malware

Janicab S0163

Type: malware
Platform: macOS
Created: 14 December 2017
Last modified: 12 September 2024

Janicab is an OS X trojan that relied on a valid developer ID and oblivious users to install it. [1]

TechniquesBottom 17%

Tactics41st pct

Threat groupsNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Janicab MITRE reference S0163

Cron T1053.003 ↗

Janicab used a cron job for persistence on Mac devices.2

Execution · Persistence · Privilege Escalation16 detection rules

Screen Capture T1113 ↗

Janicab captured screenshots and sent them out to a C2 server.3 4

Collection15 detection rules

Audio Capture T1123 ↗

Janicab captured audio and sent it out to a C2 server.5 6

Collection9 detection rules

Code Signing T1553.002 ↗

Janicab used a valid AppleDeveloperID to sign the code to get past security restrictions.7

Defense Impairment1 detection rules

Standing S0163

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques4Bottom 17%

17th percentile · 83% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics541st pct

41st percentile · 59% of 825 ATT&CK software entries have more tactics spanned.

Threat groups061% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique12medBottom 22%

22nd percentile · 78% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique3.5med

Janicab detections S0163

41 distinct rules cover the 4 techniques recorded for this malware. 23 Sigma · 18 Splunk.

4 covered by at least one rule41 distinct rules in total

Showing 1-41 of 41 rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects attempts to record audio using the arecord and ecasound utilities.	Generic	test	process_creation	linux	Linux Auditd	Collection Audio Capture	-	low	Pawel Mazur, Milad Cheraghi	2021-09-04	2025-12-05	a7af2487-9c2f-42e4-9bb9-ff961f0561d5
	Detects audio capture via PowerShell Cmdlet.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Audio Capture	-	medium	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Nasreddine Bencherchali (Nextron Systems)	2019-10-24	2023-04-06	932fb0d8-692b-4b0f-a26e-5643a50fe7d6
	Detect attacker collecting audio via SoundRecorder application.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Audio Capture	-	medium	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	2019-10-24	2021-11-27	83865853-59aa-449e-9600-74b9d89a6d6e
	Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. (...)	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Execution, Persistence, Privilege Escalation Scheduled Task/Job Cron	-	medium	Austin Songer @austinsonger	2021-11-22	2022-12-18	1c71e254-6655-42c1-b2d6-5e4718d7fc0a
Splunk	The following analytic detects the creation of a cron job within the Cisco Isovalent environment. (...)	Anomaly	stable	process_creation	-	Cisco	Execution, Persistence, Privilege Escalation Scheduled Task/Job Cron Container Orchestration Job	-	medium	Bhavin Patel, Splunk	2026-01-05	2026-05-13	94531a31-a041-4777-909f-cd92ed3b71ad
Splunk	The following analytic detects outbound connections initiated by command-line tools such as curl or wget. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Execution Command and Scripting Interpreter Command and Control Ingress Tool Transfer Execution, Persistence, Privilege Escalation Scheduled Task/Job Cron	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	173a1cb9-1814-4128-a9dc-f29dade89957
Splunk	The following analytic detects unauthorized file creation in known crontab directories on Unix-based systems. (...)	Anomaly	stable	file_event	linux	Sysmon	Execution, Persistence, Privilege Escalation Scheduled Task/Job Cron	-	medium	Teoderick Contreras, Splunk	2021-12-21	2026-05-13	023f3452-5f27-11ec-bf00-acde48001122
Splunk	The following analytic detects the creation of the /etc/at.allow or /etc/at.deny configuration files in Linux. (...)	Anomaly	stable	file_event	linux	Sysmon	Execution, Persistence, Privilege Escalation Scheduled Task/Job Cron	-	medium	Teoderick Contreras, Splunk	2021-12-21	2026-05-13	977b3082-5f3d-11ec-b954-acde48001122
Splunk	The following analytic detects the suspicious editing of cron jobs in Linux using the crontab command-line parameter (-e). (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Execution, Persistence, Privilege Escalation Scheduled Task/Job Cron	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	f4bb7321-7e64-4d1e-b1aa-21f8b019a91f
Splunk	The following analytic detects potential tampering with cronjob files on a Linux system. (...)	Hunting	stable	file_event	linux	Linux Auditd	Execution, Persistence, Privilege Escalation Scheduled Task/Job Cron	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	fea71cf0-fa10-4ef6-9202-9682b2e0c477
