malware

ISMInjector S0189

Type: malware
Platform: Windows
Created: 16 January 2018
Last modified: 25 April 2025

ISMInjector is a Trojan used to install another OilRig backdoor, ISMAgent. [1]

TechniquesBottom 17%

Tactics32nd pct

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0189

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
	Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)	2023-02-15	2024-03-05	3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5
Splunk	The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Deobfuscate/Decode Files or Information	-	medium	Michael Haag, Splunk	2021-03-25	2026-10-02	bfe94226-8c10-11eb-a4b3-acde48001122
	Detects execution of ChromeLoader malware via a registered scheduled task	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task Persistence Software Extensions	-	high	@kostastsale	2022-01-10	—	0a74c5a9-1b71-4475-9af2-7829d320d5c2
Splunk	This analytic detects Lumma Stealer activity using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services Stealth Obfuscated Files or Information Execution User Execution	-	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	96bce783-c22e-4e48-8cf1-3eb2794c5083
Splunk	The following analytic detects repeated malware file downloads initiated by the same internal host (src) within a short time window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Ingress Tool Transfer Stealth Obfuscated Files or Information	-	medium	Nasreddine Bencherchali, Splunk	2025-04-09	2026-09-22	aeff2bb5-3483-48d4-9be8-c8976194be1e
Splunk	This analytic identifies Snort intrusion signatures that have been triggered by ten or more distinct internal IP addresses within a one-hour window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Ingress Tool Transfer Stealth Obfuscated Files or Information	-	medium	Nasreddine Bencherchali, Splunk	2025-04-16	2026-05-13	a4c76d0a-56b6-44be-814b-939746c4d406
	Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton	2020-10-11	2023-02-01	74403157-20f5-415d-89a7-c505779585cf
Splunk	The following analytic detects the execution of the curl utility where the command line includes percent-encoded characters and explicit file output options (such as -o or --output). (...)	Anomaly	stable	process_creation	windows · linux	CrowdStrike · Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer Stealth Obfuscated Files or Information	-	medium	Nasreddine Bencherchali, Splunk	2026-03-03	2026-05-13	9a8d5516-4c5e-11ef-9d42-acde48001122
	Detects usage of base64 utility to decode arbitrary base64-encoded text	Generic	test	process_creation	linux	Sysmon	Stealth Obfuscated Files or Information	-	low	Daniil Yugoslavskiy, oscd.community	2020-10-19	2021-11-27	e2072cab-8c9a-459b-b63c-40ae79e27031
	Detects usage of base64 utility to decode arbitrary base64-encoded text	Generic	test	process_creation	macos	-	Stealth Obfuscated Files or Information	-	low	Daniil Yugoslavskiy, oscd.community	2020-10-19	2022-11-26	719c22d7-c11a-4f2c-93a6-2cfdd5412f68
	Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot AP (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	medium	Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1)	2019-03-04	2022-10-09	958d81aa-8566-4cea-a565-59ccd4df27b0
	Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during (...)	Emerging	test	scheduled_job	windows	WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	CVE-2023-42793	critical	Nasreddine Bencherchali (Nextron Systems)	2023-10-24	—	3b8e5084-4de9-449a-a40d-0e11014f2e2d
	Detects when a user enables DNS-over-HTTPS. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Persistence, Defense Impairment Modify Registry	-	medium	Austin Songer	2021-07-22	2023-08-17	04b45a8a-d11d-49e4-9acc-4a1b524407a5
	Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community	2023-02-15	2025-06-04	cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7
	Detects the execution of certutil with the "encode" flag to encode a file to base64. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)	2019-02-24	2024-03-05	e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a
	Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Obfuscated Files or Information	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-05-15	2024-03-05	82a6714f-4899-4f16-9c1e-9a333544d4c3
	Detects remote thread creation from CACTUSTORCH as described in references.	Generic	test	create_remote_thread	windows	Sysmon	Execution Command and Scripting Interpreter Visual Basic JavaScript Privilege Escalation, Stealth Process Injection Process Hollowing Stealth System Binary Proxy Execution Mshta	-	high	@SBousseaden (detection), Thomas Patzke (rule)	2019-02-01	2023-05-05	2e4e488a-6164-4811-9ea1-f960c7359c40
	Detects the creation of a schtask via PowerSploit or Empire Default Configuration.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Markus Neis, @Karneades	2018-03-06	2023-03-03	56c217c3-2de2-479b-990f-5c109ba8458f
	Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process hollowing. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation, Stealth Process Injection Process Hollowing	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-07-01	—	85d23b42-9a9d-4f8f-b3d7-d2733c1d58f5
	Detects when adversaries stop services or processes by deleting or disabling their respective schedu (...)	Generic	test	scheduled_job	windows	WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-12-05	2023-03-13	7595ba94-cf3b-4471-aa03-4f6baa9e5fad
