malware

RTM S0148

Type: malware
Platform: Windows
Created: 31 May 2017
Last modified: 16 April 2025

RTM is custom malware written in Delphi. It is used by the group of the same name (RTM). Newer versions of the malware have been reported publicly as Redaman.[1][2]

TechniquesTop 3%

TacticsTop 6%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0148

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups.	Hunting	test	file_access	windows	-	Persistence, Defense Impairment Modify Registry	-	low	frack113	2023-09-15	2024-07-29	337a31c6-46c4-46be-886a-260d7aa78cac
	Detect set Notification_Suppress to 1 to disable the Windows security center notification	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	0c93308a-3f1b-40a9-b649-57ea1a1c1d63
	Detects denied requests by Active Directory Certificate Services. (...)	Generic	test	-	windows	WinEventLog System	Defense Impairment Subvert Trust Controls Install Root Certificate	-	low	@SerkinValery	2024-03-07	—	994bfd6d-0a2e-481e-a861-934069fcf5f5
	Detect set DisallowRun to 1 to prevent user running specific computer program	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	275641a5-a492-45e2-a817-7c81e9d9d3e9
	Detects the deletion of the "Zone.Identifier" ADS. (...)	Hunting	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	low	frack113	2023-09-04	—	7eac0a16-5832-4e81-865f-0268a6d19e4b
	Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...)	Generic	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-09-04	2025-07-04	3109530e-ab47-4cc6-a953-cac5ebcc93ae
	Detect enable rdp feature to allow specific user to rdp connect on the targeted machine	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	37b437cf-3fc5-4c8e-9c94-1d7c9aff842b
	Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	medium	Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community	2020-10-13	2022-10-20	1e53dd56-8d83-4eb4-a43e-b790a05510aa
	This rule will looks any process with low privilege launching Windows Installer service (msiexec.exe (...)	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community	2020-10-13	—	078235c5-6ec5-48e7-94b2-f8b5474379ea
	Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	medium	Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community	2020-10-13	2024-12-01	cd951fdc-4b2f-47f5-ba99-a33bf61e3770
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	Detects DNS queries made by "AppInstaller.EXE". (...)	Generic	test	dns	windows	Sysmon	Command and Control Ingress Tool Transfer	-	medium	frack113	2021-11-24	2023-11-09	7cff77e1-9663-46a3-8260-17f2e1aa9d0a
	Detects suspicious user agent strings used in APT malware in proxy logs	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems), Markus Neis	2019-11-12	2024-02-15	6ec820f2-e963-4801-9127-d8b2dce4d31b
	Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant	Emerging	stable	process_creation	windows	Sysmon · WinEventLog Security	Stealth System Binary Proxy Execution Rundll32	-	critical	Florian Roth (Nextron Systems), @41thexplorer	2018-11-20	2023-03-08	7453575c-a747-40b9-839b-125a0aae324b
	Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant	Emerging	stable	file_event	windows	Sysmon	Stealth System Binary Proxy Execution Rundll32	-	critical	@41thexplorer	2018-11-20	2023-02-20	3a3f81ca-652c-482b-adeb-b1c804727f74
	Detects suspicious user agent string of APT40 Dropbox tool	Emerging	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage	-	high	Thomas Patzke	2019-11-12	2023-05-18	5ba715b6-71b7-44fd-8245-f66893e81b3d
	Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer	-	medium	Victor Sergeev, oscd.community	2020-10-09	2023-10-18	eee00933-a761-4cd0-be70-c42fe91731e7
	The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Initial Access Phishing Spearphishing Attachment Execution User Execution	-	medium	Sreeman	2020-03-13	2022-04-14	24de4f3b-804c-4165-b442-5a06a2302c7e
	Once established within a system or network, an adversary may use automated techniques for collecting internal data.	Generic	test	ps_script	windows	PowerShell	Collection Automated Collection	-	medium	frack113	2021-07-28	2022-12-25	c1dda054-d638-4c16-afc8-53e007f3fbc5
	Once established within a system or network, an adversary may use automated techniques for collecting internal data.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Automated Collection Credential Access Unsecured Credentials Credentials In Files	-	medium	frack113	2021-07-28	2022-11-11	f576a613-2392-4067-9d1a-9345fb58d8d1
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
Splunk	The following analytic identifies anomalous GetObject API activity in AWS, indicating potential data exfiltration attempts. (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Collection Automated Collection	-	medium	Bhavin Patel, Splunk	2023-04-10	2026-05-13	e4384bbf-5835-4831-8d85-694de6ad2cc6
Splunk	The following analytic identifies the creation of AWS Batch jobs that could potentially abuse the AWS Bucket Replication feature on S3 buckets. (...)	Generic	stable	scheduled_job	-	AWS CloudTrail · AWS	Collection Automated Collection	-	medium	Bhavin Patel, Splunk	2023-04-24	2026-05-13	04455dd3-ced7-480f-b8e6-5469b99e98e2
Splunk	The following analytic detects the creation of an AWS DataSync task, which could indicate potential data exfiltration. (...)	Generic	stable	scheduled_job	-	AWS CloudTrail · AWS	Collection Automated Collection	-	medium	Bhavin Patel, Splunk	2023-04-10	2026-05-13	05c4b09f-ea28-4c7c-a7aa-a246f665c8a2
