malware
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.4
SslMM creates a new thread implementing a keylogging facility using Windows Keyboard Accelerators.5
SslMM sends information to its hard-coded C2, including OS version, service pack information, processor speed, system name, and OS install date.6
SslMM contains a feature to manipulate process privileges and tokens.7
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
44th percentile · 56% of 825 ATT&CK software entries have more Enterprise techniques.
80th percentile · 80% of 825 ATT&CK software entries have this many tactics spanned or fewer.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
78th percentile · 78% of 825 ATT&CK software entries have this many detection rules per technique or fewer.
478 distinct rules cover the 9 techniques recorded for this malware. 306 Sigma · 172 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Splunk | The following analytic detects the use of commands to add or set exclusions
in Windows Defender. It (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Nasreddine Bencherchali, Splunk | 2021-11-25 | 2026-06-08 | 773b66fe-4dd9-11ec-8289-acde48001122 | |||
Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nasreddine Bencherchali (Nextron Systems) | 2022-09-02 | 2024-03-19 | d7662ff6-9e97-4596-a61d-9839e32dee8d | ||||
Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts | Generic | test | ps_script | windows | PowerShell | - | high | Florian Roth (Nextron Systems) | 2022-11-09 | — | e0d6c087-2d1c-47fd-8799-3904103c5a98 | ||||
Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. (...) | Generic | experimental | registry_set | windows | Sysmon · WinEventLog Security | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2025-12-25 | — | aa37cbb0-da36-42cb-a90f-fdf216fc7467 | ||||
Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive". | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | @kostastsale, Nasreddine Bencherchali (Nextron Systems) | 2023-11-05 | 2024-08-16 | 31e124fb-5dc4-42a0-83b3-44a69c77b271 | ||||
Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:
- Use (...) | Generic | experimental | process_creation | linux | Linux Auditd | - | high | Milad Cheraghi | 2025-05-26 | 2025-12-05 | e497a24e-9345-4a62-9803-b06d7d7cb132 | ||||
Splunk | The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike · Cisco NVM · Cisco | - | medium | Bhavin Patel, Splunk, sventec, Github Community | 2021-07-12 | 2026-09-22 | a51bfe1a-94f0-48cc-b4e4-16a110145893 | - | ||
Detect changes in auditd configuration files | Generic | test | file_event | linux | Linux Auditd | - | high | Mikhail Larin, oscd.community | 2019-10-25 | 2021-11-27 | 977ef627-4539-4875-adf4-ed8f780c4922 | ||||
Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove
model safety (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Marco Pedrinazzi (@pedrinazziM) (InTheCyber) | 2026-07-10 | — | 59b70e4d-dd17-44a9-b740-acf07ae3eb6a | ||||
Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken
model safety c (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Marco Pedrinazzi (@pedrinazziM) (InTheCyber) | 2026-07-10 | — | 1c722651-254a-4b04-a9f4-99b62a2d0a1f | ||||
Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | high | suktech24 | 2025-11-27 | — | d2656e78-c069-4571-8220-9e0ab5913f19 | ||||
Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs. | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | high | faloker | 2020-02-11 | 2022-10-09 | 6e61ee20-ce00-4f8d-8aee-bedd8216f7e3 | ||||
Detects evade to Macie detection. | Unsupported | unsupported | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Sittikorn S | 2021-07-06 | 2023-03-24 | 91f6a16c-ef71-437a-99ac-0b070e3ad221 | ||||
Detects the modification of the findings on SecurityHub. | Generic | stable | cloud_audit | - | AWS CloudTrail · AWS | - | high | Sittikorn S | 2021-06-28 | — | a607e1fe-74bf-4440-a3ec-b059b9103157 | ||||
Splunk | The following analytic detects when the risk-based step-up consent security setting in Azure AD is disabled. (...) | Generic | stable | account_management | - | Microsoft 365 | - | medium | Mauricio Velazco, Splunk | 2023-11-16 | 2026-05-13 | 875de3d7-09bc-4916-8c0a-0929f4ced3d8 | |||
