malware
ELMER is a non-persistent, proxy-aware HTTP backdoor written in Delphi that has been used by APT16. [1]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
12th percentile · 88% of 825 ATT&CK software entries have more Enterprise techniques.
12th percentile · 88% of 825 ATT&CK software entries have more tactics spanned.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
73rd percentile · 73% of 825 ATT&CK software entries have this many detection rules per technique or fewer.
97 distinct rules cover the 3 techniques recorded for this malware. 74 Sigma · 23 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects suspicious user agent strings used in APT malware in proxy logs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Markus Neis | 2019-11-12 | 2024-02-15 | 6ec820f2-e963-4801-9127-d8b2dce4d31b | ||||
Detects suspicious user agent string of APT40 Dropbox tool | Emerging | test | proxy | - | - | - | high | Thomas Patzke | 2019-11-12 | 2023-05-18 | 5ba715b6-71b7-44fd-8245-f66893e81b3d | ||||
Detects automated lateral movement by Turla group | Unsupported | unsupported | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Markus Neis | 2017-11-07 | 2023-02-24 | 75925535-ca97-4e0a-a850-00b5c00779dc | ||||
Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...) | Emerging | experimental | dns | - | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 73e5d24f-493f-4092-bd2f-c72cabda40ee | ||||
Detects Bitsadmin connections to IP addresses instead of FQDN names | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2022-06-10 | 2022-08-24 | 8ccd35a2-1c7c-468b-b568-ac6cdf80eec3 | ||||
Detects Bitsadmin connections to domains with uncommon TLDs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Tim Shelton | 2019-03-07 | 2026-09-30 | 9eb68894-7476-4cd6-8752-23b51f5883a7 | ||||
Detects usage of "getcap" binary. (...) | Generic | test | process_creation | linux | Sysmon | - | low | Nasreddine Bencherchali (Nextron Systems) | 2022-12-28 | 2026-01-24 | d8d97d51-122d-4cdd-9e2f-01b4b4933530 | ||||
Detects HTTP request used by Chafer malware to receive data from its C2. | Emerging | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2019-01-31 | 2024-02-15 | fb502828-2db0-438e-93e6-801c7548686d | ||||
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. (...) | Generic | test | ps_script | windows | PowerShell | - | medium | frack113 | 2022-01-23 | 2025-07-18 | d4488827-73af-4f8d-9244-7b7662ef046e | ||||
Find information about network devices that is not stored in config files | Generic | test | authentication | - | Cisco AAA · Cisco | - | low | Austin Clark | 2019-08-12 | 2023-01-04 | 9705a6a1-6db6-4a16-a987-15b7151e299b | ||||
Splunk | This analytic detects the usage of the Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes (600 seconds). (...) | Anomaly | stable | network_connection | - | Cisco NVM · Cisco | - | medium | Radka Viskova, Splunk | 2026-09-18 | 2026-09-22 | 6bc88a9d-f7de-4257-b526-acf15bc5a517 | |||
Splunk | The following analytic detects the use of known suspicious SSL certificates in any observed event where the SSL_CertFingerprint field is present. (...) | Generic | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-09-22 | c43f7b49-2dab-4e76-892e-7f971c2f20f1 | |||
Splunk | The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | f7e5e792-d907-46c1-a58e-4ff974dc462a | |||
Splunk | The following analytic detects connections with a high Encrypted Visibility Engine (EVE) threat confidence score, indicating potentially malicious behavior within encrypted traffic. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 8c15183e-2e70-4db4-86c3-88f8d9129b66 | |||
Splunk | The following analytic detects outbound connections initiated by command-line tools such as curl or wget. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 173a1cb9-1814-4128-a9dc-f29dade89957 | |||
Detects DNS requests to Cloudflared tunnels domains. (...) | Generic | test | dns | windows | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-12-20 | — | a1d9eec5-33b2-4177-8d24-27fe754d0812 | ||||
Detects Turla ComRAT network communication. | Emerging | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2020-05-26 | 2024-02-26 | 7857f021-007f-4928-8b2c-7aedbe64bb82 | ||||
Detects suspicious user agent strings used by crypto miners in proxy logs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2019-10-21 | 2021-11-27 | fa935401-513b-467b-81f4-f9e77aa0dd78 | ||||
