malware
Komplex is a backdoor that has been used by APT28 on OS X and appears to be developed in a similar manner to XAgentOSX.[1] [2]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
The OsInfo function in Komplex collects the current running username.3
The OsInfo function in Komplex collects a running process list.4
The Komplex trojan creates a persistent launch agent called with $HOME/Library/LaunchAgents/com.apple.updates.plist with launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist.7
The Komplex payload is stored in a hidden directory at /Users/Shared/.local/kextd.8
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
33rd percentile · 67% of 825 ATT&CK software entries have more Enterprise techniques.
41st percentile · 59% of 825 ATT&CK software entries have more tactics spanned.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
19th percentile · 81% of 825 ATT&CK software entries have more detection rules per technique.
160 distinct rules cover the 7 techniques recorded for this malware. 106 Sigma · 54 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects the deletion of the "Zone.Identifier" ADS. (...) | Hunting | test | file_delete | windows | Sysmon | - | low | frack113 | 2023-09-04 | — | 7eac0a16-5832-4e81-865f-0268a6d19e4b | ||||
Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...) | Generic | test | file_delete | windows | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-09-04 | 2025-07-04 | 3109530e-ab47-4cc6-a953-cac5ebcc93ae | ||||
Detects suspicious user agent strings used in APT malware in proxy logs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Markus Neis | 2019-11-12 | 2024-02-15 | 6ec820f2-e963-4801-9127-d8b2dce4d31b | ||||
Detects suspicious user agent string of APT40 Dropbox tool | Emerging | test | proxy | - | - | - | high | Thomas Patzke | 2019-11-12 | 2023-05-18 | 5ba715b6-71b7-44fd-8245-f66893e81b3d | ||||
Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. (...) | Emerging | experimental | file_event | macos | - | - | high | Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital) | 2025-11-22 | — | e710a880-1f18-4417-b6a0-b5afdf7e3023 | ||||
Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...) | Emerging | experimental | dns | - | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 73e5d24f-493f-4092-bd2f-c72cabda40ee | ||||
Detects backup catalog deletions | Generic | test | - | windows | WinEventLog Application | - | medium | Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection) | 2017-05-12 | 2022-12-25 | 9703792d-fd9a-456d-a672-ff92efe4806a | ||||
Detects Bitsadmin connections to IP addresses instead of FQDN names | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2022-06-10 | 2022-08-24 | 8ccd35a2-1c7c-468b-b568-ac6cdf80eec3 | ||||
Detects Bitsadmin connections to domains with uncommon TLDs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Tim Shelton | 2019-03-07 | 2026-09-30 | 9eb68894-7476-4cd6-8752-23b51f5883a7 | ||||
Detects HTTP request used by Chafer malware to receive data from its C2. | Emerging | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2019-01-31 | 2024-02-15 | fb502828-2db0-438e-93e6-801c7548686d | ||||
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. (...) | Generic | test | ps_script | windows | PowerShell | - | medium | frack113 | 2022-01-23 | 2025-07-18 | d4488827-73af-4f8d-9244-7b7662ef046e | ||||
Splunk | The following analytic identifies the execution of the "whoami" command with the "/group" flag, where the results are passed to the "find" command in order to look for a the string "12288". (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Splunk | 2021-09-14 | 2026-05-13 | a9079b18-1633-11ec-859c-acde48001122 | - | ||
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | high | Florian Roth (Nextron Systems), MSTI (query) | 2022-10-01 | — | fa3c117a-bc0d-416e-a31b-0c0e80653efb | |||||
Find information about network devices that is not stored in config files | Generic | test | authentication | - | Cisco AAA · Cisco | - | low | Austin Clark | 2019-08-12 | 2023-01-04 | 9705a6a1-6db6-4a16-a987-15b7151e299b | ||||
