malware
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
33rd percentile · 67% of 825 ATT&CK software entries have more Enterprise techniques.
53rd percentile · 53% of 825 ATT&CK software entries have this many tactics spanned or fewer.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
15th percentile · 85% of 825 ATT&CK software entries have more detection rules per technique.
74 distinct rules cover the 7 techniques recorded for this malware. 52 Sigma · 22 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Splunk | The following analytic detects the execution of 7z or 7za processes with command lines pointing to SMB network shares. (...) | Hunting | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Splunk | 2021-08-17 | 2026-05-13 | 01d29b48-ff6f-11eb-b81e-acde48001123 | |||
Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2022-09-27 | 2026-06-05 | ec570e53-4c76-45a9-804d-dc3f355ff7a7 | ||||
Splunk | The following analytic detects the execution of 7z.exe, a 7-Zip utility, spawned from rundll32.exe or dllhost.exe. (...) | Anomaly | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Teoderick Contreras, Splunk | 2021-04-22 | 2026-05-13 | 9364ee8e-a39a-11eb-8f1d-acde48001122 | |||
Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | critical | Florian Roth (Nextron Systems) | 2019-02-21 | 2023-03-10 | 03e2746e-2b31-42f1-ab7a-eb39365b2422 | ||||
Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. (...) | Emerging | experimental | file_event | macos | - | - | high | Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital) | 2025-11-22 | — | e710a880-1f18-4417-b6a0-b5afdf7e3023 | ||||
Find information about network devices that is not stored in config files | Generic | test | authentication | - | Cisco AAA · Cisco | - | low | Austin Clark | 2019-08-12 | 2023-01-04 | 9705a6a1-6db6-4a16-a987-15b7151e299b | ||||
Splunk | This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...) | Anomaly | stable | network_device | - | Cisco IOS · Cisco | - | medium | Nasreddine Bencherchali | 2026-05-19 | 2026-05-20 | 71ac5328-2364-40cf-8381-92b8dc531399 | |||
Splunk | This analytic identifies non-browser processes reaching out to public IP lookup or geolocation servi (...) | Anomaly | stable | network_connection | - | Cisco NVM · Cisco | - | medium | Nasreddine Bencherchali, Splunk, Janantha Marasinghe | 2025-07-01 | 2026-09-22 | 568cb83e-d79e-4a23-85ec-6e1f6c30cb2f | |||
Various protocols maybe used to put data on the device for exfil or infil | Generic | test | authentication | - | Cisco AAA · Cisco | - | low | Austin Clark | 2019-08-12 | 2023-01-04 | 5e51acb2-bcbe-435b-99c6-0e3cd5e2aa59 | - | |||
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party ut (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2021-07-27 | 2026-06-05 | 9fbf5927-5261-4284-a71d-f681029ea574 | ||||
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party ut (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2021-07-27 | 2022-12-25 | e2e80da2-8c66-4e00-ae3c-2eebd29f6b6d | ||||
Detects execution of "tar.exe" in order to create a compressed file. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | Nasreddine Bencherchali (Nextron Systems), AdmU3 | 2023-12-19 | — | 418a3163-3247-4b7b-9933-dcfcb7c52ea9 | ||||
Detects execution of "tar.exe" in order to extract compressed file. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | AdmU3 | 2023-12-19 | — | bf361876-6620-407a-812f-bfe11e51e924 | ||||
Detects passwords dumps from Keychain | Generic | test | process_creation | macos | - | - | medium | Tim Ismilyaev, oscd.community, Florian Roth (Nextron Systems) | 2020-10-19 | 2021-11-27 | b120b587-a4c2-4b94-875d-99c9807d6955 | ||||
Detects loading of "credui.dll" and related DLLs by an uncommon process. (...) | Generic | test | image_load | windows | Sysmon | - | medium | Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) | 2020-10-20 | 2026-06-29 | 9ae01559-cf7e-4f8e-8e14-4c290a1b4784 | ||||
An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. | Generic | test | process_creation | linux | Linux Auditd | - | low | Timur Zinniatullin, oscd.community | 2019-10-21 | 2023-07-28 | a3b5e3e9-1b49-4119-8b8e-0344a01f21ee | ||||
Splunk | The following analytic detects modifications to the Windows registry that disable the display of hidden files. (...) | Anomaly | stable | registry_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk, Steven Dick | 2021-03-31 | 2026-05-13 | 6f3ccfa2-91fe-11eb-8f9b-acde48001122 | |||