Detects when Events are deleted in Azure Kubernetes. (...) | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-07-24 | 2022-08-23 | 225d8b09-e714-479c-a0e4-55e6f29adf35 | ||||
Detects changes to the bitbucket audit log configuration. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | medium | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | 6aa12161-235a-4dfb-9c74-fe08df8d8da1 | ||||
Detects Bitbucket global secret scanning rule deletion activity. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | medium | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | e16cf0f0-ee88-4901-bd0b-4c8d13d9ee05 | ||||
Detects Bitbucket global SSH access configuration changes. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | medium | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | 16ab6143-510a-44e2-a615-bdb80b8317fc | ||||
Detects when a secret scanning allowlist rule is added for projects. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | low | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | 42ccce6d-7bd3-4930-95cd-e4d83fa94a30 | ||||
Detects when a repository is exempted from secret scanning feature. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | high | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | b91e8d5e-0033-44fe-973f-b730316f23a1 | ||||
Detects when secret scanning rule is deleted for the project or repository. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | low | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | ff91e3f0-ad15-459f-9a85-1556390c138d | ||||
Detects user data export activity. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | medium | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | 5259cbf2-0a75-48bf-b57a-c54d6fabaef3 | ||||
Detects user permission data export attempt. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | medium | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | 87cc6698-3e07-4ba2-9b43-a85a73e151e2 | ||||
Splunk | The following analytic identifies the execution of the "whoami" command with the "/group" flag, where the results are passed to the "find" command in order to look for a the string "12288". (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Splunk | 2021-09-14 | 2026-05-13 | a9079b18-1633-11ec-859c-acde48001122 | - | ||
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | high | Florian Roth (Nextron Systems), MSTI (query) | 2022-10-01 | — | fa3c117a-bc0d-416e-a31b-0c0e80653efb | |||||
Splunk | Adversaries may intentionally suppress or reduce the volume of core Cisco ASA syslog messages to evade detection or cover their tracks. (...) | Hunting | stable | firewall | - | Cisco Secure Firewall · Cisco | medium | Bhavin Patel, Micheal Haag, Splunk | 2025-09-25 | 2026-05-13 | 4b4f8fdd-1f9e-45d8-9b0f-1f64c0b297a4 | ||||
Splunk | This analytic detects the disabling of logging functionality on a Cisco ASA device
through CLI comma (...) | Generic | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Bhavin Patel, Micheal Haag, Nasreddine Bencherchali, Splunk | 2025-09-25 | 2026-05-13 | 7b4c9f3e-5a88-4b7b-9c4b-94d8e5d67201 | |||
Splunk | This analytic detects tampering with logging filter configurations on Cisco ASA devices via CLI or ASDM. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-11-21 | 2026-05-13 | b87b48a8-6d1a-4280-9cf1-16a950dbf901 | |||
Splunk | This analytic detects potential reconnaissance activities on Cisco ASA devices by identifying execution of multiple information-gathering "show" commands within a short timeframe. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-11-21 | 2026-05-13 | 6e9d4f7a-3c8b-4a9e-8d2f-7b5c9e1a6f3d | |||
Splunk | This analytic provides comprehensive monitoring of configuration changes on Cisco devices by analyzing archive logs. (...) | Hunting | stable | configuration_change | - | Cisco IOS · Cisco | medium | Bhavin Patel, Michael Haag, Splunk | 2025-08-21 | 2026-05-13 | f52d5c0b-d45d-4304-b300-a4f6a1130dec | ||||
Turn off logging locally or remote | Generic | test | authentication | - | Cisco AAA · Cisco | - | high | Austin Clark | 2019-08-11 | 2023-01-04 | 9e8f6035-88bf-4a63-96b6-b17c0508257e | ||||
Find information about network devices that is not stored in config files | Generic | test | authentication | - | Cisco AAA · Cisco | - | low | Austin Clark | 2019-08-12 | 2023-01-04 | 9705a6a1-6db6-4a16-a987-15b7151e299b | ||||
Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface. (...) | Generic | experimental | authentication | - | Cisco AAA · Cisco | - | medium | Luc Génaux | 2026-04-28 | — | ef0ff092-a24a-4fbc-beea-06c08d53e085 | ||||
Splunk | This analytic detects Cisco IOS-XE command sequences where show logging, clear logging, and exit occur within a short period. (...) | Anomaly | stable | network_device | - | Cisco IOS · Cisco | - | medium | Nasreddine Bencherchali | 2026-05-19 | 2026-05-20 | e20a6709-5f2c-4508-83fb-b3af6f705717 | |||
Splunk | This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...) | Anomaly | stable | network_device | - | Cisco IOS · Cisco | - | medium | Nasreddine Bencherchali | 2026-05-19 | 2026-05-20 | 71ac5328-2364-40cf-8381-92b8dc531399 | |||
Splunk | This analytic detects rapid modification of Cisco IOS-XE VTY access-class settings. (...) | Anomaly | stable | network_device | - | Cisco IOS · Cisco | - | medium | Nasreddine Bencherchali | 2026-05-19 | 2026-05-20 | a01ca274-16cb-476d-a814-d2ffe29d8905 | |||
Splunk | This analytic detects changes to SNMP community strings on Cisco devices, which could indicate an attacker establishing persistence or attempting to extract credentials. (...) | Anomaly | stable | configuration_change | - | Cisco IOS · Cisco | medium | Bhavin Patel, Michael Haag, Splunk | 2025-08-21 | 2026-05-13 | b0ce5521-2533-4f24-b8d5-c2ff977aae08 | ||||
Detects modification of Windows Registry Classes keys used for persistence. (...) | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) | 2019-10-25 | 2025-10-22 | 9df5f547-c86a-433e-b533-f2794357e242 | ||||
Detects the use of the redirection character ">" to redirect information on the command line. (...) | Hunting | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | frack113 | 2022-01-22 | 2024-03-19 | 4f4eaa9f-5ad4-410c-a4be-bc6132b0175a | ||||
Detects modification of autostart extensibility point (ASEP) in registry. | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name) | 2019-10-25 | 2025-10-22 | f59c3faf-50f3-464b-9f4c-1b67ab512d99 | ||||
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2022-11-10 | 2022-11-17 | 435e10e4-992a-4281-96f3-38b11106adde | ||||
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file | Generic | test | ps_script | windows | PowerShell | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2022-11-17 | — | db885529-903f-4c5d-9864-28fe199e6370 | ||||
Detects potential container discovery via listing of certain kernel features in the "/proc" virtual (...) | Generic | test | process_creation | linux | Sysmon | - | low | Seth Hanford | 2023-08-23 | — | 746c86fb-ccda-4816-8997-01386263acc4 | ||||
Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. (...) | Generic | test | file_event | windows | Sysmon | - | high | frack113 | 2021-12-30 | — | 8c3c76ca-8f8b-4b1d-aaf3-81aebcd367c9 | ||||
Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. (...) | Generic | test | - | - | Kubernetes Audit · Kubernetes | - | medium | Leo Tsaousis (@laripping) | 2024-03-26 | — | a80d927d-ac6e-443f-a867-e8d6e3897318 | ||||
Detects modification of autostart extensibility point (ASEP) in registry. | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) | 2019-10-25 | 2023-08-17 | f674e36a-4b91-431e-8aef-f8a96c2aca35 | ||||
Detects modification of autostart extensibility point (ASEP) in registry. | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) | 2019-10-25 | 2025-10-22 | 20f0ee37-5942-4e45-b7d5-c5b5db9df5cd | ||||
Detects modification of autostart extensibility point (ASEP) in registry. | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) | 2019-10-25 | 2025-10-22 | cbf93e5d-ca6c-4722-8bea-e9119007c248 | ||||
Detects unusual processes accessing desktop.ini, which can be leveraged to alter how Explorer displays a folder's content (i.e. (...) | Generic | test | file_event | windows | Sysmon | - | medium | Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO) | 2020-03-19 | 2025-12-09 | 81315b50-6b60-4d8f-9928-3466e1022515 |
72nd percentile · 72% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
57th percentile · 57% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 9 Enterprise techniques.
Technique Campaign use over its cumulative rule count.