malware

TINYTYPHON S0131

Type: malware
Created: 31 May 2017
Last modified: 10 April 2024

TINYTYPHON is a backdoor that has been used by the actors responsible for the MONSOON campaign. The majority of its code was reportedly taken from the MyDoom worm. [1]

TechniquesBottom 17%

Tactics41st pct

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

TINYTYPHON MITRE reference S0131

Automated Exfiltration T1020 ↗

When a document is found matching one of the extensions in the configuration, TINYTYPHON uploads it to the C2 server.2

Exfiltration13 detection rules

Encrypted/Encoded File T1027.013 ↗

TINYTYPHON has used XOR with 0x90 to obfuscate its configuration file.3

Stealth1 detection rules

File and Directory Discovery T1083 ↗

TINYTYPHON searches through the drive containing the OS, then all drive letters C through to Z, for documents matching certain extensions.4

Discovery29 detection rules

Registry Run Keys / Startup Folder T1547.001 ↗

TINYTYPHON installs itself under Registry Run key to establish persistence.5

Persistence · Privilege Escalation46 detection rules

Standing S0131

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques4Bottom 17%

17th percentile · 83% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics541st pct

41st percentile · 59% of 825 ATT&CK software entries have more tactics spanned.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique21med49th pct

49th percentile · 51% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique6.5med56th pct

56th percentile · 56% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.

Data comps / technique3.5med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique0medBottom 17%

17th percentile · 83% of 825 ATT&CK software entries have more mitigations per technique.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 4 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 76Splunk ESCU (cumulative) · 13

