malware

PHOREAL S0158

Type: malware
Platform: Windows
Created: 14 December 2017
Last modified: 25 April 2025

PHOREAL is a signature backdoor used by APT32. [1]

TechniquesBottom 12%

Tactics32nd pct

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0158

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups.	Hunting	test	file_access	windows	-	Persistence, Defense Impairment Modify Registry	-	low	frack113	2023-09-15	2024-07-29	337a31c6-46c4-46be-886a-260d7aa78cac
	Detect set Notification_Suppress to 1 to disable the Windows security center notification	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	0c93308a-3f1b-40a9-b649-57ea1a1c1d63
	Detect set DisallowRun to 1 to prevent user running specific computer program	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	275641a5-a492-45e2-a817-7c81e9d9d3e9
	Detect enable rdp feature to allow specific user to rdp connect on the targeted machine	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	37b437cf-3fc5-4c8e-9c94-1d7c9aff842b
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
	Detects specific windows registry modifications made by BlackByte ransomware variants. (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	frack113	2022-01-24	2025-10-21	83314318-052a-4c90-a1ad-660ece38d276
	Attempts to detect system changes made by Blue Mockingbird	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry Execution Windows Management Instrumentation	-	high	Trent Liffick (@tliffick)	2020-05-14	2022-10-09	c3198a27-23a0-4c2c-af19-e5328d49680e
	Attempts to detect system changes made by Blue Mockingbird	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry Execution Windows Management Instrumentation	-	high	Trent Liffick (@tliffick)	2020-05-14	2023-08-17	92b0b372-a939-44ed-a11b-5136cf680e27
	Detect possible persistence using Fax DLL load when service restart	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	frack113	2022-07-17	2022-12-30	9e3357ba-09d4-4fbd-a7c5-ad6386314513
	Detect change of the user account associated with the FAX service to avoid the escalation problem.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	frack113	2022-07-17	2022-12-30	e3fdf743-f05b-4051-990a-b66919be1743
	Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	@SerkinValery, Nasreddine Bencherchali (Nextron Systems)	2023-06-12	2023-08-17	ac9159cc-c364-4304-8f0a-d63fc1a0aabb
Splunk	The following analytic detects the use of `cmd.exe /c` to execute commands, a technique often employed by adversaries and malware to run batch commands or invoke other shells like PowerShell. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	CVE-2021-44228	medium	Teoderick Contreras, Bhavin Patel, Splunk	2021-10-21	2026-05-13	54a6ed00-3256-11ec-b031-acde48001122
Splunk	The following analytic identifies the use of named-pipe impersonation for privilege escalation, commonly associated with Cobalt Strike and similar frameworks. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	medium	Michael Haag, Splunk	2021-05-27	2026-05-13	eb277ba0-b96b-11eb-b00e-acde48001122
	Detects a suspicious command line execution that includes an URL and AppData string in the command l (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Command and Control Ingress Tool Transfer	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community	2019-01-16	2021-11-27	1ac8666b-046f-4201-8aba-1951aaec03a3
	detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hi (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-06-14	—	ee5e119b-1f75-4b34-add8-3be976961e39
	Detects disabling the CrashDump per registry (as used by HermeticWiper)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts Persistence, Defense Impairment Modify Registry	-	medium	Tobias Michalski (Nextron Systems)	2022-02-24	2023-08-17	2ff692c2-4594-41ec-8fcb-46587de769e0
Splunk	The following analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). (...)	Generic	stable	file_event	-	CrushFTP	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Initial Access Exploit Public-Facing Application	CVE-2025-31161	medium	Michael Haag, Splunk	2025-04-14	2026-09-08	82eb7f64-d219-4e21-acfe-956de84c1a35
	Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension. (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	CVE-2020-1048	high	EagleEye Team, Florian Roth (Nextron Systems), NVISO	2020-05-13	2024-03-25	7ec912f2-5175-4868-b811-ec13ad0f8567
Splunk	The following analytic detects executions of cmd.exe spawned by processes that are commonly abused by attackers and do not typically launch cmd.exe. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	dcfd6b40-42f9-469d-a433-2e53f7486664	-
Splunk	The following detects the execution of cscript.exe or wscript.exe processes spawned by cmd.exe, leveraging Endpoint Detection and Response (EDR) telemetry mapped to the Endpoint data model, with additional contextual filtering to improve fidelity and reduce false positives. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	-	medium	Bhavin Patel, Mauricio Velazco, Splunk	2020-04-29	2026-05-13	b89919ed-fe5f-492c-b139-95dbb162039e
	Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL Persistence, Defense Impairment Modify Registry	-	high	Dimitrios Slamaris	2017-05-15	2023-08-17	9d3436ef-9476-4c43-acca-90ce06bdf33a
	Detects registry modifications that change features of internal Windows tools (malware like Agent Te (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113, Nasreddine Bencherchali (Nextron Systems), CrimpSec	2022-03-18	2025-06-04	e2482f8d-3443-4237-b906-cc145d87a076
Splunk	The following analytic detects modifications to the Windows registry aimed at disabling the Registry Editor (regedit). (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-10-02	cd2cf33c-9201-11eb-a10a-acde48001122
	Detects the addition of a key 'MiniNt' to the registry. (...)	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Persistence, Defense Impairment Modify Registry	-	high	Ilyas Ochkov, oscd.community	2019-10-25	2021-11-27	919f2ef0-be2d-4a7a-b635-eb2b41fde044