	Detects file creation events linked to the Axios NPM supply chain compromise. (...)	Emerging	experimental	file_event	linux	Sysmon	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	b7cb840c-11f6-47f7-b3ef-5524739c9077
	Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...)	Emerging	experimental	file_event	macos	-	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	2db0458c-05c9-4069-a26f-77becd9c8c13
	Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...)	Emerging	experimental	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Unix Shell Python Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	0a23a62d-c5b3-468b-a072-25064a9a8c87
	Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.	Emerging	experimental	process_creation	macos	-	Execution Command and Scripting Interpreter AppleScript Unix Shell Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	a09ee860-31b3-4586-8a68-0ebd74ce0e5f
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
	Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...)	Emerging	experimental	dns	-	-	Command and Control Application Layer Protocol Web Protocols Command and Control Dynamic Resolution	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	73e5d24f-493f-4092-bd2f-c72cabda40ee
	Detects backup catalog deletions	Generic	test	-	windows	WinEventLog Application	Stealth Indicator Removal File Deletion	-	medium	Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection)	2017-05-12	2022-12-25	9703792d-fd9a-456d-a672-ff92efe4806a
	Detects attackers using tooling with bad opsec defaults. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth System Binary Proxy Execution Rundll32	-	high	Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)	2020-10-23	2024-08-15	a7c3d773-caef-227e-a7e7-c2f13c622329
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
Splunk	The following analytic detects the creation of a batch file (.bat) within the Windows system directory tree, specifically in the System32 or SysWOW64 folders. (...)	Anomaly	stable	file_event	windows	Sysmon	Execution User Execution Malicious File	-	medium	Steven Dick, Michael Haag, Rico Valdez, Splunk	2020-04-29	2026-07-02	503d17cb-9eab-4cf8-a20e-01d5c6987ae3	-
	Detects user data export activity.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	5259cbf2-0a75-48bf-b57a-c54d6fabaef3
	Detects user permission data export attempt.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	87cc6698-3e07-4ba2-9b43-a85a73e151e2
Splunk	The following analytic detects the use of `bitsadmin.exe` with the `transfer` parameter to download a remote object. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution, Persistence, Stealth BITS Jobs Command and Control Ingress Tool Transfer	-	medium	Michael Haag, Sittikorn S	2021-03-30	2026-10-02	80630ff4-8e4c-11eb-aab5-acde48001122
	Detects Bitsadmin connections to IP addresses instead of FQDN names	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Execution, Persistence, Stealth BITS Jobs	-	high	Florian Roth (Nextron Systems)	2022-06-10	2022-08-24	8ccd35a2-1c7c-468b-b568-ac6cdf80eec3
	Detects Bitsadmin connections to domains with uncommon TLDs	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Execution, Persistence, Stealth BITS Jobs	-	high	Florian Roth (Nextron Systems), Tim Shelton	2019-03-07	2026-09-30	9eb68894-7476-4cd6-8752-23b51f5883a7
	Detects specific windows registry modifications made by BlackByte ransomware variants. (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	frack113	2022-01-24	2025-10-21	83314318-052a-4c90-a1ad-660ece38d276
	Attempts to detect system changes made by Blue Mockingbird	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry Execution Windows Management Instrumentation	-	high	Trent Liffick (@tliffick)	2020-05-14	2022-10-09	c3198a27-23a0-4c2c-af19-e5328d49680e
	Attempts to detect system changes made by Blue Mockingbird	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry Execution Windows Management Instrumentation	-	high	Trent Liffick (@tliffick)	2020-05-14	2023-08-17	92b0b372-a939-44ed-a11b-5136cf680e27
	detects BPFDoor .lock and .pid files access in temporary file storage facility	Generic	test	file_event	linux	Linux Auditd	Execution Command and Scripting Interpreter Execution Native API	-	high	Rafal Piasecki	2022-08-10	2026-03-30	808146b2-9332-4d78-9416-d7e47012d83d
	Detects execution of Chromium based browser in headless mode	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts Hidden Window Command and Control Ingress Tool Transfer	-	low	Nasreddine Bencherchali (Nextron Systems)	2023-09-12	—	ef9dcfed-690c-4c5d-a9d1-482cd422225c
	Bypasses User Account Control using a fileless method	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	frack113	2022-01-05	2023-08-17	46dd5308-4572-4d12-aa43-8938f0184d4f
	Detects the setting of the environement variable "windir" to a non default value. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	frack113, Nextron Systems	2022-01-06	2024-01-30	724ea201-6514-4f38-9739-e5973c34f49a
	Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install sp (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Stealth System Binary Proxy Execution CMSTP	-	high	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	2019-10-24	2022-08-30	e66779cc-383e-4224-a3a4-267eeb585c40
	Identifies use of Fodhelper.exe to bypass User Account Control. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control	-	high	E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community	2019-10-24	2021-11-27	7f741dcf-fc22-4759-87b4-9ae8376676a2

Title

Description

RTM S0148

RTM MITRE reference S0148

Standing S0148

Reach

Coverage

RTM detections S0148