malware

HOMEFRY S0232

Type: malware
Platform: Windows
Created: 18 April 2018
Last modified: 11 April 2024

HOMEFRY is a 64-bit Windows password dumper/cracker that has previously been used in conjunction with other Leviathan backdoors. [1]

TechniquesBottom 12%

TacticsBottom 21%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

HOMEFRY MITRE reference S0232

OS Credential Dumping T1003 ↗

HOMEFRY can perform credential dumping.2

Credential Access51 detection rules

Encrypted/Encoded File T1027.013 ↗

Some strings in HOMEFRY are obfuscated with XOR x56.3

Stealth1 detection rules

Windows Command Shell T1059.003 ↗

HOMEFRY uses a command-line interface.4

Execution63 detection rules

Standing S0232

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques3Bottom 12%

12th percentile · 88% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics3Bottom 21%

21st percentile · 79% of 825 ATT&CK software entries have more tactics spanned.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique51medTop 8%

92nd percentile · 92% of 825 ATT&CK software entries have this many detection rules per technique or fewer.

Tests / technique6med55th pct

55th percentile · 55% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.

Data comps / technique5med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique2medTop 9%

91st percentile · 91% of 825 ATT&CK software entries have this many mitigations per technique or fewer.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 3 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 87Splunk ESCU (cumulative) · 28

