FALLCHILL S0181

Type: malware
Platform: Windows
Created: 16 January 2018
Last modified: 22 October 2025

FALLCHILL is a RAT that has been used by Lazarus Group since at least 2016 to target the aerospace, telecommunications, and finance industries. It is usually dropped by other Lazarus Group malware or delivered when a victim unknowingly visits a compromised website. [1]

Techniques44th pct

Tactics41st pct

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

FALLCHILL MITRE reference S0181

Protocol or Service Impersonation T1001.003 ↗

FALLCHILL uses fake Transport Layer Security (TLS) to communicate with its C2 server.2

Command and Control3 detection rules

System Network Configuration Discovery T1016 ↗

FALLCHILL collects MAC address and local IP address information from the victim.3

Discovery25 detection rules

File Deletion T1070.004 ↗

FALLCHILL can delete malware and associated artifacts from the victim.4

Stealth30 detection rules

Timestomp T1070.006 ↗

FALLCHILL can modify file or directory timestamps.5

Stealth7 detection rules

System Information Discovery T1082 ↗

FALLCHILL can collect operating system (OS) version information, processor information, and system name from the victim.6

Discovery54 detection rules

File and Directory Discovery T1083 ↗

FALLCHILL can search files on a victim.7

Discovery29 detection rules

Standing S0181

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques944th pct

44th percentile · 56% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics541st pct

41st percentile · 59% of 825 ATT&CK software entries have more tactics spanned.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique25med61st pct

61st percentile · 61% of 825 ATT&CK software entries have this many detection rules per technique or fewer.

Tests / technique9med

FALLCHILL detections S0181

212 distinct rules cover the 9 techniques recorded for this malware. 146 Sigma · 66 Splunk.