Detects the execution of the hdiutil utility in order to mount disk images. | Generic | test | process_creation | macos | - | - | medium | Omar Khaled (@beacon_exe) | 2024-08-10 | — | bf241472-f014-4f01-a869-96f99330ca8c | ||||
Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files. (...) | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-04-02 | 2024-03-26 | 5a5152f1-463f-436b-b2f5-8eceb3964b42 | ||||
Detects usage of "rar" to add files to an archive for potential compression. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | Timur Zinniatullin, E.M. Anhaus, oscd.community | 2019-10-21 | 2023-02-05 | 6f3e2987-db24-4c78-a860-b4f4095a7095 | ||||
Adversaries may look for details about the network configuration and settings of systems they access (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' | 2021-12-07 | 2025-10-18 | 0e4164da-94bc-450d-a7be-a4b176179f1f | ||||
Detects attempts to use system dialog prompts to capture user credentials | Generic | test | process_creation | macos | - | - | low | remotephone, oscd.community | 2020-10-13 | 2025-12-05 | 60f1ce20-484e-41bd-85f4-ac4afec2c541 | ||||
Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, ker (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems), Nasreddine Bencherchali | 2022-10-10 | 2024-11-23 | fca949cc-79ca-446e-8064-01aa7e52ece5 | ||||
Detects adversary creating hidden file or directory, by detecting directories or files with . (...) | Generic | test | process_creation | linux | Linux Auditd | - | low | Pawel Mazur | 2021-09-06 | 2025-06-16 | d08722cd-3d09-449a-80b4-83ea2d9d4616 | ||||
Detects usage of attrib.exe to hide files from users. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Sami Ruohonen | 2019-01-16 | 2023-03-14 | 4281cb20-2994-4580-aa63-c8b86d019934 | ||||
Splunk | The following analytic detects the creation of suspicious files named passff.tar and cookie.tar, which are indicative of archived stolen browser information such as history and cookies on a machine compromised with IcedID. (...) | Hunting | stable | file_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk | 2021-08-05 | 2026-05-13 | 0db4da70-f14b-11eb-8043-acde48001122 | |||
Splunk | The following analytic detects suspicious system network configuration discovery activities, which may indicate an adversary's attempt to gather information about the network environment. (...) | Anomaly | stable | process_creation | linux | Linux Auditd | - | medium | Teoderick Contreras, Splunk | 2024-08-12 | 2026-10-02 | 5db16825-81bd-4923-a8d6-d6a13a59832a | |||
Splunk | The following analytic detects the creation of files in Linux init boot directories, which are used for automatic execution upon system startup. (...) | Anomaly | stable | file_event | linux | Sysmon | - | medium | Teoderick Contreras, Splunk | 2021-12-23 | 2026-05-13 | 97d9cfb2-61ad-11ec-bb2d-acde48001122 | |||
Splunk | The following analytic identifies potential enumeration of local network configuration on Linux systems. (...) | Anomaly | stable | process_creation | linux | Sysmon · Osquery | - | medium | Teoderick Contreras, Splunk | 2022-02-14 | 2026-10-02 | 535cb214-8b47-11ec-a2c7-acde48001122 | |||
Detects process executions related to the backdoored versions of LiteLLM (v1.82.7 or v1.82.8). (...) | Emerging | experimental | process_creation | linux | Sysmon | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-03-30 | — | 36603778-030c-43c4-8cbb-cd3c1d1a80c7 | ||||
Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host. | Hunting | test | ps_module | windows | PowerShell | - | low | Christopher Peacock @SecurePeacock, SCYTHE @scythe_io | 2023-07-13 | — | ea207a23-b441-4a17-9f76-ad5be47d51d3 | ||||
Splunk | The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. (...) | Anomaly | stable | process_creation | - | Osquery | - | medium | Raven Tait, Splunk | 2026-04-14 | 2026-05-13 | 51c43b7b-e406-45d2-9bad-5c67f07e6528 | |||
Splunk | Detects command-line attempts to access or dump macOS Keychain data using native utilities or direct file access. (...) | Generic | stable | process_creation | - | Osquery | - | medium | Raven Tait, Jamie Windley, Splunk | 2026-04-14 | 2026-10-02 | dcb45a09-5e6f-441e-b2f8-cbbf923e36d9 | |||