Detects execution of curl.exe with custom useragent options | Hunting | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-01-23 | 2023-02-21 | 3286d37a-00fd-41c2-a624-a672dcd34e60 | ||||
Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | frack113 | 2022-08-20 | 2023-02-04 | b4dc61f5-6cce-468e-a608-b48b469feaa2 | ||||
Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session. | Generic | experimental | dns | windows | Sysmon | - | low | Muhammad Faisal (@faisalusuf) | 2024-12-19 | — | 882e858a-3233-4ba8-855e-2f3d3575803d | ||||
Detects DNS query requests to Devtunnels domains. (...) | Generic | test | dns | windows | Sysmon | - | medium | citron_ninja | 2023-10-25 | 2023-11-20 | 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b | ||||
Detects DNS query requests to Visual Studio Code tunnel domains. (...) | Generic | test | dns | windows | Sysmon | - | medium | citron_ninja | 2023-10-25 | 2023-11-20 | b3e6418f-7c7a-4fad-993a-93b65027a9f1 | ||||
Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy (...) | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2017-07-08 | 2025-01-18 | fdd1bfb5-f60b-4a35-910e-f36ed3d0b32f | ||||
Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares. | Generic | test | process_creation | linux | Sysmon | - | informational | Daniil Yugoslavskiy, oscd.community, CheraghiMilad | 2020-10-19 | 2024-12-01 | d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72 | ||||
Detects usage of system utilities to discover files and directories | Generic | test | process_creation | macos | - | - | informational | Daniil Yugoslavskiy, oscd.community | 2020-10-19 | 2022-11-25 | 089dbdf6-b960-4bcc-90e3-ffc3480c20f6 | ||||
Detects Baby Shark C2 Framework default communication patterns | Generic | test | proxy | - | - | - | critical | Florian Roth (Nextron Systems) | 2021-06-09 | 2024-02-15 | 304810ed-8853-437f-9e36-c4975c3dfd7e | ||||
Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods). | Generic | test | proxy | - | - | - | high | Markus Neis, Florian Roth (Nextron Systems) | 2024-02-15 | — | f3f21ce1-cdef-4bfc-8328-ed2e826f5fac | ||||
Detects user agent and URI paths used by empire agents | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2020-07-13 | 2024-02-26 | b923f7d6-ac89-4a50-a71a-89fb846b4aa8 | ||||
Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, ker (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems), Nasreddine Bencherchali | 2022-10-10 | 2024-11-23 | fca949cc-79ca-446e-8064-01aa7e52ece5 | ||||
Splunk | This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of c2 frameworks. (...) | Generic | stable | webserver | - | Suricata | - | medium | Ravent Tait, Splunk | 2026-01-06 | 2026-09-22 | 229dc225-6abe-4d28-89fd-edf874086162 | |||
Splunk | Detects when a request has more than one of the same header. (...) | Anomaly | stable | network_connection | - | Suricata | - | medium | Raven Tait, Splunk | 2025-10-21 | 2026-05-13 | 1606cc5b-fd5f-4865-9fe3-0ed1eaec2df6 | |||
Splunk | This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of malware. (...) | Generic | stable | webserver | - | Suricata | - | medium | Raven Tait, Splunk | 2026-01-06 | 2026-09-22 | 8c4866e4-f488-4253-8537-7dc4f954c292 | |||
Splunk | HTTP request smuggling is a technique for interfering with the way a web site processes sequences of HTTP requests that are received from one or more users. (...) | Generic | stable | network_connection | - | Suricata | - | medium | Raven Tait, Splunk | 2025-10-21 | 2026-05-13 | 97d85f98-9d15-41a0-8682-7030454875e7 | |||
Splunk | The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex-encoded bytes or base64-encoded strings. (...) | Anomaly | stable | network_connection | - | Zeek | - | medium | Raven Tait, Splunk | 2026-10-12 | 2026-10-12 | 0590881d-7b81-48dd-9674-1f23f7db5d40 | |||
Splunk | This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of unwanted applications. (...) | Anomaly | stable | webserver | - | Suricata | - | medium | Raven Tait, Splunk | 2026-01-06 | 2026-09-22 | 21af5447-734f-4549-956b-7a255cb2b032 | |||
Splunk | This detection identifies rapid-fire POST request attacks where an attacker sends more than 20 POST requests within a 5-second window, potentially attempting to exploit race conditions or overwhelm request handling. (...) | Anomaly | stable | network_connection | - | Nginx | - | medium | Raven Tait, Splunk | 2025-10-21 | 2026-05-13 | c8c987d6-3a1a-4555-9a52-eea0741b6113 | |||
