malware

HIDEDRV S0135

Type: malware
Platform: Windows
Created: 31 May 2017
Last modified: 17 November 2024

HIDEDRV is a rootkit used by APT28. It has been deployed along with Downdelph to execute and hide that malware. [1] [2]

TechniquesBottom 7%

TacticsBottom 12%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0135

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects potential use of CreateRemoteThread api and LoadLibrary function to inject DLL into a proces (...)	Hunting	test	create_remote_thread	windows	Sysmon	Privilege Escalation, Stealth Process Injection Dynamic-link Library Injection	-	medium	Roberto Rodriguez @Cyb3rWard0g	2019-08-11	2024-01-22	052ec6f6-1adc-41e6-907a-f1c813478bee
	Detects a potential remote threat creation with certain characteristics which are typical for Cobalt (...)	Generic	test	create_remote_thread	windows	Sysmon	Privilege Escalation, Stealth Process Injection Dynamic-link Library Injection	-	high	Olaf Hartong, Florian Roth (Nextron Systems), Aleksey Potapov, oscd.community	2018-11-30	2023-05-05	6309645e-122d-4c5b-bb2b-22e4f9c2fa42
Splunk	The following analytic identifies the use of the 'kmod' process to list kernel modules on a Linux system. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Stealth Rootkit Discovery System Information Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-09	2026-05-13	d1b088de-c47a-4572-9339-bdcc26493b32
Splunk	The following analytic identifies the use of the 'kmod' process to list kernel modules on a Linux system. (...)	Anomaly	stable	process_creation	linux	Sysmon	Stealth Rootkit Discovery System Information Discovery	-	medium	Michael Haag, Splunk	2022-06-17	2026-10-09	6df99886-0e04-4c11-8b88-325747419278
Splunk	This detection identifies file creation events associated with the installation of the Medusa rootkit, a userland LD_PRELOAD-based rootkit known for deploying shared objects, loader binaries, and configuration files into specific system directories. (...)	Generic	stable	file_event	linux	Sysmon	Reconnaissance Gather Victim Identity Information Credentials Stealth Rootkit	-	medium	Raven Tait, Splunk	2022-04-26	2026-05-13	7add8520-71d5-43aa-b262-ee082b1f0238
Splunk	The following analytic detects the loading of the dynwrapx.dll module, which is associated with the DynamicWrapperX ActiveX component. (...)	Generic	stable	image_load	windows	Sysmon	Privilege Escalation, Stealth Process Injection Dynamic-link Library Injection	-	medium	Teoderick Contreras, Splunk	2021-10-05	2026-05-13	eac5e8ba-4857-11ec-9371-acde48001122
	Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation, Stealth Process Injection Dynamic-link Library Injection	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2020-01-28	2025-01-22	6345b048-8441-43a7-9bed-541133633d7a
	Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation, Stealth Process Injection Dynamic-link Library Injection Stealth System Binary Proxy Execution Mavinject	-	high	frack113, Florian Roth	2021-07-12	2022-12-05	4f73421b-5a0b-4bbf-a892-5a7fb99bea66
	Detects potential DLL injection and execution using "Tracker.exe"	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation, Stealth Process Injection Dynamic-link Library Injection	-	medium	Avneet Singh @v3t0_, oscd.community	2020-10-18	2023-01-09	148431ce-4b70-403d-8525-fcc2993f29ea
Splunk	The following analytic detects PowerShell Script Block Logging (Event ID 4104) evidence of a complete P/Invoke process-injection API chain at either the compile phase or the execution phase. (...)	Generic	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Privilege Escalation, Stealth Process Injection Dynamic-link Library Injection Thread Execution Hijacking Asynchronous Procedure Call Process Hollowing Stealth Reflective Code Loading	-	medium	Teoderick Contreras, Splunk	2026-04-29	2026-06-25	3f1a2b4c-d5e6-7890-abcd-ef1234567890
	Detects the execution of a renamed version of the "Mavinject" process. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation, Stealth Process Injection Dynamic-link Library Injection Stealth System Binary Proxy Execution Mavinject	-	high	frack113, Florian Roth	2022-12-05	2023-02-03	e6474a1b-5390-49cd-ab41-8d88655f7394
	Detects a renamed "dctask64.exe" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Indirect Command Execution Stealth Masquerading Privilege Escalation, Stealth Process Injection Dynamic-link Library Injection Stealth System Binary Proxy Execution	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2020-01-28	2025-01-22	340a090b-c4e9-412e-bb36-b4b16fe96f9b
	Detects specific process characteristics of Chinese TAIDOOR RAT malware load	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation, Stealth Process Injection Dynamic-link Library Injection	-	high	Florian Roth (Nextron Systems)	2020-07-30	2021-11-27	d1aa3382-abab-446f-96ea-4de52908210b
	Detects default install commands of the Triple Cross eBPF rootkit based on the "deployer.sh" script	Generic	test	process_creation	linux	Sysmon	Stealth Rootkit	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-07-05	—	22236d75-d5a0-4287-bf06-c93b1770860f
Splunk	The following analytic detects the loading of new Kernel Mode Drivers from non-standard paths using Windows EventCode 7045. (...)	Generic	stable	service	windows	WinEventLog System	Privilege Escalation Exploitation for Privilege Escalation Stealth Rootkit	-	medium	Michael Haag, Splunk	2022-05-16	2026-05-13	9216ef3d-066a-4958-8f27-c84589465e62
Splunk	The following analytic identifies all drivers being loaded on Windows systems using Sysmon EventCode 6 (Driver Load). (...)	Hunting	stable	driver_load	windows	Sysmon	Privilege Escalation Exploitation for Privilege Escalation Stealth Rootkit	-	medium	Michael Haag, Splunk	2022-04-04	2026-05-13	d2d4af6a-6c2b-4d79-80c5-fc2cf12a2f68
Splunk	The following analytic detects the execution of an arbitrary DLL by the Windows Remote Auto Dialer (rasautou.exe). (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Privilege Escalation, Stealth Process Injection Dynamic-link Library Injection Stealth System Binary Proxy Execution	-	medium	Michael Haag, Splunk	2022-02-09	2026-05-13	6f42b8be-8e96-11ec-ad5a-acde48001122
Splunk	The following analytic identifies the creation of a remote thread by a process such as wermgr.exe or rundll32.exe into a browser process such as firefox.exe, chrome.exe, and others. (...)	Anomaly	stable	create_remote_thread	windows	Sysmon	Privilege Escalation, Stealth Process Injection Dynamic-link Library Injection	-	medium	Teoderick Contreras, Nasreddine Bencherchali, Splunk	2026-06-29	2026-06-29	634cce27-a3a6-4079-b0d6-3ced361a0aa9

Title

Description

HIDEDRV S0135

HIDEDRV S0135

HIDEDRV MITRE reference S0135

Standing S0135

Reach

Coverage

HIDEDRV detections S0135

HIDEDRV MITRE reference S0135

Standing S0135

Reach

Coverage

HIDEDRV detections S0135