Standing S0131

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
	Detects bulk downloading of User Data associated with AWS EC2 instances. (...)	Unsupported	unsupported	cloud_audit	-	AWS CloudTrail · AWS	Exfiltration Automated Exfiltration	-	medium	faloker	2020-02-11	2023-03-24	26ff4080-194e-47e7-9889-ef7602efed0c
	Detects the change of database master password. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Exfiltration Automated Exfiltration	-	medium	faloker	2020-02-12	2022-10-05	8a63cdd4-6207-414a-85bc-7e032bd3c1a2
	Detects usage of "getcap" binary. (...)	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	low	Nasreddine Bencherchali (Nextron Systems)	2022-12-28	2026-01-24	d8d97d51-122d-4cdd-9e2f-01b4b4933530
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
	Detects modification of Windows Registry Classes keys used for persistence. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2025-10-22	9df5f547-c86a-433e-b533-f2794357e242
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name)	2019-10-25	2025-10-22	f59c3faf-50f3-464b-9f4c-1b67ab512d99
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2023-08-17	f674e36a-4b91-431e-8aef-f8a96c2aca35
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2025-10-22	20f0ee37-5942-4e45-b7d5-c5b5db9df5cd
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2025-10-22	cbf93e5d-ca6c-4722-8bea-e9119007c248
Splunk	The following analytic detects the usage of `rclone.exe` with specific command-line arguments indicative of file transfer activities. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike · Cisco NVM · Cisco	Exfiltration Automated Exfiltration	-	medium	Michael Haag, Splunk	2021-05-13	2026-07-14	32e0baea-b3f1-11eb-a2ce-acde48001122
	Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems)	2019-10-25	2026-01-05	24357373-078f-44ed-9ac4-6d334a668a11
	Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery	-	low	frack113	2022-08-20	2023-02-04	b4dc61f5-6cce-468e-a608-b48b469feaa2
	Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	informational	Daniil Yugoslavskiy, oscd.community, CheraghiMilad	2020-10-19	2024-12-01	d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72
	Detects usage of system utilities to discover files and directories	Generic	test	process_creation	macos	-	Discovery File and Directory Discovery	-	informational	Daniil Yugoslavskiy, oscd.community	2020-10-19	2022-11-25	089dbdf6-b960-4bcc-90e3-ffc3480c20f6
	Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of e (...)	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	CVE-2022-30190	high	Vadim Varganov, Florian Roth (Nextron Systems)	2022-08-24	2023-02-23	318557a5-150c-4c8d-b70e-a9910e199857
	Detects the setting of a custom protocol handler with the name "rogue". (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	CVE-2022-38028	high	Nasreddine Bencherchali (Nextron Systems)	2024-04-23	—	5cdeb555-65de-4767-99fe-e26807465148
	Detects the setting of the DLL that handles the custom protocol handler. (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	CVE-2022-38028	high	Nasreddine Bencherchali (Nextron Systems)	2024-04-23	—	d807056b-0e00-4cec-b7f8-b8b7518e382b
	Detects when the policy allowing forks of private and internal repositories is changed (enabled or cleared).	Generic	test	cloud_audit	-	GitHub Audit · GitHub	Exfiltration Automated Exfiltration Exfiltration Transfer Data to Cloud Account	-	medium	Romain Gaillard (@romain-gaillard)	2024-07-29	—	69b3bd1e-b38a-462f-9a23-fbdbf63d2294
	Detects when a repository or an organization is being transferred to another location.	Generic	test	cloud_audit	-	GitHub Audit · GitHub	Exfiltration Automated Exfiltration Exfiltration Transfer Data to Cloud Account	-	medium	Romain Gaillard (@romain-gaillard)	2024-07-29	—	04ad83ef-1a37-4c10-b57a-81092164bf33
	Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, ker (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery Discovery Process Discovery Discovery Query Registry Discovery System Information Discovery Discovery System Service Discovery	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali	2022-10-10	2024-11-23	fca949cc-79ca-446e-8064-01aa7e52ece5
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2023-08-17	a80f662f-022f-4429-9b8c-b1a41aaa6688
	Detects the setting of a new value in the Autorun key that is used by the Kapeka backdoor for persistence.	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Swachchhanda Shrawan Poudel	2024-07-03	—	c0c67b21-eb8a-4c84-a395-40473ec3b482
	Detects registry key used by Leviathan APT in Malaysian focused campaign	Emerging	test	registry_event	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	critical	Aidan Bracher	2020-07-07	2023-09-19	70d43542-cd2d-483c-8f30-f16b436fd7db
Splunk	The following analytic detects suspicious database file and directory discovery activities, which may signal an attacker attempt to locate and assess critical database assets on a compromised system. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Discovery File and Directory Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-23	2026-05-13	f616c4f3-bde9-41cf-856c-019b65f668bb
Splunk	The following analytic detects suspicious file and directory discovery activities, which may indicate an attacker's effort to locate sensitive documents and files on a compromised system. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Discovery File and Directory Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-22	2026-10-02	0bbfb79c-a755-49a5-a38a-1128d0a452f1
Splunk	The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Discovery File and Directory Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	555cc358-bf16-4e05-9b3a-0f89c73b7261
Splunk	The following analytic detects suspicious discovery of virtual disk files and directories, which may indicate an attacker's attempt to locate and access virtualized storage environments. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Discovery File and Directory Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	eec78cef-d4c8-4b35-8f5b-6922102a4a41
