malware

EvilGrab S0152

Type: malware
Platform: Windows
Created: 14 December 2017
Last modified: 16 April 2025

EvilGrab is a malware family with common reconnaissance capabilities. It has been deployed by menuPass via malicious Microsoft Office documents as part of spearphishing campaigns. [1]

TechniquesBottom 23%

Tactics32nd pct

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0152

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects attempts to record audio using the arecord and ecasound utilities.	Generic	test	process_creation	linux	Linux Auditd	Collection Audio Capture	-	low	Pawel Mazur, Milad Cheraghi	2021-09-04	2025-12-05	a7af2487-9c2f-42e4-9bb9-ff961f0561d5
	Detects audio capture via PowerShell Cmdlet.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Audio Capture	-	medium	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Nasreddine Bencherchali (Nextron Systems)	2019-10-24	2023-04-06	932fb0d8-692b-4b0f-a26e-5643a50fe7d6
	Detect attacker collecting audio via SoundRecorder application.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Audio Capture	-	medium	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	2019-10-24	2021-11-27	83865853-59aa-449e-9600-74b9d89a6d6e
	Detects modification of Windows Registry Classes keys used for persistence. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2025-10-22	9df5f547-c86a-433e-b533-f2794357e242
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name)	2019-10-25	2025-10-22	f59c3faf-50f3-464b-9f4c-1b67ab512d99
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2023-08-17	f674e36a-4b91-431e-8aef-f8a96c2aca35
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2025-10-22	20f0ee37-5942-4e45-b7d5-c5b5db9df5cd
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2025-10-22	cbf93e5d-ca6c-4722-8bea-e9119007c248
	Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems)	2019-10-25	2026-01-05	24357373-078f-44ed-9ac4-6d334a668a11
	Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of e (...)	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	CVE-2022-30190	high	Vadim Varganov, Florian Roth (Nextron Systems)	2022-08-24	2023-02-23	318557a5-150c-4c8d-b70e-a9910e199857
	Detects the setting of a custom protocol handler with the name "rogue". (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	CVE-2022-38028	high	Nasreddine Bencherchali (Nextron Systems)	2024-04-23	—	5cdeb555-65de-4767-99fe-e26807465148
	Detects the setting of the DLL that handles the custom protocol handler. (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	CVE-2022-38028	high	Nasreddine Bencherchali (Nextron Systems)	2024-04-23	—	d807056b-0e00-4cec-b7f8-b8b7518e382b
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2023-08-17	a80f662f-022f-4429-9b8c-b1a41aaa6688
	Detects the setting of a new value in the Autorun key that is used by the Kapeka backdoor for persistence.	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Swachchhanda Shrawan Poudel	2024-07-03	—	c0c67b21-eb8a-4c84-a395-40473ec3b482
	Detects registry key used by Leviathan APT in Malaysian focused campaign	Emerging	test	registry_event	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	critical	Aidan Bracher	2020-07-07	2023-09-19	70d43542-cd2d-483c-8f30-f16b436fd7db
	Detect attempt to enable auditing of TTY input	Generic	test	file_event	linux	Linux Auditd	Credential Access, Collection Input Capture Keylogging Credential Access OS Credential Dumping	-	high	Pawel Mazur	2021-05-24	2022-12-18	49aae26c-450e-448b-911d-b3c13d178dfc
	Detect modification of the User Shell Folders registry values for Startup or Common Startup which could indicate persistence attempts. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	frack113, Swachchhanda Shrawan Poudel (Nextron Systems)	2022-10-01	2026-01-05	9c226817-8dc9-46c2-a58d-66655aafd7dc
	Detects abusing Windows 10 Narrator's Feedback-Hub	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Dmitriy Lifanov, oscd.community	2019-10-25	2022-03-26	f663a6d9-9d1b-49b8-b2b1-0637914d199a
	Detects suspicious new RUN key element pointing to an executable in a suspicious folder	Generic	experimental	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing, Swachchhanda Shrawan Poudel (Nextron Systems)	2018-08-25	2025-10-06	02ee49e2-e294-4d0f-9278-f5b3212fc588
