malware

Cherry Picker S0107

Type: malware
Platform: Windows
Created: 31 May 2017
Last modified: 25 April 2025

Cherry Picker is a point of sale (PoS) memory scraper. [1]

TechniquesBottom 12%

Tactics32nd pct

Threat groupsNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Cherry Picker MITRE reference S0107

Exfiltration Over Unencrypted Non-C2 Protocol T1048.003 ↗

Cherry Picker exfiltrates files over FTP.2

Exfiltration26 detection rules

File Deletion T1070.004 ↗

Recent versions of Cherry Picker delete files and registry keys created by the malware.3

Stealth30 detection rules

AppInit DLLs T1546.010 ↗

Some variants of Cherry Picker use AppInit_DLLs to achieve persistence by creating the following Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows "AppInit_DLLs"="pserver32.dll"4

Persistence · Privilege Escalation1 detection rules

Standing S0107

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques3Bottom 12%

12th percentile · 88% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics432nd pct

32nd percentile · 68% of 825 ATT&CK software entries have more tactics spanned.

Threat groups061% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique26med64th pct

64th percentile · 64% of 825 ATT&CK software entries have this many detection rules per technique or fewer.

Tests / technique8med72nd pct

72nd percentile · 72% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.

Data comps / technique5med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique2medTop 9%

91st percentile · 91% of 825 ATT&CK software entries have this many mitigations per technique or fewer.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 3 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 32Splunk ESCU (cumulative) · 25

