malware

CORALDECK S0212

Type: malware
Platform: Windows
Created: 18 April 2018
Last modified: 17 November 2024

CORALDECK is an exfiltration tool used by APT37. [1]

TechniquesBottom 12%

TacticsBottom 21%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

CORALDECK MITRE reference S0212

Exfiltration Over Unencrypted Non-C2 Protocol T1048.003 ↗

CORALDECK has exfiltrated data in HTTP POST headers.2

Exfiltration26 detection rules

File and Directory Discovery T1083 ↗

CORALDECK searches for specified files.3

Discovery29 detection rules

Archive via Utility T1560.001 ↗

CORALDECK has created password-protected RAR, WinImage, and zip archives to be exfiltrated.4

Collection22 detection rules

Standing S0212

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques3Bottom 12%

12th percentile · 88% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics3Bottom 21%

21st percentile · 79% of 825 ATT&CK software entries have more tactics spanned.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique26med64th pct

64th percentile · 64% of 825 ATT&CK software entries have this many detection rules per technique or fewer.

Tests / technique9medTop 19%

81st percentile · 81% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.

Data comps / technique4med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique1med57th pct

57th percentile · 57% of 825 ATT&CK software entries have this many mitigations per technique or fewer.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 3 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 59Splunk ESCU (cumulative) · 18