Splunk | This analytic detects attempts to enumerate or verify the configuration of the macOS application firewall. (...) | Anomaly | stable | process_creation | - | Osquery | - | medium | Jamie Windley, Splunk | 2026-04-15 | 2026-10-02 | f8db6e0b-55bb-40ca-bc85-2b3700adb0f8 | |||
Splunk | The following analytic detects the execution of the macOS osascript utility with AppleScript commands that display a dialog or alert containing potentially deceptive, credential-related, or security-themed content. (...) | Anomaly | stable | process_creation | - | Osquery | - | medium | Radka Viskova, Splunk | 2026-08-03 | 2026-10-02 | d565ae18-7db6-460c-a2eb-a7109f18bc5e | |||
Detects nltest commands that can be used for information discovery | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | Arun Chauhan | 2023-02-03 | — | 903076ff-f442-475a-b667-4f246bcc203b | ||||
Detects instances where an SNMP service on an OpenCanary node has had an OID request. | Generic | test | - | - | OpenCanary | - | high | Security Onion Solutions | 2024-03-08 | — | e9856028-fd4e-46e6-b3d1-10f7ceb95078 | ||||
Detects usage of 7zip utilities (7z.exe, 7za.exe and 7zr.exe) to extract password protected zip files. | Hunting | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | Nasreddine Bencherchali (Nextron Systems) | 2023-03-10 | 2026-06-05 | b717b8fd-6467-4d7d-b3d3-27f9a463af77 | ||||
This rule detects potential exfiltration by looking for a few compression extensions in the uri and (...) | Unsupported | unsupported | - | - | HTTP · Zeek | - | medium | Greg Howell, OTR (Open Threat Research) | 2020-04-05 | 2023-03-24 | 0d47e3f6-357f-4534-928c-202631d065fa | ||||
Detects network enumeration performed on AWS. | Unsupported | unsupported | cloud_audit | - | AWS CloudTrail · AWS | - | low | Janantha Marasinghe | 2022-12-13 | 2023-03-24 | c3d53999-4b14-4ddd-9d9b-e618c366b54d | ||||
Detects system discovery activity carried out by Pikabot, such as incl. (...) | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Andreas Braathen (mnemonic.io) | 2023-10-27 | 2024-01-26 | 698d4431-514f-4c82-af4d-cf573872a9f5 | ||||
Detects the execution of "wmic" with the "process" flag, which might indicate an attempt to perform reconnaissance on running processes. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-01-01 | 2025-12-15 | 221b251a-357a-49a9-920a-271802777cc0 | ||||
Detects nltest commands that can be used for information discovery | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Craig Young, oscd.community, Georg Lauenstein | 2021-07-24 | 2023-12-15 | 5cc90652-4cbd-4241-aa3b-4b462fa5a248 | ||||
Splunk | The following analytic identifies the rapid execution of processes used for system network configuration discovery on an endpoint. (...) | Anomaly | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Bhavin Patel, Splunk | 2020-04-29 | 2026-05-13 | 3f0b95e3-3195-46ac-bea3-84fb59e7fac5 | - | ||
Detects potentially suspicious command line arguments of common data compression tools | Hunting | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Florian Roth (Nextron Systems), Samir Bousseaden | 2019-10-15 | 2023-08-29 | 27a72a60-7e5e-47b1-9d17-909c9abafdcd | ||||
Detects changes to the registry for the currently logged-in user. (...) | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | frack113 | 2022-04-02 | 2023-08-17 | fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7 | ||||
Detects process discovery commands. (...) | Hunting | stable | process_creation | linux | Sysmon | - | low | Ömer Günal, oscd.community, CheraaghiMilad | 2020-10-06 | 2022-07-07 | 4e2f5868-08d4-413d-899f-dc2f1508627b | ||||
In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Cian Heasley | 2020-08-13 | 2023-02-21 | c9192ad9-75e5-43eb-8647-82a0a5b493e3 | ||||
Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compression level. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | @ROxPinTeddy | 2020-05-12 | 2022-03-16 | faa48cae-6b25-4f00-a094-08947fef582f | ||||
Detects the execution of a potential recon command where the results are piped to "findstr". (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems), frack113 | 2023-07-06 | 2025-10-08 | ccb5742c-c248-4982-8c5c-5571b9275ad3 |
91st percentile · 91% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
57th percentile · 57% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 7 Enterprise techniques.
Technique Campaign use over its cumulative rule count.