Splunk | Detects attempts to exploit a request smuggling technique against IIS that leverages a Windows quirk where requests for reserved Windows device names such as "/con" trigger an early server response before the request body is received. (...) | Generic | stable | webserver | - | Suricata | - | medium | Raven Tait, Splunk | 2025-10-21 | 2026-05-13 | 1e45e6a8-110b-4886-b815-8d69cf35bf0a | |||
Detects a potentially suspicious empty user agent strings in proxy log. (...) | Generic | test | proxy | - | - | - | medium | Florian Roth (Nextron Systems) | 2017-07-08 | 2021-11-27 | 21e44d78-95e7-421b-a464-ffd8395659c4 | ||||
Splunk | This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of Remote Monitoring and Mangement applications. (...) | Anomaly | stable | webserver | - | Suricata | - | medium | Raven Tait, Splunk | 2026-01-06 | 2026-09-22 | 61884b02-0dcf-44c5-9094-db33bac09fa6 | |||
Splunk | This Splunk query analyzes web access logs to identify and categorize non-browser user agents, detecting various types of security tools, scripting languages, automation frameworks, and suspicious patterns. (...) | Anomaly | stable | webserver | - | Nginx | - | medium | Raven Tait, Splunk | 2025-10-21 | 2026-09-22 | 04430b4e-5ca8-4e88-98b5-d6bcf54f8393 | |||
Detects the execution of the "curl.exe" command, referencing "SOCKS" and ".onion" domains, which could be indicative of Kalambur backdoor activity. | Emerging | experimental | process_creation | windows | Sysmon · WinEventLog Security | - | high | Arda Buyukkaya (EclecticIQ) | 2025-02-11 | — | e99375eb-3ee0-407a-9f90-79569cc6a01c | ||||
Detects network connections with a suspicious user-agent string containing "katz-ontop", which may indicate Katz Stealer activity. | Emerging | experimental | - | - | HTTP · Zeek | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2025-05-22 | — | 834c6d2f-5e98-4b2a-b453-0c4f234afedd | ||||
Splunk | The following analytic detects suspicious database file and directory discovery activities, which may signal an attacker attempt to locate and assess critical database assets on a compromised system. (...) | Anomaly | stable | process_creation | linux | Linux Auditd | - | medium | Teoderick Contreras, Splunk | 2024-08-23 | 2026-05-13 | f616c4f3-bde9-41cf-856c-019b65f668bb | |||
Splunk | The following analytic detects suspicious file and directory discovery activities, which may indicate an attacker's effort to locate sensitive documents and files on a compromised system. (...) | Anomaly | stable | process_creation | linux | Linux Auditd | - | medium | Teoderick Contreras, Splunk | 2024-08-22 | 2026-10-02 | 0bbfb79c-a755-49a5-a38a-1128d0a452f1 | |||
Splunk | The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. (...) | Anomaly | stable | process_creation | linux | Linux Auditd | - | medium | Teoderick Contreras, Splunk | 2024-08-12 | 2026-05-13 | 555cc358-bf16-4e05-9b3a-0f89c73b7261 | |||
Splunk | The following analytic detects suspicious discovery of virtual disk files and directories, which may indicate an attacker's attempt to locate and access virtualized storage environments. (...) | Anomaly | stable | process_creation | linux | Linux Auditd | - | medium | Teoderick Contreras, Splunk | 2024-08-12 | 2026-05-13 | eec78cef-d4c8-4b35-8f5b-6922102a4a41 | |||
Detects attempts to discover the files with setuid/setgid capability on them. (...) | Generic | test | process_creation | linux | Linux Auditd | - | low | Pawel Mazur | 2021-11-28 | 2022-12-25 | fe10751f-1995-40a5-aaa2-c97ccb4123fe | ||||
Detects suspicious user agent strings used by malware in proxy logs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) | 2017-07-08 | 2024-04-14 | 5c84856b-55a5-45f1-826f-13f37250cf4e | ||||
Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to credentials or suspicious activity. | Generic | experimental | process_creation | windows | Sysmon · WinEventLog Security | - | low | The DFIR Report | 2025-02-21 | — | 3b4e950b-a3ea-44d3-877e-432071990709 |
81st percentile · 81% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
17th percentile · 83% of 825 ATT&CK software entries have more mitigations per technique.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 3 Enterprise techniques.
Technique Campaign use over its cumulative rule count.