Standing S0232

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects file access requests to browser credential stores by uncommon processes. (...)	Hunting	test	file_access	windows	-	Credential Access OS Credential Dumping	-	low	frack113, X__Junior (Nextron Systems)	2022-04-09	2024-07-29	91cb43db-302a-47e3-b3c8-7ede481e27bf
	Detects file access requests to chromium based browser sensitive files by uncommon processes. (...)	Hunting	test	file_access	windows	-	Credential Access OS Credential Dumping	-	low	X__Junior (Nextron Systems)	2024-07-29	—	c5f37810-a85f-4186-81e9-33f23abb4141
	Detects file access requests to crypto currency files by uncommon processes. (...)	Generic	test	file_access	windows	-	Credential Access OS Credential Dumping	-	medium	X__Junior (Nextron Systems)	2024-07-29	—	f41b0311-44f9-44f0-816d-dd45e39d4bc8
	Detects a highly relevant Antivirus alert that reports password dumpers and stealers. (...)	Generic	stable	antivirus	-	-	Credential Access OS Credential Dumping LSASS Memory Security Account Manager Credential Access Steal or Forge Kerberos Tickets	-	critical	Florian Roth (Nextron Systems), Arnim Rupp	2018-09-09	2026-06-15	78cc2dd2-7d20-4d32-93ff-057084c38b93
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
Splunk	The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike · Cisco NVM · Cisco	Reconnaissance Active Scanning Stealth Masquerading Match Legitimate Resource Name or Location Credential Access OS Credential Dumping	-	medium	Bhavin Patel, Splunk, sventec, Github Community	2021-07-12	2026-09-22	a51bfe1a-94f0-48cc-b4e4-16a110145893	-
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
	Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping	-	medium	Julia Fomina, oscd.community	2020-10-09	2025-10-31	93671f99-04eb-4ab4-a161-70d446a84003
Splunk	This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Initial Access Exploit Public-Facing Application Execution Exploitation for Client Execution Credential Access OS Credential Dumping Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Nasreddine Bencherchali, Splunk	2025-04-16	2026-05-13	ec99bb81-c31b-4837-8c7d-1b32aa70b337
Splunk	The following analytic detects the use of `cmd.exe /c` to execute commands, a technique often employed by adversaries and malware to run batch commands or invoke other shells like PowerShell. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	CVE-2021-44228	medium	Teoderick Contreras, Bhavin Patel, Splunk	2021-10-21	2026-05-13	54a6ed00-3256-11ec-b031-acde48001122
Splunk	The following analytic identifies the use of named-pipe impersonation for privilege escalation, commonly associated with Cobalt Strike and similar frameworks. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	medium	Michael Haag, Splunk	2021-05-27	2026-05-13	eb277ba0-b96b-11eb-b00e-acde48001122
	Detects a suspicious command line execution that includes an URL and AppData string in the command l (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Command and Control Ingress Tool Transfer	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community	2019-01-16	2021-11-27	1ac8666b-046f-4201-8aba-1951aaec03a3
	detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hi (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-06-14	—	ee5e119b-1f75-4b34-add8-3be976961e39
	Detects suspicious processes based on name and location that access the windows credential manager and vault. (...)	Generic	test	file_access	windows	-	Credential Access OS Credential Dumping	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-10-11	2026-07-28	407aecb1-e762-4acf-8c7b-d087bcff3bb6
Splunk	The following analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). (...)	Generic	stable	file_event	-	CrushFTP	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Initial Access Exploit Public-Facing Application	CVE-2025-31161	medium	Michael Haag, Splunk	2025-04-14	2026-09-08	82eb7f64-d219-4e21-acfe-956de84c1a35
Splunk	The following analytic detects the execution of Mimikatz commands via PowerShell by leveraging PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Credential Access OS Credential Dumping	-	medium	Michael Haag, Splunk	2021-06-09	2026-05-13	8148c29c-c952-11eb-9255-acde48001122
Splunk	The following analytic detects executions of cmd.exe spawned by processes that are commonly abused by attackers and do not typically launch cmd.exe. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	dcfd6b40-42f9-469d-a433-2e53f7486664	-
Splunk	The following detects the execution of cscript.exe or wscript.exe processes spawned by cmd.exe, leveraging Endpoint Detection and Response (EDR) telemetry mapped to the Endpoint data model, with additional contextual filtering to improve fidelity and reduce false positives. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	-	medium	Bhavin Patel, Mauricio Velazco, Splunk	2020-04-29	2026-05-13	b89919ed-fe5f-492c-b139-95dbb162039e
	Detects DNS queries made by the finger utility, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. (...)	Generic	experimental	dns	windows	Sysmon	Command and Control Application Layer Protocol DNS Execution Command and Scripting Interpreter Windows Command Shell	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-11-19	—	c082c2b0-525b-4dbc-9a26-a57dc4692074
	ntds.dit retrieving using synchronisation with legitimate domain controller using Directory Replicat (...)	Unsupported	unsupported	authentication	windows	WinEventLog Security	Credential Access OS Credential Dumping	-	medium	Teymur Kheirkhabarov, oscd.community	2019-10-24	2019-11-13	51238c62-2b29-4539-ad75-e94575368a12
	ntds.dit retrieving (only computer accounts) using synchronisation with legit domain controller usin (...)	Unsupported	unsupported	authentication	windows	WinEventLog Security	Credential Access OS Credential Dumping	-	medium	Teymur Kheirkhabarov, oscd.community	2019-11-01	—	757b2a11-73e7-411a-bd46-141d906e0167
	Detects Elise backdoor activity used by APT32	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell	-	critical	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2018-01-31	2023-03-09	e507feb7-5f73-4ef6-a970-91bb6f6d744f
Splunk	The following analytic detects a suspicious registry modification that enables the plain text credential feature in Windows by setting the "UseLogonCredential" value to 1 in the WDigest registry path. (...)	Generic	stable	registry_event	windows	Sysmon	Persistence, Defense Impairment Modify Registry Credential Access OS Credential Dumping	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-10-05	2026-10-09	0c7d8ffe-25b1-11ec-9f39-acde48001122
	Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping NTDS	-	medium	sam0x90	2021-08-06	2022-10-09	7df1713a-1a5b-4a4b-a071-dc83b144a101
	Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability rep (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Initial Access Exploit Public-Facing Application	CVE-2020-10189	high	Florian Roth (Nextron Systems)	2020-03-25	2023-01-21	846b866e-2a57-46ee-8e16-85fa92759be7
	Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and Partner (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Privilege Escalation Exploitation for Privilege Escalation Execution, Stealth Hijack Execution Flow	CVE-2019-1378	high	Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro	2019-11-15	2021-11-27	1c373b6d-76ce-4553-997d-8c1da9a6b5f5
	Detects access to Signal Desktop's sensitive data files: db.sqlite and config.json. (...)	Generic	experimental	file_event	windows	WinEventLog Security	Credential Access OS Credential Dumping	-	medium	Andreas Braathen (mnemonic.io)	2025-10-19	—	5d6c375a-18ae-4952-b4f6-8b803f6c8555
	This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access Brute Force Execution Command and Scripting Interpreter PowerShell Windows Command Shell Discovery Password Policy Discovery Execution, Persistence, Privilege Escalation Scheduled Task/Job Execution Windows Management Instrumentation	-	high	Florian Roth (Nextron Systems)	2022-02-25	2023-03-08	42a993dd-bb3e-48c8-b372-4d6684c4106c
	Detects various execution patterns of the CrackMapExec pentesting framework	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Execution, Persistence, Privilege Escalation Scheduled Task/Job Execution Windows Management Instrumentation	-	high	Thomas Patzke	2020-05-22	2023-11-06	058f4380-962d-40a5-afce-50207d36d7e2
	Detects the use of Jlaive to execute assemblies in a copied PowerShell	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell	-	medium	Jose Luis Sanchez Martinez (@Joseliyo_Jstnk)	2022-05-24	2023-02-22	0a99eb3e-1617-41bd-b095-13dc767f3def
	Detects command line parameters used by Koadic hack tool	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic JavaScript	-	high	wagga, Jonhnathan Ribeiro, oscd.community	2020-01-12	2023-02-11	5cddf373-ef00-4112-ad72-960ac29bac34
	Detects default filenames output from the execution of CrackMapExec and Impacket-secretsdump against an endpoint.	Generic	test	file_event	windows	Sysmon	Credential Access OS Credential Dumping	-	high	SecurityAura	2022-11-16	2024-06-27	6e2a900a-ced9-4e4a-a9c2-13e706f9518a
	Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Execution Native API Stealth System Binary Proxy Execution Rundll32	-	high	Alexander Rausch	2020-06-24	2023-03-01	95022b85-ff2a-49fa-939a-d7b8f56eeb9b
	Detects the execution of the hacktool Rubeus via PE information of command line parameters	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping Credential Access Steal or Forge Kerberos Tickets Kerberoasting Lateral Movement Use Alternate Authentication Material Pass the Ticket	-	critical	Florian Roth (Nextron Systems)	2018-12-19	2023-04-20	7ec2c172-dceb-4c10-92c9-87c1881b7e18
	Detects the execution of the hacktool Rubeus using specific command line flags	Generic	test	ps_script	windows	PowerShell	Credential Access OS Credential Dumping Credential Access Steal or Forge Kerberos Tickets Kerberoasting Lateral Movement Use Alternate Authentication Material Pass the Ticket	-	high	Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems)	2023-04-27	—	3245cd30-e015-40ff-a31d-5cadd5f377ec
	Detects the execution of different Windows based hacktools via their import hash (imphash) even if t (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Resource Development Obtain Capabilities Tool Credential Access OS Credential Dumping	-	critical	Florian Roth (Nextron Systems)	2022-03-04	2024-11-23	24e3e58a-646b-4b50-adef-02ef935b9fc8
	Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Resource Development Obtain Capabilities Tool Credential Access OS Credential Dumping	-	high	Florian Roth (Nextron Systems)	2022-04-27	2024-01-15	37c1333a-a0db-48be-b64b-7393b2386e3b
	Detects the launch of a child process via "conhost.exe" with the "--headless" flag. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell	-	medium	Nasreddine Bencherchali (Nextron Systems)	2024-07-23	—	00ca75ab-d5ce-43be-b86c-55ff39c6abfc
	Detects a suspicious child process of a Microsoft HTML Help (HH.exe)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic JavaScript Initial Access Phishing Spearphishing Attachment Stealth System Binary Proxy Execution Compiled HTML File Regsvr32 Rundll32 Execution Windows Management Instrumentation	-	high	Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)	2020-04-01	2023-04-12	52cad028-0ff0-4854-8f67-d25dfcbc78b4
	Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe". (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping	-	low	Swachchhanda Shrawan Poudel	2024-02-12	—	e83e8899-c9b2-483b-b355-5decc942b959
	Detect attempt to enable auditing of TTY input	Generic	test	file_event	linux	Linux Auditd	Credential Access, Collection Input Capture Keylogging Credential Access OS Credential Dumping	-	high	Pawel Mazur	2021-05-24	2022-12-18	49aae26c-450e-448b-911d-b3c13d178dfc
	Detects usage of a PowerShell command to dump the live memory of a Windows machine	Generic	test	ps_script	windows	PowerShell	Credential Access OS Credential Dumping	-	high	Max Altgelt (Nextron Systems)	2021-09-21	2022-12-25	cd185561-4760-45d6-a63e-a51325112cae
	Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping	-	medium	Swachchhanda Shrawan Poudel	2024-02-12	2024-03-13	34275eb8-fa19-436b-b959-3d9ecd53fa1f
	Detects known malicious service installs that only appear in cases of lateral movement, credential dumping, and other suspicious activities.	Unsupported	unsupported	service	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service Credential Access OS Credential Dumping Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update)	2017-03-27	2022-03-21	2cfe636e-317a-4bee-9f2c-1066d9f54d1a
	Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping	-	high	Tim Rauch, Elastic (idea)	2022-09-28	2022-12-30	97dbf6e2-e436-44d8-abee-4261b24d3e41
	Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwo (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping	-	high	Tim Rauch, Janantha Marasinghe, Elastic (original idea)	2022-11-08	2023-01-22	2d3cdeec-c0db-45b4-aa86-082f7eb75701
	Detects certain DLL loads when Mimikatz gets executed	Unsupported	unsupported	image_load	windows	Sysmon	Credential Access OS Credential Dumping	-	medium	sigma	2017-03-13	2023-02-24	c0478ead-5336-46c2-bd5e-b4c84bc3a36e
	Detects network connections via finger.exe, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. (...)	Generic	experimental	network_connection	windows	Sysmon	Command and Control Application Layer Protocol DNS Execution Command and Scripting Interpreter Windows Command Shell	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-11-19	—	2fdaf50b-9fd5-449f-ba69-f17248119af6

Title

Description