7 covered by at least one rule2 with no coverage212 distinct rules in total

Showing 1-50 of 200+ rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects the deletion of the "Zone.Identifier" ADS. (...)	Hunting	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	low	frack113	2023-09-04	—	7eac0a16-5832-4e81-865f-0268a6d19e4b
	Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...)	Generic	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-09-04	2025-07-04	3109530e-ab47-4cc6-a953-cac5ebcc93ae
	Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.	Generic	test	file_event	windows	Sysmon	Command and Control Data Obfuscation Protocol or Service Impersonation	-	medium	xknow @xknow_infosec, Tim Shelton	2019-03-24	2023-10-18	75bf09fa-1dd7-4d18-9af9-dd9e492562eb
	Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-02-28	2025-10-22	6c8fbee5-dee8-49bc-851d-c3142d02aa47
	This method detects malicious services mentioned in APT29 report by FireEye. (...)	Unsupported	unsupported	process_creation	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Thomas Patzke	2017-11-01	2022-03-21	c069f460-2b87-4010-8dcf-e45bab362624
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
	Detects backup catalog deletions	Generic	test	-	windows	WinEventLog Application	Stealth Indicator Removal File Deletion	-	medium	Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection)	2017-05-12	2022-12-25	9703792d-fd9a-456d-a672-ff92efe4806a
	Detects user data export activity.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	5259cbf2-0a75-48bf-b57a-c54d6fabaef3
	Detects user permission data export attempt.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	87cc6698-3e07-4ba2-9b43-a85a73e151e2
	Detects usage of "getcap" binary. (...)	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	low	Nasreddine Bencherchali (Nextron Systems)	2022-12-28	2026-01-24	d8d97d51-122d-4cdd-9e2f-01b4b4933530
Splunk	This analytic detects potential reconnaissance activities on Cisco ASA devices by identifying execution of multiple information-gathering "show" commands within a short timeframe. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Gather Victim Network Information Domain Properties IP Addresses Discovery System Information Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	6e9d4f7a-3c8b-4a9e-8d2f-7b5c9e1a6f3d
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
	See what files are being deleted from flash file systems	Generic	test	authentication	-	Cisco AAA · Cisco	Impact Disk Wipe Disk Content Wipe Disk Structure Wipe Stealth Indicator Removal File Deletion	-	medium	Austin Clark	2019-08-12	2023-01-04	71d65515-c436-43c0-841b-236b1f32c21e	-
Splunk	This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Reconnaissance Gather Victim Network Information Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	71ac5328-2364-40cf-8381-92b8dc531399
Splunk	This analytic identifies non-browser processes reaching out to public IP lookup or geolocation servi (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Reconnaissance Gather Victim Network Information IP Addresses Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali, Splunk, Janantha Marasinghe	2025-07-01	2026-09-22	568cb83e-d79e-4a23-85ec-6e1f6c30cb2f
Splunk	The following analytic detects the execution of `cipher.exe` with the `/w` flag to clear unallocated sectors on a disk. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2021-06-10	2026-05-13	cd80a6ac-c9d9-11eb-8839-acde48001122
Splunk	The following analytic identifies the use of named-pipe impersonation for privilege escalation, commonly associated with Cobalt Strike and similar frameworks. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	medium	Michael Haag, Splunk	2021-05-27	2026-05-13	eb277ba0-b96b-11eb-b00e-acde48001122
	Detects the use of the redirection character ">" to redirect information on the command line. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	low	frack113	2022-01-22	2024-03-19	4f4eaa9f-5ad4-410c-a4be-bc6132b0175a
	Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...)	Generic	test	service	windows	WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Wojciech Lesicki	2021-05-26	2022-11-27	d7a95147-145f-4678-b85d-d1ff4a3bb3f6
	Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...)	Generic	test	service	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems), Wojciech Lesicki	2021-05-26	2022-11-27	5a105d34-05fc-401e-8553-272b45c1522d
	Detects potential container discovery via listing of certain kernel features in the "/proc" virtual (...)	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Seth Hanford	2023-08-23	—	746c86fb-ccda-4816-8997-01386263acc4
	Detects the installation of a service named "javamtsup" on the system. (...)	Emerging	test	service	windows	WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update)	2017-03-27	2022-10-09	cb062102-587e-4414-8efa-dbe3c7bf19c6
	Detects suspicious DACL modifications to deny access to a service that affects critical trustees. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Jonhnathan Ribeiro, oscd.community	2020-10-16	2023-02-28	99cf1e02-00fb-4c0d-8375-563f978dfd37
Splunk	The following analytic identifies specific GET or HEAD requests to web servers that indicate reconnaissance attempts to find vulnerable JBoss servers. (...)	Generic	experimental	webserver	-	-	Initial Access, Persistence External Remote Services Discovery System Information Discovery	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	104658f4-afdc-499e-9719-17243f982681	-
	Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Defense Impairment Disable or Modify Tools	-	high	Matt Anderson, Dray Agha, Anna Pham (Huntress)	2026-01-02	—	85f520e7-6f5e-43ca-874c-222e5bf9c0de
	Detects execution of the builtin "rmdir" command in order to delete directories. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Indicator Removal File Deletion	-	low	frack113	2022-01-15	2023-03-07	41ca393d-538c-408a-ac27-cf1e038be80c
	Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery	-	low	frack113	2022-08-20	2023-02-04	b4dc61f5-6cce-468e-a608-b48b469feaa2
	The PowerShell implementation of DNSCat2 calls nslookup to craft queries. (...)	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Application Layer Protocol DNS Command and Control Data Obfuscation Protocol or Service Impersonation Exfiltration Exfiltration Over C2 Channel	-	high	Cian Heasley	2020-08-08	2023-02-24	b11d75d6-d7c1-11ea-87d0-0242ac130003
	Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Seth Hanford	2023-08-23	—	11701de9-d5a5-44aa-8238-84252f131895
	Domain user and group enumeration via network reconnaissance. (...)	Unsupported	unsupported	-	-	DCE/RPC · Zeek	Discovery Account Discovery Domain Account Discovery System Information Discovery	-	medium	Nate Guagenti (@neu5ron), Open Threat Research (OTR)	2020-05-03	2023-03-24	66a0bdc6-ee04-441a-9125-99d2eb547942
	Detects a driver load from a temporary directory	Generic	test	driver_load	windows	Sysmon	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Florian Roth (Nextron Systems)	2017-02-12	2021-11-27	2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75
Splunk	This detection identifies a significant change to the system clock on an ESXi host, which may indica (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Stealth Indicator Removal Timestomp	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	910df401-b215-4675-88c5-2ad7b06d82a5	-
Splunk	This detection identifies the use of ESXCLI system-level commands that retrieve configuration details. (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Discovery System Information Discovery	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	b4d4217a-6673-4fb6-837d-07a522bdf9f7	-
	Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	informational	Daniil Yugoslavskiy, oscd.community, CheraghiMilad	2020-10-19	2024-12-01	d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72
	Detects usage of system utilities to discover files and directories	Generic	test	process_creation	macos	-	Discovery File and Directory Discovery	-	informational	Daniil Yugoslavskiy, oscd.community	2020-10-19	2022-11-25	089dbdf6-b960-4bcc-90e3-ffc3480c20f6
	Detects when the file creation time is changed to a year before 2020. (...)	Hunting	test	file_change	windows	Sysmon	Stealth Indicator Removal Timestomp	-	low	frack113, Florian Roth (Nextron Systems)	2022-08-12	2026-01-20	558eebe5-f2ba-4104-b339-36f7902bcc1a
	Detects the deletion of files by the Sysinternals SDelete utility. (...)	Generic	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-05-02	2023-02-15	6ddab845-b1b8-49c2-bbf7-1a11967f64bc
	Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries t (...)	Generic	stable	process_creation	linux	Sysmon	Stealth Indicator Removal File Deletion	-	informational	Ömer Günal, oscd.community	2020-10-07	2022-09-15	30aed7b6-d2c1-4eaf-9382-b6bc43e50c57
	Detects execution of the builtin "del"/"erase" commands in order to delete files. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Indicator Removal File Deletion	-	low	frack113	2022-01-15	2024-03-05	379fa130-190e-4c3f-b7bc-6c8e834485f3
	Detect file time attribute change to hide new or changes to existing files	Generic	test	process_creation	macos	-	Stealth Indicator Removal Timestomp	-	medium	Igor Fits, Mikhail Larin, oscd.community	2020-10-19	2022-01-12	88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0
	Detect file time attribute change to hide new or changes to existing files.	Generic	test	process_creation	linux	Linux Auditd	Stealth Indicator Removal Timestomp	-	medium	Igor Fits, oscd.community	2020-10-15	2022-11-28	b3cec4e7-6901-4b0d-a02d-8ab2d8eb818b
	Adversaries may look for details about the network configuration and settings of systems they access (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Network Configuration Discovery	-	low	frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'	2021-12-07	2025-10-18	0e4164da-94bc-450d-a7be-a4b176179f1f
	Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Indicator Removal File Deletion	-	medium	frack113 , X__Junior (Nextron Systems)	2021-12-02	2023-09-11	204b17ae-4007-471b-917b-b917b315c5db
	Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, ker (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery Discovery Process Discovery Discovery Query Registry Discovery System Information Discovery Discovery System Service Discovery	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali	2022-10-10	2024-11-23	fca949cc-79ca-446e-8064-01aa7e52ece5
	WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery Network Service Discovery Discovery System Information Discovery	-	high	Georg Lauenstein (sure[secure])	2022-09-19	2023-03-23	98b53e78-ebaf-46f8-be06-421aafd176d9
	Detects commandline keywords indicative of potential usge of the tool WinPwn. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Credential Access Credentials from Password Stores Credentials from Web Browsers Execution Native API Discovery Network Service Discovery Discovery Software Discovery Discovery System Information Discovery Credential Access Unsecured Credentials Credentials In Files	-	high	Swachchhanda Shrawan Poudel	2023-12-04	—	d557dc06-62e8-4468-a8e8-7984124908ce
	Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. (...)	Generic	test	ps_script	windows	PowerShell	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Credential Access Credentials from Password Stores Credentials from Web Browsers Execution Native API Discovery Network Service Discovery Discovery Software Discovery Discovery System Information Discovery Credential Access Unsecured Credentials Credentials In Files	-	high	Swachchhanda Shrawan Poudel	2023-12-04	—	851fd622-b675-4d26-b803-14bc7baa517a
Splunk	The following analytic identifies the use of suspicious command-line parameters associated with Impacket tools, such as `wmiexec.py`, `smbexec.py`, `dcomexec.py`, and `atexec.py`, which are used for lateral movement and remote code execution. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Distributed Component Object Model Execution Windows Management Instrumentation	-	medium	Mauricio Velazco, Splunk	2021-11-19	2026-05-13	8ce07472-496f-11ec-ab3b-3e22fbd008af
Splunk	The following analytic identifies suspicious command-line parameters associated with the use of Impacket's smbexec.py for lateral movement. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Distributed Component Object Model Execution Windows Management Instrumentation	-	medium	Michael Haag, Splunk	2023-04-25	2026-05-13	bb3c1bac-6bdf-4aa0-8dc9-068b8b712a76
Splunk	The following analytic detects the use of Impacket's `wmiexec.py` tool for lateral movement by identifying specific command-line parameters. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Distributed Component Object Model Execution Windows Management Instrumentation	-	medium	Michael Haag, Splunk	2021-11-19	2026-10-09	d6e464e4-5c6a-474e-82d2-aed616a3a492