malware

Flame S0143

Type: malware
Platform: Windows
Created: 31 May 2017
Last modified: 16 April 2025

Flame is a sophisticated toolkit that has been used to collect information since at least 2010, largely targeting Middle East countries. [1]

Techniques47th pct

TacticsTop 20%

Threat groupsNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0143

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
Splunk	The following analytic identifies potential lateral movement activities within an organization's Active Directory (AD) environment. (...)	Correlation	stable	-	-	-	Lateral Movement Exploitation of Remote Services	-	medium	Michael Haag, Splunk	2023-04-19	2026-05-13	6aa6f9dd-adfe-45a8-8f74-c4c7a0d7d037
	Detects an issue in apache logs that reports threading related errors	Generic	test	-	-	Apache	Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services	-	medium	Florian Roth (Nextron Systems)	2019-01-22	2021-11-27	e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c
	Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant	Emerging	stable	process_creation	windows	Sysmon · WinEventLog Security	Stealth System Binary Proxy Execution Rundll32	-	critical	Florian Roth (Nextron Systems), @41thexplorer	2018-11-20	2023-03-08	7453575c-a747-40b9-839b-125a0aae324b
	Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant	Emerging	stable	file_event	windows	Sysmon	Stealth System Binary Proxy Execution Rundll32	-	critical	@41thexplorer	2018-11-20	2023-02-20	3a3f81ca-652c-482b-adeb-b1c804727f74
	Detects attempts to record audio using the arecord and ecasound utilities.	Generic	test	process_creation	linux	Linux Auditd	Collection Audio Capture	-	low	Pawel Mazur, Milad Cheraghi	2021-09-04	2025-12-05	a7af2487-9c2f-42e4-9bb9-ff961f0561d5
	Detects audio capture via PowerShell Cmdlet.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Audio Capture	-	medium	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Nasreddine Bencherchali (Nextron Systems)	2019-10-24	2023-04-06	932fb0d8-692b-4b0f-a26e-5643a50fe7d6
	Detect attacker collecting audio via SoundRecorder application.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Audio Capture	-	medium	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	2019-10-24	2021-11-27	83865853-59aa-449e-9600-74b9d89a6d6e
	Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. (...)	Generic	test	-	windows	WinEventLog Application	Impact Endpoint Denial of Service Application or System Exploitation Execution Exploitation for Client Execution Credential Access Exploitation for Credential Access Privilege Escalation Exploitation for Privilege Escalation Stealth Exploitation for Stealth Lateral Movement Exploitation of Remote Services	CVE-2020-0601	critical	Florian Roth (Nextron Systems), Zach Mathis	2020-01-15	2022-10-22	48d91a3a-2363-43ba-a456-ca71ac3da5c2
	Detects attackers using tooling with bad opsec defaults. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth System Binary Proxy Execution Rundll32	-	high	Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)	2020-10-23	2024-08-15	a7c3d773-caef-227e-a7e7-c2f13c622329
Splunk	This analytic detects creation of new user accounts on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Persistence Create Account Local Account Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Local Accounts	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	9c8e4f2a-7d3b-4e5c-8a9f-1b6d4e8c3f5a
	Find local accounts being created or modified as well as remote authentication configurations	Generic	test	authentication	-	Cisco AAA · Cisco	Persistence, Privilege Escalation Account Manipulation Persistence Create Account Local Account	-	high	Austin Clark	2019-08-12	2023-01-04	6d844f0f-1c18-41af-8f19-33e7654edfc3	-
Splunk	This analytic detects Lumma Stealer activity using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services Stealth Obfuscated Files or Information Execution User Execution	-	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	96bce783-c22e-4e48-8cf1-3eb2794c5083
Splunk	This analytic detects activity associated with "Static Tundra" threat actor abuse of the Cisco Smart (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Impact Endpoint Denial of Service Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services	-	medium	Bhavin Patel, Michael Haag, Splunk	2025-04-16	2026-05-13	7e9a5a2c-2f1a-4b6a-9a4b-9e7d9c8f5a21
Splunk	This analytic detects exploitation activity of CVE-2023-27532 using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter PowerShell Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services Credential Access OS Credential Dumping LSASS Memory	CVE-2023-27532	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	7b7c2e92-f0b2-48d2-9c9b-b8de52b6b2ae
	Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth System Binary Proxy Execution Rundll32	-	high	Wojciech Lesicki	2021-06-01	2022-09-16	ae9c6a7c-9521-42a6-915e-5aaa8689d529
	Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth System Binary Proxy Execution Rundll32	-	medium	Julia Fomina, oscd.community	2020-10-05	2023-02-09	9386d78a-7207-4048-9c9f-a93a7c2d1c05
