malware

POORAIM S0216

Type: malware
Platform: Windows
Created: 18 April 2018
Last modified: 17 November 2024

POORAIM is a backdoor used by APT37 in campaigns since at least 2014. [1]

Techniques29th pct

Tactics32nd pct

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0216

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
	Detects user data export activity.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	5259cbf2-0a75-48bf-b57a-c54d6fabaef3
	Detects user permission data export attempt.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	87cc6698-3e07-4ba2-9b43-a85a73e151e2
	Detects usage of "getcap" binary. (...)	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	low	Nasreddine Bencherchali (Nextron Systems)	2022-12-28	2026-01-24	d8d97d51-122d-4cdd-9e2f-01b4b4933530
Splunk	This analytic detects potential reconnaissance activities on Cisco ASA devices by identifying execution of multiple information-gathering "show" commands within a short timeframe. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Gather Victim Network Information Domain Properties IP Addresses Discovery System Information Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	6e9d4f7a-3c8b-4a9e-8d2f-7b5c9e1a6f3d
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Reconnaissance Gather Victim Network Information Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	71ac5328-2364-40cf-8381-92b8dc531399
	Detects the use of the redirection character ">" to redirect information on the command line. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	low	frack113	2022-01-22	2024-03-19	4f4eaa9f-5ad4-410c-a4be-bc6132b0175a
	Detects potential container discovery via listing of certain kernel features in the "/proc" virtual (...)	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Seth Hanford	2023-08-23	—	746c86fb-ccda-4816-8997-01386263acc4
	Detects XSS attempts injected via GET requests in access logs	Generic	test	webserver	-	-	Initial Access Drive-by Compromise	-	high	Saw Win Naung, Nasreddine Bencherchali	2021-08-15	2022-06-14	65354b83-a2ea-4ea6-8414-3ab38be0d409
Splunk	The following analytic identifies specific GET or HEAD requests to web servers that indicate reconnaissance attempts to find vulnerable JBoss servers. (...)	Generic	experimental	webserver	-	-	Initial Access, Persistence External Remote Services Discovery System Information Discovery	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	104658f4-afdc-499e-9719-17243f982681	-
Splunk	The following analytic identifies DNS queries from internal hosts to dynamic domain providers. (...)	Generic	stable	dns	windows	Sysmon	Initial Access Drive-by Compromise	-	medium	Bhavin Patel, Splunk	2019-10-16	2026-09-22	a1e761ac-1344-4dbd-88b2-3f34c912d359	-
	Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery	-	low	frack113	2022-08-20	2023-02-04	b4dc61f5-6cce-468e-a608-b48b469feaa2
	Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Seth Hanford	2023-08-23	—	11701de9-d5a5-44aa-8238-84252f131895
	Domain user and group enumeration via network reconnaissance. (...)	Unsupported	unsupported	-	-	DCE/RPC · Zeek	Discovery Account Discovery Domain Account Discovery System Information Discovery	-	medium	Nate Guagenti (@neu5ron), Open Threat Research (OTR)	2020-05-03	2023-03-24	66a0bdc6-ee04-441a-9125-99d2eb547942
Splunk	This detection identifies the use of ESXCLI system-level commands that retrieve configuration details. (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Discovery System Information Discovery	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	b4d4217a-6673-4fb6-837d-07a522bdf9f7	-
	Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	informational	Daniil Yugoslavskiy, oscd.community, CheraghiMilad	2020-10-19	2024-12-01	d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72
	Detects usage of system utilities to discover files and directories	Generic	test	process_creation	macos	-	Discovery File and Directory Discovery	-	informational	Daniil Yugoslavskiy, oscd.community	2020-10-19	2022-11-25	089dbdf6-b960-4bcc-90e3-ffc3480c20f6
	Detects a flashplayer update from an unofficial location	Generic	test	proxy	-	-	Initial Access Drive-by Compromise Stealth Masquerading Match Legitimate Resource Name or Location Execution User Execution Malicious File	-	high	Florian Roth (Nextron Systems)	2017-10-25	2022-08-08	4922a5dd-6743-4fc2-8e81-144374280997
	Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and code execution. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Application Layer Protocol Command and Control Web Service Bidirectional Communication	-	medium	Daniel Koifman (KoifSec)	2025-11-29	—	5bac7a56-da88-4c27-922e-c81e113b20cb
	Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, ker (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery Discovery Process Discovery Discovery Query Registry Discovery System Information Discovery Discovery System Service Discovery	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali	2022-10-10	2024-11-23	fca949cc-79ca-446e-8064-01aa7e52ece5
	WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery Network Service Discovery Discovery System Information Discovery	-	high	Georg Lauenstein (sure[secure])	2022-09-19	2023-03-23	98b53e78-ebaf-46f8-be06-421aafd176d9
	Detects commandline keywords indicative of potential usge of the tool WinPwn. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Credential Access Credentials from Password Stores Credentials from Web Browsers Execution Native API Discovery Network Service Discovery Discovery Software Discovery Discovery System Information Discovery Credential Access Unsecured Credentials Credentials In Files	-	high	Swachchhanda Shrawan Poudel	2023-12-04	—	d557dc06-62e8-4468-a8e8-7984124908ce
	Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. (...)	Generic	test	ps_script	windows	PowerShell	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Credential Access Credentials from Password Stores Credentials from Web Browsers Execution Native API Discovery Network Service Discovery Discovery Software Discovery Discovery System Information Discovery Credential Access Unsecured Credentials Credentials In Files	-	high	Swachchhanda Shrawan Poudel	2023-12-04	—	851fd622-b675-4d26-b803-14bc7baa517a
Splunk	The following analytic detects suspicious database file and directory discovery activities, which may signal an attacker attempt to locate and assess critical database assets on a compromised system. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Discovery File and Directory Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-23	2026-05-13	f616c4f3-bde9-41cf-856c-019b65f668bb
Splunk	The following analytic detects suspicious file and directory discovery activities, which may indicate an attacker's effort to locate sensitive documents and files on a compromised system. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Discovery File and Directory Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-22	2026-10-02	0bbfb79c-a755-49a5-a38a-1128d0a452f1
Splunk	The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Discovery File and Directory Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	555cc358-bf16-4e05-9b3a-0f89c73b7261
Splunk	The following analytic identifies the use of the 'kmod' process to list kernel modules on a Linux system. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Stealth Rootkit Discovery System Information Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-09	2026-05-13	d1b088de-c47a-4572-9339-bdcc26493b32
Splunk	The following analytic detects suspicious discovery of virtual disk files and directories, which may indicate an attacker's attempt to locate and access virtualized storage environments. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Discovery File and Directory Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	eec78cef-d4c8-4b35-8f5b-6922102a4a41
	Detects attempts to discover the files with setuid/setgid capability on them. (...)	Generic	test	process_creation	linux	Linux Auditd	Privilege Escalation Abuse Elevation Control Mechanism Discovery File and Directory Discovery	-	low	Pawel Mazur	2021-11-28	2022-12-25	fe10751f-1995-40a5-aaa2-c97ccb4123fe
Splunk	The following analytic identifies the use of the 'kmod' process to list kernel modules on a Linux system. (...)	Anomaly	stable	process_creation	linux	Sysmon	Stealth Rootkit Discovery System Information Discovery	-	medium	Michael Haag, Splunk	2022-06-17	2026-10-09	6df99886-0e04-4c11-8b88-325747419278
	Detects a set of suspicious network related commands often used in recon stages	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery System Information Discovery	-	high	Florian Roth (Nextron Systems)	2022-02-07	—	e6313acd-208c-44fc-a0ff-db85d572e90e
	Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to credentials or suspicious activity.	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery	-	low	The DFIR Report	2025-02-21	—	3b4e950b-a3ea-44d3-877e-432071990709
	Detects the use of grep to identify information about the operating system architecture. (...)	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-06-02	—	d27ab432-2199-483f-a297-03633c05bae6
	Detects the enabling of the "EnablePeriodicBackup" registry value. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Collection Screen Capture	-	medium	Nasreddine Bencherchali (Nextron Systems)	2024-07-01	—	973ef012-8f1a-4c40-93b4-7e659a5cd17f