Splunk	The following analytic detects the use of the crontab command with the list parameter (-l) to enumerate scheduled tasks configured in the invoking user's crontab on Linux systems. (...)	Hunting	stable	process_creation	linux	Sysmon · Cisco	Execution, Persistence, Privilege Escalation Scheduled Task/Job Cron	-	medium	Teoderick Contreras, Bhavin Patel, Onur Mustafa Erdogan, Splunk	2026-09-03	2026-09-03	8ef82980-0e95-43d7-a802-b488b668d14f
Splunk	The following analytic detects the suspicious editing of cron jobs in Linux using the crontab command-line parameter (-e). (...)	Hunting	stable	process_creation	linux	Sysmon	Execution, Persistence, Privilege Escalation Scheduled Task/Job Cron	-	medium	Teoderick Contreras, Splunk	2021-12-21	2026-05-13	0d370304-5f26-11ec-a4bb-acde48001122
Splunk	The following analytic detects potential tampering with cronjob files on a Linux system by identifying 'echo' commands that append code to existing cronjob files. (...)	Hunting	stable	process_creation	linux	Sysmon	Execution, Persistence, Privilege Escalation Scheduled Task/Job Cron	-	medium	Teoderick Contreras, Splunk	2021-12-21	2026-05-13	b5b91200-5f27-11ec-bb4e-acde48001122
Splunk	The following analytic detects potential unauthorized modifications to Linux cronjobs using text editors like "nano," "vi," or "vim." It identifies this activity by monitoring command-line executions that interact with cronjob configuration paths. (...)	Hunting	stable	process_creation	linux	Sysmon	Execution, Persistence, Privilege Escalation Scheduled Task/Job Cron	-	medium	Teoderick Contreras, Splunk	2021-12-21	2026-05-13	dcc89bde-5f24-11ec-87ca-acde48001122
	Detects suspicious modification of crontab file.	Generic	test	-	linux	Cron	Execution, Persistence, Privilege Escalation Scheduled Task/Job Cron	-	medium	Pawel Mazur	2022-04-16	—	af202fd3-7bff-4212-a25a-fb34606cfcbe
	Detects the creation of cron files in Cron directories, which could indicate potential persistence mechanisms being established by an attacker. (...)	Generic	experimental	file_event	linux	Sysmon	Execution, Persistence, Privilege Escalation Scheduled Task/Job Cron	-	low	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC	2021-10-15	2026-04-28	6c4e2f43-d94d-4ead-b64d-97e53fa2bd05
	Detects instances where an SIP service on an OpenCanary node has had a SIP request.	Generic	test	-	-	OpenCanary	Collection Audio Capture	-	high	Security Onion Solutions	2024-03-08	—	e30de276-68ec-435c-ab99-ef3befec6c61
	Detects the enabling of the "EnablePeriodicBackup" registry value. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Collection Screen Capture	-	medium	Nasreddine Bencherchali (Nextron Systems)	2024-07-01	—	973ef012-8f1a-4c40-93b4-7e659a5cd17f
	Detects files that have extensions commonly seen while SDelete is used to wipe files.	Generic	test	-	windows	WinEventLog Security	Impact Data Destruction Stealth Indicator Removal File Deletion Stealth Obfuscated Files or Information Indicator Removal from Tools Defense Impairment Subvert Trust Controls Code Signing	-	medium	Thomas Patzke	2017-06-14	2024-12-13	39a80702-d7ca-4a83-b776-525b1f86a36d
	Potential adversaries accessing the microphone and webcam in an endpoint.	Generic	test	registry_event	windows	WinEventLog Security	Collection Audio Capture	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-06-07	2021-11-27	8cd538a4-62d5-4e83-810b-12d41e428d6e
Splunk	The following analytic detects the creation of files in the Remcos folder within the AppData directory, specifically targeting keylog and clipboard log files. (...)	Generic	stable	file_event	windows	Sysmon	Collection Screen Capture	-	medium	Teoderick Contreras, Splunk, Sanjay Govind	2021-09-22	2026-05-13	25ae862a-1ac3-11ec-94a1-acde48001122
	Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. (...)	Generic	test	process_creation	linux	Sysmon	Execution, Persistence, Privilege Escalation Scheduled Task/Job Cron	-	medium	Alejandro Ortuno, oscd.community	2020-10-06	2022-11-27	6b14bac8-3e3a-4324-8109-42f0546a347f
	Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. (...)	Generic	test	process_creation	macos	-	Execution, Persistence, Privilege Escalation Scheduled Task/Job Cron	-	medium	Alejandro Ortuno, oscd.community	2020-10-06	2022-11-27	7c3b43d8-d794-47d2-800a-d277715aa460
