-bdc3-680931f1db86
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
Splunk	The following analytic detects the use of `bitsadmin.exe` with the `transfer` parameter to download a remote object. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution, Persistence, Stealth BITS Jobs Command and Control Ingress Tool Transfer	-	medium	Michael Haag, Sittikorn S	2021-03-30	2026-10-02	80630ff4-8e4c-11eb-aab5-acde48001122
	Detects Bitsadmin connections to IP addresses instead of FQDN names	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Execution, Persistence, Stealth BITS Jobs	-	high	Florian Roth (Nextron Systems)	2022-06-10	2022-08-24	8ccd35a2-1c7c-468b-b568-ac6cdf80eec3
	Detects Bitsadmin connections to domains with uncommon TLDs	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Execution, Persistence, Stealth BITS Jobs	-	high	Florian Roth (Nextron Systems), Tim Shelton	2019-03-07	2026-09-30	9eb68894-7476-4cd6-8752-23b51f5883a7
	Detects default file names outputted by the BloodHound collection tool SharpHound	Generic	test	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	C.J. May	2022-08-09	2026-02-19	02773bed-83bf-469f-b7ff-e676e7d78bab
	Detects execution of Chromium based browser in headless mode	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts Hidden Window Command and Control Ingress Tool Transfer	-	low	Nasreddine Bencherchali (Nextron Systems)	2023-09-12	—	ef9dcfed-690c-4c5d-a9d1-482cd422225c
	Detects powershell execution with that make use of to the bxor (Bitwise XOR). (...)	Hunting	test	ps_classic_start	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	low	Teymur Kheirkhabarov, Harish Segar	2020-06-29	2024-12-11	812837bb-b17f-45e9-8bd0-0ec35d2e3bd6
	Detects calls to cmdlets that are used to export certificates from the local certificate store. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Credential Access Unsecured Credentials Private Keys	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-05-18	—	9e716b33-63b2-46da-86a4-bd3c3b9b5dfb
	Detects HTTP request used by Chafer malware to receive data from its C2.	Emerging	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems)	2019-01-31	2024-02-15	fb502828-2db0-438e-93e6-801c7548686d
	Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell	-	medium	frack113	2021-11-01	2025-10-07	87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180

Title

Description

SeaDuke S0053

SeaDuke MITRE reference S0053

Standing S0053

Reach

Coverage

SeaDuke detections S0053