Standing S0107

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects the deletion of the "Zone.Identifier" ADS. (...)	Hunting	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	low	frack113	2023-09-04	—	7eac0a16-5832-4e81-865f-0268a6d19e4b
	Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...)	Generic	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-09-04	2025-07-04	3109530e-ab47-4cc6-a953-cac5ebcc93ae
	Detects backup catalog deletions	Generic	test	-	windows	WinEventLog Application	Stealth Indicator Removal File Deletion	-	medium	Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection)	2017-05-12	2022-12-25	9703792d-fd9a-456d-a672-ff92efe4806a
Splunk	This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Collection Data from Local System Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration Exfiltration Over C2 Channel	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	8a9e5f2b-6d4c-4e7f-9b3a-1c8d7f5e2a9b
	See what files are being deleted from flash file systems	Generic	test	authentication	-	Cisco AAA · Cisco	Impact Disk Wipe Disk Content Wipe Disk Structure Wipe Stealth Indicator Removal File Deletion	-	medium	Austin Clark	2019-08-12	2023-01-04	71d65515-c436-43c0-841b-236b1f32c21e	-
Splunk	The following analytic detects potentially suspicious large volumes of data sent by the connection initiator on flows from internal to external networks. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration Exfiltration Over C2 Channel Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	3d8536b6-52b4-4c3e-b695-3f2e90bb22be
Splunk	The following analytic detects the execution of `cipher.exe` with the `/w` flag to clear unallocated sectors on a disk. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2021-06-10	2026-05-13	cd80a6ac-c9d9-11eb-8839-acde48001122
	Detects attempts to post the file with the usage of wget utility. (...)	Generic	test	process_creation	linux	Linux Auditd	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Pawel Mazur	2021-11-18	2022-12-25	cb39d16b-b3b6-4a7a-8222-1cf24b686ffc
	Detects execution of the builtin "rmdir" command in order to delete directories. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Indicator Removal File Deletion	-	low	frack113	2022-01-15	2023-03-07	41ca393d-538c-408a-ac27-cf1e038be80c
Splunk	The following analytic identifies DNS queries with unusually large lengths by computing the standard deviation of query lengths and filtering those exceeding two times the standard deviation. (...)	Anomaly	stable	dns	windows	Sysmon	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Bhavin Patel, Splunk	2019-10-16	2026-05-13	1a67f15a-f4ff-4170-84e9-08cf6f75d6f5	-
	Detects the deletion of files by the Sysinternals SDelete utility. (...)	Generic	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-05-02	2023-02-15	6ddab845-b1b8-49c2-bbf7-1a11967f64bc
	Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries t (...)	Generic	stable	process_creation	linux	Sysmon	Stealth Indicator Removal File Deletion	-	informational	Ömer Günal, oscd.community	2020-10-07	2022-09-15	30aed7b6-d2c1-4eaf-9382-b6bc43e50c57
	Detects execution of the builtin "del"/"erase" commands in order to delete files. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Indicator Removal File Deletion	-	low	frack113	2022-01-15	2024-03-05	379fa130-190e-4c3f-b7bc-6c8e834485f3
	Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Indicator Removal File Deletion	-	medium	frack113 , X__Junior (Nextron Systems)	2021-12-02	2023-09-11	204b17ae-4007-471b-917b-b917b315c5db
Splunk	The following analytic detects outbound emails with attachments sent from an internal email domain to an external domain. (...)	Hunting	stable	account_management	-	Google Cloud	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Teoderick Contreras, Stanislav Miskovic, Splunk	2021-08-17	2026-05-13	dc4dc3a8-ff54-11eb-8bf7-acde48001122
	High DNS queries bytes amount from host per short period of time	Unsupported	unsupported	dns	-	-	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Daniil Yugoslavskiy, oscd.community	2019-10-24	2023-03-24	0f6c1bf5-70a5-4963-aef9-aab1eefb50bd	-
	High DNS queries bytes amount from host per short period of time	Unsupported	unsupported	firewall	-	-	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Daniil Yugoslavskiy, oscd.community	2019-10-24	2023-03-24	3b6e327d-8649-4102-993f-d25786481589	-
	High DNS requests amount from host per short period of time	Unsupported	unsupported	dns	-	-	Command and Control Application Layer Protocol DNS Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Daniil Yugoslavskiy, oscd.community	2019-10-24	2023-03-24	b4163085-4001-46a3-a79a-55d8bbbc7a3a	-
	High DNS requests amount from host per short period of time	Unsupported	unsupported	firewall	-	-	Command and Control Application Layer Protocol DNS Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Daniil Yugoslavskiy, oscd.community	2019-10-24	2023-03-24	51186749-7415-46be-90e5-6914865c825a	-
	Extremely high rate of NULL record type DNS requests from host per short period of time. (...)	Unsupported	unsupported	dns	-	-	Command and Control Application Layer Protocol DNS Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Daniil Yugoslavskiy, oscd.community	2019-10-24	2023-03-24	44ae5117-9c44-40cf-9c7c-7edad385ca70	-
	Extremely high rate of TXT record type DNS requests from host per short period of time. (...)	Unsupported	unsupported	dns	-	-	Command and Control Application Layer Protocol DNS Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Daniil Yugoslavskiy, oscd.community	2019-10-24	2023-03-24	f0a8cedc-1d22-4453-9c44-8d9f4ebd5d35	-
Splunk	The following analytic detects the deletion of SSH keys on a Linux machine. (...)	Anomaly	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	73a56508-1cf5-4df7-b8d9-5737fbdc27d2
Splunk	The following analytic detects the deletion of cron jobs on a Linux machine. (...)	Anomaly	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	3b132a71-9335-4f33-9932-00bb4f6ac7e8
Splunk	The following analytic detects the deletion of init daemon scripts on a Linux machine. (...)	Generic	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	729aab57-d26f-4156-b97f-ab8dda8f44b1
Splunk	The following analytic detects the deletion of services on a Linux machine. (...)	Generic	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	b509bbd3-0331-4aaa-8e4a-d2affe100af6
Splunk	The following analytic detects the deletion of SSL certificates on a Linux machine. (...)	Anomaly	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	839ab790-a60a-4f81-bfb3-02567063f615
