malware

yty S0248

Type: malware
Platform: Windows
Created: 17 October 2018
Last modified: 22 October 2025

yty is a modular, plugin-based malware framework. The components of the framework are written in a variety of programming languages. [1]

Techniques66th pct

TacticsTop 20%

Threat groupsNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0248

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.	Generic	test	ps_script	windows	PowerShell	Discovery Account Discovery Domain Account Discovery Remote System Discovery	-	low	frack113	2022-03-17	2023-07-08	36bed6b2-e9a0-4fff-beeb-413a92b86138
	Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). (...)	Generic	test	pipe_created	windows	Sysmon	Collection Data from Local System	-	medium	Roberto Rodriguez @Cyb3rWard0g	2021-10-08	2023-11-30	1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
	An attempt to export an AWS EC2 instance has been detected. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Collection Data from Local System Exfiltration Transfer Data to Cloud Account	-	low	Diogo Braz	2020-04-16	2022-10-05	54b9a76a-3c71-4673-b4b3-2edb4566ea7b
	Detects user data export activity.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	5259cbf2-0a75-48bf-b57a-c54d6fabaef3
	Detects user permission data export attempt.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	87cc6698-3e07-4ba2-9b43-a85a73e151e2
	Detects usage of "getcap" binary. (...)	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	low	Nasreddine Bencherchali (Nextron Systems)	2022-12-28	2026-01-24	d8d97d51-122d-4cdd-9e2f-01b4b4933530
Splunk	The following analytic identifies the execution of the "whoami" command with the "/group" flag, where the results are passed to the "find" command in order to look for a the string "12288". (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Owner/User Discovery	-	medium	Teoderick Contreras, Splunk	2021-09-14	2026-05-13	a9079b18-1633-11ec-859c-acde48001122	-
	Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery Remote System Discovery Persistence Server Software Component Web Shell Discovery System Owner/User Discovery	CVE-2022-41040 CVE-2022-41082	high	Florian Roth (Nextron Systems), MSTI (query)	2022-10-01	—	fa3c117a-bc0d-416e-a31b-0c0e80653efb
	Detects execution of ChromeLoader malware via a registered scheduled task	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task Persistence Software Extensions	-	high	@kostastsale	2022-01-10	—	0a74c5a9-1b71-4475-9af2-7829d320d5c2
Splunk	This analytic detects file copy activity on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Collection Data from Cloud Storage Collection Data from Local System	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	4d7e8f3a-9c2b-4e6f-8a1d-5b9c7e2f4a8c
Splunk	This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Collection Data from Local System Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration Exfiltration Over C2 Channel	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	8a9e5f2b-6d4c-4e7f-9b3a-1c8d7f5e2a9b
Splunk	This analytic detects potential reconnaissance activities on Cisco ASA devices by identifying execution of multiple information-gathering "show" commands within a short timeframe. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Gather Victim Network Information Domain Properties IP Addresses Discovery System Information Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	6e9d4f7a-3c8b-4a9e-8d2f-7b5c9e1a6f3d
	Collect pertinent data from the configuration files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery Account Discovery Local Account Collection Data from Local System Credential Access Unsecured Credentials Credentials In Files	-	low	Austin Clark	2019-08-11	2023-01-04	cd072b25-a418-4f98-8ebc-5093fb38fe1a
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Reconnaissance Gather Victim Network Information Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	71ac5328-2364-40cf-8381-92b8dc531399
Splunk	This analytic detects bursts of ping, SSH, and Telnet commands issued from Cisco IOS or NX-OS devices. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Discovery Network Service Discovery Lateral Movement Remote Services SSH Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	efb20922-17bc-4fb0-880c-be50cfc100dd
Splunk	This analytic identifies non-browser processes reaching out to public IP lookup or geolocation servi (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Reconnaissance Gather Victim Network Information IP Addresses Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali, Splunk, Janantha Marasinghe	2025-07-01	2026-09-22	568cb83e-d79e-4a23-85ec-6e1f6c30cb2f
Splunk	The following analytic detects a blocked connection event by identifying a "Block" value in the action field. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	17e9b764-3a2b-4d36-9751-32d13ce4718b
Splunk	The following analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	1f57f10e-1dc5-47ea-852c-2e85b2503d79
Splunk	This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. (...)	Generic	stable	configuration_change	-	Cisco IOS · Cisco	Collection Data from Local System Exfiltration Exfiltration Over Web Service	CVE-2018-0171	medium	Bhavin Patel, Michael Haag, Splunk	2025-08-21	2026-05-13	1abce487-f480-4d5f-a551-01de0bece0bd
	Detects the use of the redirection character ">" to redirect information on the command line. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	low	frack113	2022-01-22	2024-03-19	4f4eaa9f-5ad4-410c-a4be-bc6132b0175a
	Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Owner/User Discovery	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-11-10	2022-11-17	435e10e4-992a-4281-96f3-38b11106adde
	Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file	Generic	test	ps_script	windows	PowerShell	Discovery System Owner/User Discovery	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-11-17	—	db885529-903f-4c5d-9864-28fe199e6370
	Detects potential container discovery via listing of certain kernel features in the "/proc" virtual (...)	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Seth Hanford	2023-08-23	—	746c86fb-ccda-4816-8997-01386263acc4
	Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.	Generic	experimental	-	windows	WinEventLog System	Collection Data from Local System Credential Access OS Credential Dumping Security Account Manager	-	medium	Jason Mull	2025-05-12	—	882fbe50-d8d7-4e29-ae80-0648a8556866
	Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot AP (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	medium	Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1)	2019-03-04	2022-10-09	958d81aa-8566-4cea-a565-59ccd4df27b0
Splunk	The following analytic identifies specific GET or HEAD requests to web servers that indicate reconnaissance attempts to find vulnerable JBoss servers. (...)	Generic	experimental	webserver	-	-	Initial Access, Persistence External Remote Services Discovery System Information Discovery	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	104658f4-afdc-499e-9719-17243f982681	-
	Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during (...)	Emerging	test	scheduled_job	windows	WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	CVE-2023-42793	critical	Nasreddine Bencherchali (Nextron Systems)	2023-10-24	—	3b8e5084-4de9-449a-a40d-0e11014f2e2d
	Enumerates Active Directory to determine computers that are joined to the domain	Generic	test	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	frack113	2022-02-12	—	1f6399cf-2c80-4924-ace1-6fcff3393480
	Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery	-	low	frack113	2022-08-20	2023-02-04	b4dc61f5-6cce-468e-a608-b48b469feaa2
	Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Seth Hanford	2023-08-23	—	11701de9-d5a5-44aa-8238-84252f131895
Splunk	The following analytic detects the execution of `nltest.exe` with command-line arguments `/dclist:` or `/dsgetdc:` to discover domain controllers. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-07-20	41243735-89a7-4c83-bcdd-570aa78f00a1
Splunk	The following analytic identifies the execution of `wmic.exe` with command-line arguments used to discover domain controllers in a Windows domain. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	64c7adaa-48ee-483c-b0d6-7175bc65e6cc
	Domain user and group enumeration via network reconnaissance. (...)	Unsupported	unsupported	-	-	DCE/RPC · Zeek	Discovery Account Discovery Domain Account Discovery System Information Discovery	-	medium	Nate Guagenti (@neu5ron), Open Threat Research (OTR)	2020-05-03	2023-03-24	66a0bdc6-ee04-441a-9125-99d2eb547942
	Detects the execution of "whoami.exe" with the "/all" flag	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Owner/User Discovery	-	medium	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2023-12-04	2024-03-05	c248c896-e412-4279-8c15-1c558067b6fa
	One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and M (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Data from Local System	-	medium	frack113	2022-02-13	2024-03-05	6a69f62d-ce75-4b57-8dce-6351eb55b362
	Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.	Generic	test	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Hypervisor CLI Discovery System Owner/User Discovery Discovery System Service Discovery	-	medium	Cedric Maurugeon	2023-09-04	—	33e814e0-1f00-4e43-9c34-31fb7ae2b174
Splunk	This detection identifies access to sensitive system and configuration files on an ESXi host, including authentication data, service configurations, and VMware-specific management settings. (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Collection Data from Local System Credential Access OS Credential Dumping /etc/passwd and /etc/shadow	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	6fa0073d-6ca0-4f93-913d-fb420c9de15b	-
	Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. (...)	Generic	test	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Hypervisor CLI Discovery System Owner/User Discovery Discovery System Service Discovery	-	medium	Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon	2023-09-04	—	f41dada5-3f56-4232-8503-3fb7f9cf2d60
Splunk	This detection identifies the use of ESXCLI system-level commands that retrieve configuration details. (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Discovery System Information Discovery	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	b4d4217a-6673-4fb6-837d-07a522bdf9f7	-
	Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. (...)	Generic	test	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Hypervisor CLI Discovery System Owner/User Discovery Discovery System Service Discovery	-	medium	Cedric Maurugeon	2023-09-04	—	e80273e1-9faf-40bc-bd85-dbaff104c4e9
Splunk	This detection identifies the use of a remote tool to download virtual machine disk files from a datastore. (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Collection Data from Local System	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	2e155547-aaac-49d3-b0ef-ceabc31fd364	-
	Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.	Generic	test	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Hypervisor CLI Discovery System Owner/User Discovery Discovery System Service Discovery	-	medium	Cedric Maurugeon	2023-09-04	—	5f1573a7-363b-4114-9208-ad7a61de46eb
	Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. (...)	Generic	test	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Hypervisor CLI Discovery System Owner/User Discovery Discovery System Service Discovery	-	medium	Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon	2023-09-04	—	d54c2f06-aca9-4e2b-81c9-5317858f4b79
	Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	informational	Daniil Yugoslavskiy, oscd.community, CheraghiMilad	2020-10-19	2024-12-01	d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72
	Detects usage of system utilities to discover files and directories	Generic	test	process_creation	macos	-	Discovery File and Directory Discovery	-	informational	Daniil Yugoslavskiy, oscd.community	2020-10-19	2022-11-25	089dbdf6-b960-4bcc-90e3-ffc3480c20f6
	Adversaries may look for details about the network configuration and settings of systems they access (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Network Configuration Discovery	-	low	frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'	2021-12-07	2025-10-18	0e4164da-94bc-450d-a7be-a4b176179f1f
	Detects AS-REP roasting is an attack that is often-overlooked. (...)	Generic	test	ps_script	windows	PowerShell	Discovery System Owner/User Discovery	-	medium	frack113	2022-03-17	—	96c982fe-3d08-4df4-bed2-eb14e02f21c8
Splunk	The following analytic detects the execution of `powershell.exe` with the `Get-AdComputer` commandlet, which is used to discover remote systems within a domain. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	c5a31f80-5888-4d81-9f78-1cc65026316e

Title

Description

yty S0248

yty MITRE reference S0248

Standing S0248

Reach

Coverage

yty detections S0248