	Detects several different DNS-answers by one domain with IPs from internal and external networks. (...)	Unsupported	unsupported	dns	windows	Sysmon	Initial Access Drive-by Compromise	-	medium	Ilyas Ochkov, oscd.community	2019-10-25	2023-02-24	eb07e747-2552-44cd-af36-b659ae0958e4
	Detects listing of the inodes of the "/" directory to determine if the we are running inside of a container.	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Seth Hanford	2023-08-23	2025-11-24	43e26eb5-cd58-48d1-8ce9-a273f5d298d8
	Detects usage of "find" binary in a suspicious manner to perform discovery	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-12-28	—	8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf
	Detects usage of "find" binary in a suspicious manner to perform discovery	Generic	test	process_creation	macos	-	Discovery File and Directory Discovery	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-12-28	—	85de3a19-b675-4a51-bfc6-b11a5186c971
	Detects the use of grep to discover specific files created by the GobRAT malware	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	high	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-06-02	—	e34cfa0c-0a50-4210-9cb3-5632d08eb041
	Detects the execution of "wmic" with the "process" flag, which might indicate an attempt to perform reconnaissance on running processes. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Process Discovery Execution Windows Management Instrumentation	-	medium	frack113	2022-01-01	2025-12-15	221b251a-357a-49a9-920a-271802777cc0
	Detects the execution of WMIC in order to get a list of firewall, antivirus and antispywware products. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery Execution Windows Management Instrumentation	-	medium	Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems)	2023-02-14	2025-03-17	e568650b-5dcd-4658-8f34-ded0b1e13992
	Detects potential suspicious behaviour using secedit.exe. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access, Collection Adversary-in-the-Middle Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Authentication Package Port Monitors Active Setup Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Persistence, Privilege Escalation Event Triggered Execution Netsh Helper DLL Accessibility Features Stealth Hide Artifacts Hidden Users Execution, Stealth Hijack Execution Flow Path Interception by PATH Environment Variable Persistence, Defense Impairment, Credential Access Modify Authentication Process Password Filter DLL Persistence Server Software Component Terminal Services DLL Discovery System Information Discovery	-	medium	Janantha Marasinghe	2022-11-18	2022-12-30	c2c76b77-32be-4d1f-82c9-7e544bdfe0eb
Splunk	The following analytic detects the presence of "api.telegram.org" in the CommandLine of a process. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Exfiltration Exfiltration Over C2 Channel Command and Control Web Service Bidirectional Communication	-	medium	Nasreddine Bencherchali, Splunk, Zaki Zarkasih Al Mustafa	2025-02-19	2026-05-13	d6b0d627-d0bf-46b1-936f-c48284767d21
	Detects connections with Azure Front Door (known legitimate service that can be leveraged for C2) th (...)	Hunting	test	network_connection	windows	Sysmon	Command and Control Proxy Domain Fronting Command and Control Web Service Bidirectional Communication	-	medium	Isaac Dunham	2024-11-07	—	8cb4d14e-776e-43c2-8fb9-91e7fcea32b4
	Detects technique used by MAZE ransomware to enumerate directories using Powershell	Generic	test	ps_script	windows	PowerShell	Discovery File and Directory Discovery	-	medium	frack113	2022-03-17	—	162e69a7-7981-4344-84a9-0f1c9a217a52
	Detect adversaries enumerate sensitive files	Generic	test	ps_script	windows	PowerShell	Discovery File and Directory Discovery	-	medium	frack113	2022-09-16	—	7d416556-6502-45b2-9bad-9d2f05f38997
	Detects process discovery commands. (...)	Hunting	stable	process_creation	linux	Sysmon	Discovery Process Discovery	-	low	Ömer Günal, oscd.community, CheraaghiMilad	2020-10-06	2022-07-07	4e2f5868-08d4-413d-899f-dc2f1508627b
	Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery Cloud Service Discovery Discovery File and Directory Discovery	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-10-18	2023-02-04	38646daa-e78f-4ace-9de0-55547b2d30da
	Detects the execution of System Informer, a task manager tool to view and manipulate processes, kern (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Stealth Hide Artifacts Discovery System Information Discovery	-	medium	Florian Roth (Nextron Systems)	2023-05-08	2024-11-23	5722dff1-4bdd-4949-86ab-fbaf707e767a

Title

Description

POORAIM S0216

POORAIM MITRE reference S0216

Standing S0216

Reach

Coverage

POORAIM detections S0216