OLDBAIT S0138

Type: malware
Platform: Windows
Created: 31 May 2017
Last modified: 17 November 2024

OLDBAIT is a credential harvester used by APT28. [1] [2]

Techniques29th pct

TacticsBottom 21%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

OLDBAIT MITRE reference S0138

Obfuscated Files or Information T1027 ↗

OLDBAIT obfuscates internal strings and unpacks them at startup.3

Stealth117 detection rules

Match Legitimate Resource Name or Location T1036.005 ↗

OLDBAIT installs itself in %ALLUSERPROFILE%\\Application Data\Microsoft\MediaPlayer\updatewindws.exe; the directory name is missing a space and the file name is missing the letter "o."4

Stealth30 detection rules

Web Protocols T1071.001 ↗

OLDBAIT can use HTTP for C2.5

Command and Control60 detection rules

Mail Protocols T1071.003 ↗

OLDBAIT can use SMTP for C2.6

Command and Control3 detection rules

Credentials from Password Stores T1555 ↗

OLDBAIT collects credentials from several email clients.7

Credential Access13 detection rules

Credentials from Web Browsers T1555.003 ↗

OLDBAIT collects credentials from Internet Explorer, Mozilla Firefox, and Eudora.8

Credential Access12 detection rules

Standing S0138

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques629th pct

29th percentile · 71% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics3Bottom 21%

21st percentile · 79% of 825 ATT&CK software entries have more tactics spanned.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique21.5med50th pct

50th percentile · 50% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique6med

OLDBAIT detections S0138

233 distinct rules cover the 6 techniques recorded for this malware. 187 Sigma · 46 Splunk.