See what files are being deleted from flash file systems | Generic | test | authentication | - | Cisco AAA · Cisco | - | medium | Austin Clark | 2019-08-12 | 2023-01-04 | 71d65515-c436-43c0-841b-236b1f32c21e | - | |||
Splunk | This analytic detects the usage of the Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes (600 seconds). (...) | Anomaly | stable | network_connection | - | Cisco NVM · Cisco | - | medium | Radka Viskova, Splunk | 2026-09-18 | 2026-09-22 | 6bc88a9d-f7de-4257-b526-acf15bc5a517 | |||
Splunk | The following analytic detects the use of known suspicious SSL certificates in any observed event where the SSL_CertFingerprint field is present. (...) | Generic | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-09-22 | c43f7b49-2dab-4e76-892e-7f971c2f20f1 | |||
Splunk | The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | f7e5e792-d907-46c1-a58e-4ff974dc462a | |||
Splunk | The following analytic detects connections with a high Encrypted Visibility Engine (EVE) threat confidence score, indicating potentially malicious behavior within encrypted traffic. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 8c15183e-2e70-4db4-86c3-88f8d9129b66 | |||
Splunk | The following analytic detects outbound connections initiated by command-line tools such as curl or wget. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 173a1cb9-1814-4128-a9dc-f29dade89957 | |||
Splunk | The following analytic detects the execution of `cipher.exe` with the `/w` flag to clear unallocated sectors on a disk. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Splunk | 2021-06-10 | 2026-05-13 | cd80a6ac-c9d9-11eb-8839-acde48001122 | |||
Detects DNS requests to Cloudflared tunnels domains. (...) | Generic | test | dns | windows | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-12-20 | — | a1d9eec5-33b2-4177-8d24-27fe754d0812 | ||||
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2022-11-10 | 2022-11-17 | 435e10e4-992a-4281-96f3-38b11106adde | ||||
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file | Generic | test | ps_script | windows | PowerShell | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2022-11-17 | — | db885529-903f-4c5d-9864-28fe199e6370 | ||||
Detects Turla ComRAT network communication. | Emerging | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2020-05-26 | 2024-02-26 | 7857f021-007f-4928-8b2c-7aedbe64bb82 | ||||
Detects suspicious user agent strings used by crypto miners in proxy logs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2019-10-21 | 2021-11-27 | fa935401-513b-467b-81f4-f9e77aa0dd78 | ||||
Detects execution of curl.exe with custom useragent options | Hunting | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-01-23 | 2023-02-21 | 3286d37a-00fd-41c2-a624-a672dcd34e60 | ||||
Detects execution of the builtin "rmdir" command in order to delete directories. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | frack113 | 2022-01-15 | 2023-03-07 | 41ca393d-538c-408a-ac27-cf1e038be80c | ||||
Splunk | The following analytic detects modifications to the Windows registry that disable the display of hidden files. (...) | Anomaly | stable | registry_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk, Steven Dick | 2021-03-31 | 2026-05-13 | 6f3ccfa2-91fe-11eb-8f9b-acde48001122 | |||
Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files. (...) | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-04-02 | 2024-03-26 | 5a5152f1-463f-436b-b2f5-8eceb3964b42 | ||||
Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session. | Generic | experimental | dns | windows | Sysmon | - | low | Muhammad Faisal (@faisalusuf) | 2024-12-19 | — | 882e858a-3233-4ba8-855e-2f3d3575803d | ||||
Detects DNS query requests to Devtunnels domains. (...) | Generic | test | dns | windows | Sysmon | - | medium | citron_ninja | 2023-10-25 | 2023-11-20 | 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b | ||||
Detects DNS query requests to Visual Studio Code tunnel domains. (...) | Generic | test | dns | windows | Sysmon | - | medium | citron_ninja | 2023-10-25 | 2023-11-20 | b3e6418f-7c7a-4fad-993a-93b65027a9f1 | ||||
