Truvasys S0178

Type: malware
Platform: Windows
Created: 16 January 2018
Last modified: 25 April 2025

Truvasys is first-stage malware that has been used by PROMETHIUM. It is a collection of modules written in the Delphi programming language. [1] [2] [3]

TechniquesBottom 7%

TacticsBottom 21%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Truvasys detections S0178

50 distinct rules cover the 2 techniques recorded for this malware. 43 Sigma · 7 Splunk.

2 covered by at least one rule50 distinct rules in total

Showing 1-50 of 50 rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects modification of Windows Registry Classes keys used for persistence. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2025-10-22	9df5f547-c86a-433e-b533-f2794357e242
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name)	2019-10-25	2025-10-22	f59c3faf-50f3-464b-9f4c-1b67ab512d99
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2023-08-17	f674e36a-4b91-431e-8aef-f8a96c2aca35
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2025-10-22	20f0ee37-5942-4e45-b7d5-c5b5db9df5cd
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2025-10-22	cbf93e5d-ca6c-4722-8bea-e9119007c248
	Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems)	2019-10-25	2026-01-05	24357373-078f-44ed-9ac4-6d334a668a11
	Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of e (...)	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	CVE-2022-30190	high	Vadim Varganov, Florian Roth (Nextron Systems)	2022-08-24	2023-02-23	318557a5-150c-4c8d-b70e-a9910e199857
	Detects the setting of a custom protocol handler with the name "rogue". (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	CVE-2022-38028	high	Nasreddine Bencherchali (Nextron Systems)	2024-04-23	—	5cdeb555-65de-4767-99fe-e26807465148
	Detects the setting of the DLL that handles the custom protocol handler. (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	CVE-2022-38028	high	Nasreddine Bencherchali (Nextron Systems)	2024-04-23	—	d807056b-0e00-4cec-b7f8-b8b7518e382b
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2023-08-17	a80f662f-022f-4429-9b8c-b1a41aaa6688
	Detects the setting of a new value in the Autorun key that is used by the Kapeka backdoor for persistence.	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Swachchhanda Shrawan Poudel	2024-07-03	—	c0c67b21-eb8a-4c84-a395-40473ec3b482
	Detects registry key used by Leviathan APT in Malaysian focused campaign	Emerging	test	registry_event	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	critical	Aidan Bracher	2020-07-07	2023-09-19	70d43542-cd2d-483c-8f30-f16b436fd7db
Splunk	The following analytic detects the execution of a kworker process with a command line in writable directories such as /home/, /var/log, and /tmp on a Linux machine. (...)	Hunting	stable	process_creation	linux	Sysmon	Stealth Masquerading Masquerade Task or Service	-	medium	Teoderick Contreras, Splunk	2022-04-07	2026-05-13	1cefb270-74a5-4e27-aa0c-2b6fa7c5b4ed
	Detect modification of the User Shell Folders registry values for Startup or Common Startup which could indicate persistence attempts. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	frack113, Swachchhanda Shrawan Poudel (Nextron Systems)	2022-10-01	2026-01-05	9c226817-8dc9-46c2-a58d-66655aafd7dc
	Detects abusing Windows 10 Narrator's Feedback-Hub	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Dmitriy Lifanov, oscd.community	2019-10-25	2022-03-26	f663a6d9-9d1b-49b8-b2b1-0637914d199a
	Detects suspicious new RUN key element pointing to an executable in a suspicious folder	Generic	experimental	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing, Swachchhanda Shrawan Poudel (Nextron Systems)	2018-08-25	2025-10-06	02ee49e2-e294-4d0f-9278-f5b3212fc588
	Detects modification of autostart extensibility point (ASEP) in registry. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2026-08-28	baecf8fb-edbf-429f-9ade-31fc3f22b970
	Detects activity mentioned in Operation Wocao report	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Masquerading Masquerade Task or Service Stealth Obfuscated Files or Information Discovery Query Registry Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Florian Roth (Nextron Systems), frack113	2019-12-20	2022-10-09	1cfac73c-be78-4f9a-9b08-5bde0c3953ab