	Detects modification of autostart extensibility point (ASEP) in registry. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2026-08-28	baecf8fb-edbf-429f-9ade-31fc3f22b970
	Detects instances where an SIP service on an OpenCanary node has had a SIP request.	Generic	test	-	-	OpenCanary	Collection Audio Capture	-	high	Security Onion Solutions	2024-03-08	—	e30de276-68ec-435c-ab99-ef3befec6c61
	Detects the enabling of the "EnablePeriodicBackup" registry value. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Collection Screen Capture	-	medium	Nasreddine Bencherchali (Nextron Systems)	2024-07-01	—	973ef012-8f1a-4c40-93b4-7e659a5cd17f
	Detects changes to the "Winlogon" registry key where a process will set the value of the "Shell" to a value that was observed being used by KamiKakaBot samples in order to achieve persistence.	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Nasreddine Bencherchali (Nextron Systems), X__Junior	2024-03-22	—	c9b86500-1ec2-4de6-9120-d744c8fb5caf
	Detects PowerShell scripts that contains reference to keystroke capturing functions	Generic	test	ps_script	windows	PowerShell	Credential Access, Collection Input Capture Keylogging	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-01-04	—	965e2db9-eddb-4cf6-a986-7a967df651e4
	Detects suspicious command line reg.exe tool adding key to RUN key in Registry	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)	2021-06-28	2025-02-17	de587dce-915e-4218-aac4-835ca6af6f70
	Detects Ryuk ransomware activity	Emerging	stable	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Florian Roth (Nextron Systems), Vasiliy Burov, Nasreddine Bencherchali (Nextron Systems)	2019-12-16	2023-02-03	c37510b8-2107-4b78-aa32-72f251e7a844
	Detects PowerShell writing startup shortcuts. (...)	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Christopher Peacock '@securepeacock', SCYTHE	2021-10-24	2023-02-23	92fa78e7-4d39-45f1-91a3-8b23f3f1088d
	Detects potential suspicious behaviour using secedit.exe. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access, Collection Adversary-in-the-Middle Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Authentication Package Port Monitors Active Setup Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Persistence, Privilege Escalation Event Triggered Execution Netsh Helper DLL Accessibility Features Stealth Hide Artifacts Hidden Users Execution, Stealth Hijack Execution Flow Path Interception by PATH Environment Variable Persistence, Defense Impairment, Credential Access Modify Authentication Process Password Filter DLL Persistence Server Software Component Terminal Services DLL Discovery System Information Discovery	-	medium	Janantha Marasinghe	2022-11-18	2022-12-30	c2c76b77-32be-4d1f-82c9-7e544bdfe0eb
	Adversaries may log user keystrokes to intercept credentials as the user types them.	Generic	test	ps_script	windows	PowerShell	Credential Access, Collection Input Capture Keylogging	-	medium	frack113	2021-07-30	2022-07-11	34f90d3c-c297-49e9-b26d-911b05a4866c
	Potential adversaries accessing the microphone and webcam in an endpoint.	Generic	test	registry_event	windows	WinEventLog Security	Collection Audio Capture	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-06-07	2021-11-27	8cd538a4-62d5-4e83-810b-12d41e428d6e
Splunk	The following analytic identifies modifications to registry keys commonly used for persistence mechanisms. (...)	Generic	stable	registry_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk	2020-04-29	2026-10-09	f5f6af30-7aa7-4295-bfe9-07fe87c01a4b
	Detects a possible persistence mechanism using RUN key for Windows Explorer and pointing to a suspic (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Florian Roth (Nextron Systems), oscd.community	2018-07-18	2023-12-11	b7916c2a-fa2f-4795-9477-32b731f70f11
	Detects the setting of a registry inside the "\Shell\Open\Command" value with PowerShell classes from the "System.Security.Cryptography" namespace. (...)	Hunting	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information Command Obfuscation	-	medium	Andreas Braathen (mnemonic.io)	2023-12-01	—	1c2a3268-3881-414a-80af-a5b313b14c0e
Splunk	The following analytic detects the creation of files in the Remcos folder within the AppData directory, specifically targeting keylog and clipboard log files. (...)	Generic	stable	file_event	windows	Sysmon	Collection Screen Capture	-	medium	Teoderick Contreras, Splunk, Sanjay Govind	2021-09-22	2026-05-13	25ae862a-1ac3-11ec-94a1-acde48001122
