malware

SHOTPUT S0063

Type: malware
Platform: Windows
Created: 31 May 2017
Last modified: 25 April 2025

SHOTPUT is a custom backdoor used by APT3. [1]

Techniques29th pct

TacticsBottom 12%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

SHOTPUT MITRE reference S0063

Remote System Discovery T1018 ↗

SHOTPUT has a command to list all servers in the domain, as well as one to locate domain controllers on a domain.2

Discovery39 detection rules

Obfuscated Files or Information T1027 ↗

SHOTPUT is obscured using XOR encoding and appended to a valid GIF file.3 4

Stealth117 detection rules

System Network Connections Discovery T1049 ↗

SHOTPUT uses netstat to list TCP connection status.5

Discovery17 detection rules

Process Discovery T1057 ↗

SHOTPUT has a command to obtain a process listing.6

Discovery10 detection rules

File and Directory Discovery T1083 ↗

SHOTPUT has a command to obtain a directory listing.7

Discovery29 detection rules

Local Account T1087.001 ↗

SHOTPUT has a command to retrieve information about connected users.8

Discovery27 detection rules

Standing S0063

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques629th pct

29th percentile · 71% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics2Bottom 12%

12th percentile · 88% of 825 ATT&CK software entries have more tactics spanned.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique28med68th pct

68th percentile · 68% of 825 ATT&CK software entries have this many detection rules per technique or fewer.

Tests / technique10.5medTop 8%

92nd percentile · 92% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.

Data comps / technique4med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique0medBottom 17%

17th percentile · 83% of 825 ATT&CK software entries have more mitigations per technique.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 6 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 173Splunk ESCU (cumulative) · 60

