malware
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
66th percentile · 66% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.
80th percentile · 80% of 825 ATT&CK software entries have this many tactics spanned or fewer.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
9th percentile · 91% of 825 ATT&CK software entries have more detection rules per technique.
72nd percentile · 72% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
57th percentile · 57% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 15 Enterprise techniques.
Technique Campaign use over its cumulative rule count.
464 distinct rules cover the 15 techniques recorded for this malware. 257 Sigma · 207 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects file access requests to browser credential stores by uncommon processes. (...) | Hunting | test | file_event | windows | WinEventLog Security | - | low | Daniel Koifman (@Koifsec), Nasreddine Bencherchali | 2024-10-21 | — | 4b60e527-ec73-4b47-8cb3-f02ad927ca65 | ||||
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. (...) | Generic | test | ps_script | windows | PowerShell | - | medium | frack113 | 2022-01-30 | — | fc028194-969d-4122-8abe-0470d5b8f12f | ||||
Splunk | The following analytic detects the use of commands to add or set exclusions
in Windows Defender. It (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Nasreddine Bencherchali, Splunk | 2021-11-25 | 2026-06-08 | 773b66fe-4dd9-11ec-8289-acde48001122 | |||
Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nasreddine Bencherchali (Nextron Systems) | 2022-09-02 | 2024-03-19 | d7662ff6-9e97-4596-a61d-9839e32dee8d | ||||
Detects the deletion of the "Zone.Identifier" ADS. (...) | Hunting | test | file_delete | windows | Sysmon | - | low | frack113 | 2023-09-04 | — | 7eac0a16-5832-4e81-865f-0268a6d19e4b | ||||
Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...) | Generic | test | file_delete | windows | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-09-04 | 2025-07-04 | 3109530e-ab47-4cc6-a953-cac5ebcc93ae | ||||
Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts | Generic | test | ps_script | windows | PowerShell | - | high | Florian Roth (Nextron Systems) | 2022-11-09 | — | e0d6c087-2d1c-47fd-8799-3904103c5a98 | ||||
Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. (...) | Generic | experimental | registry_set | windows | Sysmon · WinEventLog Security | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2025-12-25 | — | aa37cbb0-da36-42cb-a90f-fdf216fc7467 | ||||
Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive". | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | @kostastsale, Nasreddine Bencherchali (Nextron Systems) | 2023-11-05 | 2024-08-16 | 31e124fb-5dc4-42a0-83b3-44a69c77b271 | ||||
Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:
- Use (...) | Generic | experimental | process_creation | linux | Linux Auditd | - | high | Milad Cheraghi | 2025-05-26 | 2025-12-05 | e497a24e-9345-4a62-9803-b06d7d7cb132 | ||||
Detect changes in auditd configuration files | Generic | test | file_event | linux | Linux Auditd | - | high | Mikhail Larin, oscd.community | 2019-10-25 | 2021-11-27 | 977ef627-4539-4875-adf4-ed8f780c4922 | ||||
Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove
model safety (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Marco Pedrinazzi (@pedrinazziM) (InTheCyber) | 2026-07-10 | — | 59b70e4d-dd17-44a9-b740-acf07ae3eb6a | ||||
Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken
model safety c (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Marco Pedrinazzi (@pedrinazziM) (InTheCyber) | 2026-07-10 | — | 1c722651-254a-4b04-a9f4-99b62a2d0a1f | ||||
Detects changes to the EC2 instance startup script. (...) | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | high | faloker | 2020-02-12 | 2022-06-07 | 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df | ||||
Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. (...) | Generic | experimental | cloud_audit | - | AWS CloudTrail · AWS | - | high | suktech24 | 2025-11-27 | — | d2656e78-c069-4571-8220-9e0ab5913f19 | ||||
Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs. | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | high | faloker | 2020-02-11 | 2022-10-09 | 6e61ee20-ce00-4f8d-8aee-bedd8216f7e3 | ||||
Detects evade to Macie detection. | Unsupported | unsupported | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Sittikorn S | 2021-07-06 | 2023-03-24 | 91f6a16c-ef71-437a-99ac-0b070e3ad221 | ||||
Detects the modification of the findings on SecurityHub. | Generic | stable | cloud_audit | - | AWS CloudTrail · AWS | - | high | Sittikorn S | 2021-06-28 | — | a607e1fe-74bf-4440-a3ec-b059b9103157 | ||||
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...) | Emerging | experimental | process_creation | linux | Sysmon | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 0a23a62d-c5b3-468b-a072-25064a9a8c87 | ||||
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup. | Emerging | experimental | process_creation | macos | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | a09ee860-31b3-4586-8a68-0ebd74ce0e5f | ||||
Splunk | The following analytic detects when the risk-based step-up consent security setting in Azure AD is disabled. (...) | Generic | stable | account_management | - | Microsoft 365 | - | medium | Mauricio Velazco, Splunk | 2023-11-16 | 2026-05-13 | 875de3d7-09bc-4916-8c0a-0929f4ced3d8 | |||
Detects when Events are deleted in Azure Kubernetes. (...) | Generic | test | cloud_audit | - | Azure Activity Logs · Azure | - | medium | Austin Songer @austinsonger | 2021-07-24 | 2022-08-23 | 225d8b09-e714-479c-a0e4-55e6f29adf35 | ||||
Detects backup catalog deletions | Generic | test | - | windows | WinEventLog Application | - | medium | Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection) | 2017-05-12 | 2022-12-25 | 9703792d-fd9a-456d-a672-ff92efe4806a | ||||
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2020-01-29 | 2023-01-26 | e32d4572-9826-4738-b651-95fa63747e8a | ||||
Detects changes to the bitbucket audit log configuration. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | medium | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | 6aa12161-235a-4dfb-9c74-fe08df8d8da1 | ||||
Detects Bitbucket global secret scanning rule deletion activity. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | medium | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | e16cf0f0-ee88-4901-bd0b-4c8d13d9ee05 | ||||
Detects Bitbucket global SSH access configuration changes. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | medium | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | 16ab6143-510a-44e2-a615-bdb80b8317fc | ||||
Detects when a secret scanning allowlist rule is added for projects. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | low | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | 42ccce6d-7bd3-4930-95cd-e4d83fa94a30 | ||||
Detects when a repository is exempted from secret scanning feature. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | high | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | b91e8d5e-0033-44fe-973f-b730316f23a1 | ||||
Detects when secret scanning rule is deleted for the project or repository. | Generic | test | cloud_audit | - | Bitbucket Audit · Bitbucket | - | low | Muhammad Faisal (@faisalusuf) | 2024-02-25 | — | ff91e3f0-ad15-459f-9a85-1556390c138d | ||||
Detects the usage of the unsafe bpftrace option | Generic | test | process_creation | linux | Sysmon | - | medium | Andreas Hunkeler (@Karneades) | 2022-02-11 | — | f8341cb2-ee25-43fa-a975-d8a5a9714b39 | ||||
Splunk | The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Splunk | 2021-03-25 | 2026-10-02 | bfe94226-8c10-11eb-a4b3-acde48001122 | |||
Splunk | Adversaries may intentionally suppress or reduce the volume of core Cisco ASA syslog messages to evade detection or cover their tracks. (...) | Hunting | stable | firewall | - | Cisco Secure Firewall · Cisco | medium | Bhavin Patel, Micheal Haag, Splunk | 2025-09-25 | 2026-05-13 | 4b4f8fdd-1f9e-45d8-9b0f-1f64c0b297a4 | ||||
Splunk | This analytic detects the disabling of logging functionality on a Cisco ASA device
through CLI comma (...) | Generic | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Bhavin Patel, Micheal Haag, Nasreddine Bencherchali, Splunk | 2025-09-25 | 2026-05-13 | 7b4c9f3e-5a88-4b7b-9c4b-94d8e5d67201 | |||
