malware

Calisto S0274

Type: malware
Platform: macOS
Created: 17 October 2018
Last modified: 16 April 2025

Calisto is a macOS Trojan that opens a backdoor on the compromised machine. Calisto is believed to have first been developed in 2016. [1] [2]

Techniques66th pct

TacticsTop 20%

Threat groupsNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0274

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
Splunk	The following analytic detects the execution of 7z or 7za processes with command lines pointing to SMB network shares. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Collection Archive Collected Data Archive via Utility	-	medium	Teoderick Contreras, Splunk	2021-08-17	2026-05-13	01d29b48-ff6f-11eb-b81e-acde48001123
	Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-09-27	2026-06-05	ec570e53-4c76-45a9-804d-dc3f355ff7a7
	Detects activity when a member is added to a security-enabled global group	Generic	stable	account_management	windows	WinEventLog Security	Persistence, Privilege Escalation Account Manipulation	-	low	Alexandr Yampolskyi, SOC Prime	2023-04-26	—	c43c26be-2e87-46c7-8661-284588c5a53e
	Detects activity when a member is removed from a security-enabled global group	Generic	stable	-	windows	WinEventLog Security	Persistence, Privilege Escalation Account Manipulation	-	low	Alexandr Yampolskyi, SOC Prime	2023-04-26	—	02c39d30-02b5-45d2-b435-8aebfe5a8629
	Addition of domains is seldom and should be verified for legitimacy.	Generic	stable	-	windows	WinEventLog Security	Persistence, Privilege Escalation Account Manipulation	-	medium	Thomas Patzke	2019-12-03	2024-01-16	0255a820-e564-4e40-af2b-6ac61160335c
	Detects activity when a security-enabled global group is deleted	Generic	stable	account_management	windows	WinEventLog Security	Persistence, Privilege Escalation Account Manipulation	-	low	Alexandr Yampolskyi, SOC Prime	2023-04-26	—	b237c54b-0f15-4612-a819-44b735e0de27
	Detects scenarios where one can control another users or computers account without having to use their credentials.	Generic	test	account_management	windows	WinEventLog Security	Persistence, Privilege Escalation Account Manipulation	-	high	@neu5ron	2017-04-13	2024-02-26	300bac00-e041-4ee2-9c36-e262656a6ecc
	Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). (...)	Generic	test	pipe_created	windows	Sysmon	Collection Data from Local System	-	medium	Roberto Rodriguez @Cyb3rWard0g	2021-10-08	2023-11-30	1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3
	Detects the deletion of the "Zone.Identifier" ADS. (...)	Hunting	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	low	frack113	2023-09-04	—	7eac0a16-5832-4e81-865f-0268a6d19e4b
	Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...)	Generic	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-09-04	2025-07-04	3109530e-ab47-4cc6-a953-cac5ebcc93ae
Splunk	The following analytic detects the execution of 7z.exe, a 7-Zip utility, spawned from rundll32.exe or dllhost.exe. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Collection Archive Collected Data Archive via Utility	-	medium	Michael Haag, Teoderick Contreras, Splunk	2021-04-22	2026-05-13	9364ee8e-a39a-11eb-8f1d-acde48001122
	Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.	Generic	test	-	-	Azure Risk Detection · Azure	Persistence, Privilege Escalation Account Manipulation	-	high	Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'	2023-09-03	—	258b6593-215d-4a26-a141-c8e31c1299a6
	Detects DNS queries made by "AppInstaller.EXE". (...)	Generic	test	dns	windows	Sysmon	Command and Control Ingress Tool Transfer	-	medium	frack113	2021-11-24	2023-11-09	7cff77e1-9663-46a3-8260-17f2e1aa9d0a
	Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility Credential Access OS Credential Dumping LSASS Memory	-	critical	Florian Roth (Nextron Systems)	2019-02-21	2023-03-10	03e2746e-2b31-42f1-ab7a-eb39365b2422
	Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer	-	medium	Victor Sergeev, oscd.community	2020-10-09	2023-10-18	eee00933-a761-4cd0-be70-c42fe91731e7
Splunk	The following analytic identifies when a policy is deleted in AWS. (...)	Hunting	stable	cloud_audit	-	AWS CloudTrail · AWS	Persistence, Privilege Escalation Account Manipulation	-	medium	Patrick Bareiss, Splunk	2021-04-06	2026-05-13	609ced68-d420-4ff7-8164-ae98b4b4018c
Splunk	The following analytic detects failed attempts to delete AWS IAM groups, triggered by access denial, conflicts, or non-existent groups. (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Persistence, Privilege Escalation Account Manipulation	-	medium	Patrick Bareiss, Splunk	2024-05-22	2026-05-13	8d12f268-c567-4557-9813-f8389e235c06