Standing S0063

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.	Generic	test	ps_script	windows	PowerShell	Discovery Account Discovery Domain Account Discovery Remote System Discovery	-	low	frack113	2022-03-17	2023-07-08	36bed6b2-e9a0-4fff-beeb-413a92b86138
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
	Detects default file names outputted by the BloodHound collection tool SharpHound	Generic	test	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	C.J. May	2022-08-09	2026-02-19	02773bed-83bf-469f-b7ff-e676e7d78bab
	Detects usage of "getcap" binary. (...)	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	low	Nasreddine Bencherchali (Nextron Systems)	2022-12-28	2026-01-24	d8d97d51-122d-4cdd-9e2f-01b4b4933530
	Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)	2023-02-15	2024-03-05	3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5
	Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery Remote System Discovery Persistence Server Software Component Web Shell Discovery System Owner/User Discovery	CVE-2022-41040 CVE-2022-41082	high	Florian Roth (Nextron Systems), MSTI (query)	2022-10-01	—	fa3c117a-bc0d-416e-a31b-0c0e80653efb
	Collect pertinent data from the configuration files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery Account Discovery Local Account Collection Data from Local System Credential Access Unsecured Credentials Credentials In Files	-	low	Austin Clark	2019-08-11	2023-01-04	cd072b25-a418-4f98-8ebc-5093fb38fe1a
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects bursts of ping, SSH, and Telnet commands issued from Cisco IOS or NX-OS devices. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Discovery Network Service Discovery Lateral Movement Remote Services SSH Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	efb20922-17bc-4fb0-880c-be50cfc100dd
Splunk	The following analytic detects a blocked connection event by identifying a "Block" value in the action field. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	17e9b764-3a2b-4d36-9751-32d13ce4718b
Splunk	This analytic detects Lumma Stealer activity using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services Stealth Obfuscated Files or Information Execution User Execution	-	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	96bce783-c22e-4e48-8cf1-3eb2794c5083
Splunk	The following analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	1f57f10e-1dc5-47ea-852c-2e85b2503d79
Splunk	The following analytic detects repeated malware file downloads initiated by the same internal host (src) within a short time window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Ingress Tool Transfer Stealth Obfuscated Files or Information	-	medium	Nasreddine Bencherchali, Splunk	2025-04-09	2026-09-22	aeff2bb5-3483-48d4-9be8-c8976194be1e
Splunk	This analytic identifies Snort intrusion signatures that have been triggered by ten or more distinct internal IP addresses within a one-hour window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Ingress Tool Transfer Stealth Obfuscated Files or Information	-	medium	Nasreddine Bencherchali, Splunk	2025-04-16	2026-05-13	a4c76d0a-56b6-44be-814b-939746c4d406
	Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton	2020-10-11	2023-02-01	74403157-20f5-415d-89a7-c505779585cf
Splunk	The following analytic detects the execution of the curl utility where the command line includes percent-encoded characters and explicit file output options (such as -o or --output). (...)	Anomaly	stable	process_creation	windows · linux	CrowdStrike · Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer Stealth Obfuscated Files or Information	-	medium	Nasreddine Bencherchali, Splunk	2026-03-03	2026-05-13	9a8d5516-4c5e-11ef-9d42-acde48001122
	Detects usage of base64 utility to decode arbitrary base64-encoded text	Generic	test	process_creation	linux	Sysmon	Stealth Obfuscated Files or Information	-	low	Daniil Yugoslavskiy, oscd.community	2020-10-19	2021-11-27	e2072cab-8c9a-459b-b63c-40ae79e27031
	Detects usage of base64 utility to decode arbitrary base64-encoded text	Generic	test	process_creation	macos	-	Stealth Obfuscated Files or Information	-	low	Daniil Yugoslavskiy, oscd.community	2020-10-19	2022-11-26	719c22d7-c11a-4f2c-93a6-2cfdd5412f68
Splunk	The following analytic detects the execution of the `Invoke-AzureHound` command-line argument, commonly used by the AzureHound tool. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-05-13	26f02e96-c300-11eb-b611-acde48001122
Splunk	The following analytic detects the creation of specific AzureHound-related files, such as `*-azurecollection.zip` and various `.json` files, on disk. (...)	Generic	stable	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-05-13	1c34549e-c31b-11eb-996b-acde48001122
Splunk	The following analytic detects the execution of SharpHound command-line arguments, specifically `-collectionMethod` and `invoke-bloodhound`. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	a0bdd2f6-c2ff-11eb-b918-acde48001122
Splunk	The following analytic detects the creation of files typically associated with SharpHound, a reconnaissance tool used for gathering domain and trust data. (...)	Generic	stable	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	42b4b438-beed-11eb-ba1d-acde48001122
Splunk	The following analytic detects the usage of the SharpHound binary by identifying its original filename, `SharpHound.exe`, and the process name. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	dd04b29a-beed-11eb-87bc-acde48001122
	Enumerates Active Directory to determine computers that are joined to the domain	Generic	test	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	frack113	2022-02-12	—	1f6399cf-2c80-4924-ace1-6fcff3393480
	Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery	-	low	frack113	2022-08-20	2023-02-04	b4dc61f5-6cce-468e-a608-b48b469feaa2
Splunk	The following analytic detects the execution of `nltest.exe` with command-line arguments `/dclist:` or `/dsgetdc:` to discover domain controllers. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-07-20	41243735-89a7-4c83-bcdd-570aa78f00a1