	Detects activity mentioned in Operation Wocao report	Emerging	test	account_management	windows	WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Masquerading Masquerade Task or Service Stealth Obfuscated Files or Information Discovery Query Registry Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Florian Roth (Nextron Systems), frack113	2019-12-20	2022-11-27	74ad4314-482e-4c3e-b237-3f7ed3b9ca8d
	Detects changes to the "Winlogon" registry key where a process will set the value of the "Shell" to a value that was observed being used by KamiKakaBot samples in order to achieve persistence.	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Nasreddine Bencherchali (Nextron Systems), X__Junior	2024-03-22	—	c9b86500-1ec2-4de6-9120-d744c8fb5caf
	Detects suspicious command line reg.exe tool adding key to RUN key in Registry	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)	2021-06-28	2025-02-17	de587dce-915e-4218-aac4-835ca6af6f70
	Detects Ryuk ransomware activity	Emerging	stable	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Florian Roth (Nextron Systems), Vasiliy Burov, Nasreddine Bencherchali (Nextron Systems)	2019-12-16	2023-02-03	c37510b8-2107-4b78-aa32-72f251e7a844
	Detects PowerShell writing startup shortcuts. (...)	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Christopher Peacock '@securepeacock', SCYTHE	2021-10-24	2023-02-23	92fa78e7-4d39-45f1-91a3-8b23f3f1088d
	Detects potential suspicious behaviour using secedit.exe. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access, Collection Adversary-in-the-Middle Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Authentication Package Port Monitors Active Setup Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Persistence, Privilege Escalation Event Triggered Execution Netsh Helper DLL Accessibility Features Stealth Hide Artifacts Hidden Users Execution, Stealth Hijack Execution Flow Path Interception by PATH Environment Variable Persistence, Defense Impairment, Credential Access Modify Authentication Process Password Filter DLL Persistence Server Software Component Terminal Services DLL Discovery System Information Discovery	-	medium	Janantha Marasinghe	2022-11-18	2022-12-30	c2c76b77-32be-4d1f-82c9-7e544bdfe0eb
Splunk	The following analytic identifies modifications to registry keys commonly used for persistence mechanisms. (...)	Generic	stable	registry_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk	2020-04-29	2026-10-09	f5f6af30-7aa7-4295-bfe9-07fe87c01a4b
	Detects a possible persistence mechanism using RUN key for Windows Explorer and pointing to a suspic (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Florian Roth (Nextron Systems), oscd.community	2018-07-18	2023-12-11	b7916c2a-fa2f-4795-9477-32b731f70f11
	Detects the setting of a registry inside the "\Shell\Open\Command" value with PowerShell classes from the "System.Security.Cryptography" namespace. (...)	Hunting	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information Command Obfuscation	-	medium	Andreas Braathen (mnemonic.io)	2023-12-01	—	1c2a3268-3881-414a-80af-a5b313b14c0e
	Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence.	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Masquerade Task or Service Match Legitimate Resource Name or Location Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-02-05	—	9f8573c9-22b4-40e3-89c1-72bc2b8d49ab
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Persistence, Privilege Escalation Event Triggered Execution AppCert DLLs	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2023-08-17	046218bd-e0d8-4113-a3c3-895a12b2b298
	Detects Silence downloader. (...)	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Discovery Process Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Owner/User Discovery	-	high	Alina Stepchenkova, Roman Rezvukhin, Group-IB, oscd.community	2019-11-01	2023-02-24	170901d1-de11-4de7-bccb-8fa13678d857	-
	A General detection for files being created in the Windows startup directory. (...)	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-05-02	2025-12-03	2aa0a6b4-a865-495b-ab51-c28249537b75
	Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware.	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Execution Windows Management Instrumentation	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-02-17	—	c80e66d8-1780-48a9-b412-46663fd21ac0
	Detects potential PowerShell commands or code within registry run keys	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	frack113, Florian Roth (Nextron Systems)	2022-03-17	2025-07-18	8d85cf08-bf97-4260-ba49-986a2a65129c
	Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Interne (...)	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Florian Roth (Nextron Systems), Swachchhanda Shrawan Poude (Nextron Systems)	2019-10-01	2025-02-17	9c5037d1-c568-49b3-88c7-9846a5bdc2be
	Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common persistence technique used by threat actors. (...)	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Execution User Execution Malicious File	-	high	Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)	2022-08-10	2025-10-12	28208707-fe31-437f-9a7f-4b1108b94d2e
	Detects suspicious inline VBScript keywords as used by UNC2452	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Florian Roth (Nextron Systems)	2021-03-05	2022-10-09	20c3f09d-c53d-4e85-8b74-6aa50e2f1b61
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2023-08-17	e7a2fd40-3ae1-4a85-bf80-15cf624fb1b1
	Detects modifications to User Shell Folders registry values via reg.exe or PowerShell, which could indicate persistence attempts. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Persistence, Defense Impairment Modify Registry	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-01-05	—	8f3ab69a-aa22-4943-aa58-e0a52fdf6818
	Detects VBScript content stored into registry keys as seen being used by UNC2452 group	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Florian Roth (Nextron Systems)	2021-03-05	2023-08-17	46490193-1b22-4c29-bdd6-5bf63907216f
Splunk	The following analytic detects the creation of files in the Windows %startup% folder, a common persistence technique. (...)	Anomaly	stable	file_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Teoderick Contreras, Splunk	2023-01-16	2026-07-20	99d157cb-923f-4a00-aee9-1f385412146f
	Detects changes to the Windows EventLog channel permission values. (...)	Generic	experimental	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Persistence, Defense Impairment Modify Registry	-	high	X__Junior	2025-01-16	2025-08-16	ba226dcf-d390-4642-b9af-b534872f1156
Splunk	Detects the initial agent or persistent agent processes for Northstar C2 being run. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Resource Development Stage Capabilities Execution User Execution Malicious File	-	medium	Raven Tait, Splunk	2021-06-23	2026-05-13	5f13d5b2-5181-487b-89eb-e2b471522202
Splunk	The following analytic detects the execution of PowerShell commands to install unsigned AppX packages using Add-AppxPackage or Add-AppPackage cmdlets with the -AllowUnsigned flag. (...)	Generic	stable	ps_script	windows	PowerShell	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Execution Command and Scripting Interpreter PowerShell	-	medium	Michael Haag, Splunk	2025-08-18	2026-05-13	d2f77901-dbfa-42d9-8af7-dcd0f1a50a2f
Splunk	The following analytic detects modifications to the BootExecute registry key, which manages applications and services executed during system boot. (...)	Generic	stable	registry_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Persistence, Stealth Pre-OS Boot	CVE-2022-21894	medium	Michael Haag, Teoderick Contreras, Splunk	2023-05-11	2026-10-02	eabbac3a-45aa-4659-920f-6b8cff383fb8
Splunk	The following analytic identifies modifications to the SafeBoot registry keys, specifically within the Minimal and Network paths. (...)	Generic	stable	registry_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Teoderick Contreras, Michael Haag, Splunk	2022-03-31	2026-10-02	c6149154-c9d8-11eb-9da7-acde48001122
	Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by adding malicious files to the Startup folder. (...)	Generic	experimental	file_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	CVE-2025-6218 CVE-2025-8088	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-07-16	—	74a2b37d-fea4-41e0-9ac7-c9fbcf1f60cc
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2023-08-17	d6c2ce7e-afb5-4337-9ca4-4b5254ed0565
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2023-08-17	18f2065c-d36c-464a-a748-bcf909acb2e3
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2025-12-08	b29aed60-ebd1-442b-9cb5-16a1d0324adb
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2025-10-22	480421f9-417f-4d3b-9552-fd2728443ec8

Truvasys S0178

Truvasys S0178

Truvasys MITRE reference S0178

Standing S0178

Truvasys MITRE reference S0178

Standing S0178

Reach

Coverage

Truvasys detections S0178