	Detects Obfuscated use of Clip.exe to execute PowerShell	Unsupported	unsupported	driver_load	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-13	2021-09-16	21e4b3c1-4985-4aa4-a6c0-f8639590a5f3
	Detects Obfuscated use of Clip.exe to execute PowerShell	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-13	2022-11-17	b222df08-0e07-11eb-adc1-0242ac120002
	Detects Obfuscated use of Clip.exe to execute PowerShell	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-13	2024-04-05	73e67340-0d25-11eb-adc1-0242ac120002
	Detects Obfuscated use of Clip.exe to execute PowerShell	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-13	2024-04-05	a136cde0-61ad-4a61-9b82-8dc490e60dd2
	Detects Obfuscated use of Clip.exe to execute PowerShell	Generic	test	service	windows	WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-13	2022-11-27	4edf51e1-cb83-4e1a-bc39-800e396068e3
	Detects Obfuscated use of Clip.exe to execute PowerShell	Generic	test	service	windows	WinEventLog System	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-13	2023-02-20	f7385ee2-0e0c-11eb-adc1-0242ac120002
	Detects Obfuscated Powershell via COMPRESS OBFUSCATION	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-12-29	7eedcc9d-9fdb-4d94-9c54-474e8affc0c7
	Detects Obfuscated Powershell via COMPRESS OBFUSCATION	Unsupported	unsupported	driver_load	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2023-03-04	c70731dd-0097-40ff-b112-f7032f29c16c
	Detects Obfuscated Powershell via COMPRESS OBFUSCATION	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	20e5497e-331c-4cd5-8d36-935f6e2a9a07
	Detects Obfuscated Powershell via COMPRESS OBFUSCATION	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	7034cbbb-cc55-4dc2-8dad-36c0b942e8f1
	Detects Obfuscated Powershell via COMPRESS OBFUSCATION	Generic	test	service	windows	WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	7a922f1b-2635-4d6c-91ef-af228b198ad3
	Detects Obfuscated Powershell via COMPRESS OBFUSCATION	Generic	test	service	windows	WinEventLog System	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	175997c5-803c-4b08-8bb0-70b099f47595
	Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	2019-11-08	2026-03-16	4bf943c6-5146-4273-98dd-e958fd1e3abf
	Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...)	Unsupported	unsupported	driver_load	windows	Sysmon	Stealth Obfuscated Files or Information	-	high	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	2019-11-08	2022-07-07	e75c48bd-3434-4d61-94b7-ddfaa2c08487
	Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...)	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	2019-11-08	2022-12-31	1b9dc62e-6e9e-42a3-8990-94d7a10007f7
	Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...)	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	2019-11-08	2022-12-31	2f211361-7dce-442d-b78a-c04039677378
	Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...)	Generic	test	service	windows	WinEventLog Security	Stealth Obfuscated Files or Information	-	high	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	2019-11-08	2022-11-27	fd0f5778-d3cb-4c9a-9695-66759d04702a
	Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...)	Generic	test	service	windows	WinEventLog System	Stealth Obfuscated Files or Information	-	high	Daniel Bohannon (@Mandiant/@FireEye), oscd.community	2019-11-08	2022-11-27	51aa9387-1c53-4153-91cc-d73c59ae1ca9
	Detects Obfuscated Powershell via RUNDLL LAUNCHER	Unsupported	unsupported	driver_load	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-03-08	03b024c6-aad1-4da5-9f60-e9e8c00fa64c
	Detects Obfuscated Powershell via RUNDLL LAUNCHER	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	e6cb92b4-b470-4eb8-8a9d-d63e8583aae0
	Detects Obfuscated Powershell via RUNDLL LAUNCHER	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	a23791fe-8846-485a-b16b-ca691e1b03d4
	Detects Obfuscated Powershell via RUNDLL LAUNCHER	Generic	test	service	windows	WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	f241cf1b-3a6b-4e1a-b4f9-133c00dd95ca
	Detects Obfuscated Powershell via RUNDLL LAUNCHER	Generic	test	service	windows	WinEventLog System	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Timur Zinniatullin, oscd.community	2020-10-18	2022-11-29	11b52f18-aaec-4d60-9143-5dd8cc4706b9
	Detects Obfuscated use of stdin to execute PowerShell	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-15	2024-04-15	6c96fc76-0eb1-11eb-adc1-0242ac120002
	Detects Obfuscated use of stdin to execute PowerShell	Unsupported	unsupported	driver_load	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-15	2021-09-17	de7fb680-6efa-4bf3-af2c-14b6d33c8e6e
	Detects Obfuscated use of stdin to execute PowerShell	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-15	2024-04-05	779c8c12-0eb1-11eb-adc1-0242ac120002
	Detects Obfuscated use of stdin to execute PowerShell	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-15	2024-04-05	9ac8b09b-45de-4a07-9da1-0de8c09304a3
	Detects Obfuscated use of stdin to execute PowerShell	Generic	test	service	windows	WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-15	2022-11-29	0c718a5e-4284-4fb9-b4d9-b9a50b3a1974
	Detects Obfuscated use of stdin to execute PowerShell	Generic	test	service	windows	WinEventLog System	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	high	Jonathan Cheong, oscd.community	2020-10-15	2022-11-29	72862bf2-0eb1-11eb-adc1-0242ac120002

Title

Description

ISMInjector S0189

ISMInjector S0189

ISMInjector MITRE reference S0189

Standing S0189

Reach

Coverage

ISMInjector detections S0189