6 covered by at least one rule233 distinct rules in total

Showing 1-50 of 200+ rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects file access requests to browser credential stores by uncommon processes. (...)	Hunting	test	file_event	windows	WinEventLog Security	Credential Access Credentials from Password Stores Credentials from Web Browsers	-	low	Daniel Koifman (@Koifsec), Nasreddine Bencherchali	2024-10-21	—	4b60e527-ec73-4b47-8cb3-f02ad927ca65
	Adversaries may acquire credentials from web browsers by reading files specific to the target browser. (...)	Generic	test	ps_script	windows	PowerShell	Credential Access Credentials from Password Stores Credentials from Web Browsers	-	medium	frack113	2022-01-30	—	fc028194-969d-4122-8abe-0470d5b8f12f
	Detects suspicious user agent strings used in APT malware in proxy logs	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems), Markus Neis	2019-11-12	2024-02-15	6ec820f2-e963-4801-9127-d8b2dce4d31b
	Detects suspicious user agent string of APT40 Dropbox tool	Emerging	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage	-	high	Thomas Patzke	2019-11-12	2023-05-18	5ba715b6-71b7-44fd-8245-f66893e81b3d
Splunk	The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike · Cisco NVM · Cisco	Reconnaissance Active Scanning Stealth Masquerading Match Legitimate Resource Name or Location Credential Access OS Credential Dumping	-	medium	Bhavin Patel, Splunk, sventec, Github Community	2021-07-12	2026-09-22	a51bfe1a-94f0-48cc-b4e4-16a110145893	-
	Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...)	Emerging	experimental	dns	-	-	Command and Control Application Layer Protocol Web Protocols Command and Control Dynamic Resolution	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	73e5d24f-493f-4092-bd2f-c72cabda40ee
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
	Detects Bitsadmin connections to IP addresses instead of FQDN names	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Execution, Persistence, Stealth BITS Jobs	-	high	Florian Roth (Nextron Systems)	2022-06-10	2022-08-24	8ccd35a2-1c7c-468b-b568-ac6cdf80eec3
	Detects Bitsadmin connections to domains with uncommon TLDs	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Execution, Persistence, Stealth BITS Jobs	-	high	Florian Roth (Nextron Systems), Tim Shelton	2019-03-07	2026-09-30	9eb68894-7476-4cd6-8752-23b51f5883a7
	Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)	2023-02-15	2024-03-05	3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5
	Detects HTTP request used by Chafer malware to receive data from its C2.	Emerging	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems)	2019-01-31	2024-02-15	fb502828-2db0-438e-93e6-801c7548686d
	Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. (...)	Generic	test	ps_script	windows	PowerShell	Command and Control Application Layer Protocol Web Protocols	-	medium	frack113	2022-01-23	2025-07-18	d4488827-73af-4f8d-9244-7b7662ef046e
Splunk	This analytic detects the usage of the Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes (600 seconds). (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Command and Control Application Layer Protocol Web Protocols Execution Command and Scripting Interpreter AppleScript	-	medium	Radka Viskova, Splunk	2026-09-18	2026-09-22	6bc88a9d-f7de-4257-b526-acf15bc5a517
Splunk	The following analytic detects the use of known suspicious SSL certificates in any observed event where the SSL_CertFingerprint field is present. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Resource Development Develop Capabilities Code Signing Certificates Command and Control Encrypted Channel Asymmetric Cryptography Resource Development Obtain Capabilities Digital Certificates	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-09-22	c43f7b49-2dab-4e76-892e-7f971c2f20f1
Splunk	The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage Command and Control Ingress Tool Transfer Resource Development Obtain Capabilities Tool Command and Control Proxy External Proxy	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	f7e5e792-d907-46c1-a58e-4ff974dc462a
Splunk	The following analytic detects connections with a high Encrypted Visibility Engine (EVE) threat confidence score, indicating potentially malicious behavior within encrypted traffic. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Command and Control Encrypted Channel Asymmetric Cryptography Exfiltration Exfiltration Over C2 Channel Command and Control Ingress Tool Transfer	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	8c15183e-2e70-4db4-86c3-88f8d9129b66
Splunk	This analytic detects Lumma Stealer activity using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services Stealth Obfuscated Files or Information Execution User Execution	-	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	96bce783-c22e-4e48-8cf1-3eb2794c5083
Splunk	The following analytic detects repeated malware file downloads initiated by the same internal host (src) within a short time window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Ingress Tool Transfer Stealth Obfuscated Files or Information	-	medium	Nasreddine Bencherchali, Splunk	2025-04-09	2026-09-22	aeff2bb5-3483-48d4-9be8-c8976194be1e
Splunk	This analytic identifies Snort intrusion signatures that have been triggered by ten or more distinct internal IP addresses within a one-hour window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Ingress Tool Transfer Stealth Obfuscated Files or Information	-	medium	Nasreddine Bencherchali, Splunk	2025-04-16	2026-05-13	a4c76d0a-56b6-44be-814b-939746c4d406
Splunk	The following analytic detects outbound connections initiated by command-line tools such as curl or wget. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Execution Command and Scripting Interpreter Command and Control Ingress Tool Transfer Execution, Persistence, Privilege Escalation Scheduled Task/Job Cron	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	173a1cb9-1814-4128-a9dc-f29dade89957
	Detects DNS requests to Cloudflared tunnels domains. (...)	Generic	test	dns	windows	Sysmon	Command and Control Application Layer Protocol Web Protocols Command and Control Protocol Tunneling	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-12-20	—	a1d9eec5-33b2-4177-8d24-27fe754d0812
	Detects Turla ComRAT network communication.	Emerging	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems)	2020-05-26	2024-02-26	7857f021-007f-4928-8b2c-7aedbe64bb82
	Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton	2020-10-11	2023-02-01	74403157-20f5-415d-89a7-c505779585cf
	Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. (...)	Generic	test	-	-	Kubernetes Audit · Kubernetes	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Leo Tsaousis (@laripping)	2024-03-26	—	a80d927d-ac6e-443f-a867-e8d6e3897318
