malware
ROKRAT is a cloud-based remote access tool (RAT) used by APT37 to target victims in South Korea. APT37 has used ROKRAT during several campaigns from 2016 through 2021.[1][2][3]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
ROKRAT can use the GetForegroundWindow and GetWindowText APIs to discover where the user is typing.7
ROKRAT can access the HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData Registry key to obtain the System manufacturer value to identify the machine type.8
ROKRAT can encrypt data prior to exfiltration by using an RSA public key.910
ROKRAT can send collected files back over same C2 channel.12
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
92nd percentile · 92% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.
98th percentile · 98% of 825 ATT&CK software entries have this many tactics spanned or fewer.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
47th percentile · 53% of 825 ATT&CK software entries have more detection rules per technique.
62nd percentile · 62% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
57th percentile · 57% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 30 Enterprise techniques.
Technique Campaign use over its cumulative rule count.
1004 distinct rules cover the 30 techniques recorded for this malware. 661 Sigma · 343 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups. | Hunting | test | file_access | windows | - | - | low | frack113 | 2023-09-15 | 2024-07-29 | 337a31c6-46c4-46be-886a-260d7aa78cac | ||||
Detects file access requests to browser credential stores by uncommon processes. (...) | Hunting | test | file_event | windows | WinEventLog Security | - | low | Daniel Koifman (@Koifsec), Nasreddine Bencherchali | 2024-10-21 | — | 4b60e527-ec73-4b47-8cb3-f02ad927ca65 | ||||
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. (...) | Generic | test | ps_script | windows | PowerShell | - | medium | frack113 | 2022-01-30 | — | fc028194-969d-4122-8abe-0470d5b8f12f | ||||
Detects file access requests to the Windows Credential History File by an uncommon application. (...) | Generic | test | file_access | windows | - | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2022-10-17 | 2024-07-29 | 7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2 | ||||
Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. (...) | Generic | test | file_access | windows | - | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2022-10-17 | 2026-07-28 | 46612ae6-86be-4802-bc07-39b59feb1309 | ||||
Detect set Notification_Suppress to 1 to disable the Windows security center notification | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 0c93308a-3f1b-40a9-b649-57ea1a1c1d63 | ||||
Detect set DisallowRun to 1 to prevent user running specific computer program | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 275641a5-a492-45e2-a817-7c81e9d9d3e9 | ||||
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). (...) | Generic | test | pipe_created | windows | Sysmon | - | medium | Roberto Rodriguez @Cyb3rWard0g | 2021-10-08 | 2023-11-30 | 1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3 | ||||
Detects the deletion of the "Zone.Identifier" ADS. (...) | Hunting | test | file_delete | windows | Sysmon | - | low | frack113 | 2023-09-04 | — | 7eac0a16-5832-4e81-865f-0268a6d19e4b | ||||
Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...) | Generic | test | file_delete | windows | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-09-04 | 2025-07-04 | 3109530e-ab47-4cc6-a953-cac5ebcc93ae | ||||
Detects javaw.exe in AppData folder as used by Adwind / JRAT | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community | 2017-11-10 | 2022-10-09 | 1fac1481-2dbc-48b2-9096-753c49b4ec71 | ||||
Detects javaw.exe in AppData folder as used by Adwind / JRAT | Generic | test | file_event | windows | Sysmon | - | high | Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community | 2017-11-10 | 2022-12-02 | 0bcfabcb-7929-47f4-93d6-b33fb67d34d1 | ||||
Detect enable rdp feature to allow specific user to rdp connect on the targeted machine | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 37b437cf-3fc5-4c8e-9c94-1d7c9aff842b | ||||
Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 . | Emerging | stable | antivirus | - | - | critical | Sittikorn S, Nuttakorn T, Tim Shelton | 2021-07-01 | 2023-10-23 | 6fe1719e-ecdf-4caf-bffe-4f501cb0a561 | |||||
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled. | Generic | experimental | - | windows | AppLocker | - | medium | heyyanu | 2026-03-26 | — | 557e3bd3-7f21-495d-8d50-7c8bdfb8041c | ||||
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running. | Generic | test | - | windows | AppLocker | - | medium | Pushkarev Dmitry | 2020-06-28 | 2025-12-03 | 401e5d00-b944-11ea-8f9a-00163ecd60ae | ||||
Detects DNS queries made by "AppInstaller.EXE". (...) | Generic | test | dns | windows | Sysmon | - | medium | frack113 | 2021-11-24 | 2023-11-09 | 7cff77e1-9663-46a3-8260-17f2e1aa9d0a | ||||
Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under (...) | Emerging | test | image_load | windows | Sysmon | - | high | Florian Roth (Nextron Systems) | 2021-09-07 | 2022-10-09 | 33a2d1dd-f3b0-40bd-8baf-7974468927cc | ||||
Detects suspicious user agent strings used in APT malware in proxy logs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Markus Neis | 2019-11-12 | 2024-02-15 | 6ec820f2-e963-4801-9127-d8b2dce4d31b | ||||
Detects suspicious user agent string of APT40 Dropbox tool | Emerging | test | proxy | - | - | - | high | Thomas Patzke | 2019-11-12 | 2023-05-18 | 5ba715b6-71b7-44fd-8245-f66893e81b3d | ||||
Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Victor Sergeev, oscd.community | 2020-10-09 | 2023-10-18 | eee00933-a761-4cd0-be70-c42fe91731e7 | ||||
The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Sreeman | 2020-03-13 | 2022-04-14 | 24de4f3b-804c-4165-b442-5a06a2302c7e | ||||
Detects attempts to record audio using the arecord and ecasound utilities. | Generic | test | process_creation | linux | Linux Auditd | - | low | Pawel Mazur, Milad Cheraghi | 2021-09-04 | 2025-12-05 | a7af2487-9c2f-42e4-9bb9-ff961f0561d5 | ||||
Detects audio capture via PowerShell Cmdlet. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Nasreddine Bencherchali (Nextron Systems) | 2019-10-24 | 2023-04-06 | 932fb0d8-692b-4b0f-a26e-5643a50fe7d6 | ||||
Detect attacker collecting audio via SoundRecorder application. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community | 2019-10-24 | 2021-11-27 | 83865853-59aa-449e-9600-74b9d89a6d6e | ||||
Detects automated lateral movement by Turla group | Unsupported | unsupported | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Markus Neis | 2017-11-07 | 2023-02-24 | 75925535-ca97-4e0a-a850-00b5c00779dc | ||||
Splunk | Detects identities generating anomalously large model responses relative to their own historical baseline. (...) | Anomaly | stable | - | - | AWS | - | medium | Rod Soto | 2026-07-06 | 2026-07-06 | a839a6f7-aaac-438b-9d99-be0b49481e17 | |||
Splunk | Detects identities invoking high-risk filesystem and execution tools via AWS Bedrock Claude. (...) | Anomaly | stable | - | - | AWS | - | medium | Rod Soto | 2026-07-06 | 2026-07-06 | 989b3702-1df3-4076-9e2f-8dcbcc2b4bef | |||
Splunk | This detection identifies prompts with hostile or aggressive sentiment being sent to AWS Bedrock Claude models. (...) | Anomaly | stable | - | - | AWS | - | medium | Rod Soto | 2026-07-06 | 2026-07-06 | 54734442-955a-4427-9a86-2d9712151067 | |||
Splunk | This search surfaces AWS Bedrock Claude prompts containing phrases commonly associated with prompt injection or jailbreak attempts, such as instruction overrides, persona switching, or requests to ignore prior guidance. (...) | Hunting | stable | - | - | AWS | - | medium | Rod Soto | 2026-07-06 | 2026-07-06 | 9e162548-3e9a-4a74-9eb5-34ee28350f07 | |||
Splunk | This detection identifies sensitive data such as social security numbers, passwords, API keys, and credit card numbers being sent in prompts to AWS Bedrock Claude models. (...) | Anomaly | stable | - | - | AWS | - | medium | Rod Soto | 2026-07-06 | 2026-07-06 | 39346724-a73a-4e01-8e93-4f4791e1a0bb | |||
Splunk | This detection identifies unusually large prompts sent to AWS Bedrock Claude models by calculating the statistical baseline of input token counts and flagging requests that exceed one standard deviations above the mean. (...) | Anomaly | stable | - | - | AWS | - | medium | Rod Soto | 2026-07-06 | 2026-07-08 | 95fbdd4e-1202-4971-b85a-513b2005086e | |||