Splunk	The following analytic detects the successful deletion of a group within AWS IAM, leveraging CloudTrail IAM events. (...)	Hunting	stable	cloud_audit	-	AWS CloudTrail · AWS	Persistence, Privilege Escalation Account Manipulation Discovery Permission Groups Discovery Cloud Groups	-	medium	Patrick Bareiss, Splunk	2024-05-22	2026-05-13	1bbe54f1-93d7-4764-8a01-ddaa12ece7ac
	Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. (...)	Emerging	experimental	file_event	macos	-	Persistence, Privilege Escalation Create or Modify System Process Launch Daemon Stealth Hide Artifacts Hidden Files and Directories	-	high	Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital)	2025-11-22	—	e710a880-1f18-4417-b6a0-b5afdf7e3023
Splunk	The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike · Cisco NVM · Cisco	Reconnaissance Active Scanning Stealth Masquerading Match Legitimate Resource Name or Location Credential Access OS Credential Dumping	-	medium	Bhavin Patel, Splunk, sventec, Github Community	2021-07-12	2026-09-22	a51bfe1a-94f0-48cc-b4e4-16a110145893	-
	Adversaries may enumerate browser bookmarks to learn more about compromised hosts. (...)	Generic	test	ps_script	windows	PowerShell	Discovery Browser Information Discovery	-	low	frack113	2021-12-13	2022-12-25	e0565f5d-d420-4e02-8a68-ac00d864f9cf
	An attempt to export an AWS EC2 instance has been detected. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Collection Data from Local System Exfiltration Transfer Data to Cloud Account	-	low	Diogo Braz	2020-04-16	2022-10-05	54b9a76a-3c71-4673-b4b3-2edb4566ea7b
	Detects AWS API key creation for a user by another user. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Persistence, Privilege Escalation Account Manipulation	-	medium	faloker	2020-02-12	2026-08-14	0a5177f4-6ca9-44c2-aacf-d3f3d8b6e4d2
Splunk	The following analytic detects the deletion of an IAM policy in AWS. (...)	Hunting	stable	cloud_audit	-	AWS CloudTrail · AWS	Persistence, Privilege Escalation Account Manipulation	-	medium	Michael Haag, Splunk	2021-04-06	2026-05-13	ec3a9362-92fe-11eb-99d0-acde48001122
Splunk	The following analytic identifies failed attempts to delete AWS IAM groups. (...)	Anomaly	stable	account_management	-	AWS CloudTrail · AWS	Persistence, Privilege Escalation Account Manipulation	-	medium	Michael Haag, Splunk	2021-04-06	2026-05-13	723b861a-92eb-11eb-93b8-acde48001122
Splunk	The following analytic identifies the successful deletion of an IAM group in AWS. (...)	Hunting	stable	account_management	-	AWS CloudTrail · AWS	Persistence, Privilege Escalation Account Manipulation Discovery Permission Groups Discovery Cloud Groups	-	medium	Michael Haag, Splunk	2021-04-06	2026-05-13	e776d06c-9267-11eb-819b-acde48001122
	Detects when a transfer lock was removed from a Route 53 domain. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Persistence, Privilege Escalation Account Manipulation	-	low	Elastic, Austin Songer @austinsonger	2021-07-22	2022-10-09	3940b5f1-3f46-44aa-b746-ebe615b879e0
	Detects when a request has been made to transfer a Route 53 domain to another AWS account.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Persistence, Privilege Escalation Account Manipulation	-	low	Elastic, Austin Songer @austinsonger	2021-07-22	2022-10-09	b056de1a-6e6e-4e40-a67e-97c9808cf41b
	Detects activity when someone is changing passwords on behalf of other users. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Persistence, Privilege Escalation Account Manipulation	-	high	toffeebr33k	2021-08-09	2024-04-26	055fb148-60f8-462d-ad16-26926ce050f1
	Detects file creation events linked to the Axios NPM supply chain compromise. (...)	Emerging	experimental	file_event	linux	Sysmon	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	b7cb840c-11f6-47f7-b3ef-5524739c9077
	Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...)	Emerging	experimental	file_event	macos	-	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	2db0458c-05c9-4069-a26f-77becd9c8c13
	Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...)	Emerging	experimental	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Unix Shell Python Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	0a23a62d-c5b3-468b-a072-25064a9a8c87
	Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.	Emerging	experimental	process_creation	macos	-	Execution Command and Scripting Interpreter AppleScript Unix Shell Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	a09ee860-31b3-4586-8a68-0ebd74ce0e5f
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
Splunk	The following analytic detects the addition of a new owner to a Service Principal within an Azure AD tenant. (...)	Generic	stable	account_management	-	Microsoft 365	Persistence, Privilege Escalation Account Manipulation	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2022-08-30	2026-05-13	7ddf2084-6cf3-4a44-be83-474f7b73c701