Splunk	The following analytic identifies the execution of `wmic.exe` with command-line arguments used to discover domain controllers in a Windows domain. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	64c7adaa-48ee-483c-b0d6-7175bc65e6cc
	Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	informational	Daniil Yugoslavskiy, oscd.community, CheraghiMilad	2020-10-19	2024-12-01	d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72
	Detects usage of system utilities to discover files and directories	Generic	test	process_creation	macos	-	Discovery File and Directory Discovery	-	informational	Daniil Yugoslavskiy, oscd.community	2020-10-19	2022-11-25	089dbdf6-b960-4bcc-90e3-ffc3480c20f6
	Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community	2023-02-15	2025-06-04	cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7
	Detects the execution of certutil with the "encode" flag to encode a file to base64. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)	2019-02-24	2024-03-05	e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a
	Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-05-15	2024-03-05	82a6714f-4899-4f16-9c1e-9a333544d4c3
Splunk	The following analytic detects the execution of `powershell.exe` with the `Get-AdComputer` commandlet, which is used to discover remote systems within a domain. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	c5a31f80-5888-4d81-9f78-1cc65026316e
Splunk	The following analytic detects the execution of the `Get-AdComputer` PowerShell commandlet using PowerShell Script Block Logging (EventCode=4104). (...)	Hunting	stable	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-10-02	a9a1da02-8e27-4bf7-a348-f4389c9da487
Splunk	The following analytic detects the execution of `powershell.exe` with command-line arguments that utilize `Get-DomainComputer` to discover remote systems. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	ed550c19-712e-43f6-bd19-6f58f61b3a5e
Splunk	The following analytic detects the execution of the `Get-DomainComputer` commandlet using PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	f64da023-b988-4775-8d57-38e512beb56e
Splunk	The following analytic detects the execution of `powershell.exe` with the `Get-DomainController` command, which is used to discover remote systems within a Windows domain. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-10-02	868ee0e4-52ab-484a-833a-6d85b7c028d0
Splunk	The following analytic detects the execution of the `Get-DomainController` commandlet using PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	676b600a-a94d-4951-b346-11329431e6c1
Splunk	The following analytic detects the execution of `powershell.exe` with the `Get-LocalUser` commandlet, which is used to query local user accounts. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account	-	medium	Mauricio Velazco, Splunk	2021-08-24	2026-10-02	85fae8fa-0427-11ec-8b78-acde48001122
Splunk	The following analytic detects the execution of the `Get-LocalUser` PowerShell commandlet using PowerShell Script Block Logging (EventCode=4104). (...)	Hunting	stable	ps_script	windows	PowerShell	Discovery Account Discovery Local Account Execution Command and Scripting Interpreter PowerShell	-	medium	Mauricio Velazco, Splunk	2021-08-24	2026-05-13	2e891cbe-0426-11ec-9c9c-acde48001122
Splunk	The following analytic identifies the execution of `powershell.exe` with the `Get-NetTcpConnection` command, which lists current TCP connections on a system. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Network Connections Discovery	-	medium	Mauricio Velazco, Splunk	2021-08-24	2026-05-13	e02af35c-1de5-4afe-b4be-f45aba57272b
Splunk	The following analytic detects the execution of the `Get-NetTcpconnection` PowerShell cmdlet using PowerShell Script Block Logging (EventCode=4104). (...)	Hunting	stable	ps_script	windows	PowerShell	Discovery System Network Connections Discovery	-	medium	Mauricio Velazco, Splunk	2021-08-24	2026-05-13	091712ff-b02a-4d43-82ed-34765515d95d
Splunk	The following analytic detects the execution of `powershell.exe` with command-line arguments that utilize the `Get-WmiObject` cmdlet to discover remote systems, specifically targeting the `DS_Computer` parameter. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-10-02	7141122c-3bc2-4aaa-ab3b-7a85a0bbefc3
Splunk	The following analytic detects the execution of the `Get-WmiObject` cmdlet with the `DS_Computer` class parameter via PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	29b99201-723c-4118-847a-db2b3d3fb8ea
Splunk	The following analytic detects the execution of `powershell.exe` with command-line arguments that utilize the `Get-WmiObject` cmdlet and the `Win32_UserAccount` parameter to query local user accounts. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account	-	medium	Mauricio Velazco, Splunk	2021-08-24	2026-05-13	b44f6ac6-0429-11ec-87e9-acde48001122
Splunk	The following analytic detects the execution of the `Get-WmiObject` commandlet with the `Win32_UserAccount` parameter via PowerShell Script Block Logging (EventCode=4104). (...)	Hunting	stable	ps_script	windows	PowerShell	Discovery Account Discovery Local Account Execution Command and Scripting Interpreter PowerShell	-	medium	Mauricio Velazco, Splunk	2021-08-24	2026-05-13	640b0eda-0429-11ec-accd-acde48001122
	Detects command line parameters used by Bloodhound and Sharphound hack tools	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	Florian Roth (Nextron Systems)	2019-12-20	2023-02-04	f376c8a7-a2d0-4ddc-aa0c-16c17236d962
	Detects execution of the hacktool NetExec. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Lateral Movement Remote Services Discovery Remote System Discovery	-	high	Chirag Damani	2026-03-29	—	7638e5fe-600c-4289-a968-f49dd537ec7d
	Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, ker (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery Discovery Process Discovery Discovery Query Registry Discovery System Information Discovery Discovery System Service Discovery	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali	2022-10-10	2024-11-23	fca949cc-79ca-446e-8064-01aa7e52ece5

Title

Description