Splunk | This analytic detects tampering with logging filter configurations on Cisco ASA devices via CLI or ASDM. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-11-21 | 2026-05-13 | b87b48a8-6d1a-4280-9cf1-16a950dbf901 | |||
Splunk | This analytic provides comprehensive monitoring of configuration changes on Cisco devices by analyzing archive logs. (...) | Hunting | stable | configuration_change | - | Cisco IOS · Cisco | medium | Bhavin Patel, Michael Haag, Splunk | 2025-08-21 | 2026-05-13 | f52d5c0b-d45d-4304-b300-a4f6a1130dec | ||||
Turn off logging locally or remote | Generic | test | authentication | - | Cisco AAA · Cisco | - | high | Austin Clark | 2019-08-11 | 2023-01-04 | 9e8f6035-88bf-4a63-96b6-b17c0508257e | ||||
Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface. (...) | Generic | experimental | authentication | - | Cisco AAA · Cisco | - | medium | Luc Génaux | 2026-04-28 | — | ef0ff092-a24a-4fbc-beea-06c08d53e085 | ||||
See what files are being deleted from flash file systems | Generic | test | authentication | - | Cisco AAA · Cisco | - | medium | Austin Clark | 2019-08-12 | 2023-01-04 | 71d65515-c436-43c0-841b-236b1f32c21e | - | |||
Splunk | This analytic detects Cisco IOS-XE command sequences where show logging, clear logging, and exit occur within a short period. (...) | Anomaly | stable | network_device | - | Cisco IOS · Cisco | - | medium | Nasreddine Bencherchali | 2026-05-19 | 2026-05-20 | e20a6709-5f2c-4508-83fb-b3af6f705717 | |||
Splunk | This analytic detects rapid modification of Cisco IOS-XE VTY access-class settings. (...) | Anomaly | stable | network_device | - | Cisco IOS · Cisco | - | medium | Nasreddine Bencherchali | 2026-05-19 | 2026-05-20 | a01ca274-16cb-476d-a814-d2ffe29d8905 | |||
Splunk | This analytic detects changes to SNMP community strings on Cisco devices, which could indicate an attacker establishing persistence or attempting to extract credentials. (...) | Anomaly | stable | configuration_change | - | Cisco IOS · Cisco | medium | Bhavin Patel, Michael Haag, Splunk | 2025-08-21 | 2026-05-13 | b0ce5521-2533-4f24-b8d5-c2ff977aae08 | ||||
Detects the use of the `syslog` syscall with action code 5 (SYSLOG_ACTION_CLEAR),
(4 is SYSLOG_ACTIO (...) | Generic | experimental | process_creation | linux | Linux Auditd | - | medium | Milad Cheraghi | 2025-05-27 | 2025-12-05 | eca5e022-d368-4043-98e5-9736fb01f72f | ||||
Splunk | The following analytic detects the execution of `cipher.exe` with the `/w` flag to clear unallocated sectors on a disk. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Splunk | 2021-06-10 | 2026-05-13 | cd80a6ac-c9d9-11eb-8839-acde48001122 | |||
Detects PowerShell scripts that make use of the "Compress-Archive" cmdlet in order to compress folders and files. (...) | Hunting | test | ps_script | windows | PowerShell | - | low | Timur Zinniatullin, oscd.community | 2019-10-21 | 2023-12-15 | 6dc5d284-69ea-42cf-9311-fb1c3932a69a | ||||
Detects execution of "tar.exe" in order to create a compressed file. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | Nasreddine Bencherchali (Nextron Systems), AdmU3 | 2023-12-19 | — | 418a3163-3247-4b7b-9933-dcfcb7c52ea9 | ||||
Detects execution of "tar.exe" in order to extract compressed file. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | AdmU3 | 2023-12-19 | — | bf361876-6620-407a-812f-bfe11e51e924 | ||||
Detects a command used by conti to exfiltrate NTDS | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems) | 2021-08-09 | 2022-10-09 | aa92fd02-09f2-48b0-8a93-864813fb8f41 | ||||
Detects passwords dumps from Keychain | Generic | test | process_creation | macos | - | - | medium | Tim Ismilyaev, oscd.community, Florian Roth (Nextron Systems) | 2020-10-19 | 2021-11-27 | b120b587-a4c2-4b94-875d-99c9807d6955 | ||||
Detects loading of "credui.dll" and related DLLs by an uncommon process. (...) | Generic | test | image_load | windows | Sysmon | - | medium | Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) | 2020-10-20 | 2026-06-29 | 9ae01559-cf7e-4f8e-8e14-4c290a1b4784 |