Standing S0212

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
Splunk	The following analytic detects the execution of 7z or 7za processes with command lines pointing to SMB network shares. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Collection Archive Collected Data Archive via Utility	-	medium	Teoderick Contreras, Splunk	2021-08-17	2026-05-13	01d29b48-ff6f-11eb-b81e-acde48001123
	Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-09-27	2026-06-05	ec570e53-4c76-45a9-804d-dc3f355ff7a7
Splunk	The following analytic detects the execution of 7z.exe, a 7-Zip utility, spawned from rundll32.exe or dllhost.exe. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Collection Archive Collected Data Archive via Utility	-	medium	Michael Haag, Teoderick Contreras, Splunk	2021-04-22	2026-05-13	9364ee8e-a39a-11eb-8f1d-acde48001122
	Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility Credential Access OS Credential Dumping LSASS Memory	-	critical	Florian Roth (Nextron Systems)	2019-02-21	2023-03-10	03e2746e-2b31-42f1-ab7a-eb39365b2422
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
	Detects usage of "getcap" binary. (...)	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	low	Nasreddine Bencherchali (Nextron Systems)	2022-12-28	2026-01-24	d8d97d51-122d-4cdd-9e2f-01b4b4933530
Splunk	This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Collection Data from Local System Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration Exfiltration Over C2 Channel	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	8a9e5f2b-6d4c-4e7f-9b3a-1c8d7f5e2a9b
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	The following analytic detects potentially suspicious large volumes of data sent by the connection initiator on flows from internal to external networks. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration Exfiltration Over C2 Channel Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	3d8536b6-52b4-4c3e-b695-3f2e90bb22be
	Various protocols maybe used to put data on the device for exfil or infil	Generic	test	authentication	-	Cisco AAA · Cisco	Collection Archive Collected Data Archive via Utility Collection Data Staged Command and Control Ingress Tool Transfer	-	low	Austin Clark	2019-08-12	2023-01-04	5e51acb2-bcbe-435b-99c6-0e3cd5e2aa59	-
	An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party ut (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility	-	medium	frack113	2021-07-27	2026-06-05	9fbf5927-5261-4284-a71d-f681029ea574
	An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party ut (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility	-	medium	frack113	2021-07-27	2022-12-25	e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d
	Detects execution of "tar.exe" in order to create a compressed file. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility	-	low	Nasreddine Bencherchali (Nextron Systems), AdmU3	2023-12-19	—	418a3163-3247-4b7b-9933-dcfcb7c52ea9
	Detects execution of "tar.exe" in order to extract compressed file. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility	-	low	AdmU3	2023-12-19	—	bf361876-6620-407a-812f-bfe11e51e924
	An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.	Generic	test	process_creation	linux	Linux Auditd	Collection Archive Collected Data Archive via Utility	-	low	Timur Zinniatullin, oscd.community	2019-10-21	2023-07-28	a3b5e3e9-1b49-4119-8b8e-0344a01f21ee
	Detects attempts to post the file with the usage of wget utility. (...)	Generic	test	process_creation	linux	Linux Auditd	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Pawel Mazur	2021-11-18	2022-12-25	cb39d16b-b3b6-4a7a-8222-1cf24b686ffc
	Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery	-	low	frack113	2022-08-20	2023-02-04	b4dc61f5-6cce-468e-a608-b48b469feaa2
	Detects the execution of the hdiutil utility in order to mount disk images.	Generic	test	process_creation	macos	-	Collection Archive Collected Data Archive via Utility Initial Access Phishing Spearphishing Attachment	-	medium	Omar Khaled (@beacon_exe)	2024-08-10	—	bf241472-f014-4f01-a869-96f99330ca8c
Splunk	The following analytic identifies DNS queries with unusually large lengths by computing the standard deviation of query lengths and filtering those exceeding two times the standard deviation. (...)	Anomaly	stable	dns	windows	Sysmon	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Bhavin Patel, Splunk	2019-10-16	2026-05-13	1a67f15a-f4ff-4170-84e9-08cf6f75d6f5	-
	Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	informational	Daniil Yugoslavskiy, oscd.community, CheraghiMilad	2020-10-19	2024-12-01	d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72
	Detects usage of system utilities to discover files and directories	Generic	test	process_creation	macos	-	Discovery File and Directory Discovery	-	informational	Daniil Yugoslavskiy, oscd.community	2020-10-19	2022-11-25	089dbdf6-b960-4bcc-90e3-ffc3480c20f6
	Detects usage of "rar" to add files to an archive for potential compression. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility	-	low	Timur Zinniatullin, E.M. Anhaus, oscd.community	2019-10-21	2023-02-05	6f3e2987-db24-4c78-a860-b4f4095a7095
Splunk	The following analytic detects outbound emails with attachments sent from an internal email domain to an external domain. (...)	Hunting	stable	account_management	-	Google Cloud	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Teoderick Contreras, Stanislav Miskovic, Splunk	2021-08-17	2026-05-13	dc4dc3a8-ff54-11eb-8bf7-acde48001122
	Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, ker (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery Discovery Process Discovery Discovery Query Registry Discovery System Information Discovery Discovery System Service Discovery	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali	2022-10-10	2024-11-23	fca949cc-79ca-446e-8064-01aa7e52ece5
	High DNS queries bytes amount from host per short period of time	Unsupported	unsupported	dns	-	-	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Daniil Yugoslavskiy, oscd.community	2019-10-24	2023-03-24	0f6c1bf5-70a5-4963-aef9-aab1eefb50bd	-
	High DNS queries bytes amount from host per short period of time	Unsupported	unsupported	firewall	-	-	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Daniil Yugoslavskiy, oscd.community	2019-10-24	2023-03-24	3b6e327d-8649-4102-993f-d25786481589	-
	High DNS requests amount from host per short period of time	Unsupported	unsupported	dns	-	-	Command and Control Application Layer Protocol DNS Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Daniil Yugoslavskiy, oscd.community	2019-10-24	2023-03-24	b4163085-4001-46a3-a79a-55d8bbbc7a3a	-
	High DNS requests amount from host per short period of time	Unsupported	unsupported	firewall	-	-	Command and Control Application Layer Protocol DNS Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Daniil Yugoslavskiy, oscd.community	2019-10-24	2023-03-24	51186749-7415-46be-90e5-6914865c825a	-