	Detects attempts to use screencapture to collect macOS screenshots	Generic	test	process_creation	macos	-	Collection Screen Capture	-	low	remotephone, oscd.community	2020-10-13	2021-11-27	0877ed01-da46-4c49-8476-d49cdd80dfa7
	Detects execution of Windows Problem Steps Recorder (psr.exe), a utility used to record the user screen and clicks.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Screen Capture	-	medium	Beyu Denis, oscd.community	2019-10-12	2024-01-04	2158f96f-43c2-43cb-952a-ab4580f32382
	Detects adversary creating screen capture of a desktop with Import Tool. (...)	Generic	test	process_creation	linux	Linux Auditd	Collection Screen Capture	-	low	Pawel Mazur	2021-09-21	2022-10-09	dbe4b9c5-c254-4258-9688-d6af0b7967fd
	Detects adversary creating screen capture of a full with xwd. (...)	Generic	test	process_creation	linux	Linux Auditd	Collection Screen Capture	-	low	Pawel Mazur	2021-09-13	2022-12-18	e2f17c5d-b02a-442b-9052-6eb89c9fec9c
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Persistence, Privilege Escalation Event Triggered Execution AppCert DLLs	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2023-08-17	046218bd-e0d8-4113-a3c3-895a12b2b298
	Detects Silence downloader. (...)	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Discovery Process Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Owner/User Discovery	-	high	Alina Stepchenkova, Roman Rezvukhin, Group-IB, oscd.community	2019-11-01	2023-02-24	170901d1-de11-4de7-bccb-8fa13678d857	-
	A General detection for files being created in the Windows startup directory. (...)	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-05-02	2025-12-03	2aa0a6b4-a865-495b-ab51-c28249537b75
	Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware.	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Execution Windows Management Instrumentation	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-02-17	—	c80e66d8-1780-48a9-b412-46663fd21ac0
	Detects Processes accessing the camera and microphone from suspicious folder	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Collection Audio Capture Collection Video Capture	-	high	Den Iuzvyk	2020-06-07	2022-10-09	62120148-6b7a-42be-8b91-271c04e281a3
Splunk	The following analytic detects the creation of image files in the AppData folder by processes that also have a file reference in the same folder. (...)	Generic	stable	process_creation	windows	Sysmon	Collection Screen Capture	-	medium	Teoderick Contreras, Splunk	2021-09-22	2026-05-13	f6f904c4-1ac0-11ec-806b-acde48001122
	Detects potential PowerShell commands or code within registry run keys	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	frack113, Florian Roth (Nextron Systems)	2022-03-17	2025-07-18	8d85cf08-bf97-4260-ba49-986a2a65129c
	Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Interne (...)	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Florian Roth (Nextron Systems), Swachchhanda Shrawan Poude (Nextron Systems)	2019-10-01	2025-02-17	9c5037d1-c568-49b3-88c7-9846a5bdc2be
	Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common persistence technique used by threat actors. (...)	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Execution User Execution Malicious File	-	high	Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)	2022-08-10	2025-10-12	28208707-fe31-437f-9a7f-4b1108b94d2e
	Detects suspicious inline VBScript keywords as used by UNC2452	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Florian Roth (Nextron Systems)	2021-03-05	2022-10-09	20c3f09d-c53d-4e85-8b74-6aa50e2f1b61
Splunk	The following analytic detects the creation of .wav files in the AppData folder, a behavior associated with Remcos RAT malware, which stores audio recordings in this location for data exfiltration. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Collection Screen Capture	-	medium	Teoderick Contreras, Splunk	2021-09-22	2026-05-13	5be109e6-1ac5-11ec-b421-acde48001122
	Detects processes loading "System.Drawing.ni.dll". (...)	Hunting	test	image_load	windows	Sysmon	Collection Screen Capture	-	low	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-05-02	2023-02-22	666ecfc7-229d-42b8-821e-1a8f8cb7057c

Title

Description

EvilGrab S0152

EvilGrab MITRE reference S0152

Standing S0152

Reach

Coverage

EvilGrab detections S0152