	Detects suspicious user agent strings used by crypto miners in proxy logs	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems)	2019-10-21	2021-11-27	fa935401-513b-467b-81f4-f9e77aa0dd78
Splunk	The following analytic detects the execution of the curl utility where the command line includes percent-encoded characters and explicit file output options (such as -o or --output). (...)	Anomaly	stable	process_creation	windows · linux	CrowdStrike · Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer Stealth Obfuscated Files or Information	-	medium	Nasreddine Bencherchali, Splunk	2026-03-03	2026-05-13	9a8d5516-4c5e-11ef-9d42-acde48001122
	Detects execution of curl.exe with custom useragent options	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Application Layer Protocol Web Protocols	-	medium	frack113	2022-01-23	2023-02-21	3286d37a-00fd-41c2-a624-a672dcd34e60
	Detects usage of base64 utility to decode arbitrary base64-encoded text	Generic	test	process_creation	linux	Sysmon	Stealth Obfuscated Files or Information	-	low	Daniil Yugoslavskiy, oscd.community	2020-10-19	2021-11-27	e2072cab-8c9a-459b-b63c-40ae79e27031
	Detects usage of base64 utility to decode arbitrary base64-encoded text	Generic	test	process_creation	macos	-	Stealth Obfuscated Files or Information	-	low	Daniil Yugoslavskiy, oscd.community	2020-10-19	2022-11-26	719c22d7-c11a-4f2c-93a6-2cfdd5412f68
	Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session.	Generic	experimental	dns	windows	Sysmon	Command and Control Application Layer Protocol Web Protocols Lateral Movement Exploitation of Remote Services	-	low	Muhammad Faisal (@faisalusuf)	2024-12-19	—	882e858a-3233-4ba8-855e-2f3d3575803d
	Detects DNS query requests to Devtunnels domains. (...)	Generic	test	dns	windows	Sysmon	Command and Control Application Layer Protocol Web Protocols Command and Control Protocol Tunneling	-	medium	citron_ninja	2023-10-25	2023-11-20	1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b
	Detects DNS query requests to Visual Studio Code tunnel domains. (...)	Generic	test	dns	windows	Sysmon	Command and Control Application Layer Protocol Web Protocols	-	medium	citron_ninja	2023-10-25	2023-11-20	b3e6418f-7c7a-4fad-993a-93b65027a9f1
	Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.	Generic	test	file_event	windows	Sysmon	Credential Access Credentials from Password Stores Credential Access Unsecured Credentials Private Keys	-	high	Nounou Mbeiri, Nasreddine Bencherchali (Nextron Systems)	2024-06-26	—	7892ec59-c5bb-496d-8968-e5d210ca3ac4
	Adversaries may search for common password storage locations to obtain user credentials. (...)	Generic	test	ps_script	windows	PowerShell	Credential Access Credentials from Password Stores	-	medium	frack113	2021-12-20	2022-12-25	99c49d9c-34ea-45f7-84a7-4751ae6b2cbc
	Adversaries may search for common password storage locations to obtain user credentials. (...)	Generic	test	ps_script	windows	PowerShell	Credential Access Credentials from Password Stores	-	medium	frack113	2021-12-20	2022-12-25	603c6630-5225-49c1-8047-26c964553e0e
	Detects Winword starting uncommon sub process MicroScMgmt.exe as used in exploits for CVE-2015-1641	Emerging	stable	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location	CVE-2015-1641	critical	Florian Roth (Nextron Systems)	2018-02-22	2021-11-27	7993792c-5ce2-4475-a3db-a3a5539827ef
	Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy (...)	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems)	2017-07-08	2025-01-18	fdd1bfb5-f60b-4a35-910e-f36ed3d0b32f
	Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community	2023-02-15	2025-06-04	cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7
	Detects the execution of certutil with the "encode" flag to encode a file to base64. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)	2019-02-24	2024-03-05	e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a
	Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-05-15	2024-03-05	82a6714f-4899-4f16-9c1e-9a333544d4c3
	Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (...)	Generic	test	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Nasreddine Bencherchali (Nextron Systems)	2024-06-24	—	13c02350-4177-4e45-ac17-cf7ca628ff5e
	Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.). (...)	Generic	test	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)	2020-05-26	2026-07-28	d5866ddf-ce8f-4aea-b28e-d96485a20d3d
	Detects a flashplayer update from an unofficial location	Generic	test	proxy	-	-	Initial Access Drive-by Compromise Stealth Masquerading Match Legitimate Resource Name or Location Execution User Execution Malicious File	-	high	Florian Roth (Nextron Systems)	2017-10-25	2022-08-08	4922a5dd-6743-4fc2-8e81-144374280997
	Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Syma (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Command and Control Ingress Tool Transfer Stealth Masquerading Match Legitimate Resource Name or Location	-	critical	Florian Roth (Nextron Systems)	2020-05-20	2023-03-09	3711eee4-a808-4849-8a14-faf733da3612
	Detects Baby Shark C2 Framework default communication patterns	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	critical	Florian Roth (Nextron Systems)	2021-06-09	2024-02-15	304810ed-8853-437f-9e36-c4975c3dfd7e
	Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Markus Neis, Florian Roth (Nextron Systems)	2024-02-15	—	f3f21ce1-cdef-4bfc-8328-ed2e826f5fac
	Detects user agent and URI paths used by empire agents	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems)	2020-07-13	2024-02-26	b923f7d6-ac89-4a50-a71a-89fb846b4aa8
	Detects the execution of SecurityXploded Tools	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Credential Access Credentials from Password Stores	-	critical	Florian Roth (Nextron Systems)	2018-12-19	2023-02-04	7679d464-4f74-45e2-9e01-ac66c5eb041a
	Detects commandline keywords indicative of potential usge of the tool WinPwn. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Credential Access Credentials from Password Stores Credentials from Web Browsers Execution Native API Discovery Network Service Discovery Discovery Software Discovery Discovery System Information Discovery Credential Access Unsecured Credentials Credentials In Files	-	high	Swachchhanda Shrawan Poudel	2023-12-04	—	d557dc06-62e8-4468-a8e8-7984124908ce
	Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. (...)	Generic	test	ps_script	windows	PowerShell	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Credential Access Credentials from Password Stores Credentials from Web Browsers Execution Native API Discovery Network Service Discovery Discovery Software Discovery Discovery System Information Discovery Credential Access Unsecured Credentials Credentials In Files	-	high	Swachchhanda Shrawan Poudel	2023-12-04	—	851fd622-b675-4d26-b803-14bc7baa517a