malware
Kazuar is a fully featured, multi-platform backdoor Trojan written using the Microsoft .NET framework. [1]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Kazuar uploads files from a specified directory to the C2 server.2
Kazuar is obfuscated using the open source ConfuserEx protector. Kazuar also obfuscates the name of created files/folders/mutexes and encrypts debug messages written to log files using the Rijndael cipher.6
Kazuar can sleep for a specific time and be set to communicate at specific intervals.7
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
93rd percentile · 93% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.
89th percentile · 89% of 825 ATT&CK software entries have this many tactics spanned or fewer.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
61st percentile · 61% of 825 ATT&CK software entries have this many detection rules per technique or fewer.
55th percentile · 55% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
57th percentile · 57% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 31 Enterprise techniques.
Technique Campaign use over its cumulative rule count.
908 distinct rules cover the 31 techniques recorded for this malware. 641 Sigma · 267 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Adversaries may attempt to find domain-level groups and permission settings. (...) | Generic | test | ps_module | windows | PowerShell | - | low | frack113 | 2021-12-15 | 2023-01-20 | 815bfc17-7fc6-4908-a55e-2f37b98cedb4 | ||||
Adversaries may attempt to find domain-level groups and permission settings. (...) | Generic | test | ps_script | windows | PowerShell | - | low | frack113 | 2021-12-15 | 2022-12-25 | 88f0884b-331d-403d-a3a1-b668cf035603 | ||||
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). (...) | Generic | test | pipe_created | windows | Sysmon | - | medium | Roberto Rodriguez @Cyb3rWard0g | 2021-10-08 | 2023-11-30 | 1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3 | ||||
Detects the deletion of the "Zone.Identifier" ADS. (...) | Hunting | test | file_delete | windows | Sysmon | - | low | frack113 | 2023-09-04 | — | 7eac0a16-5832-4e81-865f-0268a6d19e4b | ||||
Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...) | Generic | test | file_delete | windows | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-09-04 | 2025-07-04 | 3109530e-ab47-4cc6-a953-cac5ebcc93ae | ||||
Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nasreddine Bencherchali (Nextron Systems) | 2023-02-28 | 2025-10-22 | 6c8fbee5-dee8-49bc-851d-c3142d02aa47 | ||||
Detects the removal or uninstallation of an application via "Wmic.EXE". | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-01-28 | 2024-07-02 | b53317a0-8acf-4fd1-8de8-a5401e776b96 | ||||
Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-09-11 | — | 49d9671b-0a0a-4c09-8280-d215bfd30662 | ||||
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled. | Generic | experimental | - | windows | AppLocker | - | medium | heyyanu | 2026-03-26 | — | 557e3bd3-7f21-495d-8d50-7c8bdfb8041c | ||||
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running. | Generic | test | - | windows | AppLocker | - | medium | Pushkarev Dmitry | 2020-06-28 | 2025-12-03 | 401e5d00-b944-11ea-8f9a-00163ecd60ae | ||||
Detects DNS queries made by "AppInstaller.EXE". (...) | Generic | test | dns | windows | Sysmon | - | medium | frack113 | 2021-11-24 | 2023-11-09 | 7cff77e1-9663-46a3-8260-17f2e1aa9d0a | ||||
Detects suspicious user agent strings used in APT malware in proxy logs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Markus Neis | 2019-11-12 | 2024-02-15 | 6ec820f2-e963-4801-9127-d8b2dce4d31b | ||||
This method detects malicious services mentioned in APT29 report by FireEye. (...) | Unsupported | unsupported | process_creation | windows | WinEventLog System | - | high | Thomas Patzke | 2017-11-01 | 2022-03-21 | c069f460-2b87-4010-8dcf-e45bab362624 | ||||
Detects suspicious user agent string of APT40 Dropbox tool | Emerging | test | proxy | - | - | - | high | Thomas Patzke | 2019-11-12 | 2023-05-18 | 5ba715b6-71b7-44fd-8245-f66893e81b3d | ||||
Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Victor Sergeev, oscd.community | 2020-10-09 | 2023-10-18 | eee00933-a761-4cd0-be70-c42fe91731e7 | ||||
Detects automated lateral movement by Turla group | Unsupported | unsupported | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Markus Neis | 2017-11-07 | 2023-02-24 | 75925535-ca97-4e0a-a850-00b5c00779dc | ||||
Splunk | The following analytic identifies attempts to delete AWS Bedrock Knowledge Bases, which are resources that store and manage domain-specific information for AI models. (...) | Generic | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Bhavin Patel, Splunk | 2025-03-25 | 2026-05-13 | 8b4e3d62-f743-11ee-9f6e-acde48001123 | |||
Detects changes to the EC2 instance startup script. (...) | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | high | faloker | 2020-02-12 | 2022-06-07 | 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df | ||||
An attempt to export an AWS EC2 instance has been detected. (...) | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | low | Diogo Braz | 2020-04-16 | 2022-10-05 | 54b9a76a-3c71-4673-b4b3-2edb4566ea7b | ||||
Detects when a EFS Fileshare Mount is modified or deleted. (...) | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Austin Songer @austinsonger | 2021-08-15 | 2022-10-09 | 6a7ba45c-63d8-473e-9736-2eaabff79964 | ||||
Identifies when an EKS cluster is created or deleted. | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | low | Austin Songer | 2021-08-16 | 2022-10-09 | 33d50d03-20ec-4b74-a74e-1e65a38af1c0 | ||||