	Extremely high rate of NULL record type DNS requests from host per short period of time. (...)	Unsupported	unsupported	dns	-	-	Command and Control Application Layer Protocol DNS Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Daniil Yugoslavskiy, oscd.community	2019-10-24	2023-03-24	44ae5117-9c44-40cf-9c7c-7edad385ca70	-
	Extremely high rate of TXT record type DNS requests from host per short period of time. (...)	Unsupported	unsupported	dns	-	-	Command and Control Application Layer Protocol DNS Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Daniil Yugoslavskiy, oscd.community	2019-10-24	2023-03-24	f0a8cedc-1d22-4453-9c44-8d9f4ebd5d35	-
Splunk	The following analytic detects the creation of suspicious files named passff.tar and cookie.tar, which are indicative of archived stolen browser information such as history and cookies on a machine compromised with IcedID. (...)	Hunting	stable	file_event	windows	Sysmon	Collection Archive Collected Data Archive via Utility	-	medium	Teoderick Contreras, Splunk	2021-08-05	2026-05-13	0db4da70-f14b-11eb-8043-acde48001122
Splunk	The following analytic detects suspicious database file and directory discovery activities, which may signal an attacker attempt to locate and assess critical database assets on a compromised system. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Discovery File and Directory Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-23	2026-05-13	f616c4f3-bde9-41cf-856c-019b65f668bb
Splunk	The following analytic detects suspicious file and directory discovery activities, which may indicate an attacker's effort to locate sensitive documents and files on a compromised system. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Discovery File and Directory Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-22	2026-10-02	0bbfb79c-a755-49a5-a38a-1128d0a452f1
Splunk	The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Discovery File and Directory Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	555cc358-bf16-4e05-9b3a-0f89c73b7261
Splunk	The following analytic detects suspicious discovery of virtual disk files and directories, which may indicate an attacker's attempt to locate and access virtualized storage environments. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Discovery File and Directory Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	eec78cef-d4c8-4b35-8f5b-6922102a4a41
	Detects attempts to discover the files with setuid/setgid capability on them. (...)	Generic	test	process_creation	linux	Linux Auditd	Privilege Escalation Abuse Elevation Control Mechanism Discovery File and Directory Discovery	-	low	Pawel Mazur	2021-11-28	2022-12-25	fe10751f-1995-40a5-aaa2-c97ccb4123fe
Splunk	The following analytic detects the use of shell's /dev/tcp or /dev/udp pseudo-device feature to establish outbound network connections. (...)	Anomaly	stable	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Raven Tait, Splunk	2026-07-08	2026-07-08	f324bc06-8436-4606-8882-0a8fb480b719
	Detects process executions related to the backdoored versions of LiteLLM (v1.82.7 or v1.82.8). (...)	Emerging	experimental	process_creation	linux	Sysmon	Collection Archive Collected Data Archive via Utility Persistence, Privilege Escalation Create or Modify System Process Systemd Service Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-03-30	—	36603778-030c-43c4-8cbb-cd3c1d1a80c7
Splunk	The following analytic detects the high-frequency exfiltration of archive files via HTTP POST requests. (...)	Generic	stable	network_connection	-	Splunk Stream HTTP	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Teoderick Contreras, Splunk	2021-04-22	2026-05-13	4477f3ea-a28f-11eb-b762-acde48001122
	Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to credentials or suspicious activity.	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery	-	low	The DFIR Report	2025-02-21	—	3b4e950b-a3ea-44d3-877e-432071990709
	Detects usage of 7zip utilities (7z.exe, 7za.exe and 7zr.exe) to extract password protected zip files.	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility	-	low	Nasreddine Bencherchali (Nextron Systems)	2023-03-10	2026-06-05	b717b8fd-6467-4d7d-b3d3-27f9a463af77
Splunk	The following analytic detects potential data exfiltration using plain HTTP POST requests. (...)	Generic	stable	network_connection	-	Splunk Stream HTTP	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Teoderick Contreras, Splunk	2021-04-22	2026-09-08	e2b36208-a364-11eb-8909-acde48001122
	Normally, DNS logs contain a limited amount of different dns queries for a single domain. (...)	Unsupported	unsupported	dns	-	-	Command and Control Application Layer Protocol DNS Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	high	Patrick Bareiss	2019-04-07	2023-03-24	1ec4b281-aa65-46a2-bdae-5fd830ed914e
	Detects the execution of a PowerShell script with a call to the "Send-MailMessage" cmdlet along with the "-Attachments" flag. (...)	Hunting	test	ps_script	windows	PowerShell	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	frack113	2022-09-26	2024-11-01	9a7afa56-4762-43eb-807d-c3dc9ffe211b
	Detects usage of "find" binary in a suspicious manner to perform discovery	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-12-28	—	8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf
	Detects usage of "find" binary in a suspicious manner to perform discovery	Generic	test	process_creation	macos	-	Discovery File and Directory Discovery	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-12-28	—	85de3a19-b675-4a51-bfc6-b11a5186c971
	This rule detects potential exfiltration by looking for a few compression extensions in the uri and (...)	Unsupported	unsupported	-	-	HTTP · Zeek	Collection Archive Collected Data Archive via Utility Collection Data from Local System	-	medium	Greg Howell, OTR (Open Threat Research)	2020-04-05	2023-03-24	0d47e3f6-357f-4534-928c-202631d065fa
	Detects potentially suspicious command line arguments of common data compression tools	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility	-	medium	Florian Roth (Nextron Systems), Samir Bousseaden	2019-10-15	2023-08-29	27a72a60-7e5e-47b1-9d17-909c9abafdcd
	Detects technique used by MAZE ransomware to enumerate directories using Powershell	Generic	test	ps_script	windows	PowerShell	Discovery File and Directory Discovery	-	medium	frack113	2022-03-17	—	162e69a7-7981-4344-84a9-0f1c9a217a52
	Detects Exfiltration Over Alternative Protocol - ICMP. (...)	Generic	test	ps_script	windows	PowerShell	Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol	-	medium	Bartlomiej Czyz @bczyz1, oscd.community	2020-10-10	2022-12-25	4c4af3cd-2115-479c-8193-6b8bfce9001c

Title

Description