Splunk	The following analytic detects a high frequency of file deletions in the /boot/ folder on Linux systems. (...)	Generic	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	e27fbc5d-0445-4c4a-bc39-87f060d5c602
Splunk	The following analytic detects a high frequency of file deletions in the /etc/ folder on Linux systems. (...)	Anomaly	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	9d867448-2aff-4d07-876c-89409a752ff8
Splunk	The following analytic detects the deletion of Linux service unit configuration files by suspicious processes. (...)	Anomaly	stable	process_creation	linux	Sysmon	Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2023-02-08	2026-05-13	6c077f81-2a83-4537-afbc-0e62e3215d55
Splunk	The following analytic detects the use of shell's /dev/tcp or /dev/udp pseudo-device feature to establish outbound network connections. (...)	Anomaly	stable	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Raven Tait, Splunk	2026-07-08	2026-07-08	f324bc06-8436-4606-8882-0a8fb480b719
Splunk	The following analytic detects the high-frequency exfiltration of archive files via HTTP POST requests. (...)	Generic	stable	network_connection	-	Splunk Stream HTTP	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Teoderick Contreras, Splunk	2021-04-22	2026-05-13	4477f3ea-a28f-11eb-b762-acde48001122
	DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\Software\Microsoft\Window (...)	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Event Triggered Execution AppInit DLLs	-	medium	Ilyas Ochkov, oscd.community, Tim Shelton	2019-10-25	2022-12-25	4f84b697-c9ed-4420-8ab5-e09af5b2345d
Splunk	The following analytic detects potential data exfiltration using plain HTTP POST requests. (...)	Generic	stable	network_connection	-	Splunk Stream HTTP	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Teoderick Contreras, Splunk	2021-04-22	2026-09-08	e2b36208-a364-11eb-8909-acde48001122
	Normally, DNS logs contain a limited amount of different dns queries for a single domain. (...)	Unsupported	unsupported	dns	-	-	Command and Control Application Layer Protocol DNS Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	high	Patrick Bareiss	2019-04-07	2023-03-24	1ec4b281-aa65-46a2-bdae-5fd830ed914e
	Detects the execution of a PowerShell script with a call to the "Send-MailMessage" cmdlet along with the "-Attachments" flag. (...)	Hunting	test	ps_script	windows	PowerShell	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	frack113	2022-09-26	2024-11-01	9a7afa56-4762-43eb-807d-c3dc9ffe211b
	Detects files that have extensions commonly seen while SDelete is used to wipe files.	Generic	test	-	windows	WinEventLog Security	Impact Data Destruction Stealth Indicator Removal File Deletion Stealth Obfuscated Files or Information Indicator Removal from Tools Defense Impairment Subvert Trust Controls Code Signing	-	medium	Thomas Patzke	2017-06-14	2024-12-13	39a80702-d7ca-4a83-b776-525b1f86a36d
	Detects uncommon and potentially suspicious one-liner command containing both "ping" and "copy" at the same time, which is usually used by malware.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Indicator Removal File Deletion	-	medium	X__Junior (Nextron Systems)	2023-07-18	2024-03-06	ded2b07a-d12f-4284-9b76-653e37b6c8b0
	Detects Exfiltration Over Alternative Protocol - ICMP. (...)	Generic	test	ps_script	windows	PowerShell	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Bartlomiej Czyz @bczyz1, oscd.community	2020-10-10	2022-12-25	4c4af3cd-2115-479c-8193-6b8bfce9001c
	Detects the deletion of a prefetch file which may indicate an attempt to destroy forensic evidence	Generic	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	high	Cedric MAURUGEON	2021-09-29	2024-01-25	0a1f9d29-6465-4776-b091-7f43b26e4c89
Splunk	The following analytic identifies network traffic where the higher layer protocol does not match the expected port, such as non-HTTP traffic on TCP port 80. (...)	Anomaly	stable	network_connection	-	Cisco Secure Firewall · Cisco	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Rico Valdez, Splunk	2020-04-29	2026-05-13	54dc1265-2f74-4b6d-b30d-49eb506a31b3	-
	Detects the execution of Python web servers via command line interface (CLI). (...)	Generic	experimental	process_creation	linux	Sysmon	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Mohamed LAKRI	2025-10-17	—	3f0f5957-04f8-4792-ad89-192b0303bde6
Splunk	The following analytic detects the execution of a batch command designed to recursively delete files or directories, a technique often used by ransomware like Reddot to delete files in the recycle bin and prevent recovery. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2021-06-23	2026-05-13	ba570b3a-d356-11eb-8358-acde48001122
Splunk	The following analytic detects the execution of the sdelete.exe application, a Sysinternals tool often used by adversaries to securely delete files and remove forensic evidence from a targeted host. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2021-10-06	2026-05-13	31702fc0-2682-11ec-85c3-acde48001122
	Detects suspicious DNS queries using base64 encoding	Generic	test	dns	-	-	Command and Control Application Layer Protocol DNS Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Florian Roth (Nextron Systems)	2018-05-10	2022-10-09	4153a907-2451-4e4f-a578-c52bb6881432
	Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. (...)	Generic	test	network_connection	windows	Sysmon	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	frack113	2022-01-07	2022-09-21	9976fa64-2804-423c-8a5b-646ade840773
	Detects a method often used by ransomware. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Indicator Removal File Deletion	-	high	Ilya Krestinichev	2022-11-03	2024-03-05	54786ddc-5b8a-11ed-9b6a-0242ac120002
	Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	CVE-2023-23397	high	Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)	2023-03-16	2023-09-18	982e9f2d-1a85-4d5b-aea4-31f5e97c6555
	Detects the deletion of the TeamViewer log files which may indicate an attempt to destroy forensic e (...)	Generic	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	low	frack113	2022-01-16	2023-02-15	b1decb61-ed83-4339-8e95-53ea51901720
	PowerShell Remove-Item with -Path to delete a file or a folder with "-Recurse"	Hunting	test	ps_script	windows	PowerShell	Stealth Indicator Removal File Deletion	-	low	frack113	2022-01-15	2022-03-17	b8af5f36-1361-4ebe-9e76-e36128d947bf
	Detects "svchost.exe" spawning "rundll32.exe" with command arguments like "C:\windows\system32\davclnt.dll,DavSetCookie". (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-05-02	2023-09-18	2dbd9d3d-9e27-42a8-b8df-f13825c6c3d5

Title

Description