	Detects attempts to discover the files with setuid/setgid capability on them. (...)	Generic	test	process_creation	linux	Linux Auditd	Privilege Escalation Abuse Elevation Control Mechanism Discovery File and Directory Discovery	-	low	Pawel Mazur	2021-11-28	2022-12-25	fe10751f-1995-40a5-aaa2-c97ccb4123fe
	Detects email forwarding or redirecting activity in O365 Audit logs.	Hunting	test	-	-	Audit · Microsoft 365	Exfiltration Automated Exfiltration Collection Email Collection Email Forwarding Rule Stealth Hide Artifacts Email Hiding Rules	-	medium	RedCanary Team (idea), Harjot Singh @cyb3rjy0t	2023-10-11	2024-11-17	c726e007-2cd0-4a55-abfb-79730fbedee5
	Detects email forwarding or redirecting activity via ExchangePowerShell Cmdlet	Hunting	experimental	ps_script	windows	PowerShell	Exfiltration Automated Exfiltration Collection Email Collection Email Forwarding Rule Stealth Hide Artifacts Email Hiding Rules	-	medium	Nasreddine Bencherchali (Nextron Systems), Marco Pedrinazzi (@pedrinazziM) (InTheCyber)	2026-03-01	—	0c7686d5-c74e-4292-b224-2a08e956ebc4
	Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information.	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Exfiltration Automated Exfiltration	-	high	Ivan Saakov	2024-12-06	—	457cc9ac-d8e6-4d1d-8c0e-251d0f11a74c
	Detect modification of the User Shell Folders registry values for Startup or Common Startup which could indicate persistence attempts. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	frack113, Swachchhanda Shrawan Poudel (Nextron Systems)	2022-10-01	2026-01-05	9c226817-8dc9-46c2-a58d-66655aafd7dc
	Detects abusing Windows 10 Narrator's Feedback-Hub	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Dmitriy Lifanov, oscd.community	2019-10-25	2022-03-26	f663a6d9-9d1b-49b8-b2b1-0637914d199a
	Detects suspicious new RUN key element pointing to an executable in a suspicious folder	Generic	experimental	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing, Swachchhanda Shrawan Poudel (Nextron Systems)	2018-08-25	2025-10-06	02ee49e2-e294-4d0f-9278-f5b3212fc588
	Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to credentials or suspicious activity.	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery	-	low	The DFIR Report	2025-02-21	—	3b4e950b-a3ea-44d3-877e-432071990709
	Detects modification of autostart extensibility point (ASEP) in registry. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2026-08-28	baecf8fb-edbf-429f-9ade-31fc3f22b970
	Detects usage of "find" binary in a suspicious manner to perform discovery	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-12-28	—	8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf
	Detects usage of "find" binary in a suspicious manner to perform discovery	Generic	test	process_creation	macos	-	Discovery File and Directory Discovery	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-12-28	—	85de3a19-b675-4a51-bfc6-b11a5186c971
	Detects changes to the "Winlogon" registry key where a process will set the value of the "Shell" to a value that was observed being used by KamiKakaBot samples in order to achieve persistence.	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Nasreddine Bencherchali (Nextron Systems), X__Junior	2024-03-22	—	c9b86500-1ec2-4de6-9120-d744c8fb5caf
	Detects suspicious command line reg.exe tool adding key to RUN key in Registry	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)	2021-06-28	2025-02-17	de587dce-915e-4218-aac4-835ca6af6f70
	Detects Ryuk ransomware activity	Emerging	stable	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Florian Roth (Nextron Systems), Vasiliy Burov, Nasreddine Bencherchali (Nextron Systems)	2019-12-16	2023-02-03	c37510b8-2107-4b78-aa32-72f251e7a844
	Detects PowerShell writing startup shortcuts. (...)	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Christopher Peacock '@securepeacock', SCYTHE	2021-10-24	2023-02-23	92fa78e7-4d39-45f1-91a3-8b23f3f1088d
	Detects potential suspicious behaviour using secedit.exe. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access, Collection Adversary-in-the-Middle Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Authentication Package Port Monitors Active Setup Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Persistence, Privilege Escalation Event Triggered Execution Netsh Helper DLL Accessibility Features Stealth Hide Artifacts Hidden Users Execution, Stealth Hijack Execution Flow Path Interception by PATH Environment Variable Persistence, Defense Impairment, Credential Access Modify Authentication Process Password Filter DLL Persistence Server Software Component Terminal Services DLL Discovery System Information Discovery	-	medium	Janantha Marasinghe	2022-11-18	2022-12-30	c2c76b77-32be-4d1f-82c9-7e544bdfe0eb
	Detects technique used by MAZE ransomware to enumerate directories using Powershell	Generic	test	ps_script	windows	PowerShell	Discovery File and Directory Discovery	-	medium	frack113	2022-03-17	—	162e69a7-7981-4344-84a9-0f1c9a217a52
	Detects PowerShell scripts that have capabilities to read files, loop through them and resolve DNS host entries.	Generic	test	ps_script	windows	PowerShell	Exfiltration Automated Exfiltration	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-05-05	—	fbc5e92f-3044-4e73-a5c6-1c4359b539de
	Detects PowerShell scripts leveraging the "Invoke-WebRequest" cmdlet to send data via either "PUT" or "POST" method.	Generic	test	ps_script	windows	PowerShell	Exfiltration Automated Exfiltration	-	low	frack113	2022-01-07	2025-07-18	d2e3f2f6-7e09-4bf2-bc5d-90186809e7fb
	Detect adversaries enumerate sensitive files	Generic	test	ps_script	windows	PowerShell	Discovery File and Directory Discovery	-	medium	frack113	2022-09-16	—	7d416556-6502-45b2-9bad-9d2f05f38997
	Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery Cloud Service Discovery Discovery File and Directory Discovery	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-10-18	2023-02-04	38646daa-e78f-4ace-9de0-55547b2d30da
	Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery Credential Access Unsecured Credentials Credentials In Files	-	medium	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-09-24	—	44030449-b0df-4c94-aae1-502359ab28ee

Title

Description