	Sysmon registry detection of a local hidden user account.	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Persistence Create Account Local Account	-	high	Christian Burkard (Nextron Systems)	2021-05-03	2025-10-31	460479f3-80b7-42da-9c43-2cc1d54dbccd
	Detects the creation of a new user account. (...)	Generic	test	process_creation	macos	-	Persistence Create Account Local Account	-	low	Alejandro Ortuno, oscd.community	2020-10-06	2023-02-18	51719bf5-e4fd-4e44-8ba8-b830e7ac0731
	Detects the creation of a new user account. (...)	Generic	test	process_creation	linux	Linux Auditd	Persistence Create Account Local Account	-	medium	Marie Euler, Pawel Mazur	2020-05-18	2022-12-20	759d0d51-bc99-4b5e-9add-8f5b2c8e7512
	Detects creation of local users via the net.exe command with the name of "DarkGate"	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence Create Account Local Account	-	high	X__Junior (Nextron Systems)	2023-08-27	2023-10-15	bf906d7b-7070-4642-8383-e404cf26eba5
Splunk	The following analytic detects changes to computer accounts using an anonymous logon. (...)	Hunting	stable	account_management	windows	WinEventLog Security	Lateral Movement Exploitation of Remote Services	CVE-2020-1472	medium	Rod Soto, Jose Hernandez, Splunk	2020-09-18	2026-05-13	1400624a-d42d-484d-8843-e6753e6e3645
Splunk	The following analytic detects the creation of new accounts elevated to local administrators. (...)	Generic	stable	account_management	windows	WinEventLog Security	Persistence Create Account Local Account	-	medium	David Dorsey, Splunk	2020-04-29	2026-10-09	b25f6f62-0712-43c1-b203-083231ffd97d
	Detects calls of DLLs exports by ordinal numbers via rundll32.dll.	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security	Stealth System Binary Proxy Execution Rundll32	-	medium	Florian Roth (Nextron Systems)	2019-10-22	2024-07-16	e79a9e79-eb72-4e78-a628-0e7e8f59e89c
	Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session.	Generic	experimental	dns	windows	Sysmon	Command and Control Application Layer Protocol Web Protocols Lateral Movement Exploitation of Remote Services	-	low	Muhammad Faisal (@faisalusuf)	2024-12-19	—	882e858a-3233-4ba8-855e-2f3d3575803d
	Detects a specific export function name used by one of EquationGroup tools	Emerging	stable	process_creation	windows	Sysmon · WinEventLog Security	Stealth System Binary Proxy Execution Rundll32	-	critical	Florian Roth (Nextron Systems)	2019-03-04	2023-03-09	d465d1d8-27a2-4cca-9621-a800f37cf72e
Splunk	This detection identifies the creation, deletion, or modification of a local user account on an ESXi host. (...)	Anomaly	stable	-	esxi	VMware ESXi · VMware	Persistence, Privilege Escalation Account Manipulation Persistence Create Account Local Account Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	b5e3b024-a7bb-4019-8975-46cf54485e78
	Detects Golden Chickens deployment method as used by Evilnum and described in ESET July 2020 report	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth System Binary Proxy Execution Rundll32	-	critical	Florian Roth (Nextron Systems)	2020-07-10	2023-03-09	8acf3cfa-1e8c-4099-83de-a0c4038e18f0
	Detects the execution of the commonly used ZeroLogon PoC executable.	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Lateral Movement Exploitation of Remote Services	CVE-2020-1472	high	@Kostastsale, TheDFIRReport	2022-02-12	—	dcc6a01e-9471-44a0-a699-71ea96f8ed8b
	Detects exploitation attempt of CVE-2023-46214, a remote code execution (RCE) in Splunk Enterprise t (...)	Emerging	test	webserver	-	-	Lateral Movement Exploitation of Remote Services	CVE-2023-46214	high	Lars B. P. Frydenskov(Trifork Security)	2023-11-27	—	ba5268de-4dd4-4d5c-8a90-2b5e6dc1aff8
	Detects external disk drives or plugged-in USB devices.	Generic	test	-	windows	WinEventLog Security	Initial Access Hardware Additions Initial Access, Lateral Movement Replication Through Removable Media	-	low	Keith Wright	2019-11-20	2024-02-09	f69a87ea-955e-4fb4-adb2-bb9fd6685632
	Detects Archer malware invocation via rundll32	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth System Binary Proxy Execution Rundll32	-	high	Florian Roth (Nextron Systems)	2017-06-03	2021-11-27	3d4aebe0-6d29-45b2-a8a4-3dfde586a26d
	Detects the creation of an administrator account on a Fortinet FortiGate Firewall.	Generic	experimental	-	-	Windows Event · FortiGate	Persistence Create Account Local Account	-	medium	Marco Pedrinazzi (@pedrinazziM) (InTheCyber)	2025-11-01	—	cd0a4943-0edd-42cf-b50c-06f77a10d4c1
	Detects the creation of a new local user on a Fortinet FortiGate Firewall. (...)	Generic	experimental	-	-	Windows Event · FortiGate	Persistence Create Account Local Account	-	medium	Marco Pedrinazzi (@pedrinazziM) (InTheCyber)	2025-11-01	—	ddbbe845-1d74-43a8-8231-2156d180234d
	F-Secure C3 produces DLLs with a default exported StartNodeRelay function.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth System Binary Proxy Execution Rundll32	-	critical	Alfie Champion (ajpc500)	2021-06-02	2023-03-05	b18c9d4c-fac9-4708-bd06-dd5bfacf200f
	Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Execution Native API Stealth System Binary Proxy Execution Rundll32	-	high	Alexander Rausch	2020-06-24	2023-03-01	95022b85-ff2a-49fa-939a-d7b8f56eeb9b
	Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Lateral Movement Exploitation of Remote Services	-	high	@Kostastsale, Nasreddine Bencherchali (Nextron Systems)	2022-10-07	2024-08-23	b0ce780f-10bd-496d-9067-066d23dc3aa5
	Detects the creation of a local hidden user account which should not happen for event ID 4720.	Generic	test	account_management	windows	WinEventLog Security	Persistence Create Account Local Account	-	high	Christian Burkard (Nextron Systems)	2021-05-03	2024-01-16	7b449a5e-1db5-4dd0-a2dc-4e3a67282538
	Detects a suspicious child process of a Microsoft HTML Help (HH.exe)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic JavaScript Initial Access Phishing Spearphishing Attachment Stealth System Binary Proxy Execution Compiled HTML File Regsvr32 Rundll32 Execution Windows Management Instrumentation	-	high	Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)	2020-04-01	2023-04-12	52cad028-0ff0-4854-8f67-d25dfcbc78b4
	Detects RunDLL32.exe executing a single digit DLL named "1.dll" with the export function "DllRegisterServer". (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth System Binary Proxy Execution Rundll32	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-08-31	—	2bd8e100-5b3b-4b6a-bbb5-b129d3ddddc5
	Detects Kapeka backdoor process execution pattern, where the dropper launch the backdoor binary by calling rundll32 and passing the backdoor's first export ordinal (#1) with a "-d" argument.	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth System Binary Proxy Execution Rundll32	-	high	Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)	2024-07-03	—	e98f741c-6a5b-4c83-bc2a-1f4e58d07b12
	Detects the Kapeka Backdoor binary being loaded by rundll32.exe. (...)	Emerging	test	image_load	windows	Sysmon	Stealth System Binary Proxy Execution Rundll32 Execution User Execution Malicious File	-	high	Swachchhanda Shrawan Poudel	2024-07-03	—	a7e6b1f9-8d2c-4f1e-9a7d-63e4c8a2bf4c
Splunk	The following analytic detects the creation of new user accounts on Linux systems using commands like "useradd" or "adduser." It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. (...)	Hunting	stable	process_creation	linux	Sysmon · Cisco	Persistence Create Account Local Account	-	medium	Teoderick Contreras, Bhavin Patel, Splunk	2022-01-10	2026-10-02	51fbcaf2-6259-11ec-b0f3-acde48001122
Splunk	The following analytic detects the creation of new user accounts on Linux systems using commands like "useradd" or "adduser." It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Persistence Create Account Local Account	-	medium	Teoderick Contreras, Splunk	2022-01-10	2026-10-02	aae66dc0-74b4-4807-b480-b35f8027abb4
Splunk	The following analytic detects the suspicious add user account type. (...)	Anomaly	stable	account_management	linux	Linux Auditd	Persistence Create Account Local Account	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	f8c325ea-506e-4105-8ccf-da1492e90115
Splunk	The following analytic detects Redis processes spawning a system shell command. (...)	Generic	stable	process_creation	linux	Sysmon	Lateral Movement Exploitation of Remote Services Persistence Server Software Component	CVE-2022-0543	medium	Raven Tait, Splunk	2026-07-08	2026-07-08	098bbfa8-a591-44ab-9ec0-ae8ee82b4450
	Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.	Hunting	test	ps_module	windows	PowerShell	Discovery Software Discovery Security Software Discovery Discovery System Network Configuration Discovery	-	low	Christopher Peacock @SecurePeacock, SCYTHE @scythe_io	2023-07-13	—	ea207a23-b441-4a17-9f76-ad5be47d51d3
	Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. (...)	Generic	test	account_management	windows	WinEventLog Security	Persistence Create Account Local Account	-	low	Patrick Bareiss	2019-04-18	2021-01-17	66b6be3d-55d0-4f47-9855-d69df21740ea
	Detects an attempt to create a new user account via ADSI (Active Directory Service Interfaces) using (...)	Generic	experimental	ps_script	windows	PowerShell	Persistence Create Account Local Account Domain Account	-	medium	William Gokah (idea), Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems)	2026-08-13	—	e50d5d26-0cf6-4045-b82b-13c0a4e316be
	Detects PowerShell command line arguments containing ADSI (Active Directory Service Interfaces) patt (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Persistence Create Account Local Account Domain Account	-	medium	William Gokah (idea), Raylee Hawkins, Swachchhanda Shrawan Poudel (Nextron Systems)	2026-08-13	—	7c9fed65-039a-4055-8c23-fa763d94aff6
	Identifies the creation of local users via the net.exe command.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence Create Account Local Account	-	medium	Endgame, JHasenbusch (adapted to Sigma for oscd.community)	2018-10-30	2023-02-21	cd219ff3-fa99-45d4-8380-a7d15116c6dc

Title

Description

Flame S0143

Flame MITRE reference S0143

Standing S0143

Reach

Coverage

Flame detections S0143