Detects the execution of "whoami.exe" with the "/all" flag | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) | 2023-12-04 | 2024-03-05 | c248c896-e412-4279-8c15-1c558067b6fa | ||||
Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration. | Generic | test | process_creation | linux | Sysmon | - | medium | Cedric Maurugeon | 2023-09-04 | — | 33e814e0-1f00-4e43-9c34-31fb7ae2b174 | ||||
Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. (...) | Generic | test | process_creation | linux | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon | 2023-09-04 | — | f41dada5-3f56-4232-8503-3fb7f9cf2d60 | ||||
Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. (...) | Generic | test | process_creation | linux | Sysmon | - | medium | Cedric Maurugeon | 2023-09-04 | — | e80273e1-9faf-40bc-bd85-dbaff104c4e9 | ||||
Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs. | Generic | test | process_creation | linux | Sysmon | - | medium | Cedric Maurugeon | 2023-09-04 | — | 5f1573a7-363b-4114-9208-ad7a61de46eb | ||||
Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. (...) | Generic | test | process_creation | linux | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon | 2023-09-04 | — | d54c2f06-aca9-4e2b-81c9-5317858f4b79 | ||||
Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy (...) | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2017-07-08 | 2025-01-18 | fdd1bfb5-f60b-4a35-910e-f36ed3d0b32f | ||||
Detects the deletion of files by the Sysinternals SDelete utility. (...) | Generic | test | file_delete | windows | Sysmon | - | medium | Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) | 2020-05-02 | 2023-02-15 | 6ddab845-b1b8-49c2-bbf7-1a11967f64bc | ||||
Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries t (...) | Generic | stable | process_creation | linux | Sysmon | - | informational | Ömer Günal, oscd.community | 2020-10-07 | 2022-09-15 | 30aed7b6-d2c1-4eaf-9382-b6bc43e50c57 | ||||
Detects execution of the builtin "del"/"erase" commands in order to delete files. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | frack113 | 2022-01-15 | 2024-03-05 | 379fa130-190e-4c3f-b7bc-6c8e834485f3 | ||||
Detects AS-REP roasting is an attack that is often-overlooked. (...) | Generic | test | ps_script | windows | PowerShell | - | medium | frack113 | 2022-03-17 | — | 96c982fe-3d08-4df4-bed2-eb14e02f21c8 | ||||
Splunk | The following analytic detects the execution of `powershell.exe` with command-line arguments invoking the `GetCurrent` method of the WindowsIdentity .NET class. (...) | Hunting | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Mauricio Velazco, Splunk | 2021-08-24 | 2026-10-02 | 7eb9c3d5-c98c-4088-acc5-8240bad15379 | |||
Splunk | The following analytic detects the execution of the `GetCurrent` method from the WindowsIdentity .NET class using PowerShell Script Block Logging (EventCode=4104). (...) | Hunting | stable | ps_script | windows | PowerShell | - | medium | Mauricio Velazco, Splunk | 2021-08-24 | 2026-10-02 | 80879283-c30f-44f7-8471-d1381f6d437a | |||
Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 , X__Junior (Nextron Systems) | 2021-12-02 | 2023-09-11 | 204b17ae-4007-471b-917b-b917b315c5db | ||||
Detects the execution of whoami.exe with the /group command line flag to show group membership for the current user, account type, security identifiers (SID), and attributes. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-02-28 | — | bd8b828d-0dca-48e1-8a63-8a58ecf2644f | ||||
Detects Baby Shark C2 Framework default communication patterns | Generic | test | proxy | - | - | - | critical | Florian Roth (Nextron Systems) | 2021-06-09 | 2024-02-15 | 304810ed-8853-437f-9e36-c4975c3dfd7e | ||||
Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods). | Generic | test | proxy | - | - | - | high | Markus Neis, Florian Roth (Nextron Systems) | 2024-02-15 | — | f3f21ce1-cdef-4bfc-8328-ed2e826f5fac |
72nd percentile · 72% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
17th percentile · 83% of 825 ATT&CK software entries have more mitigations per technique.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 7 Enterprise techniques.
Technique Campaign use over its cumulative rule count.