malware

JPIN S0201

Type: malware
Platform: Windows
Created: 18 April 2018
Last modified: 25 April 2025

JPIN is a custom-built backdoor family used by PLATINUM. Evidence suggests developers of JPIN and Dipsind code bases were related in some way. [1]

TechniquesTop 20%

TacticsTop 11%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0201

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Adversaries may attempt to find domain-level groups and permission settings. (...)	Generic	test	ps_module	windows	PowerShell	Discovery Permission Groups Discovery Local Groups	-	low	frack113	2021-12-15	2023-01-20	815bfc17-7fc6-4908-a55e-2f37b98cedb4
	Adversaries may attempt to find domain-level groups and permission settings. (...)	Generic	test	ps_script	windows	PowerShell	Discovery Permission Groups Discovery Local Groups	-	low	frack113	2021-12-15	2022-12-25	88f0884b-331d-403d-a3a1-b668cf035603
	Detects WRITE_DAC access to a domain object	Generic	test	account_management	windows	WinEventLog Security	Defense Impairment File and Directory Permissions Modification Windows Permissions	-	critical	Roberto Rodriguez @Cyb3rWard0g	2019-09-12	2021-11-27	028c7842-4243-41cd-be6f-12f3cf1a26c7
Splunk	The following analytic detects the use of commands to add or set exclusions in Windows Defender. It (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Defense Impairment Disable or Modify Tools	-	medium	Teoderick Contreras, Nasreddine Bencherchali, Splunk	2021-11-25	2026-06-08	773b66fe-4dd9-11ec-8289-acde48001122
	Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-09-02	2024-03-19	d7662ff6-9e97-4596-a61d-9839e32dee8d
	Detects the deletion of the "Zone.Identifier" ADS. (...)	Hunting	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	low	frack113	2023-09-04	—	7eac0a16-5832-4e81-865f-0268a6d19e4b
	Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...)	Generic	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-09-04	2025-07-04	3109530e-ab47-4cc6-a953-cac5ebcc93ae
	Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts	Generic	test	ps_script	windows	PowerShell	Defense Impairment Disable or Modify Tools	-	high	Florian Roth (Nextron Systems)	2022-11-09	—	e0d6c087-2d1c-47fd-8799-3904103c5a98
	Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. (...)	Generic	experimental	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-12-25	—	aa37cbb0-da36-42cb-a90f-fdf216fc7467
	Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools	-	high	@kostastsale, Nasreddine Bencherchali (Nextron Systems)	2023-11-05	2024-08-16	31e124fb-5dc4-42a0-83b3-44a69c77b271
	Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .	Emerging	stable	antivirus	-	-	Privilege Escalation, Stealth Process Injection	CVE-2021-1675 CVE-2021-34527	critical	Sittikorn S, Nuttakorn T, Tim Shelton	2021-07-01	2023-10-23	6fe1719e-ecdf-4caf-bffe-4f501cb0a561
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	Detects DNS queries made by "AppInstaller.EXE". (...)	Generic	test	dns	windows	Sysmon	Command and Control Ingress Tool Transfer	-	medium	frack113	2021-11-24	2023-11-09	7cff77e1-9663-46a3-8260-17f2e1aa9d0a
	Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under (...)	Emerging	test	image_load	windows	Sysmon	Privilege Escalation, Stealth Process Injection	-	high	Florian Roth (Nextron Systems)	2021-09-07	2022-10-09	33a2d1dd-f3b0-40bd-8baf-7974468927cc
	Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer	-	medium	Victor Sergeev, oscd.community	2020-10-09	2023-10-18	eee00933-a761-4cd0-be70-c42fe91731e7
	Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including: - Use (...)	Generic	experimental	process_creation	linux	Linux Auditd	Defense Impairment Disable or Modify Tools Privilege Escalation, Stealth Process Injection Proc Memory	-	high	Milad Cheraghi	2025-05-26	2025-12-05	e497a24e-9345-4a62-9803-b06d7d7cb132
	Detect changes in auditd configuration files	Generic	test	file_event	linux	Linux Auditd	Defense Impairment Disable or Modify Tools	-	high	Mikhail Larin, oscd.community	2019-10-25	2021-11-27	977ef627-4539-4875-adf4-ed8f780c4922
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
Splunk	Detects identities generating anomalously large model responses relative to their own historical baseline. (...)	Anomaly	stable	-	-	AWS	Privilege Escalation, Stealth Process Injection	-	medium	Rod Soto	2026-07-06	2026-07-06	a839a6f7-aaac-438b-9d99-be0b49481e17
Splunk	Detects identities invoking high-risk filesystem and execution tools via AWS Bedrock Claude. (...)	Anomaly	stable	-	-	AWS	Privilege Escalation, Stealth Process Injection	-	medium	Rod Soto	2026-07-06	2026-07-06	989b3702-1df3-4076-9e2f-8dcbcc2b4bef
Splunk	This detection identifies prompts with hostile or aggressive sentiment being sent to AWS Bedrock Claude models. (...)	Anomaly	stable	-	-	AWS	Privilege Escalation, Stealth Process Injection	-	medium	Rod Soto	2026-07-06	2026-07-06	54734442-955a-4427-9a86-2d9712151067
Splunk	This search surfaces AWS Bedrock Claude prompts containing phrases commonly associated with prompt injection or jailbreak attempts, such as instruction overrides, persona switching, or requests to ignore prior guidance. (...)	Hunting	stable	-	-	AWS	Privilege Escalation, Stealth Process Injection	-	medium	Rod Soto	2026-07-06	2026-07-06	9e162548-3e9a-4a74-9eb5-34ee28350f07