Splunk	The following analytic detects an Azure AD user enabling a previously disabled account and resetting its password within 2 minutes. (...)	Generic	stable	authentication	-	Microsoft 365	Persistence, Privilege Escalation Account Manipulation	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2022-08-30	2026-05-13	1347b9e8-2daa-4a6f-be73-b421d3d9e268
Splunk	The following analytic identifies the modification of the SourceAnchor (ImmutableId) attribute for an Azure Active Directory user. (...)	Generic	stable	account_management	-	Microsoft 365	Persistence, Privilege Escalation Account Manipulation	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2022-09-02	2026-05-13	0c0badad-4536-4a84-a561-5ff760f3c00e
	Detects backup catalog deletions	Generic	test	-	windows	WinEventLog Application	Stealth Indicator Removal File Deletion	-	medium	Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection)	2017-05-12	2022-12-25	9703792d-fd9a-456d-a672-ff92efe4806a
	Detects global permissions change activity.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Persistence, Privilege Escalation Account Manipulation	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	aac6c4f4-87c7-4961-96ac-c3fd3a42c310
Splunk	The following analytic detects the use of `bitsadmin.exe` with the `transfer` parameter to download a remote object. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution, Persistence, Stealth BITS Jobs Command and Control Ingress Tool Transfer	-	medium	Michael Haag, Sittikorn S	2021-03-30	2026-10-02	80630ff4-8e4c-11eb-aab5-acde48001122
	Detects execution of Chromium based browser in headless mode	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts Hidden Window Command and Control Ingress Tool Transfer	-	low	Nasreddine Bencherchali (Nextron Systems)	2023-09-12	—	ef9dcfed-690c-4c5d-a9d1-482cd422225c
	Detects when a user is removed from a privileged role. (...)	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Persistence, Privilege Escalation Account Manipulation	-	high	Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'	2022-08-05	—	102e11e3-2db5-4c9e-bc26-357d42585d21
	Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Persistence, Privilege Escalation Account Manipulation Persistence, Defense Impairment, Credential Access Modify Authentication Process	-	medium	AlertIQ	2021-10-10	2022-12-25	4d78a000-ab52-4564-88a5-7ab5242b20c7
Splunk	This analytic detects file copy activity on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Collection Data from Cloud Storage Collection Data from Local System	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	4d7e8f3a-9c2b-4e6f-8a1d-5b9c7e2f4a8c
Splunk	This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Collection Data from Local System Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration Exfiltration Over C2 Channel	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	8a9e5f2b-6d4c-4e7f-9b3a-1c8d7f5e2a9b
Splunk	This analytic detects creation of new user accounts on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Persistence Create Account Local Account Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Local Accounts	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	9c8e4f2a-7d3b-4e5c-8a9f-1b6d4e8c3f5a
Splunk	This analytic detects privilege level changes for user accounts on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Persistence, Privilege Escalation Account Manipulation Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Local Accounts	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	5f7d8c3e-9a2b-4d6f-8e1c-3b5a9d7f2c4e
	Collect pertinent data from the configuration files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery Account Discovery Local Account Collection Data from Local System Credential Access Unsecured Credentials Credentials In Files	-	low	Austin Clark	2019-08-11	2023-01-04	cd072b25-a418-4f98-8ebc-5093fb38fe1a
Splunk	This analytic provides comprehensive monitoring of configuration changes on Cisco devices by analyzing archive logs. (...)	Hunting	stable	configuration_change	-	Cisco IOS · Cisco	Persistence, Privilege Escalation Account Manipulation Defense Impairment Disable or Modify Tools Persistence Server Software Component Web Shell	CVE-2018-0171	medium	Bhavin Patel, Michael Haag, Splunk	2025-08-21	2026-05-13	f52d5c0b-d45d-4304-b300-a4f6a1130dec
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b

Title

Description

Calisto S0274

Calisto MITRE reference S0274

Standing S0274

Reach

Coverage

Calisto detections S0274