Detects file creation events linked to the Axios NPM supply chain compromise. (...) | Emerging | experimental | file_event | linux | Sysmon | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | b7cb840c-11f6-47f7-b3ef-5524739c9077 | ||||
Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...) | Emerging | experimental | file_event | macos | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 2db0458c-05c9-4069-a26f-77becd9c8c13 | ||||
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...) | Emerging | experimental | process_creation | linux | Sysmon | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 0a23a62d-c5b3-468b-a072-25064a9a8c87 | ||||
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup. | Emerging | experimental | process_creation | macos | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | a09ee860-31b3-4586-8a68-0ebd74ce0e5f | ||||
Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...) | Emerging | experimental | process_creation | windows | Sysmon · WinEventLog Security | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | f6c27ecc-d890-4452-80e6-2e274a10e097 | ||||
Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...) | Emerging | experimental | dns | - | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 73e5d24f-493f-4092-bd2f-c72cabda40ee | ||||
Detects when a Container Registry is created or deleted. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | low | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 93e0ef48-37c8-49ed-a02c-038aab23628e | ||||
Identifies when a device or device configuration in azure is modified or deleted. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-09-03 | 2022-10-09 | 46530378-f9db-4af9-a9e5-889c177d3881 | ||||
Detects when a Azure Kubernetes Cluster is created or deleted. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | low | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 9541f321-7cba-4b43-80fc-fbd1fb922808 | ||||
Identifies when a Azure Kubernetes network policy is modified or deleted. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 08d6ac24-c927-4469-b3b7-2e422d6e3c43 | ||||
Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 25cb259b-bbdc-4b87-98b7-90d7c72f8743 | ||||
Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 7ee0b4aa-d8d4-4088-b661-20efdf41a04c | ||||
Identifies when ClusterRoles/Roles are being modified or deleted. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 818fee0c-e0ec-4e45-824e-83e4817b0887 | ||||
Identifies when a service account is modified or deleted. | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-08-07 | 2022-08-23 | 12d027c3-b48c-4d9d-8bb6-a732200034b2 | ||||
Detects backup catalog deletions | Generic | test | - | windows | WinEventLog Application | - | medium | Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection) | 2017-05-12 | 2022-12-25 | 9703792d-fd9a-456d-a672-ff92efe4806a | ||||
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2020-01-29 | 2023-01-26 | e32d4572-9826-4738-b651-95fa63747e8a | ||||
Detects user data export activity. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | medium | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | 5259cbf2-0a75-48bf-b57a-c54d6fabaef3 | ||||
Detects user permission data export attempt. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | medium | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | 87cc6698-3e07-4ba2-9b43-a85a73e151e2 | ||||
Splunk | The following analytic detects the use of `bitsadmin.exe` with the `transfer` parameter to download a remote object. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Sittikorn S | 2021-03-30 | 2026-10-02 | 80630ff4-8e4c-11eb-aab5-acde48001122 | |||
Detects Bitsadmin connections to IP addresses instead of FQDN names | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2022-06-10 | 2022-08-24 | 8ccd35a2-1c7c-468b-b568-ac6cdf80eec3 | ||||
Detects Bitsadmin connections to domains with uncommon TLDs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Tim Shelton | 2019-03-07 | 2026-09-30 | 9eb68894-7476-4cd6-8752-23b51f5883a7 | ||||
Detects default file names outputted by the BloodHound collection tool SharpHound | Generic | test | file_event | windows | Sysmon | - | high | C.J. May | 2022-08-09 | 2026-02-19 | 02773bed-83bf-469f-b7ff-e676e7d78bab | ||||
Attempts to detect system changes made by Blue Mockingbird | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Trent Liffick (@tliffick) | 2020-05-14 | 2022-10-09 | c3198a27-23a0-4c2c-af19-e5328d49680e | ||||
Attempts to detect system changes made by Blue Mockingbird | Emerging | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | Trent Liffick (@tliffick) | 2020-05-14 | 2023-08-17 | 92b0b372-a939-44ed-a11b-5136cf680e27 | ||||
Detects the usage of the unsafe bpftrace option | Generic | test | process_creation | linux | Sysmon | - | medium | Andreas Hunkeler (@Karneades) | 2022-02-11 | — | f8341cb2-ee25-43fa-a975-d8a5a9714b39 | ||||
Detects execution of Chromium based browser in headless mode | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | Nasreddine Bencherchali (Nextron Systems) | 2023-09-12 | — | ef9dcfed-690c-4c5d-a9d1-482cd422225c | ||||
Detects usage of "getcap" binary. (...) | Generic | test | process_creation | linux | Sysmon | - | low | Nasreddine Bencherchali (Nextron Systems) | 2022-12-28 | 2026-01-24 | d8d97d51-122d-4cdd-9e2f-01b4b4933530 | ||||
Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) | 2023-02-15 | 2024-03-05 | 3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5 | ||||
Detects HTTP request used by Chafer malware to receive data from its C2. | Emerging | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2019-01-31 | 2024-02-15 | fb502828-2db0-438e-93e6-801c7548686d |