An attempt to export an AWS EC2 instance has been detected. (...) | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | low | Diogo Braz | 2020-04-16 | 2022-10-05 | 54b9a76a-3c71-4673-b4b3-2edb4566ea7b | ||||
Detects file creation events linked to the Axios NPM supply chain compromise. (...) | Emerging | experimental | file_event | linux | Sysmon | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | b7cb840c-11f6-47f7-b3ef-5524739c9077 | ||||
Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...) | Emerging | experimental | file_event | macos | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 2db0458c-05c9-4069-a26f-77becd9c8c13 | ||||
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...) | Emerging | experimental | process_creation | linux | Sysmon | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 0a23a62d-c5b3-468b-a072-25064a9a8c87 | ||||
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup. | Emerging | experimental | process_creation | macos | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | a09ee860-31b3-4586-8a68-0ebd74ce0e5f | ||||
Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...) | Emerging | experimental | process_creation | windows | Sysmon · WinEventLog Security | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | f6c27ecc-d890-4452-80e6-2e274a10e097 | ||||
Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...) | Emerging | experimental | dns | - | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 73e5d24f-493f-4092-bd2f-c72cabda40ee | ||||
This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent. (...) | Generic | test | - | windows | WinEventLog Security | - | medium | Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC | 2021-08-26 | 2022-10-09 | ff151c33-45fa-475d-af4f-c2f93571f4fe | ||||
This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS). (...) | Generic | test | - | windows | WinEventLog Security | - | medium | Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC | 2021-08-26 | 2022-10-09 | 1d2ab8ac-1a01-423b-9c39-001510eae8e8 | ||||
Detects backup catalog deletions | Generic | test | - | windows | WinEventLog Application | - | medium | Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection) | 2017-05-12 | 2022-12-25 | 9703792d-fd9a-456d-a672-ff92efe4806a | ||||
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2020-01-29 | 2023-01-26 | e32d4572-9826-4738-b651-95fa63747e8a | ||||
Splunk | The following analytic detects the creation of a batch file (.bat) within the Windows system directory tree, specifically in the System32 or SysWOW64 folders. (...) | Anomaly | stable | file_event | windows | Sysmon | - | medium | Steven Dick, Michael Haag, Rico Valdez, Splunk | 2020-04-29 | 2026-07-02 | 503d17cb-9eab-4cf8-a20e-01d5c6987ae3 | - | ||
Detects user data export activity. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | medium | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | 5259cbf2-0a75-48bf-b57a-c54d6fabaef3 | ||||
Detects user permission data export attempt. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | medium | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | 87cc6698-3e07-4ba2-9b43-a85a73e151e2 | ||||
Splunk | The following analytic detects the use of `bitsadmin.exe` with the `transfer` parameter to download a remote object. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Sittikorn S | 2021-03-30 | 2026-10-02 | 80630ff4-8e4c-11eb-aab5-acde48001122 | |||
Detects Bitsadmin connections to IP addresses instead of FQDN names | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2022-06-10 | 2022-08-24 | 8ccd35a2-1c7c-468b-b568-ac6cdf80eec3 | ||||
Detects Bitsadmin connections to domains with uncommon TLDs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Tim Shelton | 2019-03-07 | 2026-09-30 | 9eb68894-7476-4cd6-8752-23b51f5883a7 | ||||
Detects specific windows registry modifications made by BlackByte ransomware variants. (...) | Emerging | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | frack113 | 2022-01-24 | 2025-10-21 | 83314318-052a-4c90-a1ad-660ece38d276 |