	Detects attempts to use screencapture to collect macOS screenshots	Generic	test	process_creation	macos	-	Collection Screen Capture	-	low	remotephone, oscd.community	2020-10-13	2021-11-27	0877ed01-da46-4c49-8476-d49cdd80dfa7
	Detects execution of Windows Problem Steps Recorder (psr.exe), a utility used to record the user screen and clicks.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Screen Capture	-	medium	Beyu Denis, oscd.community	2019-10-12	2024-01-04	2158f96f-43c2-43cb-952a-ab4580f32382
	Detects adversary creating screen capture of a desktop with Import Tool. (...)	Generic	test	process_creation	linux	Linux Auditd	Collection Screen Capture	-	low	Pawel Mazur	2021-09-21	2022-10-09	dbe4b9c5-c254-4258-9688-d6af0b7967fd
	Detects adversary creating screen capture of a full with xwd. (...)	Generic	test	process_creation	linux	Linux Auditd	Collection Screen Capture	-	low	Pawel Mazur	2021-09-13	2022-12-18	e2f17c5d-b02a-442b-9052-6eb89c9fec9c
	Detects Processes accessing the camera and microphone from suspicious folder	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Collection Audio Capture Collection Video Capture	-	high	Den Iuzvyk	2020-06-07	2022-10-09	62120148-6b7a-42be-8b91-271c04e281a3
Splunk	The following analytic detects the creation of image files in the AppData folder by processes that also have a file reference in the same folder. (...)	Generic	stable	process_creation	windows	Sysmon	Collection Screen Capture	-	medium	Teoderick Contreras, Splunk	2021-09-22	2026-05-13	f6f904c4-1ac0-11ec-806b-acde48001122
Splunk	The following analytic detects the creation of .wav files in the AppData folder, a behavior associated with Remcos RAT malware, which stores audio recordings in this location for data exfiltration. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Collection Screen Capture	-	medium	Teoderick Contreras, Splunk	2021-09-22	2026-05-13	5be109e6-1ac5-11ec-b421-acde48001122
	Detects processes loading "System.Drawing.ni.dll". (...)	Hunting	test	image_load	windows	Sysmon	Collection Screen Capture	-	low	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-05-02	2023-02-22	666ecfc7-229d-42b8-821e-1a8f8cb7057c
	Detects the creation of "ebpfbackdoor" files in both "cron.d" and "sudoers.d" directories. (...)	Generic	test	file_event	linux	Sysmon	Execution, Persistence, Privilege Escalation Scheduled Task/Job Cron	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-07-05	2022-12-31	1a2ea919-d11d-4d1e-8535-06cda13be20f
	Detects the enabling of the Windows Recall feature via registry manipulation. (...)	Generic	test	registry_delete	windows	Sysmon	Collection Screen Capture	-	medium	Sajid Nawaz Khan	2024-06-02	—	5dfc1465-8f65-4fde-8eb5-6194380c6a62
	Detects the enabling of the Windows Recall feature via registry manipulation. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Collection Screen Capture	-	medium	Sajid Nawaz Khan	2024-06-02	—	75180c5f-4ea1-461a-a4f6-6e4700c065d4
	Detects the enabling of the Windows Recall feature via registry manipulation. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Screen Capture	-	medium	Sajid Nawaz Khan	2024-06-02	—	817f252c-5143-4dae-b418-48c3e9f63728
Splunk	The following analytic detects the creation of screen capture files by the Braodo stealer malware. (...)	Generic	stable	file_event	windows	Sysmon	Collection Screen Capture	-	medium	Teoderick Contreras, Splunk	2024-10-18	2026-08-14	00524d1f-a032-46f5-9108-e7d9f01bfb3c
Splunk	The following analytic detects the execution of a PowerShell script designed to capture screen images on a host. (...)	Generic	stable	ps_script	windows	PowerShell	Collection Screen Capture	-	medium	Teoderick Contreras, Splunk	2023-04-05	2026-05-13	5e0b1936-8f99-4399-8ee2-9edc5b32e170
	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. (...)	Generic	test	ps_script	windows	PowerShell	Collection Screen Capture	-	medium	frack113	2021-12-28	2022-07-07	d4a11f63-2390-411c-9adf-d791fd152830
Splunk	Detects rare audio devices from Zoom logs. (...)	Hunting	experimental	-	-	Zoom	Collection Audio Capture	-	medium	Marissa Bower, Raven Tait	2025-06-12	2026-05-13	9fdbf709-4c46-4819-9fb6-98b2d72059ed	-
Splunk	Detects rare input devices from Zoom logs. (...)	Hunting	experimental	-	-	Zoom	Collection Audio Capture	-	medium	Marissa Bower, Raven Tait	2025-06-12	2026-05-13	d290eeef-d05e-49a8-b598-72296023b87b	-
Splunk	Detects rare video devices from Zoom logs. (...)	Hunting	experimental	-	-	Zoom	Collection Audio Capture	-	medium	Marissa Bower, Raven Tait	2025-06-12	2026-05-13	9b2b819d-c76b-4dc6-bd3d-148edb8de83e	-

Standing S0163

Title

Description