Splunk	The following analytic detects a suspicious registry modification aimed at disabling security audit logs by adding a specific registry entry. (...)	Generic	stable	registry_event	windows	Sysmon	Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-10-05	2026-05-13	39ebdc68-25b9-11ec-aec7-acde48001122
Splunk	The following analytic detects modifications to the Windows registry that disable the display of hidden files. (...)	Anomaly	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Stealth Hide Artifacts Hidden Files and Directories Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-05-13	6f3ccfa2-91fe-11eb-8f9b-acde48001122
Splunk	The following analytic detects a suspicious registry modification aimed at disabling Windows hotkeys for native applications. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-05-07	2026-05-13	1490f224-ad8b-11eb-8c4f-acde48001122
	Detect set UseActionCenterExperience to 0 to disable the Windows security center notification	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	3ae1a046-f7db-439d-b7ce-b8b366b81fa6
Splunk	The following analytic detects modifications to the registry that disable the CMD prompt application. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-10-02	ff86077c-9212-11eb-a1e6-acde48001122
Splunk	The following analytic detects registry modifications that disable the Control Panel on Windows systems. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-05-13	6ae0148e-9215-11eb-a94a-acde48001122
Splunk	The following analytic detects the modification of the Windows registry to disable the Run application in the Start menu. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-05-13	de81bc46-9213-11eb-adc9-acde48001122
	Detects DNS queries made by the finger utility, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. (...)	Generic	experimental	dns	windows	Sysmon	Command and Control Application Layer Protocol DNS Execution Command and Scripting Interpreter Windows Command Shell	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-11-19	—	c082c2b0-525b-4dbc-9a26-a57dc4692074
	Detects when a user enables DNS-over-HTTPS. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Persistence, Defense Impairment Modify Registry	-	medium	Austin Songer	2021-07-22	2023-08-17	04b45a8a-d11d-49e4-9acc-4a1b524407a5
	Detects Elise backdoor activity used by APT32	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell	-	critical	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2018-01-31	2023-03-09	e507feb7-5f73-4ef6-a970-91bb6f6d744f
	Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-12-15	—	c420410f-c2d8-4010-856b-dffe21866437
	Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-12-15	2023-12-22	98dedfdd-8333-49d4-9f23-d7018cccae53
Splunk	The following analytic detects a suspicious registry modification that enables the plain text credential feature in Windows by setting the "UseLogonCredential" value to 1 in the WDigest registry path. (...)	Generic	stable	registry_event	windows	Sysmon	Persistence, Defense Impairment Modify Registry Credential Access OS Credential Dumping	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-10-05	2026-10-09	0c7d8ffe-25b1-11ec-9f39-acde48001122
	Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	low	Nasreddine Bencherchali (Nextron Systems)	2022-12-09	2023-08-17	90f342e1-1aaa-4e43-b092-39fda57ed11e
	Detects changes to the "TracingDisabled" key in order to disable ETW logging for services.exe (SCM)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	low	Nasreddine Bencherchali (Nextron Systems)	2022-12-09	2023-08-17	4f281b83-0200-4b34-bf35-d24687ea57c2
	Potential adversaries stopping ETW providers recording loaded .NET assemblies.	Generic	test	registry_event	windows	WinEventLog Security	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	high	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-06-05	2022-12-20	a4c90ea1-2634-4ca0-adbb-35eae169b6fc
	Potential adversaries stopping ETW providers recording loaded .NET assemblies.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	high	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-06-05	2023-08-17	bf4fc428-dcc3-4bbd-99fe-2422aeee2544
	Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability rep (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Initial Access Exploit Public-Facing Application	CVE-2020-10189	high	Florian Roth (Nextron Systems)	2020-03-25	2023-01-21	846b866e-2a57-46ee-8e16-85fa92759be7
	Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and Partner (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Privilege Escalation Exploitation for Privilege Escalation Execution, Stealth Hijack Execution Flow	CVE-2019-1378	high	Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro	2019-11-15	2021-11-27	1c373b6d-76ce-4553-997d-8c1da9a6b5f5
	Detects FlowCloud malware registry markers from threat group TA410. (...)	Emerging	test	registry_event	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	critical	NVISO	2020-06-09	2024-03-20	5118765f-6657-4ddb-a487-d7bd673abbf1
Splunk	The following analytic detects the execution of fodhelper.exe, which is known to exploit a User Account Control (UAC) bypass by leveraging specific registry keys. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Persistence, Defense Impairment Modify Registry	-	medium	Michael Haag, Splunk	2021-03-01	2026-10-02	909f8fd8-7ac8-11eb-a1f3-acde48001122
	This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access Brute Force Execution Command and Scripting Interpreter PowerShell Windows Command Shell Discovery Password Policy Discovery Execution, Persistence, Privilege Escalation Scheduled Task/Job Execution Windows Management Instrumentation	-	high	Florian Roth (Nextron Systems)	2022-02-25	2023-03-08	42a993dd-bb3e-48c8-b372-4d6684c4106c
	Detects various execution patterns of the CrackMapExec pentesting framework	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Execution, Persistence, Privilege Escalation Scheduled Task/Job Execution Windows Management Instrumentation	-	high	Thomas Patzke	2020-05-22	2023-11-06	058f4380-962d-40a5-afce-50207d36d7e2

Title

Description

PHOREAL S0158

PHOREAL MITRE reference S0158

Standing S0158

Reach

Coverage

PHOREAL detections S0158