Splunk	This detection identifies sensitive data such as social security numbers, passwords, API keys, and credit card numbers being sent in prompts to AWS Bedrock Claude models. (...)	Anomaly	stable	-	-	AWS	Privilege Escalation, Stealth Process Injection	-	medium	Rod Soto	2026-07-06	2026-07-06	39346724-a73a-4e01-8e93-4f4791e1a0bb
Splunk	This detection identifies unusually large prompts sent to AWS Bedrock Claude models by calculating the statistical baseline of input token counts and flagging requests that exceed one standard deviations above the mean. (...)	Anomaly	stable	-	-	AWS	Privilege Escalation, Stealth Process Injection	-	medium	Rod Soto	2026-07-06	2026-07-08	95fbdd4e-1202-4971-b85a-513b2005086e
	Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	medium	Marco Pedrinazzi (@pedrinazziM) (InTheCyber)	2026-07-10	—	59b70e4d-dd17-44a9-b740-acf07ae3eb6a
	Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety c (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	medium	Marco Pedrinazzi (@pedrinazziM) (InTheCyber)	2026-07-10	—	1c722651-254a-4b04-a9f4-99b62a2d0a1f
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
	Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools Disable or Modify Cloud Log	-	high	suktech24	2025-11-27	—	d2656e78-c069-4571-8220-9e0ab5913f19
	Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	high	faloker	2020-02-11	2022-10-09	6e61ee20-ce00-4f8d-8aee-bedd8216f7e3
	Detects evade to Macie detection.	Unsupported	unsupported	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	medium	Sittikorn S	2021-07-06	2023-03-24	91f6a16c-ef71-437a-99ac-0b070e3ad221
	Detects the modification of the findings on SecurityHub.	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	high	Sittikorn S	2021-06-28	—	a607e1fe-74bf-4440-a3ec-b059b9103157
	Detects file creation events linked to the Axios NPM supply chain compromise. (...)	Emerging	experimental	file_event	linux	Sysmon	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	b7cb840c-11f6-47f7-b3ef-5524739c9077
	Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...)	Emerging	experimental	file_event	macos	-	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	2db0458c-05c9-4069-a26f-77becd9c8c13
	Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...)	Emerging	experimental	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Unix Shell Python Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	0a23a62d-c5b3-468b-a072-25064a9a8c87
	Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.	Emerging	experimental	process_creation	macos	-	Execution Command and Scripting Interpreter AppleScript Unix Shell Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	a09ee860-31b3-4586-8a68-0ebd74ce0e5f
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
Splunk	The following analytic detects when the risk-based step-up consent security setting in Azure AD is disabled. (...)	Generic	stable	account_management	-	Microsoft 365	Defense Impairment Disable or Modify Tools	-	medium	Mauricio Velazco, Splunk	2023-11-16	2026-05-13	875de3d7-09bc-4916-8c0a-0929f4ced3d8
	This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent. (...)	Generic	test	-	windows	WinEventLog Security	Discovery Query Registry	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC	2021-08-26	2022-10-09	ff151c33-45fa-475d-af4f-c2f93571f4fe
	This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS). (...)	Generic	test	-	windows	WinEventLog Security	Discovery Query Registry	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC	2021-08-26	2022-10-09	1d2ab8ac-1a01-423b-9c39-001510eae8e8
	Detects when Events are deleted in Azure Kubernetes. (...)	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Defense Impairment Disable or Modify Tools	-	medium	Austin Songer @austinsonger	2021-07-24	2022-08-23	225d8b09-e714-479c-a0e4-55e6f29adf35
	Detects backup catalog deletions	Generic	test	-	windows	WinEventLog Application	Stealth Indicator Removal File Deletion	-	medium	Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection)	2017-05-12	2022-12-25	9703792d-fd9a-456d-a672-ff92efe4806a
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
	Detects changes to the bitbucket audit log configuration.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	6aa12161-235a-4dfb-9c74-fe08df8d8da1
	Detects Bitbucket global secret scanning rule deletion activity.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	e16cf0f0-ee88-4901-bd0b-4c8d13d9ee05
	Detects Bitbucket global SSH access configuration changes.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools Lateral Movement Remote Services SSH	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	16ab6143-510a-44e2-a615-bdb80b8317fc
	Detects when a secret scanning allowlist rule is added for projects.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools	-	low	Muhammad Faisal (@faisalusuf)	2024-02-25	—	42ccce6d-7bd3-4930-95cd-e4d83fa94a30
	Detects when a repository is exempted from secret scanning feature.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools	-	high	Muhammad Faisal (@faisalusuf)	2024-02-25	—	b91e8d5e-0033-44fe-973f-b730316f23a1
	Detects when secret scanning rule is deleted for the project or repository.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools	-	low	Muhammad Faisal (@faisalusuf)	2024-02-25	—	ff91e3f0-ad15-459f-9a85-1556390c138d
	Detects user data export activity.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	5259cbf2-0a75-48bf-b57a-c54d6fabaef3

Title

Description

JPIN S0201

JPIN MITRE reference S0201

Standing S0201

Reach

Coverage

JPIN detections S0201